From 6d8092d38e4bcb93b7a06e620b618179e4592c39 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 17 Oct 2024 19:17:03 -0400
Subject: [PATCH 001/398] docs: update all html man pages with canonical link.

---
 doc/html_extra/man_pages/roundup-admin.1.html  | 3 ++-
 doc/html_extra/man_pages/roundup-demo.1.html   | 3 ++-
 doc/html_extra/man_pages/roundup-mailgw.1.html | 3 ++-
 doc/html_extra/man_pages/roundup-server.1.html | 3 ++-
 4 files changed, 8 insertions(+), 4 deletions(-)
diff --git a/doc/html_extra/man_pages/roundup-admin.1.html b/doc/html_extra/man_pages/roundup-admin.1.html
index b8102a52b..6a6b83b87 100644
--- a/doc/html_extra/man_pages/roundup-admin.1.html
+++ b/doc/html_extra/man_pages/roundup-admin.1.html
@@ -1,5 +1,5 @@
 <!-- Creator     : groff version 1.22.4 -->
-<!-- CreationDate: Sat Jul 13 04:05:30 2024 -->
+<!-- CreationDate: Thu Oct 17 23:16:02 2024 -->
 <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
 "http://www.w3.org/TR/html4/loose.dtd">
 <html>
@@ -7,6 +7,7 @@
 <meta name="generator" content="groff -Thtml, see www.gnu.org">
 <meta http-equiv="Content-Type" content="text/html; charset=US-ASCII">
 <meta name="Content-Style" content="text/css">
+<link rel="canonical" href="https://www.roundup-tracker.org/docs/man_pages/roundup-admin.1.html">
 <style type="text/css">
        p       { max-width: 65ch; margin-top: 0; margin-bottom: 0; vertical-align: top }
        pre     { margin-top: 0; margin-bottom: 0; vertical-align: top }
diff --git a/doc/html_extra/man_pages/roundup-demo.1.html b/doc/html_extra/man_pages/roundup-demo.1.html
index 11bf2ecad..9d763f470 100644
--- a/doc/html_extra/man_pages/roundup-demo.1.html
+++ b/doc/html_extra/man_pages/roundup-demo.1.html
@@ -1,5 +1,5 @@
 <!-- Creator     : groff version 1.22.4 -->
-<!-- CreationDate: Sat Jul 13 04:05:31 2024 -->
+<!-- CreationDate: Thu Oct 17 23:16:03 2024 -->
 <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
 "http://www.w3.org/TR/html4/loose.dtd">
 <html>
@@ -7,6 +7,7 @@
 <meta name="generator" content="groff -Thtml, see www.gnu.org">
 <meta http-equiv="Content-Type" content="text/html; charset=US-ASCII">
 <meta name="Content-Style" content="text/css">
+<link rel="canonical" href="https://www.roundup-tracker.org/docs/man_pages/roundup-demo.1.html">
 <style type="text/css">
        p       { max-width: 65ch; margin-top: 0; margin-bottom: 0; vertical-align: top }
        pre     { margin-top: 0; margin-bottom: 0; vertical-align: top }
diff --git a/doc/html_extra/man_pages/roundup-mailgw.1.html b/doc/html_extra/man_pages/roundup-mailgw.1.html
index 4e763ba81..defa46519 100644
--- a/doc/html_extra/man_pages/roundup-mailgw.1.html
+++ b/doc/html_extra/man_pages/roundup-mailgw.1.html
@@ -1,5 +1,5 @@
 <!-- Creator     : groff version 1.22.4 -->
-<!-- CreationDate: Sat Jul 13 04:05:30 2024 -->
+<!-- CreationDate: Thu Oct 17 23:16:02 2024 -->
 <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
 "http://www.w3.org/TR/html4/loose.dtd">
 <html>
@@ -7,6 +7,7 @@
 <meta name="generator" content="groff -Thtml, see www.gnu.org">
 <meta http-equiv="Content-Type" content="text/html; charset=US-ASCII">
 <meta name="Content-Style" content="text/css">
+<link rel="canonical" href="https://www.roundup-tracker.org/docs/man_pages/roundup-mailgw.1.html">
 <style type="text/css">
        p       { max-width: 65ch; margin-top: 0; margin-bottom: 0; vertical-align: top }
        pre     { margin-top: 0; margin-bottom: 0; vertical-align: top }
diff --git a/doc/html_extra/man_pages/roundup-server.1.html b/doc/html_extra/man_pages/roundup-server.1.html
index 83373bdfb..005db9a5a 100644
--- a/doc/html_extra/man_pages/roundup-server.1.html
+++ b/doc/html_extra/man_pages/roundup-server.1.html
@@ -1,5 +1,5 @@
 <!-- Creator     : groff version 1.22.4 -->
-<!-- CreationDate: Sat Jul 13 04:05:30 2024 -->
+<!-- CreationDate: Thu Oct 17 23:16:02 2024 -->
 <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
 "http://www.w3.org/TR/html4/loose.dtd">
 <html>
@@ -7,6 +7,7 @@
 <meta name="generator" content="groff -Thtml, see www.gnu.org">
 <meta http-equiv="Content-Type" content="text/html; charset=US-ASCII">
 <meta name="Content-Style" content="text/css">
+<link rel="canonical" href="https://www.roundup-tracker.org/docs/man_pages/roundup-server.1.html">
 <style type="text/css">
        p       { max-width: 65ch; margin-top: 0; margin-bottom: 0; vertical-align: top }
        pre     { margin-top: 0; margin-bottom: 0; vertical-align: top }

From 075442336e4ffc43d20ccd25977998d4b4f91c3d Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 17 Oct 2024 19:17:39 -0400
Subject: [PATCH 002/398] doc: fix comment

---
 scripts/Docker/Dockerfile | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/scripts/Docker/Dockerfile b/scripts/Docker/Dockerfile
index 4364b1cb3..83c162880 100644
--- a/scripts/Docker/Dockerfile
+++ b/scripts/Docker/Dockerfile
@@ -49,7 +49,8 @@ WORKDIR $appdir
 RUN apk --no-cache upgrade
 
 # Add packages needed to compile mysql, pgsql and other python modules.
-# Can't use apk to add python packages as it installs 3.9 python version.
+# Can't use apk to add python packages as it installs for base image
+# in /usr.
 #        g++ installs cc1plus needed by pip install
 RUN apk --no-cache add \
     file \

From 9117938328eb617cb9efdce38db5494cb1a9d71d Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 20 Oct 2024 18:42:21 -0400
Subject: [PATCH 003/398] - issue2551074 - In "responsive" template: click on
 hide comment leads   to a red error msg.

to files in responsive template reference the 'icing' macro. This was
replaced by a 'frame' macro in the responsive template.
---
 CHANGES.txt                                   |  2 ++
 doc/upgrading.txt                             | 27 +++++++++++++++++++
 .../responsive/html/_generic.404.html         |  2 +-
 .../templates/responsive/html/query.item.html |  2 +-
 4 files changed, 31 insertions(+), 2 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index c07a86f6f..13d6c00ed 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -26,6 +26,8 @@ Fixed:
 - issue2551131 - Return accept-patch if patch body not accepted
   (415 code). Accept-Patch returned with acceptable values. (John
   Rouillard)
+- issue2551074 - In "responsive" template: click on hide comment leads
+  to a red error msg. (Report by Ludwig Reiter; fix John Rouillard)
 
 Features:
 
diff --git a/doc/upgrading.txt b/doc/upgrading.txt
index 84ae5e090..e13c5e755 100644
--- a/doc/upgrading.txt
+++ b/doc/upgrading.txt
@@ -108,6 +108,33 @@ the `PySQLite <https://github.com/ghaering/pysqlite>`_ library has
 been removed in 2.5.0. Only the Python supplied sqlite3 library will
 be supported.
 
+Update responsive template _generic.404.html and query.item.html (recommended)
+------------------------------------------------------------------------------
+
+This only applies if your tracker is based on the responsive
+template. Check the TEMPLATE-INFO.txt file in your tracker
+home. The template name is the first component of the ``Name``
+field. For example a Name like::
+
+   Name: responsive-bugtracker
+
+is based on the responsive template. If the Name doesn't start with
+``responsive`` no changes are needed.
+
+The ``_generic.404.html`` and ``query.item.html`` templates will crash
+when displayed because a missing macro is called. Change::
+
+  <tal:block metal:use-macro="templates/page/macros/icing">
+
+to::
+
+  <tal:block metal:use-macro="templates/page/macros/frame">
+
+at the top of both files. The icing macro used in other tracker
+templates was renamed to frame in this tracker template.
+
+
+
 .. index:: Upgrading; 2.3.0 to 2.4.0
 
 Migrating from 2.3.0 to 2.4.0
diff --git a/share/roundup/templates/responsive/html/_generic.404.html b/share/roundup/templates/responsive/html/_generic.404.html
index ec207fac4..17c6c052f 100644
--- a/share/roundup/templates/responsive/html/_generic.404.html
+++ b/share/roundup/templates/responsive/html/_generic.404.html
@@ -1,5 +1,5 @@
 <!-- dollarId: issue.item,v 1.4 2001/08/03 01:19:43 richard Exp dollar-->
-<tal:block metal:use-macro="templates/page/macros/icing">
+<tal:block metal:use-macro="templates/page/macros/frame">
   <title metal:fill-slot="head_title">
   Item Not Found
   </title>
diff --git a/share/roundup/templates/responsive/html/query.item.html b/share/roundup/templates/responsive/html/query.item.html
index b2382214a..6ce4a5989 100644
--- a/share/roundup/templates/responsive/html/query.item.html
+++ b/share/roundup/templates/responsive/html/query.item.html
@@ -2,7 +2,7 @@
 <span tal:condition="context/is_view_ok" tal:replace="structure
       context/renderQueryForm" />
 <tal:block tal:condition="not:context/is_view_ok">
-  <tal:block metal:use-macro="templates/page/macros/icing">
+  <tal:block metal:use-macro="templates/page/macros/frame">
     <title metal:fill-slot="head_title">You can not view query</title>
     <tal:block metal:fill-slot="body_title">
       You can not view query.

From daa4286db38b0b84ad1376251c3186c97b2b4ce3 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 23 Oct 2024 13:26:18 -0400
Subject: [PATCH 004/398] doc: document Search permission ignores a check
 clause.

Also update formating and add a couple of missing User permisions to
list for classic tracker. There are more missing.
---
 doc/reference.txt | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/doc/reference.txt b/doc/reference.txt
index 87a0b7403..4aa99bd4d 100644
--- a/doc/reference.txt
+++ b/doc/reference.txt
@@ -1286,8 +1286,10 @@ For the "User" Role, the "classic" tracker defines:
 
 - Create, Edit and View issue, file, msg, query, keyword 
 - View priority, status
-- View user
+- View user (limited properties)
+- View their own user record
 - Edit their own user record
+- Search queries
 
 And the "Anonymous" Role has the following permissions:
 
@@ -1509,10 +1511,14 @@ The ``addPermission`` method takes a three optional parameters:
 
      ctx['permission'] the name of the permission (e.g. View, Edit...).
 
-The second form is preferred as it makes it easier to implement more
-complex permission schemes. An `example in upgrading.html
-<upgrading.html#enhancement-to-check-command-for-permissions>`_
-shows the use of ``ctx``.
+  The second form is preferred as it makes it easier to implement more
+  complex permission schemes. An `example in upgrading.html
+  <upgrading.html#enhancement-to-check-command-for-permissions>`_
+  shows the use of ``ctx``.
+
+  Note that the check option is not supported for the Search
+  permission. When searching there is no item defined, so a check
+  function doesn not make any sense.
 
 **properties**
   A sequence of property names that are the only properties to apply the

From 16c87a1db6d35236d062a6b056a18f6a43c00763 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 23 Oct 2024 17:49:23 -0400
Subject: [PATCH 005/398] doc: fix typo.

---
 doc/reference.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/reference.txt b/doc/reference.txt
index 4aa99bd4d..a13818f64 100644
--- a/doc/reference.txt
+++ b/doc/reference.txt
@@ -1518,7 +1518,7 @@ The ``addPermission`` method takes a three optional parameters:
 
   Note that the check option is not supported for the Search
   permission. When searching there is no item defined, so a check
-  function doesn not make any sense.
+  function does not make any sense.
 
 **properties**
   A sequence of property names that are the only properties to apply the

From 70a492bb119c12b4aafb31629adb2f0f595f3b10 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 10 Nov 2024 10:52:02 -0500
Subject: [PATCH 006/398] test changes for 24.04 ubuntu github action migration

Explicitly test python 3.8 on ubunutu-22.04.

Explicitly test python 3.12 on ubuntu-24.04.

disable all other testing on 24.04 for now. In future commit, remove
explicit matrix.os list entry ubuntu-24.04 in favor of ubuntu-latest
and add 22.04 to exclude.os

[skip travis]
---
 .github/workflows/ci-test.yml | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index 0132c1853..8bbbc6b5d 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -55,7 +55,7 @@ jobs:
           - "3.13"
           # - 3.6 run via include on ubuntu 20.04
           # - "3.7"
-          - "3.8"
+          # - "3.8" run via include for ubuntu-22.04
           # - "3.9"
           - "3.10"
           - "3.11"
@@ -64,7 +64,8 @@ jobs:
         # use for multiple os or ubuntu versions
         #os: [ubuntu-latest, macos-latest, windows-latest]
         # ubuntu latest 22.04 12/2022
-        os: [ubuntu-latest, ubuntu-20.04]
+        # ubuntu latest 24.04 12/2024
+        os: [ubuntu-latest, ubuntu-22.04, ubuntu-20.04, ubuntu-24.04]
 
         # if the ones above fail. fail the build
         experimental: [ false ]
@@ -81,9 +82,18 @@ jobs:
             - python-version: 3.6
               os: ubuntu-20.04
 
+            # 3.8 not available on new 24.04 runners, so run on 22.04 ubuntu
+            - python-version: 3.8
+              os: ubuntu-22.04
+
+              # test on new default 24.04 runner 3.12 for 24.04
+            - python-version: 3.12
+              os: ubuntu-24.04
+
         exclude:
-            # skip all python versions on 20.04 except explicitly included
-            - os: ubuntu-20.04
+            # skip all python versions on 20.04/24.04 except
+            # explicitly included
+            - os: [ubuntu-20.04, ubuntu-24.04]
 
     # run the finalizer for coveralls even if one or more
     # experimental matrix runs fail.

From ff274fba1e590c5c6a78974eec488da3044420ff Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 10 Nov 2024 11:05:05 -0500
Subject: [PATCH 007/398] test changes for 24.04 ubuntu github action migration

Exclude was not working and I was running all versions on all
platforms.

[skip travis]
---
 .github/workflows/ci-test.yml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index 8bbbc6b5d..71d52e3dc 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -93,7 +93,8 @@ jobs:
         exclude:
             # skip all python versions on 20.04/24.04 except
             # explicitly included
-            - os: [ubuntu-20.04, ubuntu-24.04]
+            - os: ubuntu-20.04
+            - os: ubuntu-24.04
 
     # run the finalizer for coveralls even if one or more
     # experimental matrix runs fail.
@@ -218,7 +219,7 @@ jobs:
 
       - name: Install auxiliary packages
         run: |
-          sudo apt-get install swig gpgsm libgpgme-dev
+          sudo apt-get install swig gpgsm libgpgme-dev libgpgme-dev
           # pygments for markdown2 to highlight code blocks
           pip install markdown2 pygments
           # docutils for ReStructuredText

From 1337972ed69fa7abff8068bbc7f4d0ddc7508a86 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 10 Nov 2024 11:09:23 -0500
Subject: [PATCH 008/398] test changes for 24.04 ubuntu github action migration

Remove ubuntu-22.04 explicitly. It was running 22.04 as both
ubuntu-latest and ubuntu-22.04. I had expected it to realise that was
a duplicate job (for latest == 22.04) and not run it.

[skip travis]
---
 .github/workflows/ci-test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index 71d52e3dc..723966a33 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -65,7 +65,7 @@ jobs:
         #os: [ubuntu-latest, macos-latest, windows-latest]
         # ubuntu latest 22.04 12/2022
         # ubuntu latest 24.04 12/2024
-        os: [ubuntu-latest, ubuntu-22.04, ubuntu-20.04, ubuntu-24.04]
+        os: [ubuntu-latest, ubuntu-20.04, ubuntu-24.04]
 
         # if the ones above fail. fail the build
         experimental: [ false ]

From d43f45a8dfe166a8be11a047f56208cb9dabdf60 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 10 Nov 2024 11:12:23 -0500
Subject: [PATCH 009/398] test changes for 24.04 ubuntu github action migration

Move 24.04 to first in matrix to try to get it to run earlier as I
only run 4 builds in parallel.

[skip travis]
---
 .github/workflows/ci-test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index 723966a33..178e10aad 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -65,7 +65,7 @@ jobs:
         #os: [ubuntu-latest, macos-latest, windows-latest]
         # ubuntu latest 22.04 12/2022
         # ubuntu latest 24.04 12/2024
-        os: [ubuntu-latest, ubuntu-20.04, ubuntu-24.04]
+        os: [ubuntu-24.04, ubuntu-latest, ubuntu-20.04]
 
         # if the ones above fail. fail the build
         experimental: [ false ]

From 1c47007f24e7de3816d584f7ecd6a37e44f62c8f Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 10 Nov 2024 11:58:53 -0500
Subject: [PATCH 010/398] order change, add libgpgme - 24.04 ubuntu github
 action migration
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Move 24.04 to first in matrix to try to get it to run earlier as I
only run 4 builds in parallel.

Replace redundant libgpgme-dev with libgpgme to try to fix error with
pip install gpg:


  Collecting gpg
    Downloading gpg-1.10.0.tar.gz (39 kB)
    Installing build dependencies: started
    Installing build dependencies: finished with status 'done'
    Getting requirements to build wheel: started
    Getting requirements to build wheel: finished with status 'error'
    error: subprocess-exited-with-error

    Ã— Getting requirements to build wheel did not run successfully.
    â”‚ exit code: 1
    â•°â”€> [2 lines of output]
	<string>:163: SyntaxWarning: invalid escape sequence '\s'
	Could not find gpgme-config.  Please install the libgpgme
    development package.
	[end of output]


[skip travis]
---
 .github/workflows/ci-test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index 178e10aad..e4dc992f0 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -219,7 +219,7 @@ jobs:
 
       - name: Install auxiliary packages
         run: |
-          sudo apt-get install swig gpgsm libgpgme-dev libgpgme-dev
+          sudo apt-get install swig gpgsm libgpgme-dev libgpgme
           # pygments for markdown2 to highlight code blocks
           pip install markdown2 pygments
           # docutils for ReStructuredText

From e7541dbea27267f871bd14b7307d2059ba82c66c Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 10 Nov 2024 12:03:27 -0500
Subject: [PATCH 011/398] disable 22.04 - 24.04 ubuntu github action migration

Disable running 22.04 tests to speed up feedback cycle.

[skip travis]
---
 .github/workflows/ci-test.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index e4dc992f0..4d4371ffa 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -94,6 +94,8 @@ jobs:
             # skip all python versions on 20.04/24.04 except
             # explicitly included
             - os: ubuntu-20.04
+            # disable for testing when getting 24.04 running
+            - os: ubuntu-22.04
             - os: ubuntu-24.04
 
     # run the finalizer for coveralls even if one or more

From 3eafd6e95303e88cba92755c5707f247bc5bf0e6 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 10 Nov 2024 12:14:28 -0500
Subject: [PATCH 012/398] add libgpgme11-dev- 24.04 ubuntu github action
 migration

This seems to supply gpgme-config.

[skip travis]
---
 .github/workflows/ci-test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index 4d4371ffa..2dbf8ec02 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -221,7 +221,7 @@ jobs:
 
       - name: Install auxiliary packages
         run: |
-          sudo apt-get install swig gpgsm libgpgme-dev libgpgme
+          sudo apt-get install swig gpgsm libgpgme-dev libgpgme11-dev
           # pygments for markdown2 to highlight code blocks
           pip install markdown2 pygments
           # docutils for ReStructuredText

From 38cc24607800273c64d5661cd77f5d7d7c24224d Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 10 Nov 2024 12:16:42 -0500
Subject: [PATCH 013/398] disable test ubuntu-latest - 24.04 ubuntu github
 action migration

speed up feedback cycle.
[skip travis]
---
 .github/workflows/ci-test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index 2dbf8ec02..38d82e9f1 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -95,7 +95,7 @@ jobs:
             # explicitly included
             - os: ubuntu-20.04
             # disable for testing when getting 24.04 running
-            - os: ubuntu-22.04
+            - os: ubuntu-latest
             - os: ubuntu-24.04
 
     # run the finalizer for coveralls even if one or more

From 5a458ef55c4e90824c1f1f26f9d6a52eca3112b0 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 10 Nov 2024 12:23:58 -0500
Subject: [PATCH 014/398] apt-get install libgpgme11t64 - 24.04 ubuntu github
 action migration

looks like libgpgme11t64 is the libgpgme11 for noble 24.04. Will it
work???

[skip travis]
---
 .github/workflows/ci-test.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index 38d82e9f1..ec1bebfe2 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -221,7 +221,9 @@ jobs:
 
       - name: Install auxiliary packages
         run: |
-          sudo apt-get install swig gpgsm libgpgme-dev libgpgme11-dev
+          sudo apt-get install swig gpgsm libgpgme-dev
+          # required for pip install/build of gpg on ubuntu 24.04??
+          sudo apt-get install libgpgme11t64 || true
           # pygments for markdown2 to highlight code blocks
           pip install markdown2 pygments
           # docutils for ReStructuredText

From 46f0e73b1de005f5ba66dedace4149fdda7139c2 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 10 Nov 2024 13:00:11 -0500
Subject: [PATCH 015/398] special case ignore gpg build - 24.04 ubuntu github
 action migration

If gpg build fails and we are on 24.04, continue.

This allows build to still fail if gpg build fails on another platform
provided I have the script correct. I build gpg on 24.04 to make
testing a fix/change to the underlying platform packages easy. In case
an external change fixes it.

[skip travis]
---
 .github/workflows/ci-test.yml | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index ec1bebfe2..6b987bbfd 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -222,13 +222,17 @@ jobs:
       - name: Install auxiliary packages
         run: |
           sudo apt-get install swig gpgsm libgpgme-dev
-          # required for pip install/build of gpg on ubuntu 24.04??
-          sudo apt-get install libgpgme11t64 || true
           # pygments for markdown2 to highlight code blocks
           pip install markdown2 pygments
           # docutils for ReStructuredText
-          pip install beautifulsoup4 brotli docutils gpg jinja2 \
+          pip install beautifulsoup4 brotli docutils jinja2 \
             mistune==0.8.4 pyjwt pytz whoosh
+          # gpg doesn't build on Ubuntu 24.04. Ignore failure on that
+          # platform only. Grep os-release to cover matrix.os in
+          # [ubunutu-latest, ubuntu-24.04].
+          pip install gpg || ( save_status=$?; \
+             if grep 24.04 /etc/os-release > /dev/null; then \
+                 exit 0; else exit $save_status; fi; )
 
       - name: Install aux packages that need versions differences
         # if zstd fails install, keep going with test, don't abort

From 31e88ccdd281b0df4ceaccdf5a53607ee7e3df97 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 10 Nov 2024 13:53:01 -0500
Subject: [PATCH 016/398] cleanup - 24.04 ubuntu github action migration

Reorder some stanzas to try to get 24.04 to run earlier.

Add comment when skipping gpg for 24.04.

Re-enable testing on ubuntu-latest (disable the exclude case).

[skip travis]
---
 .github/workflows/ci-test.yml | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index 6b987bbfd..58843c8e3 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -78,6 +78,10 @@ jobs:
             #  os: ubuntu-22.04
             #  experimental: true
             
+            # test on new default 24.04 runner 3.12 for 24.04
+            - python-version: 3.12
+              os: ubuntu-24.04
+
             # 3.6 not available on new 22.04 runners, so run on 20.04 ubuntu
             - python-version: 3.6
               os: ubuntu-20.04
@@ -86,18 +90,16 @@ jobs:
             - python-version: 3.8
               os: ubuntu-22.04
 
-              # test on new default 24.04 runner 3.12 for 24.04
-            - python-version: 3.12
-              os: ubuntu-24.04
-
         exclude:
             # skip all python versions on 20.04/24.04 except
             # explicitly included
             - os: ubuntu-20.04
-            # disable for testing when getting 24.04 running
-            - os: ubuntu-latest
             - os: ubuntu-24.04
 
+            # disable when testing ubuntu-24.04 to speed up
+            # runs.
+            # - os: ubuntu-latest
+
     # run the finalizer for coveralls even if one or more
     # experimental matrix runs fail.
     # moving it above strategy produces unexpected value false
@@ -232,7 +234,8 @@ jobs:
           # [ubunutu-latest, ubuntu-24.04].
           pip install gpg || ( save_status=$?; \
              if grep 24.04 /etc/os-release > /dev/null; then \
-                 exit 0; else exit $save_status; fi; )
+                 echo "Ignoring error ubuntu-24.04: issue2551368"; exit 0; \
+                 else exit $save_status; fi; )
 
       - name: Install aux packages that need versions differences
         # if zstd fails install, keep going with test, don't abort

From d9f5acd22d1544109f8e0a3f81237ab6e62bdc0f Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 10 Nov 2024 14:06:21 -0500
Subject: [PATCH 017/398] add gpg package to build - ubuntu-22.04 python 3.13
 skips pgp tests.

The 3.13 tests on ubuntu-22.04 report that PGP tests are skipped
because:


  SKIPPED [1] test/test_mailgw.py:296: Skipping PGP tests: 'gpg' not installed


the same tests pass under python 3.12 and ubuntu-22.04. Under both
versions, the gpg build and install report no issues.

Add the gpg package to see if it fixes it.

(Log used:
https://github.com/roundup-tracker/roundup/actions/runs/11633664792/job/32399246320)
---
 .github/workflows/ci-test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index 58843c8e3..528f414ec 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -223,7 +223,7 @@ jobs:
 
       - name: Install auxiliary packages
         run: |
-          sudo apt-get install swig gpgsm libgpgme-dev
+          sudo apt-get install swig gpg gpgsm libgpgme-dev
           # pygments for markdown2 to highlight code blocks
           pip install markdown2 pygments
           # docutils for ReStructuredText

From 6cf2bcc6589ab1c484eb52e9d6799d6c01056abf Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 10 Nov 2024 14:09:53 -0500
Subject: [PATCH 018/398] drop testing python 3.11 from matrix.

Drop 3.11 to reduce test time.

3.13, 3.12, 3.10, 3.8, 3.6
---
 .github/workflows/ci-test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index 528f414ec..6ae00c9cf 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -58,7 +58,7 @@ jobs:
           # - "3.8" run via include for ubuntu-22.04
           # - "3.9"
           - "3.10"
-          - "3.11"
+          # - "3.11"
           - "3.12"
 
         # use for multiple os or ubuntu versions

From db129eea4a3d982c96f0c077bdd4eebbc11b0f95 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 10 Nov 2024 14:25:16 -0500
Subject: [PATCH 019/398] add new tmate debug point.

before problematic gpg install.
---
 .github/workflows/ci-test.yml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index 6ae00c9cf..c7cc01b8c 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -221,6 +221,16 @@ jobs:
           pip install mysqlclient
           pip install psycopg2
 
+      # https://github.com/mxschmitt/action-tmate
+      # allow remote ssh into the CI container. I need this to debug
+      # some xfail cases 
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.debug_enabled }}
+        timeout-minutes: 10
+        with:
+          limit-access-to-actor: true
+
       - name: Install auxiliary packages
         run: |
           sudo apt-get install swig gpg gpgsm libgpgme-dev

From 4595edd4467f0f16df84ff2a452655e30e3d6c01 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 11 Nov 2024 13:16:48 -0500
Subject: [PATCH 020/398] try 24.04 issue2551338 - xapian doesn't build in CI
 for 3.13 python

try release 24.04 of ubuntu with 3.13.
---
 .github/workflows/build-xapian.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build-xapian.yml b/.github/workflows/build-xapian.yml
index 2441a1a8a..4bb220668 100644
--- a/.github/workflows/build-xapian.yml
+++ b/.github/workflows/build-xapian.yml
@@ -26,7 +26,7 @@ concurrency:
 jobs:
   test:
     name: build xapian
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
 
     env:
      # get colorized pytest output even without a controlling tty

From 1d5c9f3494d0dace7a563b43ec95f731689c3f99 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 11 Nov 2024 13:24:31 -0500
Subject: [PATCH 021/398] set xapian version 1.4.22 - xapian doesn't build in
 CI for 3.13 python

force xapian version to 1.4.22 to match installed version
(was forced to 1.4.25)

Still ubuntu-24.04 with python 3.13.

[skip travis]
---
 .github/workflows/build-xapian.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build-xapian.yml b/.github/workflows/build-xapian.yml
index 4bb220668..171aafb3e 100644
--- a/.github/workflows/build-xapian.yml
+++ b/.github/workflows/build-xapian.yml
@@ -82,7 +82,7 @@ jobs:
           # Sphinx required to build the xapian python bindings. Use 1.8.5 on
           # older python and newest on newer.
           pip install sphinx
-          XAPIAN_VER="1.4.25"; echo $XAPIAN_VER;
+          XAPIAN_VER="1.4.22"; echo $XAPIAN_VER;
           cd /tmp
           curl -s -O https://oligarchy.co.uk/xapian/$XAPIAN_VER/xapian-bindings-$XAPIAN_VER.tar.xz
           tar -Jxvf xapian-bindings-$XAPIAN_VER.tar.xz

From 28a7dc3e6dbfa1dc8b6339d300dd318e03d691b7 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 11 Nov 2024 13:48:24 -0500
Subject: [PATCH 022/398] cleanup special case  - xapian doesn't build in CI
 for 3.13 python

Remove python version checks from xapian script. Keep if: clause that
skips xapian install on 3.13 until we are on ubuntu-24.04 image.

python xapian binding for 1.4.22 looks like it builds correctly on 24.04.

https://github.com/roundup-tracker/roundup/actions/runs/11784123806/job/32822658400

[skip travis]
---
 .github/workflows/ci-test.yml | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index c7cc01b8c..d2e5e4b4c 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -256,6 +256,9 @@ jobs:
               pip install Markdown; fi
 
       - name: Install xapian
+        # comment the if: line out once we start running on
+        # ubuntu-24.04. 24.04 has xapian 1.4.22 which builds
+        # correctly with python 3.13.
         if: matrix.python-version != '3.13'
         run: |
           set -xv
@@ -264,11 +267,7 @@ jobs:
           # older python and newest on newer.
           if [[ $PYTHON_VERSION == "2."* ]]; then pip install sphinx==1.8.5; fi
           if [[ $PYTHON_VERSION == '3.'* ]] ; then pip install sphinx; fi
-          if [[ $PYTHON_VERSION != "3.13" ]]; then
-             XAPIAN_VER=$(dpkg -l libxapian-dev | tail -n 1 | awk '{print $3}' | cut -d '-' -f 1); echo $XAPIAN_VER;
-          else
-             XAPIAN_VER="1.4.25"; echo $XAPIAN_VER;
-          fi
+          XAPIAN_VER=$(dpkg -l libxapian-dev | tail -n 1 | awk '{print $3}' | cut -d '-' -f 1); echo $XAPIAN_VER;
           cd /tmp
           curl -s -O https://oligarchy.co.uk/xapian/$XAPIAN_VER/xapian-bindings-$XAPIAN_VER.tar.xz
           tar -Jxvf xapian-bindings-$XAPIAN_VER.tar.xz
@@ -291,7 +290,7 @@ jobs:
             diff -u configure.FCS configure || true; \
             ./configure --prefix=$VIRTUAL_ENV --with-python3 --disable-documentation; \
           fi
-          case "$PYTHON_VERSION" in "3.13") echo skipping xapian build;; *) make && sudo make install; esac
+          make && sudo make install
 
       - name: Test build roundup and install locale so lang tests work.
         run: |

From 8c3c7a551c5419a615d922cda1ac2223318f4a9b Mon Sep 17 00:00:00 2001
From: Ralf Schlatterbeck <rsc@runtux.com>
Date: Wed, 20 Nov 2024 08:30:56 +0100
Subject: [PATCH 023/398] Add change note

---
 CHANGES.txt | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/CHANGES.txt b/CHANGES.txt
index c07a86f6f..71cb87f34 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -223,6 +223,12 @@ Fixed:
   HTTP/1.1, this causes a delay while the browser waits for a timeout.
   Forcing the connection to close after the CSV file is written
   removes the delay. (John Rouillard)
+- issue2551330 Add an optional 'filter' function to the Permission
+  objects and the addPermission method. This is used to optimize search
+  performance by not checking items returned from a database query
+  one-by-one (using the check function) but instead offload the
+  permission checks to the database. For SQL backends this performs the
+  filtering in the database.  (Ralf Schlatterbeck)
 
 Features:
 

From 51501b33130d7e44043bdf04026e8f5a6950e6ce Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 20 Nov 2024 09:17:05 -0500
Subject: [PATCH 024/398] move ralf's update to the correct version.

Ralf's changes update was in the 2.4.0 section. Move to 2.5.0 section.
---
 CHANGES.txt | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index 71cb87f34..7c78b3e4b 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -37,6 +37,12 @@ Features:
 - issue2551315 - Document use of
   RestfulInstance.max_response_row_size to limit data returned
   from rest request.
+- issue2551330 Add an optional 'filter' function to the Permission
+  objects and the addPermission method. This is used to optimize search
+  performance by not checking items returned from a database query
+  one-by-one (using the check function) but instead offload the
+  permission checks to the database. For SQL backends this performs the
+  filtering in the database.  (Ralf Schlatterbeck)
 
 2024-07-13 2.4.0
 
@@ -223,12 +229,6 @@ Fixed:
   HTTP/1.1, this causes a delay while the browser waits for a timeout.
   Forcing the connection to close after the CSV file is written
   removes the delay. (John Rouillard)
-- issue2551330 Add an optional 'filter' function to the Permission
-  objects and the addPermission method. This is used to optimize search
-  performance by not checking items returned from a database query
-  one-by-one (using the check function) but instead offload the
-  permission checks to the database. For SQL backends this performs the
-  filtering in the database.  (Ralf Schlatterbeck)
 
 Features:
 

From a78178c67aa33800bea047c0774fa290011b2cef Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 20 Nov 2024 09:26:13 -0500
Subject: [PATCH 025/398] clarify filter text.

Ralf verified this rewording of his original text. Also added hyperlinks to
some items.
---
 doc/reference.txt | 34 ++++++++++++++++++++--------------
 1 file changed, 20 insertions(+), 14 deletions(-)

diff --git a/doc/reference.txt b/doc/reference.txt
index 23f2b65d8..bc81e8431 100644
--- a/doc/reference.txt
+++ b/doc/reference.txt
@@ -1515,25 +1515,31 @@ complex permission schemes. An `example in upgrading.html
 shows the use of ``ctx``.
 
 **filter**
-  A function to be executed on the results of a ``filter`` call of the
-  schema ``Class`` before displaying the results in an ``index``
-  template. Calling a ``filter`` method on all results is usually faster
-  than calling a ``check`` method (see previous paragraph) on *each
-  individual result*. The ``filter`` method has the signature::
+  This optional function returns parameters for the ``filter`` method
+  when getting ``Class`` items (users, issues etc.) from the
+  database. It filters items at the database level (using SQL where
+  possible).  This pre-filters the number of items returned from the
+  database when displaying results in an ``index`` template.  This
+  filtering is usually faster than calling a ``check`` method (see
+  previous argument) on *each individual result*.
+
+  The ``filter`` method has the signature::
   
     filter(db, userid, klass)
   
   where ``db`` is the database handle, ``userid`` is the user attempting
   access and ``klass`` is the ``Class`` in the schema.
-  The ``filter`` function must return a list of dictionaries of
-  parameters of the ``Class.filter`` call. Results found during a query
-  executed by an index template are passed through the filter calls
-  computed by the ``filter`` function. An empty list of filter
-  parameters indicates no access. Note that defining a ``filter``
-  function also needs the definition of a ``check`` function for
-  checking individual items for visibility. A ``check`` function is
-  manufactured automatically from a ``filter`` function if no ``check``
-  function is defined.
+
+  The ``filter`` function must return a *list* of dictionaries of
+  parameters of the
+  `Class.filter <design.html#:~:text=search_matches>`_ call. Results
+  found during a query executed by an index template are passed
+  through the filter calls computed by the ``filter`` function. An
+  empty list of filter parameters (``[]``) indicates no access. When
+  using a filter, a check function is still needed to test each
+  individual item for visibility. When the filter function is defined
+  but a check function is not defined, a check function is
+  manufactured automatically from the ``filter`` function.
 
   Note that the filter option is not supported for the Search
   permission. Since the filter function is called *after* the search was

From f65781c19a381cba9c450718f942b25916221f41 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 20 Nov 2024 09:28:08 -0500
Subject: [PATCH 026/398] unwrap examples; clarify text

some examples were overflowing the box when displayed as
html. Reformat to prevent overflow/wrap.

Also clarify some example text.
---
 doc/reference.txt | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/doc/reference.txt b/doc/reference.txt
index bc81e8431..e82af41e4 100644
--- a/doc/reference.txt
+++ b/doc/reference.txt
@@ -1549,7 +1549,9 @@ shows the use of ``ctx``.
   in the query checks above would look like::
 
     def filter_query(db, userid, klass):
-        return [{'filterspec': {'private_for': ['-1', userid]}}]
+        return [{'filterspec': {
+                     'private_for': ['-1', userid]
+               }}]
 
   This would be called by the framework for all queries found when
   displaying queries. It filters for all queries where the
@@ -1570,10 +1572,11 @@ shows the use of ``ctx``.
   "or"  condition, the user has access if either the ``private_for``
   check passes *or* the user is the creator of the query.
 
-  Now consider an example where we have a class ``organisation`` and the
-  ``issue`` class has a ``Link`` to ``organisation`` as has the ``user``
-  class.  Users may only see issues that belong to their own
-  ``organisation``. A ``check`` function for this would be::
+  Consider an example where we have a class structure where both the
+  ``issue`` class and the ``user`` class include a reference to an
+  ``organization`` class. Users are permitted to view only those
+  issues that are associated with their respective organizations. A
+  check function or this could look like::
 
     def view_issue(db, userid, itemid):
         user  = db.user.getnode(userid)
@@ -1589,7 +1592,9 @@ shows the use of ``ctx``.
         user = db.user.getnode(userid)
         if not user.organisation:
             return []
-        return [{'filterspec': {'organisation': user.organisation}}]
+        return [{'filterspec': {
+                     'organisation': user.organisation
+               }}]
 
   This filters for all issues where the organisation is the same as the
   organisation of the user. Note how the filter fails early returning an

From d485ecc676878409c625dc5628a6a77e05a4ca93 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 20 Nov 2024 09:34:56 -0500
Subject: [PATCH 027/398] Document that filter() can return more than just
 filterspec params

Document that filter() can return retired and exct_match_spec
parameters as well.

Also that the filter() params are incorporated in the database query
rather than filtering the data after it is returned from the database.
Ralf can you verify that this rewite is correct?
---
 doc/reference.txt | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/doc/reference.txt b/doc/reference.txt
index e82af41e4..dfc10e900 100644
--- a/doc/reference.txt
+++ b/doc/reference.txt
@@ -1532,9 +1532,14 @@ shows the use of ``ctx``.
 
   The ``filter`` function must return a *list* of dictionaries of
   parameters of the
-  `Class.filter <design.html#:~:text=search_matches>`_ call. Results
-  found during a query executed by an index template are passed
-  through the filter calls computed by the ``filter`` function. An
+  `Class.filter <design.html#:~:text=search_matches>`_ call.
+  This includes filterspec, retired and exact_match_specs.
+  Note that sort and group parameters of the filter call should
+  not be set by filter method (they will be overwritten) and the
+  parameter search_matches must not be set.
+
+  The query executed by an index template is modified by the
+  parameters computed by the ``filter`` function. An
   empty list of filter parameters (``[]``) indicates no access. When
   using a filter, a check function is still needed to test each
   individual item for visibility. When the filter function is defined

From b2225013d9d01929645ba9910878ddcc9656875b Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 20 Nov 2024 16:09:17 -0500
Subject: [PATCH 028/398] update instruction on care and feeding for tracker.

---
 website/README.txt | 30 +++++++++++++++++++++++++++---
 1 file changed, 27 insertions(+), 3 deletions(-)

diff --git a/website/README.txt b/website/README.txt
index ec22b71e1..4d5fab225 100644
--- a/website/README.txt
+++ b/website/README.txt
@@ -124,8 +124,16 @@ Roundup is run using gunicorn and wsgi.
 You have 'sudo -u roundup' access if you need to run things as the
 roundup user.
 
-The configuration is in the "website/issues" section of Roundup's
-Mercurical SCM repository and copied manually to the live tracker.
+The configuration is tracked in multiple places.
+The one used by PSF infrastrcuture is:
+
+   https://github.com/psf/bpo-tracker-roundup
+
+Contact ee-durbin (or psf infra) for an invite to their repo.
+
+Usually testing is done with: the "website/issues" section
+of Roundup's Mercurical SCM repository and copied manually to the live
+tracker.
 
   * get a working copy of roundup/website/issues from the SCM, either via
         hg clone https://hg.code.sf.net/p/roundup/code
@@ -135,7 +143,23 @@ Mercurical SCM repository and copied manually to the live tracker.
   * check the differences
       diff -ur /srv/roundup/trackers/roundup/ roundup/website/issues/
 
-Copy differences using 'sudo -u roundup ...'.
+Copy differences using 'sudo -u roundup ...' into production for testing.
+
+Restart the server with:
+
+ sudo service roundup-roundup restart
+
+The git version is what PSF uses if they have to rebuild/move our
+tracker. So it's important to keep it up to date.
+
+They also generate the config.ini from an ansible script. So if you
+need to change settings in config.ini (e.g. logging from ERROR to
+WARNING) and have it persist across (daily+) ansible runs you need to
+update:
+
+ pillar/base/bugs.sls
+
+in the https://github.com/python/psf-salt repo and then push it.
 
 Getting a user account
 ~~~~~~~~~~~~~~~~~~~~~~

From e5daacfbbd8daaecc760ffe7859f9729ff6a8b26 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Tue, 26 Nov 2024 17:11:13 -0500
Subject: [PATCH 029/398] issue2551370 - prefix session cookie with __Secure-
 over https

Limit use of roundup session cookie to HTTPS protocol by adding
__Secure- prefix. Automatic testing includes http behavior only.
Https behavious has been manually tested only. Need to be able to spin
up an https server using wsgiref to test https behavior in CI.
issue 2551373 opened to track automatic testing of https behavior.
---
 CHANGES.txt             |  2 ++
 doc/upgrading.txt       | 15 +++++++++++++++
 roundup/cgi/client.py   |  8 ++++++--
 test/test_liveserver.py | 12 ++++++++++++
 4 files changed, 35 insertions(+), 2 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index 34bd98d41..9d835f994 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -45,6 +45,8 @@ Features:
   one-by-one (using the check function) but instead offload the
   permission checks to the database. For SQL backends this performs the
   filtering in the database.  (Ralf Schlatterbeck)
+- issue2551370 - mark roundup session cookie with __Secure-
+  prefix. (John Rouillard)
 
 2024-07-13 2.4.0
 
diff --git a/doc/upgrading.txt b/doc/upgrading.txt
index e13c5e755..0935db79a 100644
--- a/doc/upgrading.txt
+++ b/doc/upgrading.txt
@@ -133,6 +133,21 @@ to::
 at the top of both files. The icing macro used in other tracker
 templates was renamed to frame in this tracker template.
 
+More secure session cookie handling (info)
+------------------------------------------
+
+This affects you if you are accessing a tracker via https.  The name
+for the cookie that you get when logging into the web interface has a
+new name. When upgrading to Roundup 2.5 all users will have to to log
+in again. The cookie now has a ``__Secure-`` prefix to prevent it
+from being exposed/used over http.
+
+If your tracker is using the unencrypted http protocol, nothing has
+changed.
+
+See
+https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes
+for details on this security measure.
 
 
 .. index:: Upgrading; 2.3.0 to 2.4.0
diff --git a/roundup/cgi/client.py b/roundup/cgi/client.py
index 6abe157c4..c2214fafd 100644
--- a/roundup/cgi/client.py
+++ b/roundup/cgi/client.py
@@ -190,8 +190,12 @@ def __init__(self, client):
         self.session_db = client.db.getSessionManager()
 
         # parse cookies for session id
-        self.cookie_name = 'roundup_session_%s' % \
-            re.sub('[^a-zA-Z]', '', client.instance.config.TRACKER_NAME)
+        if self.client.secure:
+            cookie_template = '__Secure-roundup_session_%s'
+        else:
+            cookie_template = 'roundup_session_%s'
+        self.cookie_name = cookie_template % \
+                re.sub('[^a-zA-Z]', '', client.instance.config.TRACKER_NAME)
         cookies = LiberalCookie(client.env.get('HTTP_COOKIE', ''))
         if self.cookie_name in cookies:
             try:
diff --git a/test/test_liveserver.py b/test/test_liveserver.py
index f1493179f..de6033023 100644
--- a/test/test_liveserver.py
+++ b/test/test_liveserver.py
@@ -176,6 +176,18 @@ def create_login_session(self, username="admin", password="sekrit",
             return session
         return session, response
 
+    def test_cookie_attributes(self):
+        session, _response = self.create_login_session()
+
+        cookie_box = session.cookies._cookies['localhost.local']['/']
+        cookie = cookie_box['roundup_session_Roundupissuetracker']
+
+        # check cookie attributes. This is an http session, so
+        # we can't check secure or see cookie with __Secure- prefix 8-(.
+        self.assertEqual(cookie.name, 'roundup_session_Roundupissuetracker')
+        self.assertEqual(cookie.expires, None)  # session cookie
+        self.assertEqual(cookie._rest['HttpOnly'], None)  # flag is present
+        self.assertEqual(cookie._rest['SameSite'], 'Lax')
 
     def test_query(self):
         current_user_query = (

From b1f976c447742815f7ddde13f17ebfcc161ef3f4 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 1 Dec 2024 17:38:15 -0500
Subject: [PATCH 030/398] allow roundup-server to log real client IP behind
 reverse proxy

added -P flag to roundup-server to log client address from
X-Forwarded-For reverse proxy header rather than connecting
address. This logs the actual client address when roundup-server is
run behind a reverse proxy. It also appends a '+' sign to the logged
address/name.

This makes correlating reverse proxy logs to roundup logs much easier
by propagating the IP address.

Also added documentation for -D flag that was undocumented.
---
 CHANGES.txt                       |  5 +++++
 roundup/scripts/roundup_server.py | 37 ++++++++++++++++++++++++++-----
 share/man/man1/roundup-server.1   | 14 ++++++++++++
 3 files changed, 51 insertions(+), 5 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index 9d835f994..c6a774b4e 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -47,6 +47,11 @@ Features:
   filtering in the database.  (Ralf Schlatterbeck)
 - issue2551370 - mark roundup session cookie with __Secure-
   prefix. (John Rouillard)
+- add -P flag to roundup-server to log client address from
+  X-Forwarded-For reverse proxy header rather than connecting
+  address. This logs the actual client address when
+  roundup-server is run behind a reverse proxy. It also appends a
+  + sign to the logged address/name. (John Rouillard)
 
 2024-07-13 2.4.0
 
diff --git a/roundup/scripts/roundup_server.py b/roundup/scripts/roundup_server.py
index 46fc58424..20375aefe 100644
--- a/roundup/scripts/roundup_server.py
+++ b/roundup/scripts/roundup_server.py
@@ -26,6 +26,7 @@
 import io
 import logging
 import os
+import re
 import socket
 import sys     # modify sys.path when running in source tree
 import time
@@ -534,11 +535,27 @@ def inner_run_cgi(self):
         tracker.Client(tracker, self, env).main()
 
     def address_string(self):
+        """Get IP address of client from:
+               left most element of X-Forwarded-For header element if set
+               client ip address otherwise.
+           if returned string is from X-Forwarded-For append + to string.
+        """
+        from_forwarded_header=""
+        forwarded_for = None
+        if 'X-FORWARDED-FOR' in self.headers:
+            forwarded_for = re.split(r'[,\s]',
+                                     self.headers['X-FORWARDED-FOR'],
+                                     maxsplit=1)[0]
+            from_forwarded_header="+"
         if self.LOG_IPADDRESS:
-            return self.client_address[0]
+            return "%s%s" % (forwarded_for or self.client_address[0],
+                             from_forwarded_header)
         else:
-            host, port = self.client_address
-            return socket.getfqdn(host)
+            if forwarded_for:
+                host = forwarded_for
+            else:
+                host, port = self.client_address
+            return "%s%s" % (socket.getfqdn(host), from_forwarded_header)
 
     def log_message(self, format, *args):
         ''' Try to *safely* log to stderr.
@@ -547,7 +564,7 @@ def log_message(self, format, *args):
             logger = logging.getLogger('roundup.http')
 
             logger.info("%s - - [%s] %s" %
-                        (self.client_address[0],
+                        (self.address_string(),
                          self.log_date_time_string(),
                          format % args))
         else:
@@ -680,6 +697,11 @@ class ServerConfig(configuration.Config):
                 "If set to yes the python logging module is used with "
                 "qualname\n'roundup.http'. Otherwise logging is done to "
                 "stderr or the file\nspecified using the -l/logfile option."),
+            (configuration.BooleanOption, "log_proxy_header", "no",
+                "Use first element of reverse proxy header X-Forwarded-For "
+                "as client IP address.\nThis appends a '+' sign to the logged "
+                "host ip/name. Use only if server is\naccessible only via "
+                "trusted reverse proxy."),
             (configuration.NullableFilePathOption, "pidfile", "",
                 "File to which the server records "
                 "the process id of the daemon.\n"
@@ -734,6 +756,7 @@ class ServerConfig(configuration.Config):
         "multiprocess": "t:",
         "template": "i:",
         "loghttpvialogger": 'L',
+        "log_proxy_header": 'P',
         "ssl": "s",
         "pem": "e:",
         "include_headers": "I:",
@@ -952,7 +975,8 @@ def usage(message=''):
  -g <GID>      runs the Roundup web server as this GID
  -d <PIDfile>  run the server in the background and write the server's PID
                to the file indicated by PIDfile. The -l option *must* be
-               specified if -d is used.'''
+               specified if -d is used.
+ -D            run the server in the foreground even when -d is used.'''
     if message:
         message += '\n\n'
     print(_('''\n%(message)sUsage: roundup-server [options] [name=tracker home]*
@@ -974,6 +998,9 @@ def usage(message=''):
  -m <children> maximum number of children to spawn in fork multiprocess mode
  -s            enable SSL
  -L            http request logging uses python logging (roundup.http)
+ -P            log client address/name using reverse proxy X-Forwarded-For
+               header and not the connection IP (which is the reverse proxy).
+               Appends a '+' sign to the logged address/name.
  -e <fname>    PEM file containing SSL key and certificate
  -t <mode>     multiprocess mode (default: %(mp_def)s).
                Allowed values: %(mp_types)s.
diff --git a/share/man/man1/roundup-server.1 b/share/man/man1/roundup-server.1
index 254c2d293..ec1a9150c 100644
--- a/share/man/man1/roundup-server.1
+++ b/share/man/man1/roundup-server.1
@@ -20,6 +20,9 @@ Run the server in the background and write the server's PID to the
 file indicated by PIDfile. The -l (or -L) option \fBmust\fP be
 specified if -d is used.
 .TP
+\fB-D\fP
+Run the server in the foreground even if -d is used.
+.TP
 \fB-t\fP \fBfork|thread|debug|none\fP
 Control multi-process mode. \fBdebug\fP and \fBnone\fP are always
 available. If an invalid mode is specified the server starts in
@@ -33,6 +36,17 @@ may need to be increased on a heavily loaded site.  Default 40.
 Sets a filename to log to (instead of stdout). This is required if the -d
 option is used.
 .TP
+\fB-P\fP
+If a reverse proxy is used in front of the roundup-server, the server
+will log the ip address of the proxy, not the client browser. Using -P
+logs the left most entry in the X-Forwarded-For http header as the
+IP address of the client. This address will be logged or resolved to a
+hostname (with \fB-N\fP) and a '+' character will be appended.
+\fB-P\fP should only be used when the
+roundup server is accessible only from trusted proxy hosts. See:
+https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For
+for details and warnings about using the X-Forwarded-For header.
+.TP
 \fB-L\fP
 Have the server log using the Python logger with key roundup.http.
 .TP

From 03d63a88d5dfd76d9cabd9a492c4c4920969a333 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 1 Dec 2024 18:29:20 -0500
Subject: [PATCH 031/398] fix formatting of config.ini help text for
 roundup-server.

all lines < 80 characters, try to fill to 65 or so characters.
---
 roundup/scripts/roundup_server.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/roundup/scripts/roundup_server.py b/roundup/scripts/roundup_server.py
index 20375aefe..9d3ca24f5 100644
--- a/roundup/scripts/roundup_server.py
+++ b/roundup/scripts/roundup_server.py
@@ -698,9 +698,9 @@ class ServerConfig(configuration.Config):
                 "qualname\n'roundup.http'. Otherwise logging is done to "
                 "stderr or the file\nspecified using the -l/logfile option."),
             (configuration.BooleanOption, "log_proxy_header", "no",
-                "Use first element of reverse proxy header X-Forwarded-For "
-                "as client IP address.\nThis appends a '+' sign to the logged "
-                "host ip/name. Use only if server is\naccessible only via "
+                "Use first element of reverse proxy header X-Forwarded-For\n"
+                "as client IP address. This appends a '+' sign to the logged\n"
+                "host ip/name. Use only if server is accessible only via\n"
                 "trusted reverse proxy."),
             (configuration.NullableFilePathOption, "pidfile", "",
                 "File to which the server records "

From 510baf4a75630bff5f18cef5f802673cfa4e02e1 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 1 Dec 2024 22:33:05 -0500
Subject: [PATCH 032/398] docs: issue2550698 - Document the logical expression
 search a bit

Updated and tested docs in user_guide.txt.

To close out ticket still need unit tests.
---
 CHANGES.txt        |  2 ++
 doc/user_guide.txt | 37 +++++++++++++++++++++++++++++++++++++
 2 files changed, 39 insertions(+)

diff --git a/CHANGES.txt b/CHANGES.txt
index c6a774b4e..2dd44d109 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -28,6 +28,8 @@ Fixed:
   Rouillard)
 - issue2551074 - In "responsive" template: click on hide comment leads
   to a red error msg. (Report by Ludwig Reiter; fix John Rouillard)
+- issue2550698 - added documentation on filtering using RPN property
+  expressions. (John Rouillard)
 
 Features:
 
diff --git a/doc/user_guide.txt b/doc/user_guide.txt
index e93c8c320..11054e2ea 100644
--- a/doc/user_guide.txt
+++ b/doc/user_guide.txt
@@ -445,6 +445,42 @@ the supported format and features.
 
 .. _`documentation for configuring the native-fts`: admin_guide.html#configuring-native-fts-full-text-search
 
+Advanced Searching with Property Expressions
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+You can create more advanced searches in your tracker by using Reverse
+Polish Notation (`RPN`_) to make property expressions. By default, when
+filtering by multiple items, the expression type is 'or'. For
+instance, if you filter the property assignedto by adding the query
+string element "assignedto=2,3,40", it matches users "2 or 3 or
+40". In RPN, this would be written as "2, 3, or, 4, or". Roundup uses
+negative numbers to represent operators. For example, using "-1" for a
+single value (e.g. the assignedto Link property, but not the keyword
+multivalued/MultiLink property) matches an issue where the property is
+'not set'.
+
+The operators and their corresponding numbers are:
+
+* 'not' is represented by -2
+* 'and' is represented by -3
+* 'or' is represented by -4
+
+So, "assignedto=2,3,40" is the same as
+"assignedto=2,3,-4,40,-4". While this example is the same as
+"2,3,40", the expression "keyword=1,2,-3,-2" filters issues that don't
+have both keywords 1 and 2.
+
+Another example is: ``creator=3,-2,1,-2,-3``. This is the same as the
+expression: ``(not user3) and (not user1)``. Using the rules of logic,
+this is the same as: ``not (user3 or user1)`` which is expressed in
+RPN as ``creator=3,1,-4,-2``. Compare this to ``creator=3,1,-2`` which
+returns issues created by user3 or any user other than user1.
+
+Typing these expressions manually can be tiresome, so there's an
+expression editor on the search page. You can access it by clicking on
+the ``(expr)`` link, which makes creating these expressions a bit
+easier.
+
 Using the Classhelper
 ---------------------
 
@@ -771,3 +807,4 @@ If the author of the message is also in the nosy list for the item that
 the message is attached to, then the config var ``MESSAGES_TO_AUTHOR``
 is queried to determine if they get a nosy list copy of the message too.
 
+.. _`RPN`: https://en.wikipedia.org/wiki/Reverse_Polish_notation

From 2a443282d103ea742f7e971aa1432058bd50bdfc Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 2 Dec 2024 12:02:36 -0500
Subject: [PATCH 033/398] docs: new example, summary issue2550698 - Document
 the logical expression search a bit

---
 doc/user_guide.txt | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/doc/user_guide.txt b/doc/user_guide.txt
index 11054e2ea..a1f1bae2d 100644
--- a/doc/user_guide.txt
+++ b/doc/user_guide.txt
@@ -476,10 +476,21 @@ this is the same as: ``not (user3 or user1)`` which is expressed in
 RPN as ``creator=3,1,-4,-2``. Compare this to ``creator=3,1,-2`` which
 returns issues created by user3 or any user other than user1.
 
+Another example, useful when filtering issues, is:
+
+  keyword=-1,-2,1,8,-3,-2,-3
+
+which returns issues that have one or more keywords set and the issue
+does not have keyword1 and keyword8 both set. In more standard infix
+form:
+
+  not empty and not (keyword1 and keyword8)
+
 Typing these expressions manually can be tiresome, so there's an
 expression editor on the search page. You can access it by clicking on
 the ``(expr)`` link, which makes creating these expressions a bit
-easier.
+easier. But at least you can use this info to understand the search
+syntax in the URL.
 
 Using the Classhelper
 ---------------------

From ddfb2431d976474aa28f33f10cfe4251922c6594 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 2 Dec 2024 13:53:23 -0500
Subject: [PATCH 034/398] doc/test: issue2551374 - add error handling for
 filter expressions

Added doc that invalid filter expressions are silently ignored and a
fallback search is generated.

Added disabled test that uses incorrect filter expression examples
from this issue.
---
 doc/user_guide.txt   | 44 +++++++++++++++++++++++++-------------------
 test/db_test_base.py | 19 +++++++++++++++++++
 2 files changed, 44 insertions(+), 19 deletions(-)

diff --git a/doc/user_guide.txt b/doc/user_guide.txt
index a1f1bae2d..6e8d00644 100644
--- a/doc/user_guide.txt
+++ b/doc/user_guide.txt
@@ -449,15 +449,15 @@ Advanced Searching with Property Expressions
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 You can create more advanced searches in your tracker by using Reverse
-Polish Notation (`RPN`_) to make property expressions. By default, when
-filtering by multiple items, the expression type is 'or'. For
+Polish Notation (`RPN`_) to make property expressions. By default,
+when filtering by multiple items, the expression type is 'or'. For
 instance, if you filter the property assignedto by adding the query
-string element "assignedto=2,3,40", it matches users "2 or 3 or
-40". In RPN, this would be written as "2, 3, or, 4, or". Roundup uses
-negative numbers to represent operators. For example, using "-1" for a
-single value (e.g. the assignedto Link property, but not the keyword
-multivalued/MultiLink property) matches an issue where the property is
-'not set'.
+string element ``assignedto=2,3,40``, it matches users numbered ``2 or
+3 or 40``. In RPN, this would be written as ``2, 3, or, 4,
+or``. Roundup uses negative numbers to represent operators. For
+example, using "-1" for a single value (e.g. the assignedto Link
+property, but not the keyword multivalued/MultiLink property) matches
+an issue where the property is 'not set'.
 
 The operators and their corresponding numbers are:
 
@@ -465,10 +465,10 @@ The operators and their corresponding numbers are:
 * 'and' is represented by -3
 * 'or' is represented by -4
 
-So, "assignedto=2,3,40" is the same as
-"assignedto=2,3,-4,40,-4". While this example is the same as
-"2,3,40", the expression "keyword=1,2,-3,-2" filters issues that don't
-have both keywords 1 and 2.
+So, ``assignedto=2,3,40`` is the same as
+``assignedto=2,3,-4,40,-4``. While this example is the same as
+``2,3,40``, the expression ``keyword=1,2,-3,-2`` filters issues that
+don't have both keywords 1 and 2.
 
 Another example is: ``creator=3,-2,1,-2,-3``. This is the same as the
 expression: ``(not user3) and (not user1)``. Using the rules of logic,
@@ -476,21 +476,27 @@ this is the same as: ``not (user3 or user1)`` which is expressed in
 RPN as ``creator=3,1,-4,-2``. Compare this to ``creator=3,1,-2`` which
 returns issues created by user3 or any user other than user1.
 
-Another example, useful when filtering issues, is:
+Another example, useful when filtering issues, is::
 
   keyword=-1,-2,1,8,-3,-2,-3
 
 which returns issues that have one or more keywords set and the issue
 does not have keyword1 and keyword8 both set. In more standard infix
-form:
+form::
 
   not empty and not (keyword1 and keyword8)
 
-Typing these expressions manually can be tiresome, so there's an
-expression editor on the search page. You can access it by clicking on
-the ``(expr)`` link, which makes creating these expressions a bit
-easier. But at least you can use this info to understand the search
-syntax in the URL.
+Typing these expressions manually can be tiresome and tricky. On the
+search page, there's an expression editor. You can access it by
+clicking on the ``(expr)`` link, which makes creating these
+expressions a bit easier.
+
+Note that errors in your expression (e.g. a missing operand) are
+silently ignored and a fallback search is conducted. This is
+`considered a bug <https://issues.roundup-tracker.org/issue2551374>`_
+and will hopefully be fixed in the future. But at least you can use
+this info to understand the search syntax in the URL if you see
+something strange.
 
 Using the Classhelper
 ---------------------
diff --git a/test/db_test_base.py b/test/db_test_base.py
index 096f31771..d3d87e22b 100644
--- a/test/db_test_base.py
+++ b/test/db_test_base.py
@@ -2074,6 +2074,25 @@ def testFilteringLinkExpression(self):
             ae(filt(None, {a: ['1','-2','2','-2','-4']}, ('+',a)),
                 ['3','4','1','2'])
 
+    def NOtestFilteringLinkInvalid(self):
+        """Test invalid filter expressions.
+           Code must be written to generate an exception for these.
+           Then this code must be changed to test the exception.
+           See issue 2551374 in the roundup tracker.
+        """
+        ae, iiter = self.filteringSetup()
+        a = 'assignedto'
+        # filt(??, filter expression, sort order)
+        # ae = self.assertEqual(val1, val2)
+        for filt in iiter():
+            # -2 is missing an operand
+            ae(filt(None, {a: ['-2','2','-2','-4']},
+                    ('+',a)), [])
+            # 3 is left on the stack
+            ae(filt(None, {a: ['3','2','-2']},
+                    ('+',a)), [])
+
+
     def testFilteringRevLink(self):
         ae, iiter = self.filteringSetupTransitiveSearch('user')
         # We have

From b9a52fafb296fd725937efe7c88173b11bdd9f9d Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Tue, 3 Dec 2024 10:53:32 -0500
Subject: [PATCH 035/398] add security advantage of depending on core library.

After reading about NPM supply chain attacks, emphasize core functions
of Roundup are available without reaching out to PyPi.
---
 doc/features.txt | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/doc/features.txt b/doc/features.txt
index 1ca99fd39..6c2f946ab 100644
--- a/doc/features.txt
+++ b/doc/features.txt
@@ -26,6 +26,9 @@ from Ka-Ping Yee in the :index:`Software Carpentry` "Track" design competition.
 - Can be run in a container like Docker or kubernetes.
 - Deploy in your network as a standalone web server or `through
   various methods`_ like WSGI, FastCGI, plain CGI, etc.
+- Essential tracking features depend on the Python standard
+  library. Supplementary packages from PyPI are optional and can be
+  tailored to fit your unique threat model and security needs.
 
 **Issue Tracking and Management**
 

From 5322210e3aceecd8dd11e1bfc41dbc711afbc9f8 Mon Sep 17 00:00:00 2001
From: Ralf Schlatterbeck <rsc@runtux.com>
Date: Wed, 4 Dec 2024 10:45:26 +0100
Subject: [PATCH 036/398] Documentation and fix for REST headers

issue2551372 - Better document necessary headers for REST and fix
logging to log missing Origin header.
---
 CHANGES.txt           | 3 +++
 doc/rest.txt          | 8 +++++++-
 roundup/cgi/client.py | 3 +++
 3 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index 2dd44d109..73b4e03fa 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -30,6 +30,9 @@ Fixed:
   to a red error msg. (Report by Ludwig Reiter; fix John Rouillard)
 - issue2550698 - added documentation on filtering using RPN property
   expressions. (John Rouillard)
+- issue2551372 - Better document necessary headers for REST and fix
+  logging to log missing Origin header (Ralf Schlatterbeck with
+  suggestions on documentation by John Rouillard)
 
 Features:
 
diff --git a/doc/rest.txt b/doc/rest.txt
index c700590aa..689fcf52a 100644
--- a/doc/rest.txt
+++ b/doc/rest.txt
@@ -68,7 +68,7 @@ explicitly set.)
 Preventing CSRF Attacks
 -----------------------
 
-Clients should set the header X-REQUESTED-WITH to any value and the
+Clients should set the header ``X-REQUESTED-WITH`` to any value and the
 tracker's config.ini should have ``csrf_enforce_header_x-requested-with
 = yes`` or ``required``.
 
@@ -77,6 +77,12 @@ that is not hosted at the same origin as Roundup, you must permit
 the origin using the ``allowed_api_origins`` setting in
 ``config.ini``.
 
+If you access the REST interface with a method other than ``GET``, you
+must also supply an origin header with a value that is either the
+default origin (the URL of the tracker without the path component set in
+the config file as ``web`` in section ``[tracker]``) or one that is
+permitted by ``allowed_api_origins``.
+
 Rate Limiting API Failed Logins
 -------------------------------
 
diff --git a/roundup/cgi/client.py b/roundup/cgi/client.py
index c2214fafd..a638de6a1 100644
--- a/roundup/cgi/client.py
+++ b/roundup/cgi/client.py
@@ -719,8 +719,10 @@ def handle_rest(self):
         if not self.is_origin_header_ok(api=True):
             if 'HTTP_ORIGIN' not in self.env:
                 msg = self._("Required Header Missing")
+                err = 'Origin header missing'
             else:
                 msg = self._("Client is not allowed to use Rest Interface.")
+                err = 'Unauthorized for REST request'
 
             # Use code 400. Codes 401 and 403 imply that authentication
             # is needed or authenticated person is not authorized.
@@ -730,6 +732,7 @@ def handle_rest(self):
             self.reject_request(output,
                                 message_type="application/json",
                                 status=400)
+            logger.error(err)
             return
 
         # Handle CORS preflight request. We know rest is enabled

From 9f57c7beb296c2887f8dfc58ae2cfd2cbd548164 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sat, 7 Dec 2024 17:34:06 -0500
Subject: [PATCH 037/398] A few cleanups to toml format. alphabetize,
 whitespace...

Using: pretty-toml-sort with --spaces-indent-inline-array 4 then
editing the result to keep blank lines inside sections and some
comments that it was stripping.
---
 pyproject.toml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pyproject.toml b/pyproject.toml
index 5b2c475be..379a4dd72 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -100,6 +100,8 @@ ignore = [
    "SIM105",
 ]
 
+[tool.ruff.lint.mccabe]
+max-complexity = 50
 
 [tool.ruff.lint.per-file-ignores]
 "roundup/anypy/*.py" = ["RET505", "RET506"]
@@ -108,12 +110,10 @@ ignore = [
 "roundup/support.py" = ["E401"]
 "roundup/security.py" = ["E701"]
 "roundup/date.py" = ["E231", "E701"]
-"roundup/backends/back_sqlite.py" = [ "E203" ]
+"roundup/backends/back_sqlite.py" = ["E203"]
 
-[too.ruff.lint.pylint]
+[tool.ruff.lint.pylint]
 max-args = 6
-max-branches=20
+max-branches = 20
 max-statements = 100
 
-[tool.ruff.lint.mccabe]
-max-complexity = 50

From 4dd59a3759942c21252a36731c9fc76076a639f4 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 8 Dec 2024 01:09:34 -0500
Subject: [PATCH 038/398] refactor: issue2551289. invalid REST Accept header
 stops request

Sending a POST, PUT (maybe PATCH) with an accept header that is not
application/json or xml (if enabled) used to complete the request
before throwing a 406 error. This was wrong.

Now it reports an error without dispatching/processing the requested
transaction.  This is the first of a series of refactors of the
dispatch method to make it faster and more readable by using return
early pattern and extracting methods from the code.

changes:

 The following now return 406 errors not 400 errors
   invalid version specified with @apiver in URL.
   invalid version specified with @apiver in payload body
   invalid version specified in accept headers as
     application/vnd.roundup.test-vz+json or version property

 Parsing the accept header returns a 400 when presented with a
   parameter without an = sign or other parse error. They used to
   return a 406 which is wrong since the header is malformed rather
   than having a value I can't respond to.

 Some error messages were made clearer.

 Results in the case of an error are proper json error object rather
   than text/plain strings.

 New test added for testdetermine_output_formatBadAccept that test the
   new method using the same test cases as for
   testDispatchBadAccept. I intend to extend the test coverage for
   determine_output_format to cover more cases. This should be a faster
   unit test than for dispatch.

 Removed .lower() calls for accept_mime_type as the input values are
   taken from the values in the __accepted_content_type dict which
   only has lower case values.
---
 CHANGES.txt         |   3 +
 doc/upgrading.txt   |  12 +++
 roundup/rest.py     | 225 ++++++++++++++++++++++++++++++--------------
 test/rest_common.py | 183 ++++++++++++++++++++++++++++++-----
 4 files changed, 324 insertions(+), 99 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index 73b4e03fa..89b00f90a 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -33,6 +33,9 @@ Fixed:
 - issue2551372 - Better document necessary headers for REST and fix
   logging to log missing Origin header (Ralf Schlatterbeck with
   suggestions on documentation by John Rouillard)
+- issue2551289 - Invalid REST Accept header with post/put performs
+  change before returning 406. Error before making any changes to the
+  db if we can't respond with requested format. (John Rouillard)
 
 Features:
 
diff --git a/doc/upgrading.txt b/doc/upgrading.txt
index 0935db79a..8439ac54e 100644
--- a/doc/upgrading.txt
+++ b/doc/upgrading.txt
@@ -149,6 +149,18 @@ See
 https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#cookie_prefixes
 for details on this security measure.
 
+Invalid accept header now prevents operation (info)
+---------------------------------------------------
+
+In earlier versions, the rest interface checked for an incorrect
+"Accept" header, "@apiver", or the ".json" mime type only after
+processing the request. This would lead to a 406 error, but the
+requested change would still be completed.
+
+In this release, the validation of the output format and version
+occurs before any database changes are made. Now, all errors related
+to the data format (mime type, API version) will return 406 errors,
+where some previously resulted in 400 errors.
 
 .. index:: Upgrading; 2.3.0 to 2.4.0
 
diff --git a/roundup/rest.py b/roundup/rest.py
index 85bc6e969..c9991cf4a 100644
--- a/roundup/rest.py
+++ b/roundup/rest.py
@@ -268,6 +268,8 @@ def parse_accept_header(accept):
 
     Default `q` for values that are not specified is 1.0
 
+    If q value > 1.0, it is parsed as a very small value.
+
     # Based on https://gist.github.com/samuraisam/2714195
     # Also, based on a snipped found in this project:
     #   https://github.com/martinblech/mimerender
@@ -2206,6 +2208,136 @@ def handle_apiRateLimitExceeded(self, apiRateLimit):
             # human may read it
         ), None)
 
+    def determine_output_format(self, uri):
+        """Returns tuple of:
+
+            (format for returned output,
+             possibly modified uri,
+             output error object (if error else None))
+
+           Verify that client is requesting an output we can produce
+           with a version we support.
+
+           Only application/json and application/xml (optional)
+           are currently supported. .vcard might be useful
+           in the future for user objects.
+
+           Find format for returned output:
+
+             1) Get format from url extension (.json, .xml) and return
+                 if invalid return (None, uri, 406 error)
+                 if not found continue
+             2) Parse Accept header obeying q values
+                 if header unparsible return 400 error object.
+             3) if empty or missing Accept header
+                return self.__default_accept_type
+             4) match and return best Accept header/version
+                  if version error found in matching type return 406 error
+             5) if no requested format is supported return 406
+                error
+
+        """
+        # get the request format for response
+        # priority : extension from uri (/rest/data/issue.json)
+        #              only json or xml valid at this time.
+        #            header (Accept: application/json, application/xml)
+        #            default (application/json)
+        ext_type = os.path.splitext(urlparse(uri).path)[1][1:]
+
+        # Check to see if the extension matches a value in
+        # self.__accepted_content_type. In the future other output
+        # such as .vcard for downloading user info can be
+        # supported. This method also allow detection of mistyped
+        # types like jon for json. Limit extension length to less than
+        # 10 characters to allow passing JWT via URL path. Could be
+        # useful for magic link login method or account recovery workflow,
+        # using a JWT with a short expiration time and limited rights
+        # (e.g. only password change permission))
+        if ext_type and (len(ext_type) < 10):
+            if ext_type not in list(self.__accepted_content_type.values()):
+                self.client.response_code = 406
+                return (None, uri,
+                        self.error_obj(
+                            406,
+                            _("Content type '%s' requested in URL is "
+                             "not available.\nAcceptable types: %s\n") %
+                            (ext_type,
+                             ", ".join(sorted(
+                                 set(self.__accepted_content_type.values()))))))
+
+            # strip extension so uri makes sense.
+            # E.G. .../issue.json -> .../issue
+            uri = uri[:-(len(ext_type) + 1)]
+            return (ext_type, uri, None)
+
+        # parse Accept header and get the content type
+        # Acceptable types ordered with preferred one (by q value)
+        # first in list.
+        try:
+            accept_header = parse_accept_header(
+                self.client.request.headers.get('Accept')
+            )
+        except UsageError as e:
+            self.client.response_code = 406
+            return (None, uri, self.error_obj(
+                400, _("Unable to parse Accept Header. %(error)s. "
+                       "Acceptable types: %(acceptable_types)s") % {
+                           'error': e.args[0],
+                           'acceptable_types': " ".join(sorted(
+                               self.__accepted_content_type.keys()))}))
+
+        if not accept_header:
+            # we are using the default
+            return (self.__default_accept_type, uri, None)
+
+        accept_type = ""
+        for part in accept_header:
+            if accept_type:
+                # we accepted the best match, stop searching for
+                # lower quality matches.
+                break
+            if part[0] in self.__accepted_content_type:
+                accept_type = self.__accepted_content_type[part[0]]
+                # Version order:
+                #  1) accept header version=X specifier
+                #     application/vnd.x.y; version=1
+                #  2) from type in accept-header type/subtype-vX
+                #     application/vnd.x.y-v1
+                #  3) from @apiver in query string to make browser
+                #     use easy
+                # This code handles 1 and 2. Set api_version to none
+                # to trigger @apiver parsing below
+                # Places that need the api_version info should
+                # use default if version = None
+                try:
+                    self.api_version = int(part[1]['version'])
+                except KeyError:
+                    self.api_version = None
+                except (ValueError, TypeError):
+                    self.client.response_code = 406
+                    # TypeError if int(None)
+                    msg = _("Unrecognized api version: %s. "
+                           "See /rest without specifying api version "
+                           "for supported versions.") % (
+                               part[1]['version'])
+                    return (None, uri,
+                           self.error_obj(406, msg))
+
+        # accept_type will be empty only if there is an Accept header
+        # with invalid values.
+        if accept_type:
+            return (accept_type, uri, None)
+
+        self.client.response_code = 400
+        return (None, uri,
+                self.error_obj(
+                    406,
+                    _("Requested content type(s) '%s' not available.\n"
+                      "Acceptable mime types are: %s") %
+                    (self.client.request.headers.get('Accept'),
+                     ", ".join(sorted(
+                         self.__accepted_content_type.keys())))))
+
     def dispatch(self, method, uri, input):
         """format and process the request"""
         output = None
@@ -2248,75 +2380,15 @@ def dispatch(self, method, uri, input):
                     'Ignoring X-HTTP-Method-Override using %s request on %s',
                     method.upper(), uri)
 
-        # parse Accept header and get the content type
-        # Acceptable types ordered with preferred one first
-        # in list.
-        try:
-            accept_header = parse_accept_header(headers.get('Accept'))
-        except UsageError as e:
-            output = self.error_obj(406, _("Unable to parse Accept Header. %(error)s. "
-                      "Acceptable types: %(acceptable_types)s") % {
-                          'error': e.args[0],
-                          'acceptable_types': " ".join(sorted(self.__accepted_content_type.keys()))})
-            accept_header = []
-
-        if not accept_header:
-            accept_type = self.__default_accept_type
-        else:
-            accept_type = None
-        for part in accept_header:
-            if accept_type:
-                # we accepted the best match, stop searching for
-                # lower quality matches.
-                break
-            if part[0] in self.__accepted_content_type:
-                accept_type = self.__accepted_content_type[part[0]]
-                # Version order:
-                #  1) accept header version=X specifier
-                #     application/vnd.x.y; version=1
-                #  2) from type in accept-header type/subtype-vX
-                #     application/vnd.x.y-v1
-                #  3) from @apiver in query string to make browser
-                #     use easy
-                # This code handles 1 and 2. Set api_version to none
-                # to trigger @apiver parsing below
-                # Places that need the api_version info should
-                # use default if version = None
-                try:
-                    self.api_version = int(part[1]['version'])
-                except KeyError:
-                    self.api_version = None
-                except (ValueError, TypeError):
-                    # TypeError if int(None)
-                    msg = ("Unrecognized api version: %s. "
-                           "See /rest without specifying api version "
-                           "for supported versions." % (
-                               part[1]['version']))
-                    output = self.error_obj(400, msg)
-
-        # get the request format for response
-        # priority : extension from uri (/rest/data/issue.json),
-        #            header (Accept: application/json, application/xml)
-        #            default (application/json)
-        ext_type = os.path.splitext(urlparse(uri).path)[1][1:]
+        # FIXME: when this method is refactored, change
+        # determine_output_format to raise an exception. Catch it here
+        # and return early. Also set self.client.response_code from
+        # error object['error']['status'] and remove from
+        # determine_output_format.
+        (output_format, uri, error) = self.determine_output_format(uri)
+        if error:
+            output = error
 
-        # Check to see if the length of the extension is less than 6.
-        # this allows use of .vcard for a future use in downloading
-        # user info. It also allows passing through larger items like
-        # JWT that has a final component > 6 items. This method also
-        # allow detection of mistyped types like jon for json.
-        if ext_type and (len(ext_type) < 6):
-            # strip extension so uri make sense
-            # .../issue.json -> .../issue
-            uri = uri[:-(len(ext_type) + 1)]
-        else:
-            ext_type = None
-
-        # headers.get('Accept') is never empty if called here.
-        # accept_type will be set to json if there is no Accept header
-        # accept_type wil be empty only if there is an Accept header
-        # with invalid values.
-        data_type = ext_type or accept_type or headers.get('Accept') or "invalid"
         if method.upper() == 'OPTIONS':
             # add access-control-allow-* access-control-max-age to support
             # CORS preflight
@@ -2441,6 +2513,9 @@ def dispatch(self, method, uri, input):
                "See /rest without specifying api version "
                "for supported versions.")
         try:
+            # FIXME: the version priority here is different
+            # from accept header. accept mime type in url
+            # takes priority over Accept header. Opposite here.
             if not self.api_version:
                 self.api_version = int(input['@apiver'].value)
         # Can also return a TypeError ("not indexable")
@@ -2448,7 +2523,7 @@ def dispatch(self, method, uri, input):
         except (KeyError, TypeError):
             self.api_version = None
         except ValueError:
-            output = self.error_obj(400, msg % input['@apiver'].value)
+            output = self.error_obj(406, msg % input['@apiver'].value)
 
         # by this time the API version is set. Error if we don't
         # support it?
@@ -2459,7 +2534,7 @@ def dispatch(self, method, uri, input):
             #    Use default if not specified for now.
             self.api_version = self.__default_api_version
         elif self.api_version not in self.__supported_api_versions:
-            output = self.error_obj(400, msg % self.api_version)
+            output = self.error_obj(406, msg % self.api_version)
 
         # sadly del doesn't work on FieldStorage which can be the type of
         # input. So we have to ignore keys starting with @ at other
@@ -2479,19 +2554,23 @@ def dispatch(self, method, uri, input):
             output = self.error_obj(405, msg.args[0])
             self.client.setHeader("Allow", msg.args[1])
 
-        return self.format_dispatch_output(data_type, output, pretty_output)
+        return self.format_dispatch_output(output_format,
+                                           output,
+                                           pretty_output)
 
     def format_dispatch_output(self, accept_mime_type, output,
                                pretty_print=True):
         # Format the content type
-        if accept_mime_type.lower() == "json":
+        # if accept_mime_type is None, the client specified invalid
+        # mime types so we default to json output.
+        if accept_mime_type == "json" or accept_mime_type is None:
             self.client.setHeader("Content-Type", "application/json")
             if pretty_print:
                 indent = 4
             else:
                 indent = None
             output = RoundupJSONEncoder(indent=indent).encode(output)
-        elif accept_mime_type.lower() == "xml" and dicttoxml:
+        elif accept_mime_type == "xml" and dicttoxml:
             self.client.setHeader("Content-Type", "application/xml")
             if 'error' in output:
                 # capture values in error with types unsupported
diff --git a/test/rest_common.py b/test/rest_common.py
index a693923fe..35c2a9208 100644
--- a/test/rest_common.py
+++ b/test/rest_common.py
@@ -1837,6 +1837,140 @@ def testDispatchBadContent(self):
                          self.server.client.additional_headers)
         self.server.client.additional_headers = {}
 
+    def testdetermine_output_formatBadAccept(self):
+        dof = self.server.determine_output_format
+
+        # simulate: /rest/data/issue expect failure unknown accept settings
+        body=b'{ "title": "Joe Doe has problems", \
+                 "nosy": [ "1", "3" ], \
+                 "assignedto": "2", \
+                 "abool": true, \
+                 "afloat": 2.3, \
+                 "anint": 567890 \
+        }'
+        env = { "CONTENT_TYPE": "application/json",
+                "CONTENT_LENGTH": len(body),
+                "REQUEST_METHOD": "POST"
+        }
+        self.server.client.env.update(env)
+        headers={"accept": "application/zot; version=1; q=0.5",
+                 "content-type": env['CONTENT_TYPE'],
+                 "content-length": env['CONTENT_LENGTH'],
+        }
+
+        self.headers=headers
+        # we need to generate a FieldStorage the looks like
+        #  FieldStorage(None, None, 'string') rather than
+        #  FieldStorage(None, None, [])
+        body_file=BytesIO(body)  # FieldStorage needs a file
+        form = client.BinaryFieldStorage(body_file,
+                                headers=headers,
+                                environ=env)
+        self.server.client.request.headers.get=self.get_header
+
+        (output_type, uri, error) = dof("/rest/data/issue")
+
+        self.assertEqual(self.server.client.response_code, 406)
+        self.assertIn(b"Requested content type(s) 'application/zot; version=1; q=0.5' not available.\nAcceptable mime types are: */*, application/json",
+                      s2b(error['error']['msg']))
+
+        # simulate: /rest/data/issue works, multiple acceptable output, one
+        # is valid
+        self.server.client.response_code = ""
+        env = { "CONTENT_TYPE": "application/json",
+                "CONTENT_LENGTH": len(body),
+                "REQUEST_METHOD": "POST"
+        }
+        self.server.client.env.update(env)
+        headers={"accept": "application/zot; version=1; q=0.75, "
+                           "application/json; version=1; q=0.5",
+                 "content-type": env['CONTENT_TYPE'],
+                 "content-length": env['CONTENT_LENGTH'],
+        }
+
+        self.headers=headers
+        # we need to generate a FieldStorage the looks like
+        #  FieldStorage(None, None, 'string') rather than
+        #  FieldStorage(None, None, [])
+        body_file=BytesIO(body)  # FieldStorage needs a file
+        form = client.BinaryFieldStorage(body_file,
+                                headers=headers,
+                                environ=env)
+        self.server.client.request.headers.get=self.get_header
+        (output_type, uri, error) = dof("/rest/data/issue")
+
+        self.assertEqual(self.server.client.response_code, "")
+        self.assertEqual(output_type, "json")
+        self.assertEqual(uri, "/rest/data/issue")
+        self.assertEqual(error, None)
+
+        # test 3 accept is empty. This triggers */* so passes
+        self.server.client.response_code = ""
+        headers={"accept": "",
+                 "content-type": env['CONTENT_TYPE'],
+                 "content-length": env['CONTENT_LENGTH'],
+        }
+
+        self.headers=headers
+        # we need to generate a FieldStorage the looks like
+        #  FieldStorage(None, None, 'string') rather than
+        #  FieldStorage(None, None, [])
+        body_file=BytesIO(body)  # FieldStorage needs a file
+        form = client.BinaryFieldStorage(body_file,
+                                headers=headers,
+                                environ=env)
+        self.server.client.request.headers.get=self.get_header
+        (output_type, uri, error) = dof("/rest/data/issue")
+
+        self.assertEqual(self.server.client.response_code, "")
+        self.assertEqual(output_type, "json")
+        self.assertEqual(uri, "/rest/data/issue")
+        self.assertEqual(error, None)
+
+        # test 4 accept is random junk.
+        headers={"accept": "Xyzzy I am not a mime, type;",
+                 "content-type": env['CONTENT_TYPE'],
+                 "content-length": env['CONTENT_LENGTH'],
+        }
+
+        self.headers=headers
+        # we need to generate a FieldStorage the looks like
+        #  FieldStorage(None, None, 'string') rather than
+        #  FieldStorage(None, None, [])
+        body_file=BytesIO(body)  # FieldStorage needs a file
+        form = client.BinaryFieldStorage(body_file,
+                                headers=headers,
+                                environ=env)
+        self.server.client.request.headers.get=self.get_header
+        (output_type, uri, error) = dof("/rest/data/issue")
+
+        self.assertEqual(self.server.client.response_code, 400)
+        self.assertEqual(output_type, None)
+        self.assertEqual(uri, "/rest/data/issue")
+        self.assertIn('Unable to parse Accept Header. Invalid media type: Xyzzy I am not a mime. Acceptable types: */* application/json', error['error']['msg'])
+
+        # test 5 accept mimetype is ok, param is not
+        headers={"accept": "*/*; foo",
+                 "content-type": env['CONTENT_TYPE'],
+                 "content-length": env['CONTENT_LENGTH'],
+        }
+
+        self.headers=headers
+        # we need to generate a FieldStorage the looks like
+        #  FieldStorage(None, None, 'string') rather than
+        #  FieldStorage(None, None, [])
+        body_file=BytesIO(body)  # FieldStorage needs a file
+        form = client.BinaryFieldStorage(body_file,
+                                headers=headers,
+                                environ=env)
+        self.server.client.request.headers.get=self.get_header
+        (output_type, uri, error) = dof("/rest/data/issue")
+
+        self.assertEqual(self.server.client.response_code, 400)
+        self.assertEqual(output_type, None)
+        self.assertEqual(uri, "/rest/data/issue")
+        self.assertIn('Unable to parse Accept Header. Invalid param: foo. Acceptable types: */* application/json', error['error']['msg'])
+
     def testDispatchBadAccept(self):
         # simulate: /rest/data/issue expect failure unknown accept settings
         body=b'{ "title": "Joe Doe has problems", \
@@ -1868,10 +2002,11 @@ def testDispatchBadAccept(self):
         results = self.server.dispatch(env["REQUEST_METHOD"],
                             "/rest/data/issue",
                             form)
-
         print(results)
+        json_dict = json.loads(b2s(results))
         self.assertEqual(self.server.client.response_code, 406)
-        self.assertIn(b"Requested content type 'application/zot; version=1; q=0.5' is not available.\nAcceptable types: */*, application/json", results)
+        self.assertIn("Requested content type(s) 'application/zot; version=1; q=0.5' not available.\nAcceptable mime types are: */*, application/json",
+                      json_dict['error']['msg'])
 
         # simulate: /rest/data/issue works, multiple acceptable output, one
         # is valid
@@ -1902,12 +2037,7 @@ def testDispatchBadAccept(self):
         print(results)
         self.assertEqual(self.server.client.response_code, 201)
         json_dict = json.loads(b2s(results))
-        # ERROR this should be 1. What's happening is that the code
-        # for handling 406 error code runs through everything and creates
-        # the item. Then it throws a 406 after the work is done when it
-        # realizes it can't respond as requested. So the 406 post above
-        # creates issue 1 and this one creates issue 2.
-        self.assertEqual(json_dict['data']['id'], "2")
+        self.assertEqual(json_dict['data']['id'], "1")
 
 
         # test 3 accept is empty. This triggers */* so passes
@@ -1932,9 +2062,7 @@ def testDispatchBadAccept(self):
         print(results)
         self.assertEqual(self.server.client.response_code, 201)
         json_dict = json.loads(b2s(results))
-        # This is one more than above. Will need to be fixed
-        # When error above is fixed.
-        self.assertEqual(json_dict['data']['id'], "3")
+        self.assertEqual(json_dict['data']['id'], "2")
 
         # test 4 accept is random junk.
         headers={"accept": "Xyzzy I am not a mime, type;",
@@ -1956,7 +2084,7 @@ def testDispatchBadAccept(self):
                             form)
 
         print(results)
-        self.assertEqual(self.server.client.response_code, 406)
+        self.assertEqual(self.server.client.response_code, 400)
         json_dict = json.loads(b2s(results))
         self.assertIn('Unable to parse Accept Header. Invalid media type: Xyzzy I am not a mime. Acceptable types: */* application/json', json_dict['error']['msg'])
 
@@ -1980,7 +2108,7 @@ def testDispatchBadAccept(self):
                             form)
 
         print(results)
-        self.assertEqual(self.server.client.response_code, 406)
+        self.assertEqual(self.server.client.response_code, 400)
         json_dict = json.loads(b2s(results))
         self.assertIn('Unable to parse Accept Header. Invalid param: foo. Acceptable types: */* application/json', json_dict['error']['msg'])
 
@@ -2147,7 +2275,7 @@ def testDispatch(self):
         results = self.server.dispatch('PUT',
                             "/rest/data/user/%s/realname"%self.joeid,
                             form)
-        self.assertEqual(self.server.client.response_code, 400)
+        self.assertEqual(self.server.client.response_code, 406)
         del(self.headers)
 
         # TEST #2
@@ -2427,13 +2555,14 @@ def testDispatch(self):
         print(results)
         try:  # only verify local copy not system installed copy
             from roundup.dicttoxml import dicttoxml
-            includexml = ', application/xml'
+            includexml = ', xml'
         except ImportError:
             includexml = ''
-        
-        response="Requested content type 'jon' is not available.\n" \
-                 "Acceptable types: */*, application/json%s\n"%includexml
-        self.assertEqual(b2s(results), response)
+
+        json_dict = json.loads(b2s(results))
+        response= ("Content type 'jon' requested in URL is not available.\n"
+                 "Acceptable types: json%s\n") % includexml
+        self.assertEqual(json_dict['error']['msg'], response)
 
         # TEST #9
         # GET: test that version can be set with accept:
@@ -2457,7 +2586,8 @@ def testDispatch(self):
                             "/rest/data/issue/1", form)
         print("9a: " + b2s(results))
         json_dict = json.loads(b2s(results))
-        self.assertEqual(json_dict['error']['status'], 400)
+        # note bad @apiver returns 400 not 406.
+        self.assertEqual(json_dict['error']['status'], 406)
         self.assertEqual(json_dict['error']['msg'],
               "Unrecognized api version: L. See /rest without "
               "specifying api version for supported versions.")
@@ -2469,7 +2599,8 @@ def testDispatch(self):
                             "/rest/data/issue/1", form)
         print("9b: " + b2s(results))
         json_dict = json.loads(b2s(results))
-        self.assertEqual(json_dict['error']['status'], 400)
+        self.assertEqual(self.server.client.response_code, 406)
+        self.assertEqual(json_dict['error']['status'], 406)
         self.assertEqual(json_dict['error']['msg'],
               "Unrecognized api version: z. See /rest without "
               "specifying api version for supported versions.")
@@ -2480,9 +2611,9 @@ def testDispatch(self):
         results = self.server.dispatch('GET',
                             "/rest/data/issue/1", self.empty_form)
         print("9c:" + b2s(results))
-        self.assertEqual(self.server.client.response_code, 400)
+        self.assertEqual(self.server.client.response_code, 406)
         json_dict = json.loads(b2s(results))
-        self.assertEqual(json_dict['error']['status'], 400)
+        self.assertEqual(json_dict['error']['status'], 406)
         self.assertEqual(json_dict['error']['msg'],
               "Unrecognized api version: z. See /rest without "
               "specifying api version for supported versions.")
@@ -2495,9 +2626,9 @@ def testDispatch(self):
         results = self.server.dispatch('GET',
                             "/rest/data/issue/1", self.empty_form)
         print("9d: " + b2s(results))
-        self.assertEqual(self.server.client.response_code, 400)
+        self.assertEqual(self.server.client.response_code, 406)
         json_dict = json.loads(b2s(results))
-        self.assertEqual(json_dict['error']['status'], 400)
+        self.assertEqual(json_dict['error']['status'], 406)
         self.assertEqual(json_dict['error']['msg'],
               "Unrecognized api version: a. See /rest without "
               "specifying api version for supported versions.")
@@ -2728,7 +2859,7 @@ def testAcceptHeaderParsing(self):
                                        self.empty_form)
         print(results)
         json_dict = json.loads(b2s(results))
-        self.assertEqual(self.server.client.response_code, 400)
+        self.assertEqual(self.server.client.response_code, 406)
         self.assertEqual(self.server.client.additional_headers['Content-Type'],
                          "application/json")
         self.assertEqual(json_dict['error']['msg'],

From b2cbaac1a92faba0907624ead7775c9ba0212b0c Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 8 Dec 2024 09:10:21 -0500
Subject: [PATCH 039/398] bug: handle case where argv[0] is invoked by
 setuptools-py2cfg

I am working on migrating to pyproject.toml. I used setuptools-py2cfg
to generate a toml version of setup.py. It results in argv[0] as a
PosixPath and no a string. So guard against processing the PosixPath
when looking for prefix argument.

Overall the resulting pyproject.toml isn't installing any of the data
files, docs etc. It doesn't seem to process MANIFEST.in to get the
data files correctly. So no joy so far and I am not checking in the
result.
---
 setup.py | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/setup.py b/setup.py
index 542a8041a..da1d00061 100755
--- a/setup.py
+++ b/setup.py
@@ -78,6 +78,12 @@ def get_prefix():
         if prefix_arg:
             prefix = a
             break
+
+        # argv[0] can be a PosixPath when setup.py
+        # is invoked by setuptools-py2cfg
+        if not isinstance(a, str):
+            continue
+
         # is there a short form -p or something for this??
         if a.startswith('--prefix'):
             if a == '--prefix':

From a44e4c869c486d545a891eaee76489f0aeb789c4 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 8 Dec 2024 09:11:53 -0500
Subject: [PATCH 040/398] chore: bump version to 2.5.0

---
 roundup/__init__.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roundup/__init__.py b/roundup/__init__.py
index c879727c6..2e14b388a 100644
--- a/roundup/__init__.py
+++ b/roundup/__init__.py
@@ -67,6 +67,6 @@
 '''
 __docformat__ = 'restructuredtext'
 
-__version__ = '2.4.0'
+__version__ = '2.5.0'
 
 # vim: set filetype=python ts=4 sw=4 et si

From ba0e68a9b867712606fd12a0b9a1e1adea658a10 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 8 Dec 2024 17:22:33 -0500
Subject: [PATCH 041/398] feat: issue2551068 - Provide way to retrieve file/msg
 data via rest endpoint.

Use Allow header to change format of /binary_content endpoint.  If
Allow header for endpoint is not application/json, it will be matched
against the mime type for the file. */*, text/* are supported and will
return the native mime type if present.

Changes:

  move */* mime type from static dict of supported types. It was
     hardcoded to return json only. Now it can return a matching
     non-json mime type for the /binary_content endpoint.

  Edited some errors to explicitly add */* mime type.

  Cleanups to use ', ' separation in lists of valid mime types rather
    than just space separated.

  Remove ETag header when sending raw content. See issue 2551375 for
     background.

  Doc added to rest.txt.

  Small format fix up (add dash) in CHANGES.txt.

  Make passing an unset/None/False accept_mime_type to
    format_dispatch_output a 500 error. This used to be the fallback
    to produce a 406 error after all processing had happened. It
    should no longer be possible to take that code path as all 406
    errors (with valid accept_mime_types) are generated before
    processing takes place.

  Make format_dispatch_output handle output other than json/xml so it
       can send back binary_content data.

  Removed a spurious client.response_code = 400 that seems to not be
    used.

  Tests added for all code paths.

  Database setup for tests msg and file entry. This required a file
    upload test to change so it doesn't look for file1 as the link
    returned by the upload. Download the link and verify the data
    rather than verifying the link.

 Multiple formatting changes to error messages to make all lists of
    valid mime types ', ' an not just space separated.
---
 CHANGES.txt         |   7 +-
 doc/rest.txt        |  84 +++++++++++-
 roundup/rest.py     |  95 +++++++++++--
 test/rest_common.py | 326 +++++++++++++++++++++++++++++++++++++++++++-
 4 files changed, 492 insertions(+), 20 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index 89b00f90a..1cdd1a241 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -47,7 +47,7 @@ Features:
 - issue2551315 - Document use of
   RestfulInstance.max_response_row_size to limit data returned
   from rest request.
-- issue2551330 Add an optional 'filter' function to the Permission
+- issue2551330 - Add an optional 'filter' function to the Permission
   objects and the addPermission method. This is used to optimize search
   performance by not checking items returned from a database query
   one-by-one (using the check function) but instead offload the
@@ -60,6 +60,11 @@ Features:
   address. This logs the actual client address when
   roundup-server is run behind a reverse proxy. It also appends a
   + sign to the logged address/name. (John Rouillard)
+- issue2551068 - Provide way to retrieve file/msg data via rest
+  endpoint. Raw file/msg data can be retrieved using the
+  /binary_content attribute and an Accept header to select the mime
+  type for the data (e.g. image/png for a png file). The existing html
+  interface method still works and is supported, but is legacy.
 
 2024-07-13 2.4.0
 
diff --git a/doc/rest.txt b/doc/rest.txt
index 689fcf52a..2c69ed599 100644
--- a/doc/rest.txt
+++ b/doc/rest.txt
@@ -368,7 +368,7 @@ extension ``.json`` or ``.xml`` to the path component of the url. This
 will force json or xml (if supported) output. If you use an extension
 it takes priority over any accept headers. Note the extension does not
 work for the ``/rest`` or ``/rest/data`` paths. In these cases it
-returs a 404 error. Adding the header ``Accept: application/xml``
+returns a 404 error. Adding the header ``Accept: application/xml``
 allows these paths to return xml data.
 
 The rest interface returns status 406 if you use an unrecognized
@@ -378,6 +378,8 @@ the accept header are available or if the accept header is invalid.
 Note: ``dicttoxml2.py`` is an updated version of ``dicttoxml.py``. If
 you are still using Python 2.7 or 3.6, you can use ``dicttoxml.py``.
 
+Also the ``/binary_content`` attribute endpoint can be used to
+retrieve raw file data in many formats.
 
 General Guidelines
 ------------------
@@ -906,6 +908,86 @@ You can retreive a message with a url like
      }
   }
 
+With Roundup 2.5 you can retrieve the data directly from the rest
+interface using the ``Accept`` header value to select a structured (json
+or optional xml) representation (as above) or a stream with just the
+content data.
+
+Using the wildcard type ``*/*`` in the ``Accept`` header with the url
+``.../binary_content`` will return the raw data and the recorded mime
+type of the the data as the ``Content-Type``. Using ``*/*`` with
+another end point will return ``json`` data. An ``Accept`` value of
+``application/octet-stream`` matches any mime type and retrieves the
+raw data as ``Content-Type: application/octet-stream``.
+
+To access the contents of a PNG image file (in file23), you use the
+following link:
+``https://.../demo/rest/data/file/23/binary_content``. To find out the
+mime type, you can check this URL:
+``https://.../demo/rest/data/file/23/type``.
+
+By setting the header to ``Accept: application/octet-stream; q=1.0,
+application/json; q=0.5``, you will receive the binary PNG file with
+the header ``Content-Type: application/octet-stream``. If you switch
+the ``q`` values, you will receive the encoded JSON version::
+
+  {
+    "data": {
+        "id": "23",
+        "type": "<class 'bytes'>",
+        "link": "https://.../demo/rest/data/file/23/binary_content",
+        "data": "b'\\x89PNG\\r\\n\\x1a\\n\\x00[...]0\\x00\\x00\\x00IEND\\xaeB`\\x82'",
+        "@etag": "\"db6adc1b09d95b0388d79c7905bc7982\""
+    }
+  }
+
+with ``Content-Type: application/json`` and a (4x larger) json encoded
+representation of the binary data.
+
+If you want it returned with a ``Content-Type: image/png`` header,
+you can use ``image/png`` or ``*/*`` in the Accept header.
+
+For message files, you can use
+``https://.../demo/rest/data/msg/23/binary_content`` with ``Accept:
+application/octet-stream; q=0.5, application/json; q=0.4, image/png;
+q=0.495, text/*``. It will return the plain text of the message.
+
+Most message files are not stored with a mime type. Getting
+``https://.../demo/rest/data/msg/23/type`` returns::
+
+  {
+    "data": {
+        "id": "23",
+        "type": "<class 'NoneType'>",
+        "link": "https://.../demo/rest/data/msg/23/type",
+        "data": null,
+        "@etag": "\"ba98927a8bb4c56f6cfc31a36f94ad16\""
+    }
+  }
+
+The data attribute will usually be null/empty. As a result, mime type
+matching for an item without a mime type is forgiving.
+
+Messages are meant to be human readable, so the mime type ``text/*``
+can be used to access any text style mime type (``text/plain``,
+``text/x-rst``, ``text/markdown``, ``text/html``, ...) or an empty
+mime type. If the item's type is not empty, it will be used as the
+Content-Type (similar to ``*/*``). Otherwise ``text/*`` will be the
+Content-Type. If your tracker supports markup languages
+(e.g. markdown), you should set the mime type (e.g. ``text/markdown``)
+when storing your message.
+
+Note that the header ``X-Content-Type-Options: nosniff`` is returned
+with a non javascript or xml binary_content response to prevent the
+browser from trying to interpret the returned data.
+
+Legacy Method (HTML interface)
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+With the addition of file binary content streaming in the rest
+interface to Roundup 2.5.0, this method (using the html interface) is
+considered legacy but still works.
+
 To retreive the content, you can use the content link property:
 ``https://.../demo/msg11/``. The trailing / is required. Without the
 /, you get a web page that includes metadata about the message. With
diff --git a/roundup/rest.py b/roundup/rest.py
index c9991cf4a..c7a2ea53c 100644
--- a/roundup/rest.py
+++ b/roundup/rest.py
@@ -433,7 +433,6 @@ class RestfulInstance(object):
     __default_patch_op = "replace"  # default operator for PATCH method
     __accepted_content_type = {
         "application/json": "json",
-        "*/*": "json",
     }
     __default_accept_type = "json"
 
@@ -2232,6 +2231,8 @@ def determine_output_format(self, uri):
              3) if empty or missing Accept header
                 return self.__default_accept_type
              4) match and return best Accept header/version
+                  this includes matching mime types for file downloads
+                       using the binary_content property
                   if version error found in matching type return 406 error
              5) if no requested format is supported return 406
                 error
@@ -2281,9 +2282,9 @@ def determine_output_format(self, uri):
             self.client.response_code = 406
             return (None, uri, self.error_obj(
                 400, _("Unable to parse Accept Header. %(error)s. "
-                       "Acceptable types: %(acceptable_types)s") % {
+                       "Acceptable types: */*, %(acceptable_types)s") % {
                            'error': e.args[0],
-                           'acceptable_types': " ".join(sorted(
+                           'acceptable_types': ", ".join(sorted(
                                self.__accepted_content_type.keys()))}))
 
         if not accept_header:
@@ -2291,11 +2292,45 @@ def determine_output_format(self, uri):
             return (self.__default_accept_type, uri, None)
 
         accept_type = ""
+        valid_binary_content_types = []
+        if uri.endswith("/binary_content"):
+            request_path = uri
+            request_class, request_id = request_path.split('/')[-3:-1]
+            try:
+                designator_type = self.db.getclass(
+                    request_class).get(request_id, "type")
+            except (KeyError, IndexError):
+                # class (KeyError) or
+                # id (IndexError) does not exist
+                # Return unknown mime type and no error.
+                # The 400/404 error will be thrown by other code.
+                return (None, uri, None)
+
+            if designator_type:
+                # put this first as we usually require exact mime
+                # type match and this will be matched most often.
+                # Also for text/* Accept header it will be returned.
+                valid_binary_content_types.append(designator_type)
+
+            if not designator_type or designator_type.startswith('text/'):
+                # allow text/* as msg items can have empty type field
+                # also match text/* for text/plain, text/x-rst,
+                # text/markdown, text/html etc.
+                valid_binary_content_types.append("text/*")
+
+            # Octet-stream should be allowed for any content.
+            # client.py sets 'X-Content-Type-Options: nosniff'
+            # for file downloads (sendfile) via the html interface,
+            # so we should be able to set it in this code as well.
+            valid_binary_content_types.append("application/octet-stream")
+
         for part in accept_header:
             if accept_type:
                 # we accepted the best match, stop searching for
                 # lower quality matches.
                 break
+
+            # check for structured rest return types (json xml)
             if part[0] in self.__accepted_content_type:
                 accept_type = self.__accepted_content_type[part[0]]
                 # Version order:
@@ -2311,6 +2346,8 @@ def determine_output_format(self, uri):
                 # use default if version = None
                 try:
                     self.api_version = int(part[1]['version'])
+                    if self.api_version not in self.__supported_api_versions:
+                        raise ValueError
                 except KeyError:
                     self.api_version = None
                 except (ValueError, TypeError):
@@ -2323,17 +2360,45 @@ def determine_output_format(self, uri):
                     return (None, uri,
                            self.error_obj(406, msg))
 
+            if part[0] == "*/*":
+                if valid_binary_content_types:
+                    self.client.setHeader("X-Content-Type-Options", "nosniff")
+                    accept_type = valid_binary_content_types[0]
+                else:
+                    accept_type = "json"
+
+            # check type of binary_content
+            if part[0] in valid_binary_content_types:
+                self.client.setHeader("X-Content-Type-Options", "nosniff")
+                accept_type = part[0]
+            # handle text wildcard
+            if ((part[0] in 'text/*') and
+                "text/*" in valid_binary_content_types):
+                self.client.setHeader("X-Content-Type-Options", "nosniff")
+                # use best choice of mime type, try not to use
+                # text/* if there is a real text mime type/subtype.
+                accept_type = valid_binary_content_types[0]
+
         # accept_type will be empty only if there is an Accept header
         # with invalid values.
         if accept_type:
             return (accept_type, uri, None)
 
-        self.client.response_code = 400
+        if valid_binary_content_types:
+            return (None, uri,
+                    self.error_obj(
+                        406,
+                        _("Requested content type(s) '%s' not available.\n"
+                          "Acceptable mime types are: */*, %s") %
+                        (self.client.request.headers.get('Accept'),
+                         ", ".join(sorted(
+                             valid_binary_content_types)))))
+
         return (None, uri,
                 self.error_obj(
                     406,
                     _("Requested content type(s) '%s' not available.\n"
-                      "Acceptable mime types are: %s") %
+                      "Acceptable mime types are: */*, %s") %
                     (self.client.request.headers.get('Accept'),
                      ", ".join(sorted(
                          self.__accepted_content_type.keys())))))
@@ -2597,14 +2662,20 @@ def format_dispatch_output(self, accept_mime_type, output,
 
             output = '<?xml version="1.0" encoding="UTF-8" ?>\n' + \
                      b2s(dicttoxml(output, root=False))
+        elif accept_mime_type:
+            self.client.setHeader("Content-Type", accept_mime_type)
+            # do not send etag when getting binary_content. The ETag
+            # is for the item not the content of the item. So the ETag
+            # can change even though the content is the same. Since
+            # content is immutable by default, the client shouldn't
+            # need the etag for writing.
+            self.client.setHeader("ETag", None)
+            return output['data']['data']
         else:
-            # FIXME?? consider moving this earlier. We should
-            # error out before doing any work if we can't
-            # display acceptable output.
-            self.client.response_code = 406
-            output = ("Requested content type '%s' is not available.\n"
-                      "Acceptable types: %s" % (accept_mime_type,
-                      ", ".join(sorted(self.__accepted_content_type.keys()))))
+            self.client.response_code = 500
+            output = _("Internal error while formatting response.\n"
+                       "accept_mime_type is not defined. This should\n"
+                       "never happen\n")
 
         # Make output json end in a newline to
         # separate from following text in logs etc..
diff --git a/test/rest_common.py b/test/rest_common.py
index 35c2a9208..b3bf43985 100644
--- a/test/rest_common.py
+++ b/test/rest_common.py
@@ -7,6 +7,7 @@
 from datetime import datetime, timedelta
 from roundup.anypy.cgi_ import cgi
 from roundup.anypy.datetime_ import utcnow
+from roundup.date import Date
 from roundup.exceptions import UsageError
 from roundup.test.tx_Source_detector import init as tx_Source_init
 
@@ -102,6 +103,29 @@ def setUp(self):
 
         self.db.user.set('1', address="admin@admin.com")
         self.db.user.set('2', address="anon@admin.com")
+
+        # set up some more stuff for testing
+        self.db.msg.create(
+            author="1",
+            date=Date(),
+            summary="stuff",
+            content="abcdefghi\njklmnop",
+            type="text/markdown"
+        )
+
+        self.db.msg.create(
+            author="1",
+            date=Date(),
+            summary="stuff",
+            content="abcdefghi\njklmnop",
+        )
+
+        self.db.file.create(
+            name="afile",
+            content="PNG\x01abcdefghi\njklmnop",
+            type="image/png"
+        )
+
         self.db.commit()
         self.db.close()
         self.db = self.instance.open('joe')
@@ -1947,7 +1971,7 @@ def testdetermine_output_formatBadAccept(self):
         self.assertEqual(self.server.client.response_code, 400)
         self.assertEqual(output_type, None)
         self.assertEqual(uri, "/rest/data/issue")
-        self.assertIn('Unable to parse Accept Header. Invalid media type: Xyzzy I am not a mime. Acceptable types: */* application/json', error['error']['msg'])
+        self.assertIn('Unable to parse Accept Header. Invalid media type: Xyzzy I am not a mime. Acceptable types: */*, application/json', error['error']['msg'])
 
         # test 5 accept mimetype is ok, param is not
         headers={"accept": "*/*; foo",
@@ -1969,7 +1993,298 @@ def testdetermine_output_formatBadAccept(self):
         self.assertEqual(self.server.client.response_code, 400)
         self.assertEqual(output_type, None)
         self.assertEqual(uri, "/rest/data/issue")
-        self.assertIn('Unable to parse Accept Header. Invalid param: foo. Acceptable types: */* application/json', error['error']['msg'])
+        self.assertIn('Unable to parse Accept Header. Invalid param: foo. Acceptable types: */*, application/json', error['error']['msg'])
+
+        # test 6: test paths:
+        #
+        test_suite = [
+            (# use binary_content on a class that doesn't support it
+                {"path": "/rest/data/issue/1/binary_content",
+                 "accept": "",
+                 "response_code": "",
+                 "output_type": None,
+                 "uri": "/rest/data/issue/1/binary_content",
+                 "error": None
+                }),
+            (# use invalid class
+                {"path": "/rest/data/notissue/1/binary_content",
+                 "accept": "",
+                 "response_code": "",
+                 "output_type": None,
+                 "uri": "/rest/data/notissue/1/binary_content",
+                 "error": None
+                }),
+            (# use invalid id
+                {"path": "/rest/data/issue/99/binary_content",
+                 "accept": "",
+                 "response_code": "",
+                 "output_type": None,
+                 "uri": "/rest/data/issue/99/binary_content",
+                 "error": None
+                }),
+        ]
+             
+        for test in test_suite:
+            self.server.client.response_code = ""
+            env = { "CONTENT_TYPE": "application/json",
+                    "CONTENT_LENGTH": len(body),
+                    "REQUEST_METHOD": "GET"
+            }
+            self.server.client.env.update(env)
+            headers={"accept": test["accept"] or
+                     "application/zot; version=1; q=0.75, "
+                     "application/json; version=1; q=0.5",
+                     "content-type": env['CONTENT_TYPE'],
+                     "content-length": env['CONTENT_LENGTH'],
+            }
+
+            self.headers=headers
+            # we need to generate a FieldStorage the looks like
+            #  FieldStorage(None, None, 'string') rather than
+            #  FieldStorage(None, None, [])
+            body_file=BytesIO(body)  # FieldStorage needs a file
+            form = client.BinaryFieldStorage(
+                body_file,
+                headers=headers,
+                environ=env)
+            self.server.client.request.headers.get=self.get_header
+            (output_type, uri, error) = dof(test["path"])
+
+            self.assertEqual(self.server.client.response_code,
+                             test["response_code"])
+            self.assertEqual(output_type, test["output_type"])
+            self.assertEqual(uri, test["uri"])
+            self.assertEqual(error, test["error"])
+
+        # test 7: test paths:
+        #
+        test_suite = [
+            (# use wildcard accept on item and get back json output
+                {"path": "/rest/data/file/1",
+                 "accept": "*/*",
+                 "response_code": "",
+                 "output_type": "json",
+                 "uri": "/rest/data/file/1",
+                 "error": None,
+                 "has_nosniff": False,
+                }),
+            (# use wildcard accept and get back file's actual mime type
+                {"path": "/rest/data/file/1/binary_content",
+                 "accept": "*/*",
+                 "response_code": "",
+                 "output_type": "image/png",
+                 "uri": "/rest/data/file/1/binary_content",
+                 "error": None,
+                 "has_nosniff": True,
+
+                }),
+            (# use json accept and get back json
+                {"path": "/rest/data/file/1/binary_content",
+                 "accept": "application/json",
+                 "response_code": "",
+                 "output_type": "json",
+                 "uri": "/rest/data/file/1/binary_content",
+                 "error": None,
+                 "has_nosniff": False,
+                }),
+            (# use json accept with invalid number version and get back error
+                {"path": "/rest/data/file/1/binary_content",
+                 "accept": "application/json; q=0.5; version=22",
+                 "response_code": 406,
+                 "output_type": None,
+                 "uri": "/rest/data/file/1/binary_content",
+                 "error": {'error': {'status': 406, 'msg': 'Unrecognized api version: 22. See /rest without specifying api version for supported versions.'}},
+                 "has_nosniff": False,
+                }),
+            (# use json accept with invalid string version and get back error
+                {"path": "/rest/data/file/1/binary_content",
+                 "accept": "application/json; q=0.5; version=z",
+                 "response_code": 406,
+                 "output_type": None,
+                 "uri": "/rest/data/file/1/binary_content",
+                 "error": {'error': {'status': 406, 'msg': 'Unrecognized api version: z. See /rest without specifying api version for supported versions.'}},
+                 "has_nosniff": False,
+                }),
+            (# use octet-stream accept and get back octet-stream mime type
+                {"path": "/rest/data/file/1/binary_content",
+                 "accept": "application/octet-stream; q=0.9, */*; q=0.5",
+                 "response_code": "",
+                 "output_type": "application/octet-stream",
+                 "uri": "/rest/data/file/1/binary_content",
+                 "error": None,
+                 "has_nosniff": True,
+                }),
+            (# use image/png accept and get back image/png mime type
+                {"path": "/rest/data/file/1/binary_content",
+                 "accept": "application/octet-stream; q=0.9, image/png",
+                 "response_code": "",
+                 "output_type": "image/png",
+                 "uri": "/rest/data/file/1/binary_content",
+                 "error": None,
+                 "has_nosniff": True,
+                }),
+            (# use invalid accept and get back error
+                {"path": "/rest/data/file/1/binary_content",
+                 "accept": "image/svg+html",
+                 "response_code": 406,
+                 "output_type": None,
+                 "uri": "/rest/data/file/1/binary_content",
+                 "error": {'error': 
+                           {'status': 406, 'msg': "Requested content type(s) 'image/svg+html' not available.\nAcceptable mime types are: */*, application/octet-stream, image/png"}},
+                 "has_nosniff": False,
+                }),
+            (# use wildcard accept and get back msg's actual mime type
+                {"path": "/rest/data/msg/1/binary_content",
+                 "accept": "*/*",
+                 "response_code": "",
+                 "output_type": "text/markdown",
+                 "uri": "/rest/data/msg/1/binary_content",
+                 "error": None,
+                 "has_nosniff": True,
+                }),
+            (# use octet-stream accept and get back octet-stream mime type
+                {"path": "/rest/data/msg/1/binary_content",
+                 "accept": "application/octet-stream; q=0.9, */*; q=0.5",
+                 "response_code": "",
+                 "output_type": "application/octet-stream",
+                 "uri": "/rest/data/msg/1/binary_content",
+                 "error": None,
+                 "has_nosniff": True,
+                }),
+
+            (# use wildcard text accept and get back msg's actual mime type
+                {"path": "/rest/data/msg/1/binary_content",
+                 "accept": "text/*",
+                 "response_code": "",
+                 "output_type": "text/markdown",
+                 "uri": "/rest/data/msg/1/binary_content",
+                 "error": None,
+                 "has_nosniff": True,
+                }),
+            (# use wildcard text accept and get back file's actual mime type
+                {"path": "/rest/data/msg/1/binary_content",
+                 "accept": "text/markdown",
+                 "response_code": "",
+                 "output_type": "text/markdown",
+                 "uri": "/rest/data/msg/1/binary_content",
+                 "error": None,
+                 "has_nosniff": True,
+                }),
+            (# use text/plain accept and get back test/plain
+                {"path": "/rest/data/msg/1/binary_content",
+                 "accept": "text/plain",
+                 "response_code": 406,
+                 "output_type": None,
+                 "uri": "/rest/data/msg/1/binary_content",
+                 "error": {'error':
+                           {'status': 406, 'msg':
+                            "Requested content type(s) 'text/plain' not available.\nAcceptable mime types are: */*, application/octet-stream, text/*, text/markdown"}},
+                 "has_nosniff": False,
+                }),
+            (# use wildcard accept and get back default msg mime type
+                {"path": "/rest/data/msg/2/binary_content",
+                 "accept": "*/*",
+                 "response_code": "",
+                 "output_type": "text/*",
+                 "uri": "/rest/data/msg/2/binary_content",
+                 "error": None,
+                 "has_nosniff": True,
+                }),
+            (# use text/* and get back text/*
+                {"path": "/rest/data/msg/2/binary_content",
+                 "accept": "text/*",
+                 "response_code": "",
+                 "output_type": "text/*",
+                 "uri": "/rest/data/msg/2/binary_content",
+                 "error": None,
+                 "has_nosniff": True,
+                }),
+            (# use text/markdown and get back error
+                {"path": "/rest/data/msg/2/binary_content",
+                 "accept": "text/markdown",
+                 "response_code": 406,
+                 "output_type": None,
+                 "uri": "/rest/data/msg/2/binary_content",
+                 "error": {'error': 
+                           {'status': 406, 'msg':
+                            "Requested content type(s) 'text/markdown' not available.\nAcceptable mime types are: */*, application/octet-stream, text/*"}},
+                 "has_nosniff": False,
+                }),
+            (# use error accept and get back error
+                {"path": "/rest/data/msg/1/binary_content",
+                 "accept": "text/markdown, q=2",
+                 "response_code": 400,
+                 "output_type": None,
+                 "uri": "/rest/data/msg/1/binary_content",
+                 "error": {'error':
+                           {'status': 400, 'msg':
+                            'Unable to parse Accept Header. Invalid media type: q=2. Acceptable types: */*, application/json'}},
+                 "has_nosniff": False,
+                 }),
+            (# use text/* but override with extension of .json get back json
+                {"path": "/rest/data/msg/2/binary_content.json",
+                 "accept": "text/*",
+                 "response_code": "",
+                 "output_type": "json",
+                 "uri": "/rest/data/msg/2/binary_content",
+                 "error": None,
+                 "has_nosniff": False,
+                }),
+            (# use text/* but override with extension of .jon get back error
+                {"path": "/rest/data/msg/2/binary_content.jon",
+                 "accept": "text/*",
+                 "response_code": 406,
+                 "output_type": None,
+                 "uri": "/rest/data/msg/2/binary_content.jon",
+                 "error": {'error':
+                           {'status': 406, 'msg':
+                            "Content type 'jon' requested in URL is not available.\nAcceptable types: json\n"}},
+                 "has_nosniff": False,
+                }),
+        ]
+             
+        for test in test_suite:
+            print(test)
+            self.server.client.response_code = ""
+            self.server.client.additional_headers = {}
+            env = { "CONTENT_TYPE": "application/json",
+                    "CONTENT_LENGTH": len(body),
+                    "REQUEST_METHOD": "GET"
+            }
+            self.server.client.env.update(env)
+            headers={"accept": test["accept"] or
+                     "application/zot; version=1; q=0.75, "
+                     "application/json; version=1; q=0.5",
+                     "content-type": env['CONTENT_TYPE'],
+                     "content-length": env['CONTENT_LENGTH'],
+            }
+
+            self.headers=headers
+            # we need to generate a FieldStorage the looks like
+            #  FieldStorage(None, None, 'string') rather than
+            #  FieldStorage(None, None, [])
+            body_file=BytesIO(body)  # FieldStorage needs a file
+            form = client.BinaryFieldStorage(
+                body_file,
+                headers=headers,
+                environ=env)
+            self.server.client.request.headers.get=self.get_header
+            (output_type, uri, error) = dof(test["path"])
+
+            self.assertEqual(self.server.client.response_code,
+                             test["response_code"])
+            self.assertEqual(output_type, test["output_type"])
+            self.assertEqual(uri, test["uri"])
+            print(error)
+            self.assertEqual(error, test["error"])
+            if test["has_nosniff"]:
+                self.assertIn("X-Content-Type-Options", 
+                              self.server.client.additional_headers)
+                self.assertEqual("nosniff",
+                                 self.server.client.additional_headers['X-Content-Type-Options'])
+            else:
+                self.assertNotIn("X-Content-Type-Options", 
+                              self.server.client.additional_headers)
 
     def testDispatchBadAccept(self):
         # simulate: /rest/data/issue expect failure unknown accept settings
@@ -2086,7 +2401,7 @@ def testDispatchBadAccept(self):
         print(results)
         self.assertEqual(self.server.client.response_code, 400)
         json_dict = json.loads(b2s(results))
-        self.assertIn('Unable to parse Accept Header. Invalid media type: Xyzzy I am not a mime. Acceptable types: */* application/json', json_dict['error']['msg'])
+        self.assertIn('Unable to parse Accept Header. Invalid media type: Xyzzy I am not a mime. Acceptable types: */*, application/json', json_dict['error']['msg'])
 
         # test 5 accept mimetype is ok, param is not
         headers={"accept": "*/*; foo",
@@ -2110,7 +2425,7 @@ def testDispatchBadAccept(self):
         print(results)
         self.assertEqual(self.server.client.response_code, 400)
         json_dict = json.loads(b2s(results))
-        self.assertIn('Unable to parse Accept Header. Invalid param: foo. Acceptable types: */* application/json', json_dict['error']['msg'])
+        self.assertIn('Unable to parse Accept Header. Invalid param: foo. Acceptable types: */*, application/json', json_dict['error']['msg'])
 
     def testStatsGen(self):
         # check stats being returned by put and get ops
@@ -3354,8 +3669,7 @@ def testPostFile(self):
         results = self.server.get_element('file', fileid, self.empty_form)
         results = results['data']
         self.assertEqual(self.dummy_client.response_code, 200)
-        self.assertEqual(results['attributes']['content'],
-            {'link': 'http://tracker.example/cgi-bin/roundup.cgi/bugs/file1/'})
+        self.assertIn("link", results['attributes']['content'])
 
         # File content is only shown with verbose=3
         form = cgi.FieldStorage()

From 2dccdf223c4d6b9216141cfed5f200cac4a0f833 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 8 Dec 2024 18:03:07 -0500
Subject: [PATCH 042/398] chore: update manifest sha256sum to fix issue with
 python version.

---
 scripts/Docker/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/Docker/Dockerfile b/scripts/Docker/Dockerfile
index 83c162880..817850f62 100644
--- a/scripts/Docker/Dockerfile
+++ b/scripts/Docker/Dockerfile
@@ -23,7 +23,7 @@ ARG source=local
 
 # parameterize the sha256 sum to pin version of python:3-alpine
 # Must use the same version in both build stages.
-ARG SHA256=7130f75b1bb16c7c5d802782131b4024fe3d7a87ce7d936e8948c2d2e0180bc4
+ARG SHA256=06ec926ba48a761e10e429c9091000863f7b91ef42296d10303c5da6c01e25ad
 
 
 # Set to any non-empy value to enable shell debugging for troubleshooting

From ba936af5c3b3a3fca8ea9341c6e43272a2ae9e6c Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 8 Dec 2024 18:26:09 -0500
Subject: [PATCH 043/398] feat: add test download via /binary_content via
 dispatch - issue2551068

CI showed I missed a code path. Dispatch and format_dispatch_output
did not have a test case though the /binary_content code path.

Added this test and verifies the data, content-type, lack of ETag
header, presence of header to prevent browser sniffing.
---
 test/rest_common.py | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/test/rest_common.py b/test/rest_common.py
index b3bf43985..522fddda1 100644
--- a/test/rest_common.py
+++ b/test/rest_common.py
@@ -3052,6 +3052,28 @@ def testDispatch(self):
 
         del(self.headers)
 
+        # TEST #11
+        # GET: test that /binary_content can be downloaded
+        form = cgi.FieldStorage()
+
+        self.server.client.env.update({'REQUEST_METHOD': 'GET'})
+
+        headers={"accept": "*/*" }
+        self.headers=headers
+        self.server.client.request.headers.get=self.get_header
+        results = self.server.dispatch('GET',
+                            "/rest/data/file/1/binary_content", form)
+
+        self.assertEqual(results, b'PNG\x01abcdefghi\njklmnop')
+        self.assertEqual(self.server.client.additional_headers['Content-Type'],
+                         'image/png')
+        self.assertNotIn("ETag", self.server.client.additional_headers)
+        self.assertEqual(
+            self.server.client.additional_headers["X-Content-Type-Options"],
+            "nosniff")
+
+        print("11: " + b2s(results))
+
     def testAcceptHeaderParsing(self):
         self.server.client.env['REQUEST_METHOD'] = 'GET'
 

From 022430a78a805401a6b075c5780df6e72e4c67a0 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 8 Dec 2024 18:57:02 -0500
Subject: [PATCH 044/398] try loading psycopg2 for python 2

Looks like psycopg2 pip install was removed.
No obvious reason for its deletion in the logs.

no-github-ci as this affects travis only.
---
 .travis.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.travis.yml b/.travis.yml
index 018e399bb..a51097b6a 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -132,6 +132,7 @@ install:
   - pip install redis
   - pip install pytz whoosh pyjwt requests
   - pip install jinja2
+  - pip install psycopg2
   # note pytest-env is not needed for redis password as there is
   # no password on CI's redis.
   - pip install pytest-cov

From 0c94f9e9e44e63a67590677d6fdbc43d3135636e Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 8 Dec 2024 21:36:29 -0500
Subject: [PATCH 045/398] chore: update to python 3.13. Also use index file
 shasum.

---
 scripts/Docker/Dockerfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/scripts/Docker/Dockerfile b/scripts/Docker/Dockerfile
index 817850f62..22650fdff 100644
--- a/scripts/Docker/Dockerfile
+++ b/scripts/Docker/Dockerfile
@@ -23,7 +23,7 @@ ARG source=local
 
 # parameterize the sha256 sum to pin version of python:3-alpine
 # Must use the same version in both build stages.
-ARG SHA256=06ec926ba48a761e10e429c9091000863f7b91ef42296d10303c5da6c01e25ad
+ARG SHA256=8287ca207e905649e9f399b5f91a119e5e9051d8cd110d5f8c3b4bd9458ebd1d
 
 
 # Set to any non-empy value to enable shell debugging for troubleshooting
@@ -35,7 +35,7 @@ ARG appdir=/usr/src/app
 # Python version as a.b Used as path component for 
 # installation directory and COPY from install dir
 # in second build stage.
-ARG pythonversion=3.12
+ARG pythonversion=3.13
 
 #FROM python:3-alpine via SHA256 sum
 FROM python@sha256:$SHA256 AS build 

From b80e2b20c78f484dde63b86b9647789309f32be9 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Tue, 10 Dec 2024 16:06:13 -0500
Subject: [PATCH 046/398] fix(web): issue2551356. Add etag header for
 not-modified (304) request.

When a 304 is returned to a conditional request for a static file,
print an ETag for the response.

ETag was always sent with a 200 response.

This also adds initial support for if-none-match conditional requests
for static files.

Changes:

Refactors the if-modified-since code out to a method.

It moves a file stat call from serve_static_file to _serve_file
so that an etag can be generated by both serve_static_file and
serve_file which call _serve_file.

Tests added. This does not test the codepath where serve_file pulls
content from the database rather than from a local file on disk.

Test mocking _serve_file changed to account for 5th argument to serve_file

BREAKING CHANGE:

function signature for client.py-Client::_serve_file() now has 5 not 4
parameters (added etag param). Since this is a "hidden" method I am
not too worried about it.
---
 CHANGES.txt           |   3 +
 roundup/cgi/client.py |  95 +++++++++++++++++++++++--------
 test/test_cgi.py      | 126 ++++++++++++++++++++++++++++++++++--------
 3 files changed, 178 insertions(+), 46 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index 1cdd1a241..c846609bf 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -36,6 +36,9 @@ Fixed:
 - issue2551289 - Invalid REST Accept header with post/put performs
   change before returning 406. Error before making any changes to the
   db if we can't respond with requested format. (John Rouillard)
+- issue2551356 - Add etag header when If-Modified-Since GET request
+  returns not-modified (304). Breaking change to function signature
+  for client.py-Client::_serve_file(). (John Rouillard)
 
 Features:
 
diff --git a/roundup/cgi/client.py b/roundup/cgi/client.py
index a638de6a1..c1b6a1794 100644
--- a/roundup/cgi/client.py
+++ b/roundup/cgi/client.py
@@ -1949,7 +1949,7 @@ def serve_file(self, designator, dre=dre):
 
         lmt = klass.get(nodeid, 'activity').timestamp()
 
-        self._serve_file(lmt, mime_type, content, filename)
+        self._serve_file(lmt, None, mime_type, content, filename)
 
     def serve_static_file(self, file):
         """ Serve up the file named from the templates dir
@@ -1989,9 +1989,6 @@ def serve_static_file(self, file):
         if filename is None:  # we didn't find a filename
             raise NotFound(file)
 
-        # last-modified time
-        lmt = os.stat(filename)[stat.ST_MTIME]
-
         # detemine meta-type
         file = str(file)
         mime_type = mimetypes.guess_type(file)[0]
@@ -2009,28 +2006,59 @@ def serve_static_file(self, file):
             self.additional_headers['Cache-Control'] = \
                             self.Cache_Control[mime_type]
 
-        self._serve_file(lmt, mime_type, '', filename)
+        self._serve_file(None, None, mime_type, '', filename)
 
-    def _serve_file(self, lmt, mime_type, content=None, filename=None):
-        """ guts of serve_file() and serve_static_file()
-        """
+    def _serve_file(self, lmt, etag, mime_type, content=None, filename=None):
+        """guts of serve_file() and serve_static_file()
 
-        # spit out headers
-        self.additional_headers['Last-Modified'] = email.utils.formatdate(lmt,
-	 usegmt=True)
+            if lmt or etag are None, derive them from file filename.
 
-        ims = None
-        # see if there's an if-modified-since...
-        #    used if this is run behind a non-caching http proxy
-        if hasattr(self.request, 'headers'):
-            ims = self.request.headers.get('if-modified-since')
-        elif 'HTTP_IF_MODIFIED_SINCE' in self.env:
-            # cgi will put the header in the env var
-            ims = self.env['HTTP_IF_MODIFIED_SINCE']
-        if ims:
-            ims = email.utils.parsedate(ims)[:6]
-            lmtt = time.gmtime(lmt)[:6]
-            if lmtt <= ims:
+            Handles if-modified-since and if-none-match etag
+            conditional gets.
+
+            It produces an raw etag header without encoding suffix.
+            But it adds Accept-Encoding to the vary header.
+
+        """
+        if filename:
+            stat_info = os.stat(filename)
+
+            if lmt is None:
+                # last-modified time
+                lmt = stat_info[stat.ST_MTIME]
+            if etag is None:
+                # FIXME: maybe etag should depend on encoding.
+                # it is an apache compatible etag without encoding.
+                etag = '"%x-%x-%x"' % (stat_info[stat.ST_INO],
+                                       stat_info[stat.ST_SIZE],
+                                       stat_info[stat.ST_MTIME])
+
+            # spit out headers for conditional request
+            self.setHeader("ETag", etag)
+            self.additional_headers['Last-Modified'] = \
+                email.utils.formatdate(lmt, usegmt=True)
+
+            inm = None
+            # ETag is a more strict check than modified date. Use etag
+            # check if available. Skip testing modified data.
+            if hasattr(self.request, 'headers'):
+                inm = self.request.headers.get('if-none-match')
+            elif 'HTTP_IF_NONE_MATCH' in self.env:
+                # maybe the cgi will put the header in the env var
+                inm = self.env['HTTP_ETAG']
+            if inm and etag == inm:
+                # because we can compress, always set Accept-Encoding
+                # value. Otherwise caches can serve up the wrong info
+                # if their cached copy has no compression.
+                self.setVary("Accept-Encoding")
+                '''
+                to solve issue2551356 I may need to determine
+                the content encoding.
+                if (self.determine_content_encoding()):
+                '''
+                raise NotModified
+
+            if self.if_not_modified_since(lmt):
                 # because we can compress, always set Accept-Encoding
                 # value. Otherwise caches can serve up the wrong info
                 # if their cached copy has no compression.
@@ -2051,6 +2079,27 @@ def _serve_file(self, lmt, mime_type, content=None, filename=None):
             self.additional_headers['Content-Length'] = str(len(content))
             self.write(content)
 
+    def if_not_modified_since(self, lmt):
+        ims = None
+        # see if there's an if-modified-since...
+        if hasattr(self.request, 'headers'):
+            ims = self.request.headers.get('if-modified-since')
+        elif 'HTTP_IF_MODIFIED_SINCE' in self.env:
+            # cgi will put the header in the env var
+            ims = self.env['HTTP_IF_MODIFIED_SINCE']
+
+        if ims:
+            datestamp = email.utils.parsedate(ims)
+            if datestamp is not None:
+                ims = datestamp[:6]
+            else:
+                # set to beginning of time so whole file will be sent
+                ims = (0, 0, 0, 0, 0, 0)
+            lmtt = time.gmtime(lmt)[:6]
+            return lmtt <= ims
+
+        return False
+
     def send_error_to_admin(self, subject, html, txt):
         """Send traceback information to admin via email.
            We send both, the formatted html (with more information) and
diff --git a/test/test_cgi.py b/test/test_cgi.py
index 430c53de1..e99bc59a5 100644
--- a/test/test_cgi.py
+++ b/test/test_cgi.py
@@ -18,7 +18,7 @@
 
 from roundup.anypy.cgi_ import cgi
 from roundup.cgi import client, actions, exceptions
-from roundup.cgi.exceptions import FormError, NotFound, Redirect
+from roundup.cgi.exceptions import FormError, NotFound, Redirect, NotModified
 from roundup.exceptions import UsageError, Reject
 from roundup.cgi.templating import HTMLItem, HTMLRequest, NoTemplate
 from roundup.cgi.templating import HTMLProperty, _HTMLItem, anti_csrf_nonce
@@ -1942,6 +1942,7 @@ def _make_client(self, form, classname='user', nodeid='1',
         if nodeid is not None:
             cl.nodeid = nodeid
         cl.db = self.db
+        cl.request = MockNull()
         cl.db.Otk =  cl.db.getOTKManager()
         #cl.db.Otk = MockNull()
         #cl.db.Otk.data = {}
@@ -2382,6 +2383,83 @@ def testRegisterActionUnusedUserCheck(self):
         if os.path.exists(SENDMAILDEBUG):
             os.remove(SENDMAILDEBUG)
 
+    def testserve_static_files_cache_headers(self):
+        """Note for headers the real headers class is case
+           insensitive.
+        """
+        # make a client instance
+        cl = self._make_client({})
+        # Make local copy in cl to not modify value in class
+        cl.Cache_Control = copy.copy (cl.Cache_Control)
+
+        # TEMPLATES dir is searched by default. So this file exists.
+        # Check the returned values.
+        cl.serve_static_file("style.css")
+
+        # gather the conditional request headers from the 200 response
+        inm =  cl.additional_headers['ETag']
+        ims =  cl.additional_headers['Last-Modified']
+
+
+        # loop over all header value possibilities that will
+        # result in not modified.
+        for headers in [
+                {'if-none-match' : inm},
+                {'if-modified-since' : ims},
+                {'if-none-match' : inm, 'if-modified-since' : ims },
+                {'if-none-match' : inm, 'if-modified-since' : "fake" },
+                {'if-none-match' : "fake", 'if-modified-since' : ims },
+        ]:
+            print(headers)
+
+            # Request same file with if-modified-since header
+            # expect NotModified with same ETag and Last-Modified headers.
+            cl.request.headers = headers
+            cl.response_code = None
+            cl.additional_headers = {}
+
+            with self.assertRaises(NotModified) as cm:
+                cl.serve_static_file("style.css")
+
+            self.assertEqual(cm.exception.args, ())
+
+            self.assertEqual(cl.response_code, None)
+            self.assertEqual(cl.additional_headers['ETag'], inm)
+            self.assertEqual(cl.additional_headers['Last-Modified'], ims)
+
+
+        ## run two cases that should not return NotModified
+        for headers in [
+                {},
+                {'if-none-match' : "fake", 'if-modified-since' : "fake" },
+        ]:
+            cl.request.headers = headers
+            cl.response_code = None
+            cl.additional_headers = {}
+
+            cl.serve_static_file("style.css")
+
+            self.assertEqual(cl.response_code, None)
+            self.assertEqual(cl.additional_headers['ETag'], inm)
+            self.assertEqual(cl.additional_headers['Last-Modified'], ims)
+
+        ## test pure cgi case
+        # headers attribute does not exist
+        cl.request = None
+        cl.response_code = None
+        cl.additional_headers = {}
+
+        cl.env["HTTP_IF_MODIFIED_SINCE"] = ims
+
+        with self.assertRaises(NotModified) as cm:
+            cl.serve_static_file("style.css")
+
+        self.assertEqual(cm.exception.args, ())
+
+        self.assertEqual(cl.response_code, None)
+        self.assertEqual(cl.additional_headers['ETag'], inm)
+        self.assertEqual(cl.additional_headers['Last-Modified'], ims)
+
     def testserve_static_files(self):
         # make a client instance
         cl = self._make_client({})
@@ -2390,8 +2468,8 @@ def testserve_static_files(self):
 
         # hijack _serve_file so I can see what is found
         output = []
-        def my_serve_file(a, b, c, d):
-            output.append((a,b,c,d))
+        def my_serve_file(a, b, c, d, e):
+            output.append((a,b,c,d,e))
         cl._serve_file = my_serve_file
 
         # check case where file is not found.
@@ -2401,8 +2479,9 @@ def my_serve_file(a, b, c, d):
         # TEMPLATES dir is searched by default. So this file exists.
         # Check the returned values.
         cl.serve_static_file("issue.index.html")
-        self.assertEqual(output[0][1], "text/html")
-        self.assertEqual(output[0][3],
+        print(output)
+        self.assertEqual(output[0][2], "text/html")
+        self.assertEqual(output[0][4],
                          normpath('_test_cgi_form/html/issue.index.html'))
         del output[0] # reset output buffer
 
@@ -2415,8 +2494,8 @@ def my_serve_file(a, b, c, d):
         # explicitly allow html directory
         cl.instance.config['STATIC_FILES'] = 'html -'
         cl.serve_static_file("issue.index.html")
-        self.assertEqual(output[0][1], "text/html")
-        self.assertEqual(output[0][3],
+        self.assertEqual(output[0][2], "text/html")
+        self.assertEqual(output[0][4],
                          normpath('_test_cgi_form/html/issue.index.html'))
         del output[0] # reset output buffer
 
@@ -2425,15 +2504,15 @@ def my_serve_file(a, b, c, d):
 
         # find file in first directory
         cl.serve_static_file("messagesummary.py")
-        self.assertEqual(output[0][1], "text/x-python")
-        self.assertEqual(output[0][3],
+        self.assertEqual(output[0][2], "text/x-python")
+        self.assertEqual(output[0][4],
                          normpath( "_test_cgi_form/detectors/messagesummary.py"))
         del output[0] # reset output buffer
 
         # find file in second directory
         cl.serve_static_file("README.txt")
-        self.assertEqual(output[0][1], "text/plain")
-        self.assertEqual(output[0][3],
+        self.assertEqual(output[0][2], "text/plain")
+        self.assertEqual(output[0][4],
                          normpath("_test_cgi_form/extensions/README.txt"))
         del output[0] # reset output buffer
 
@@ -2448,16 +2527,16 @@ def my_serve_file(a, b, c, d):
         f = open('_test_cgi_form/detectors/README.txt', 'a').close()
         # find file now in first directory
         cl.serve_static_file("README.txt")
-        self.assertEqual(output[0][1], "text/plain")
-        self.assertEqual(output[0][3],
+        self.assertEqual(output[0][2], "text/plain")
+        self.assertEqual(output[0][4],
                          normpath("_test_cgi_form/detectors/README.txt"))
         del output[0] # reset output buffer
 
         cl.instance.config['STATIC_FILES'] = ' detectors extensions '
         # make sure lack of trailing - allows searching TEMPLATES
         cl.serve_static_file("issue.index.html")
-        self.assertEqual(output[0][1], "text/html")
-        self.assertEqual(output[0][3],
+        self.assertEqual(output[0][2], "text/html")
+        self.assertEqual(output[0][4],
                          normpath("_test_cgi_form/html/issue.index.html"))
         del output[0] # reset output buffer
 
@@ -2465,8 +2544,8 @@ def my_serve_file(a, b, c, d):
         cl.instance.config['STATIC_FILES'] = 'detectors'
         # find file now in first directory
         cl.serve_static_file("messagesummary.py")
-        self.assertEqual(output[0][1], "text/x-python")
-        self.assertEqual(output[0][3],
+        self.assertEqual(output[0][2], "text/x-python")
+        self.assertEqual(output[0][4],
                          normpath("_test_cgi_form/detectors/messagesummary.py"))
         del output[0] # reset output buffer
 
@@ -2475,8 +2554,8 @@ def my_serve_file(a, b, c, d):
         f = open('_test_cgi_form/detectors/css/README.css', 'a').close()
         # use subdir in filename
         cl.serve_static_file("css/README.css")
-        self.assertEqual(output[0][1], "text/css")
-        self.assertEqual(output[0][3],
+        self.assertEqual(output[0][2], "text/css")
+        self.assertEqual(output[0][4],
                          normpath("_test_cgi_form/detectors/css/README.css"))
         del output[0] # reset output buffer
         
@@ -2486,18 +2565,19 @@ def my_serve_file(a, b, c, d):
         os.mkdir('_test_cgi_form/html/css')
         f = open('_test_cgi_form/html/css/README1.css', 'a').close()
         cl.serve_static_file("README1.css")
-        self.assertEqual(output[0][1], "text/css")
-        self.assertEqual(output[0][3],
+        self.assertEqual(output[0][2], "text/css")
+        self.assertEqual(output[0][4],
                          normpath("_test_cgi_form/html/css/README1.css"))
         self.assertTrue( "Cache-Control" in cl.additional_headers )
         self.assertEqual( cl.additional_headers,
                           {'Cache-Control': 'public, max-age=3600'} )
+        print(cl.additional_headers)
         del output[0] # reset output buffer
 
         cl.Cache_Control['README1.css'] = 'public, max-age=60'
         cl.serve_static_file("README1.css")
-        self.assertEqual(output[0][1], "text/css")
-        self.assertEqual(output[0][3],
+        self.assertEqual(output[0][2], "text/css")
+        self.assertEqual(output[0][4],
                          normpath("_test_cgi_form/html/css/README1.css"))
         self.assertTrue( "Cache-Control" in cl.additional_headers )
         self.assertEqual( cl.additional_headers,

From 6048da488344cc5076e400aea08ffd22da02b2a6 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Tue, 10 Dec 2024 17:38:57 -0500
Subject: [PATCH 047/398] fix(web): issue2551356. Add etag header ... fix env
 variable name

Changed HTTP_ETAG to HTTP_IF_NONE_MATCH.
---
 roundup/cgi/client.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roundup/cgi/client.py b/roundup/cgi/client.py
index c1b6a1794..a7e5dc966 100644
--- a/roundup/cgi/client.py
+++ b/roundup/cgi/client.py
@@ -2045,7 +2045,7 @@ def _serve_file(self, lmt, etag, mime_type, content=None, filename=None):
                 inm = self.request.headers.get('if-none-match')
             elif 'HTTP_IF_NONE_MATCH' in self.env:
                 # maybe the cgi will put the header in the env var
-                inm = self.env['HTTP_ETAG']
+                inm = self.env['HTTP_IF_NONE_MATCH']
             if inm and etag == inm:
                 # because we can compress, always set Accept-Encoding
                 # value. Otherwise caches can serve up the wrong info

From 53884a0ac45a2a54787ac8808f0216c076fd77bc Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 11 Dec 2024 11:36:16 -0500
Subject: [PATCH 048/398] chore(ruff): new name for input variable which
 doesn't shadow builtin

---
 roundup/cgi/client.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/roundup/cgi/client.py b/roundup/cgi/client.py
index a7e5dc966..9d7eb9146 100644
--- a/roundup/cgi/client.py
+++ b/roundup/cgi/client.py
@@ -597,7 +597,7 @@ def handle_xmlrpc(self):
         # Pull the raw XML out of the form.  The "value" attribute
         # will be the raw content of the POST request.
         assert self.form.file
-        input = self.form.value
+        input_data = self.form.value
         # So that the rest of Roundup can query the form in the
         # usual way, we create an empty list of fields.
         self.form.list = []
@@ -660,7 +660,7 @@ def handle_xmlrpc(self):
                                                self.instance.actions,
                                                self.translator,
                                                allow_none=True)
-            output = handler.dispatch(input)
+            output = handler.dispatch(input_data)
 
         self.setHeader("Content-Type", "text/xml")
         self.setHeader("Content-Length", str(len(output)))

From 03e4cf5cb2b7bd0002e5dd692d819b8e2e317262 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 11 Dec 2024 13:04:34 -0500
Subject: [PATCH 049/398] chore(ruff): rename input and id parms/vars - don't
 shadow builtin

Changed input parm to input_payload and id param to node_id for etag context.
Changed var/param id to item_id. Change var id to working_id.

Trying to clear a lot of ruff warnings as client.py and rest.py will
be getting some work done on them and I want to reduce erros so I can
see errors in newer code more easily.
---
 roundup/rest.py | 189 ++++++++++++++++++++++++------------------------
 1 file changed, 96 insertions(+), 93 deletions(-)

diff --git a/roundup/rest.py b/roundup/rest.py
index c7a2ea53c..31bc386b3 100644
--- a/roundup/rest.py
+++ b/roundup/rest.py
@@ -173,7 +173,7 @@ def wrapper(f):
     return wrapper
 
 
-def calculate_etag(node, key, classname="Missing", id="0",
+def calculate_etag(node, key, classname="Missing", node_id="0",
                    repr_format="json"):
     '''given a hyperdb node generate a hashed representation of it to be
     used as an etag.
@@ -194,19 +194,19 @@ def calculate_etag(node, key, classname="Missing", id="0",
     Note that repr() is chosen for the node rather than str() since
     repr is meant to be an unambiguous representation.
 
-    classname and id are used for logging only.
+    classname and node_id are used for logging only.
     '''
 
     items = node.items(protected=True)  # include every item
     etag = hmac.new(bs2b(key), bs2b(repr_format +
                                     repr(sorted(items))), md5).hexdigest()
-    logger.debug("object=%s%s; tag=%s; repr=%s", classname, id,
+    logger.debug("object=%s%s; tag=%s; repr=%s", classname, node_id,
                  etag, repr(node.items(protected=True)))
     # Quotes are part of ETag spec, normal headers don't have quotes
     return '"%s"' % etag
 
 
-def check_etag(node, key, etags, classname="Missing", id="0",
+def check_etag(node, key, etags, classname="Missing", node_id="0",
                repr_format="json"):
     '''Take a list of etags and compare to the etag for the given node.
 
@@ -218,7 +218,7 @@ def check_etag(node, key, etags, classname="Missing", id="0",
     '''
     have_etag_match = False
 
-    node_etag = calculate_etag(node, key, classname, id,
+    node_etag = calculate_etag(node, key, classname, node_id,
                                repr_format=repr_format)
 
     for etag in etags:
@@ -245,11 +245,13 @@ def check_etag(node, key, etags, classname="Missing", id="0",
         return False
 
 
-def obtain_etags(headers, input):
-    '''Get ETags value from headers or payload data'''
+def obtain_etags(headers, input_payload):
+    '''Get ETags value from headers or payload data
+       Only supports one etag value not list.
+    '''
     etags = []
-    if '@etag' in input:
-        etags.append(input['@etag'].value)
+    if '@etag' in input_payload:
+        etags.append(input_payload['@etag'].value)
     etags.append(headers.get("If-Match", None))
     return etags
 
@@ -390,8 +392,8 @@ def decorator(func):
         return decorator
 
     @classmethod
-    def execute(cls, instance, path, method, input):
-        # format the input, note that we may not lowercase the path
+    def execute(cls, instance, path, method, input_payload):
+        # format the input_payload, note that we may not lowercase the path
         # here, URL parameters are case-sensitive
         path = path.strip('/')
         if path == 'rest':
@@ -422,7 +424,7 @@ def execute(cls, instance, path, method, input):
 
                 # zip the varlist into a dictionary, and pass it to the caller
                 args = dict(zip(list_vars, match_obj.groups()))
-                args['input'] = input
+                args['input'] = input_payload
                 return func(instance, **args)
         raise NotFound('Nothing matches the given URI')
 
@@ -668,13 +670,14 @@ def patch_data(self, op, old_val, new_val):
 
         return result
 
-    def raise_if_no_etag(self, class_name, item_id, input, repr_format="json"):
+    def raise_if_no_etag(self, class_name, item_id, input_payload,
+                         repr_format="json"):
         class_obj = self.db.getclass(class_name)
         if not check_etag(class_obj.getnode(item_id),
                           self.db.config.WEB_SECRET_KEY,
-                          obtain_etags(self.client.request.headers, input),
-                          class_name,
-                          item_id, repr_format=repr_format):
+                          obtain_etags(self.client.request.headers,
+                                       input_payload), class_name, item_id,
+                          repr_format=repr_format):
             raise PreconditionFailed(
                 "If-Match is missing or does not match."
                 " Retrieve asset and retry modification if valid.")
@@ -699,20 +702,20 @@ def format_item(self, node, item_id, props=None, verbose=1):
             # pn = propname
             for pn in sorted(props):
                 ok = False
-                id = item_id
+                working_id = item_id
                 nd = node
                 cn = class_name
                 for p in pn.split('.'):
                     if not self.db.security.hasPermission(
-                            'View', uid, cn, p, id
+                            'View', uid, cn, p, working_id
                     ):
                         break
                     cl = self.db.getclass(cn)
-                    nd = cl.getnode(id)
-                    id = v = getattr(nd, p)
+                    nd = cl.getnode(working_id)
+                    working_id = v = getattr(nd, p)
                     # Handle transitive properties where something on
                     # the road is None (empty Link property)
-                    if id is None:
+                    if working_id is None:
                         prop = None
                         ok = True
                         break
@@ -728,11 +731,11 @@ def format_item(self, node, item_id, props=None, verbose=1):
                     if verbose and v:
                         if isinstance(v, type([])):
                             r = []
-                            for id in v:
-                                d = dict(id=id, link=cp + id)
+                            for working_id in v:
+                                d = dict(id=working_id, link=cp + working_id)
                                 if verbose > 1:
                                     label = linkcls.labelprop()
-                                    d[label] = linkcls.get(id, label)
+                                    d[label] = linkcls.get(working_id, label)
                                 r.append(d)
                             result[pn] = r
                         else:
@@ -768,7 +771,7 @@ def format_item(self, node, item_id, props=None, verbose=1):
 
     @Routing.route("/data/<:class_name>", 'GET')
     @_data_decorator
-    def get_collection(self, class_name, input):
+    def get_collection(self, class_name, input_payload):
         """GET resource from class URI.
 
         This function returns only items have View permission
@@ -776,7 +779,7 @@ def get_collection(self, class_name, input):
 
         Args:
             class_name (string): class name of the resource (Ex: issue, msg)
-            input (list): the submitted form of the user
+            input_payload (list): the submitted form of the user
 
         Returns:
             int: http status code 200 (OK)
@@ -806,7 +809,7 @@ def get_collection(self, class_name, input):
         display_props = set()
         sort = []
         group = []
-        for form_field in input.value:
+        for form_field in input_payload.value:
             key = form_field.name
             value = form_field.value
             if key.startswith("@page_"):  # serve the paging purpose
@@ -1021,7 +1024,7 @@ def get_collection(self, class_name, input):
                     'uri': "%s/%s?@page_index=%s&" % (self.data_path,
                                                       class_name, index) +
                            '&'.join(["%s=%s" % (field.name, field.value)
-                                     for field in input.value
+                                     for field in input_payload.value
                                      if field.name != "@page_index"])})
 
         result['@total_size'] = total_len
@@ -1031,7 +1034,7 @@ def get_collection(self, class_name, input):
 
     @Routing.route("/data/user/roles", 'GET')
     @_data_decorator
-    def get_roles(self, input):
+    def get_roles(self, input_payload):
         """Return all defined roles for users with Admin role.
            The User class property roles is a string but simulate
            it as a MultiLink to an actual Roles class.
@@ -1051,7 +1054,7 @@ def get_roles(self, input):
 
     @Routing.route("/data/<:class_name>/<:item_id>", 'GET')
     @_data_decorator
-    def get_element(self, class_name, item_id, input):
+    def get_element(self, class_name, item_id, input_payload):
         """GET resource from object URI.
 
         This function returns only properties have View permission
@@ -1062,7 +1065,7 @@ def get_element(self, class_name, item_id, input):
             item_id (string): id of the resource (Ex: 12, 15)
                 or (if the class has a key property) this can also be
                 the key name, e.g. class_name = status, item_id = 'open'
-            input (list): the submitted form of the user
+            input_payload (list): the submitted form of the user
 
         Returns:
             int: http status code 200 (OK)
@@ -1112,7 +1115,7 @@ def get_element(self, class_name, item_id, input):
         props = None
         protected = False
         verbose = 1
-        for form_field in input.value:
+        for form_field in input_payload.value:
             key = form_field.name
             value = form_field.value
             if key == "@fields" or key == "@attrs":
@@ -1153,7 +1156,7 @@ def get_element(self, class_name, item_id, input):
 
     @Routing.route("/data/<:class_name>/<:item_id>/<:attr_name>", 'GET')
     @_data_decorator
-    def get_attribute(self, class_name, item_id, attr_name, input):
+    def get_attribute(self, class_name, item_id, attr_name, input_payload):
         """GET resource from attribute URI.
 
         This function returns only attribute has View permission
@@ -1163,7 +1166,7 @@ def get_attribute(self, class_name, item_id, attr_name, input):
             class_name (string): class name of the resource (Ex: issue, msg)
             item_id (string): id of the resource (Ex: 12, 15)
             attr_name (string): attribute of the resource (Ex: title, nosy)
-            input (list): the submitted form of the user
+            input_payload (list): the submitted form of the user
 
         Returns:
             int: http status code 200 (OK)
@@ -1205,7 +1208,7 @@ def get_attribute(self, class_name, item_id, attr_name, input):
 
     @Routing.route("/data/<:class_name>", 'POST')
     @_data_decorator
-    def post_collection(self, class_name, input):
+    def post_collection(self, class_name, input_payload):
         """POST a new object to a class
 
         If the item is successfully created, the "Location" header will also
@@ -1213,7 +1216,7 @@ def post_collection(self, class_name, input):
 
         Args:
             class_name (string): class name of the resource (Ex: issue, msg)
-            input (list): the submitted form of the user
+            input_payload (list): the submitted form of the user
 
         Returns:
             int: http status code 201 (Created)
@@ -1221,29 +1224,29 @@ def post_collection(self, class_name, input):
                 id: id of the object
                 link: path to the object
         """
-        return self.post_collection_inner(class_name, input)
+        return self.post_collection_inner(class_name, input_payload)
 
     @Routing.route("/data/<:class_name>/@poe", 'POST')
     @_data_decorator
-    def get_post_once_exactly(self, class_name, input):
+    def get_post_once_exactly(self, class_name, input_payload):
         """Get the Post Once Exactly token to create a new instance of class
            See https://tools.ietf.org/html/draft-nottingham-http-poe-00"""
         otks = self.db.Otk
         poe_key = otks.getUniqueKey()
 
         try:
-            lifetime = int(input['lifetime'].value)
+            lifetime = int(input_payload['lifetime'].value)
         except KeyError:
             lifetime = 30 * 60  # 30 minutes
         except ValueError:
-            raise UsageError("Value 'lifetime' must be an integer specify lifetime in seconds. Got %s." % input['lifetime'].value)
+            raise UsageError("Value 'lifetime' must be an integer specify lifetime in seconds. Got %s." % input_payload['lifetime'].value)
 
         if lifetime > 3600 or lifetime < 1:
-            raise UsageError("Value 'lifetime' must be between 1 second and 1 hour (3600 seconds). Got %s." % input['lifetime'].value)
+            raise UsageError("Value 'lifetime' must be between 1 second and 1 hour (3600 seconds). Got %s." % input_payload['lifetime'].value)
 
         try:
             # if generic tag exists, we don't care about the value
-            is_generic = input['generic']
+            is_generic = input_payload['generic']
             # we generate a generic POE token
             is_generic = True
         except KeyError:
@@ -1269,7 +1272,7 @@ def get_post_once_exactly(self, class_name, input):
 
     @Routing.route("/data/<:class_name>/@poe/<:post_token>", 'POST')
     @_data_decorator
-    def post_once_exactly_collection(self, class_name, post_token, input):
+    def post_once_exactly_collection(self, class_name, post_token, input_payload):
         """Post exactly one to the resource named by class_name"""
         otks = self.db.Otk
 
@@ -1308,9 +1311,9 @@ def post_once_exactly_collection(self, class_name, post_token, input):
             raise UsageError("POE token '%s' not valid for %s, was generated for class %s" % (post_token, class_name, cn))
 
         # handle this as though they POSTed to /rest/data/class
-        return self.post_collection_inner(class_name, input)
+        return self.post_collection_inner(class_name, input_payload)
 
-    def post_collection_inner(self, class_name, input):
+    def post_collection_inner(self, class_name, input_payload):
         if class_name not in self.db.classes:
             raise NotFound('Class %s not found' % class_name)
         if not self.db.security.hasPermission(
@@ -1321,7 +1324,7 @@ def post_collection_inner(self, class_name, input):
         class_obj = self.db.getclass(class_name)
 
         # convert types
-        props = self.props_from_args(class_obj, input.value)
+        props = self.props_from_args(class_obj, input_payload.value)
 
         # check for the key property
         key = class_obj.getkey()
@@ -1367,7 +1370,7 @@ def post_collection_inner(self, class_name, input):
 
     @Routing.route("/data/<:class_name>/<:item_id>", 'PUT')
     @_data_decorator
-    def put_element(self, class_name, item_id, input):
+    def put_element(self, class_name, item_id, input_payload):
         """PUT a new content to an object
 
         Replace the content of the existing object
@@ -1375,7 +1378,7 @@ def put_element(self, class_name, item_id, input):
         Args:
             class_name (string): class name of the resource (Ex: issue, msg)
             item_id (string): id of the resource (Ex: 12, 15)
-            input (list): the submitted form of the user
+            input_payload (list): the submitted form of the user
 
         Returns:
             int: http status code 200 (OK)
@@ -1390,7 +1393,7 @@ def put_element(self, class_name, item_id, input):
             raise NotFound('Class %s not found' % class_name)
         class_obj = self.db.getclass(class_name)
 
-        props = self.props_from_args(class_obj, input.value, item_id)
+        props = self.props_from_args(class_obj, input_payload.value, item_id)
         for p in props:
             if not self.db.security.hasPermission(
                 'Edit', self.db.getuid(), class_name, p, item_id
@@ -1400,7 +1403,7 @@ def put_element(self, class_name, item_id, input):
                     (p, class_name, item_id)
                 )
         try:
-            self.raise_if_no_etag(class_name, item_id, input)
+            self.raise_if_no_etag(class_name, item_id, input_payload)
             result = class_obj.set(item_id, **props)
             self.db.commit()
         except (TypeError, IndexError, ValueError) as message:
@@ -1420,14 +1423,14 @@ def put_element(self, class_name, item_id, input):
 
     @Routing.route("/data/<:class_name>/<:item_id>/<:attr_name>", 'PUT')
     @_data_decorator
-    def put_attribute(self, class_name, item_id, attr_name, input):
+    def put_attribute(self, class_name, item_id, attr_name, input_payload):
         """PUT an attribute to an object
 
         Args:
             class_name (string): class name of the resource (Ex: issue, msg)
             item_id (string): id of the resource (Ex: 12, 15)
             attr_name (string): attribute of the resource (Ex: title, nosy)
-            input (list): the submitted form of the user
+            input_payload (list): the submitted form of the user
 
         Returns:
             int: http status code 200 (OK)
@@ -1450,12 +1453,12 @@ def put_attribute(self, class_name, item_id, attr_name, input):
         class_obj = self.db.getclass(class_name)
         props = {
             attr_name: self.prop_from_arg(
-                class_obj, attr_name, input['data'].value, item_id
+                class_obj, attr_name, input_payload['data'].value, item_id
             )
         }
 
         try:
-            self.raise_if_no_etag(class_name, item_id, input)
+            self.raise_if_no_etag(class_name, item_id, input_payload)
             result = class_obj.set(item_id, **props)
             self.db.commit()
         except (TypeError, IndexError, ValueError) as message:
@@ -1476,14 +1479,14 @@ def put_attribute(self, class_name, item_id, attr_name, input):
 
     @Routing.route("/data/<:class_name>", 'DELETE')
     @_data_decorator
-    def delete_collection(self, class_name, input):
+    def delete_collection(self, class_name, input_payload):
         """DELETE (retire) all objects in a class
            There is currently no use-case, so this is disabled and
            always returns Unauthorised.
 
         Args:
             class_name (string): class name of the resource (Ex: issue, msg)
-            input (list): the submitted form of the user
+            input_payload (list): the submitted form of the user
 
         Returns:
             int: http status code 200 (OK)
@@ -1526,13 +1529,13 @@ def delete_collection(self, class_name, input):
 
     @Routing.route("/data/<:class_name>/<:item_id>", 'DELETE')
     @_data_decorator
-    def delete_element(self, class_name, item_id, input):
+    def delete_element(self, class_name, item_id, input_payload):
         """DELETE (retire) an object in a class
 
         Args:
             class_name (string): class name of the resource (Ex: issue, msg)
             item_id (string): id of the resource (Ex: 12, 15)
-            input (list): the submitted form of the user
+            input_payload (list): the submitted form of the user
 
         Returns:
             int: http status code 200 (OK)
@@ -1549,7 +1552,7 @@ def delete_element(self, class_name, item_id, input):
                 'Permission to retire %s %s denied' % (class_name, item_id)
             )
 
-        self.raise_if_no_etag(class_name, item_id, input)
+        self.raise_if_no_etag(class_name, item_id, input_payload)
         class_obj.retire(item_id)
         self.db.commit()
         result = {
@@ -1560,14 +1563,14 @@ def delete_element(self, class_name, item_id, input):
 
     @Routing.route("/data/<:class_name>/<:item_id>/<:attr_name>", 'DELETE')
     @_data_decorator
-    def delete_attribute(self, class_name, item_id, attr_name, input):
+    def delete_attribute(self, class_name, item_id, attr_name, input_payload):
         """DELETE an attribute in a object by setting it to None or empty
 
         Args:
             class_name (string): class name of the resource (Ex: issue, msg)
             item_id (string): id of the resource (Ex: 12, 15)
             attr_name (string): attribute of the resource (Ex: title, nosy)
-            input (list): the submitted form of the user
+            input_payload (list): the submitted form of the user
 
         Returns:
             int: http status code 200 (OK)
@@ -1603,7 +1606,7 @@ def delete_attribute(self, class_name, item_id, attr_name, input):
             props[attr_name] = None
 
         try:
-            self.raise_if_no_etag(class_name, item_id, input)
+            self.raise_if_no_etag(class_name, item_id, input_payload)
             class_obj.set(item_id, **props)
             self.db.commit()
         except (TypeError, IndexError, ValueError) as message:
@@ -1621,7 +1624,7 @@ def delete_attribute(self, class_name, item_id, attr_name, input):
 
     @Routing.route("/data/<:class_name>/<:item_id>", 'PATCH')
     @_data_decorator
-    def patch_element(self, class_name, item_id, input):
+    def patch_element(self, class_name, item_id, input_payload):
         """PATCH an object
 
         Patch an element using 3 operators
@@ -1632,7 +1635,7 @@ def patch_element(self, class_name, item_id, input):
         Args:
             class_name (string): class name of the resource (Ex: issue, msg)
             item_id (string): id of the resource (Ex: 12, 15)
-            input (list): the submitted form of the user
+            input_payload (list): the submitted form of the user
 
         Returns:
             int: http status code 200 (OK)
@@ -1646,19 +1649,19 @@ def patch_element(self, class_name, item_id, input):
         if class_name not in self.db.classes:
             raise NotFound('Class %s not found' % class_name)
         try:
-            op = input['@op'].value.lower()
+            op = input_payload['@op'].value.lower()
         except KeyError:
             op = self.__default_patch_op
         class_obj = self.db.getclass(class_name)
 
-        self.raise_if_no_etag(class_name, item_id, input)
+        self.raise_if_no_etag(class_name, item_id, input_payload)
 
         # if patch operation is action, call the action handler
         action_args = [class_name + item_id]
         if op == 'action':
             # extract action_name and action_args from form fields
             name = None
-            for form_field in input.value:
+            for form_field in input_payload.value:
                 key = form_field.name
                 value = form_field.value
                 if key == "@action_name":
@@ -1684,7 +1687,7 @@ def patch_element(self, class_name, item_id, input):
             }
         else:
             # else patch operation is processing data
-            props = self.props_from_args(class_obj, input.value, item_id,
+            props = self.props_from_args(class_obj, input_payload.value, item_id,
                                          skip_protected=False)
 
             required_props = class_obj.get_required_props()
@@ -1722,7 +1725,7 @@ def patch_element(self, class_name, item_id, input):
 
     @Routing.route("/data/<:class_name>/<:item_id>/<:attr_name>", 'PATCH')
     @_data_decorator
-    def patch_attribute(self, class_name, item_id, attr_name, input):
+    def patch_attribute(self, class_name, item_id, attr_name, input_payload):
         """PATCH an attribute of an object
 
         Patch an element using 3 operators
@@ -1734,7 +1737,7 @@ def patch_attribute(self, class_name, item_id, attr_name, input):
             class_name (string): class name of the resource (Ex: issue, msg)
             item_id (string): id of the resource (Ex: 12, 15)
             attr_name (string): attribute of the resource (Ex: title, nosy)
-            input (list): the submitted form of the user
+            input_payload (list): the submitted form of the user
 
         Returns:
             int: http status code 200 (OK)
@@ -1748,7 +1751,7 @@ def patch_attribute(self, class_name, item_id, attr_name, input):
         if class_name not in self.db.classes:
             raise NotFound('Class %s not found' % class_name)
         try:
-            op = input['@op'].value.lower()
+            op = input_payload['@op'].value.lower()
         except KeyError:
             op = self.__default_patch_op
 
@@ -1767,11 +1770,11 @@ def patch_attribute(self, class_name, item_id, attr_name, input):
                 raise AttributeError("Attribute '%s' can not be updated "
                                      "for class %s." % (attr_name, class_name))
 
-        self.raise_if_no_etag(class_name, item_id, input)
+        self.raise_if_no_etag(class_name, item_id, input_payload)
 
         props = {
             prop: self.prop_from_arg(
-                class_obj, prop, input['data'].value, item_id
+                class_obj, prop, input_payload['data'].value, item_id
             )
         }
 
@@ -1799,7 +1802,7 @@ def patch_attribute(self, class_name, item_id, attr_name, input):
 
     @Routing.route("/data/<:class_name>", 'OPTIONS')
     @_data_decorator
-    def options_collection(self, class_name, input):
+    def options_collection(self, class_name, input_payload):
         """OPTION return the HTTP Header for the class uri
 
         Returns:
@@ -1821,7 +1824,7 @@ def options_collection(self, class_name, input):
 
     @Routing.route("/data/<:class_name>/<:item_id>", 'OPTIONS')
     @_data_decorator
-    def options_element(self, class_name, item_id, input):
+    def options_element(self, class_name, item_id, input_payload):
         """OPTION return the HTTP Header for the object uri
 
         Returns:
@@ -1846,7 +1849,7 @@ def options_element(self, class_name, item_id, input):
 
     @Routing.route("/data/<:class_name>/<:item_id>/<:attr_name>", 'OPTIONS')
     @_data_decorator
-    def option_attribute(self, class_name, item_id, attr_name, input):
+    def option_attribute(self, class_name, item_id, attr_name, input_payload):
         """OPTION return the HTTP Header for the attribute uri
 
         Returns:
@@ -1962,7 +1965,7 @@ def option_attribute(self, class_name, item_id, attr_name, input):
     )
     @Routing.route("/")
     @_data_decorator
-    def describe(self, input):
+    def describe(self, input_payload):
         """Describe the rest endpoint. Return direct children in
            links list.
         """
@@ -1999,7 +2002,7 @@ def describe(self, input):
 
     @Routing.route("/", 'OPTIONS')
     @_data_decorator
-    def options_describe(self, input):
+    def options_describe(self, input_payload):
         """OPTION return the HTTP Header for the root
 
         Returns:
@@ -2018,7 +2021,7 @@ def options_describe(self, input):
 
     @Routing.route("/data")
     @_data_decorator
-    def data(self, input):
+    def data(self, input_payload):
         """Describe the subelements of data
 
            One entry for each class the user may view
@@ -2032,7 +2035,7 @@ def data(self, input):
 
     @Routing.route("/data", 'OPTIONS')
     @_data_decorator
-    def options_data(self, input):
+    def options_data(self, input_payload):
         """OPTION return the HTTP Header for the /data element
 
         Returns:
@@ -2051,7 +2054,7 @@ def options_data(self, input):
 
     @Routing.route("/summary")
     @_data_decorator
-    def summary(self, input):
+    def summary(self, input_payload):
         """Get a summary of resource from class URI.
 
         This function returns only items have View permission
@@ -2059,7 +2062,7 @@ def summary(self, input):
 
         Args:
             class_name (string): class name of the resource (Ex: issue, msg)
-            input (list): the submitted form of the user
+            input_payload (list): the submitted form of the user
 
         Returns:
             int: http status code 200 (OK)
@@ -2403,7 +2406,7 @@ def determine_output_format(self, uri):
                      ", ".join(sorted(
                          self.__accepted_content_type.keys())))))
 
-    def dispatch(self, method, uri, input):
+    def dispatch(self, method, uri, input_payload):
         """format and process the request"""
         output = None
 
@@ -2525,12 +2528,12 @@ def dispatch(self, method, uri, input):
             "OPTIONS, GET, POST, PUT, DELETE, PATCH"
         )
 
-        # Is there an input.value with format json data?
+        # Is there an input_payload.value with format json data?
         # If so turn it into an object that emulates enough
         # of the FieldStorge methods/props to allow a response.
         content_type_header = headers.get('Content-Type', None)
         # python2 is str type, python3 is bytes
-        if type(input.value) in (str, bytes) and content_type_header:
+        if type(input_payload.value) in (str, bytes) and content_type_header:
             # the structure of a content-type header
             # is complex: mime-type; options(charset ...)
             # for now we just accept application/json.
@@ -2544,7 +2547,7 @@ def dispatch(self, method, uri, input):
             # for example.
             if content_type_header.lower() == "application/json":
                 try:
-                    input = SimulateFieldStorageFromJson(b2s(input.value))
+                    input_payload = SimulateFieldStorageFromJson(b2s(input_payload.value))
                 except ValueError as msg:
                     output = self.error_obj(400, msg)
             else:
@@ -2558,7 +2561,7 @@ def dispatch(self, method, uri, input):
 
         # check for pretty print
         try:
-            pretty_output = not input['@pretty'].value.lower() == "false"
+            pretty_output = not input_payload['@pretty'].value.lower() == "false"
         # Can also return a TypeError ("not indexable")
         # In case the FieldStorage could not parse the result
         except (KeyError, TypeError):
@@ -2567,7 +2570,7 @@ def dispatch(self, method, uri, input):
         # check for runtime statistics
         try:
             # self.report_stats initialized to False
-            self.report_stats = input['@stats'].value.lower() == "true"
+            self.report_stats = input_payload['@stats'].value.lower() == "true"
         # Can also return a TypeError ("not indexable")
         # In case the FieldStorage could not parse the result
         except (KeyError, TypeError):
@@ -2582,13 +2585,13 @@ def dispatch(self, method, uri, input):
             # from accept header. accept mime type in url
             # takes priority over Accept header. Opposite here.
             if not self.api_version:
-                self.api_version = int(input['@apiver'].value)
+                self.api_version = int(input_payload['@apiver'].value)
         # Can also return a TypeError ("not indexable")
         # In case the FieldStorage could not parse the result
         except (KeyError, TypeError):
             self.api_version = None
         except ValueError:
-            output = self.error_obj(406, msg % input['@apiver'].value)
+            output = self.error_obj(406, msg % input_payload['@apiver'].value)
 
         # by this time the API version is set. Error if we don't
         # support it?
@@ -2602,17 +2605,17 @@ def dispatch(self, method, uri, input):
             output = self.error_obj(406, msg % self.api_version)
 
         # sadly del doesn't work on FieldStorage which can be the type of
-        # input. So we have to ignore keys starting with @ at other
+        # input_payload. So we have to ignore keys starting with @ at other
         # places in the code.
         # else:
-        #     del(input['@apiver'])
+        #     del(input_payload['@apiver'])
 
         # Call the appropriate method
         try:
             # If output was defined by a prior error
             # condition skip call
             if not output:
-                output = Routing.execute(self, uri, method, input)
+                output = Routing.execute(self, uri, method, input_payload)
         except NotFound as msg:
             output = self.error_obj(404, msg)
         except Reject as msg:

From ececa86aa335396c22f6df5db46ef60232086010 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 11 Dec 2024 13:13:55 -0500
Subject: [PATCH 050/398] chore(ruff): whatespace fixes/silence linting

I silenced a list of tuple definitions because I wanted the columns to
align.
---
 roundup/cgi/client.py | 38 +++++++++++++++++++-------------------
 1 file changed, 19 insertions(+), 19 deletions(-)

diff --git a/roundup/cgi/client.py b/roundup/cgi/client.py
index 9d7eb9146..ac4afc410 100644
--- a/roundup/cgi/client.py
+++ b/roundup/cgi/client.py
@@ -1027,7 +1027,7 @@ def clean_up(self):
 
            Do it only once an hour.
         """
-        hour = 60*60
+        hour = 60 * 60
         now = time.time()
 
         # XXX: hack - use OTK table to store last_clean time information
@@ -2176,7 +2176,7 @@ def selectTemplate(self, name, view):
             else:
                 # try path/class.view
                 tplname = '%s/%s.%s' % (
-                    view[:slash_loc], name, view[slash_loc+1:])
+                    view[:slash_loc], name, view[slash_loc + 1:])
 
         if loader.check(tplname):
             return tplname
@@ -2189,7 +2189,7 @@ def selectTemplate(self, name, view):
         if slash_loc == -1:
             generic = '_generic.%s' % view
         else:
-            generic = '%s/_generic.%s' % (view[:slash_loc], view[slash_loc+1:])
+            generic = '%s/_generic.%s' % (view[:slash_loc], view[slash_loc + 1:])
         if loader.check(generic):
             return generic
 
@@ -2223,7 +2223,7 @@ def renderContext(self):
                     timings = {'starttag': '<!-- ', 'endtag': ' -->'}
                 else:
                     timings = {'starttag': '<p>', 'endtag': '</p>'}
-                timings['seconds'] = time.time()-self.start
+                timings['seconds'] = time.time() - self.start
                 s = self._(
                     '%(starttag)sTime elapsed: %(seconds)fs%(endtag)s\n'
                 ) % timings
@@ -2305,20 +2305,20 @@ def renderError(self, error, response_code=400, use_template=True):
 
     # these are the actions that are available
     actions = (
-        ('edit',        actions.EditItemAction),
-        ('editcsv',     actions.EditCSVAction),
-        ('new',         actions.NewItemAction),
-        ('register',    actions.RegisterAction),
-        ('confrego',    actions.ConfRegoAction),
-        ('passrst',     actions.PassResetAction),
-        ('login',       actions.LoginAction),
-        ('logout',      actions.LogoutAction),
-        ('search',      actions.SearchAction),
-        ('restore',     actions.RestoreAction),
-        ('retire',      actions.RetireAction),
-        ('show',        actions.ShowAction),
-        ('export_csv',  actions.ExportCSVAction),
-        ('export_csv_id',  actions.ExportCSVWithIdAction),
+        ('edit',        actions.EditItemAction),  # noqa: E241
+        ('editcsv',     actions.EditCSVAction),  # noqa: E241
+        ('new',         actions.NewItemAction),  # noqa: E241
+        ('register',    actions.RegisterAction),  # noqa: E241
+        ('confrego',    actions.ConfRegoAction),  # noqa: E241
+        ('passrst',     actions.PassResetAction),  # noqa: E241
+        ('login',       actions.LoginAction),  # noqa: E241
+        ('logout',      actions.LogoutAction),  # noqa: E241
+        ('search',      actions.SearchAction),  # noqa: E241
+        ('restore',     actions.RestoreAction),  # noqa: E241
+        ('retire',      actions.RetireAction),  # noqa: E241
+        ('show',        actions.ShowAction),  # noqa: E241
+        ('export_csv',  actions.ExportCSVAction),  # noqa: E241
+        ('export_csv_id',  actions.ExportCSVWithIdAction),  # noqa: E241
     )
 
     def handle_action(self):
@@ -2913,7 +2913,7 @@ def header(self, headers=None, response=None):
         if self.debug:
             self.headers_sent = headers
 
-    def add_cookie(self, name, value, expire=86400*365, path=None):
+    def add_cookie(self, name, value, expire=86400 * 365, path=None):
         """Set a cookie value to be sent in HTTP headers
 
         Parameters:

From ff44c00e9e4911cbb367ed707df1efcf6cb5814b Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 11 Dec 2024 13:17:42 -0500
Subject: [PATCH 051/398] chore(ruff): whatespace fixes/silence linting

---
 roundup/rest.py | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/roundup/rest.py b/roundup/rest.py
index 31bc386b3..2666a9cd6 100644
--- a/roundup/rest.py
+++ b/roundup/rest.py
@@ -119,7 +119,7 @@ def format_object(self, *args, **kwargs):
             }
         else:
             if hasattr(self.db, 'stats') and self.report_stats:
-                self.db.stats['elapsed'] = time.time()-self.start
+                self.db.stats['elapsed'] = time.time() - self.start
                 data['@stats'] = self.db.stats
             result = {
                 'data': data
@@ -574,7 +574,7 @@ def transitive_props(self, class_name, props):
                 for pn in p.split('.'):
                     # Tried to dereference a non-Link property
                     if cn is None:
-                        raise UsageError("Property %(base)s can not be dereferenced in %(p)s." % {"base": p[:-(len(pn)+1)], "p": p})
+                        raise UsageError("Property %(base)s can not be dereferenced in %(p)s." % {"base": p[:-(len(pn) + 1)], "p": p})
                     cls = self.db.getclass(cn)
                     # This raises a KeyError for unknown prop:
                     try:
@@ -1049,7 +1049,7 @@ def get_roles(self, input_payload):
         )
 
         return 200, {"collection":
-                     [{"id": rolename,"name": rolename}
+                     [{"id": rolename, "name": rolename}
                       for rolename in list(self.db.security.role.keys())]}
 
     @Routing.route("/data/<:class_name>/<:item_id>", 'GET')
@@ -1189,7 +1189,7 @@ def get_attribute(self, class_name, item_id, attr_name, input_payload):
         class_obj = self.db.getclass(class_name)
         node = class_obj.getnode(item_id)
         etag = calculate_etag(node, self.db.config.WEB_SECRET_KEY,
-                              class_name, item_id,  repr_format="json")
+                              class_name, item_id, repr_format="json")
         try:
             data = node.__getattr__(attr_name)
         except AttributeError:

From 52072e74fdbedb6d6e0b53815314d947c75e1322 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 11 Dec 2024 13:19:49 -0500
Subject: [PATCH 052/398] chore(ruff): suppress py2/py3 compatibility code
 thought useless

---
 roundup/rest.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roundup/rest.py b/roundup/rest.py
index 2666a9cd6..7c5778ff5 100644
--- a/roundup/rest.py
+++ b/roundup/rest.py
@@ -55,7 +55,7 @@
 
 # Py3 compatible basestring
 try:
-    basestring
+    basestring  # noqa: B018
 except NameError:
     basestring = str
     unicode = str

From a7365e694319d814720b6e88b440767b5e7965ae Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 11 Dec 2024 13:29:11 -0500
Subject: [PATCH 053/398] chore(ruff): return/suppress boolen directly

I suppressed one 'if bool: return true else return false' so I could
see in codecov that code was returning both true and false.
---
 roundup/cgi/client.py | 5 ++---
 roundup/rest.py       | 2 +-
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/roundup/cgi/client.py b/roundup/cgi/client.py
index ac4afc410..fed69f58a 100644
--- a/roundup/cgi/client.py
+++ b/roundup/cgi/client.py
@@ -1396,9 +1396,8 @@ def is_origin_header_ok(self, api=False, credentials=False):
         # allowing credentials. See:
         # https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS
         # under Credentials Requests and Wildcards
-        if (allowed_origins and allowed_origins[0] == '*'
-            and not credentials):
-            return True
+        return (allowed_origins and allowed_origins[0] == '*'
+                and not credentials)
 
         return False
 
diff --git a/roundup/rest.py b/roundup/rest.py
index 7c5778ff5..19d3838ff 100644
--- a/roundup/rest.py
+++ b/roundup/rest.py
@@ -239,7 +239,7 @@ def check_etag(node, key, etags, classname="Missing", node_id="0",
                 return False
             have_etag_match = True
 
-    if have_etag_match:
+    if have_etag_match:  # noqa: SIM103  leave for coverage reports
         return True
     else:
         return False

From 604b3dbaf3e4711318a31af42f12cec1912a63c7 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 11 Dec 2024 13:30:50 -0500
Subject: [PATCH 054/398] chore(ruff): replace set(generator) with {set
 comprehension}

The comprehension seems to be the more expected way to express. Not
sure if there is a performance difference.
---
 roundup/rest.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roundup/rest.py b/roundup/rest.py
index 19d3838ff..ec4d8ed23 100644
--- a/roundup/rest.py
+++ b/roundup/rest.py
@@ -360,7 +360,7 @@ def index():
 
         if isinstance(methods, basestring):  # convert string to tuple
             methods = (methods,)
-        methods = set(item.upper() for item in methods)
+        methods = {item.upper() for item in methods}
 
         # convert a rule to a compiled regex object
         # so /data/<:class>/<:id> will become

From c3dfc05be56f32d1cb569f98a8512e31da2c9ac9 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 11 Dec 2024 13:34:28 -0500
Subject: [PATCH 055/398] chore(ruff): replace not a == b with a != b

---
 roundup/rest.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/roundup/rest.py b/roundup/rest.py
index ec4d8ed23..4ff2d9aeb 100644
--- a/roundup/rest.py
+++ b/roundup/rest.py
@@ -2561,7 +2561,7 @@ def dispatch(self, method, uri, input_payload):
 
         # check for pretty print
         try:
-            pretty_output = not input_payload['@pretty'].value.lower() == "false"
+            pretty_output = input_payload['@pretty'].value.lower() != "false"
         # Can also return a TypeError ("not indexable")
         # In case the FieldStorage could not parse the result
         except (KeyError, TypeError):
@@ -2726,7 +2726,7 @@ def raise_error_on_constant(x):
             self.json_dict = json.loads(json_string,
                                     parse_constant=raise_error_on_constant)
             self.value = [self.FsValue(index, self.json_dict[index])
-                          for index in self.json_dict.keys()]
+                          for index in self.json_dict]
         except ValueError:
             self.json_dict = {}
             self.value = None

From 2cb42542ee3a967cbdce0d0d58f0e649a6a393b4 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 11 Dec 2024 13:36:40 -0500
Subject: [PATCH 056/398] chore(ruff): parenthesize "a and b or ..." to
 enforce/clarify precedence

---
 roundup/rest.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roundup/rest.py b/roundup/rest.py
index 4ff2d9aeb..11cac7675 100644
--- a/roundup/rest.py
+++ b/roundup/rest.py
@@ -916,7 +916,7 @@ def get_collection(self, class_name, input_payload):
                     else:
                         vals = []
                     for p in value.split(","):
-                        dig = p and p.isdigit() or \
+                        dig = (p and p.isdigit()) or \
                             (p[0] in ('-', '+') and p[1:].isdigit())
                         if prop.try_id_parsing and dig:
                             vals.append(p)

From 98fc6ee3e4dfe377a6c34aeacd9a8d05f4ea34e8 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 11 Dec 2024 13:46:48 -0500
Subject: [PATCH 057/398] fix: missed on input -> input_payload on e5362f8e1808

I didn't realize the associate array was being turned into keyword
args. So I left x['input'] = input_payload 8-(.
---
 roundup/rest.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roundup/rest.py b/roundup/rest.py
index 11cac7675..ad6a014ad 100644
--- a/roundup/rest.py
+++ b/roundup/rest.py
@@ -424,7 +424,7 @@ def execute(cls, instance, path, method, input_payload):
 
                 # zip the varlist into a dictionary, and pass it to the caller
                 args = dict(zip(list_vars, match_obj.groups()))
-                args['input'] = input_payload
+                args['input_payload'] = input_payload
                 return func(instance, **args)
         raise NotFound('Nothing matches the given URI')
 

From 7ace15a11cbc754f3bdb98710b1f40a97a8ee64f Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 11 Dec 2024 13:53:39 -0500
Subject: [PATCH 058/398] chore(ruff): replace 'x == y or x == z' with 'x in
 [y,z]'

---
 roundup/rest.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/roundup/rest.py b/roundup/rest.py
index ad6a014ad..602b2d9d2 100644
--- a/roundup/rest.py
+++ b/roundup/rest.py
@@ -818,7 +818,7 @@ def get_collection(self, class_name, input_payload):
                 page[key] = value
             elif key == "@verbose":
                 verbose = int(value)
-            elif key == "@fields" or key == "@attrs":
+            elif key in ["@fields", "@attrs"]:
                 f = value.split(",")
                 if len(f) == 1:
                     f = value.split(":")
@@ -1118,7 +1118,7 @@ def get_element(self, class_name, item_id, input_payload):
         for form_field in input_payload.value:
             key = form_field.name
             value = form_field.value
-            if key == "@fields" or key == "@attrs":
+            if key in ["@fields", "@attrs"]:
                 if props is None:
                     props = set()
                 # support , or : separated elements

From 00c0a489e6e1d0cb2abf03b0c72f3e06fe986adb Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 11 Dec 2024 13:56:42 -0500
Subject: [PATCH 059/398] chore(ruff): replace 'else: if bool_exp:' with 'elif
 bool_exp:'

---
 roundup/rest.py | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/roundup/rest.py b/roundup/rest.py
index 602b2d9d2..1c64b1b10 100644
--- a/roundup/rest.py
+++ b/roundup/rest.py
@@ -652,9 +652,8 @@ def patch_data(self, op, old_val, new_val):
                     result = []
                 elif isinstance(new_val, list):
                     result = [x for x in old_val if x not in new_val]
-                else:
-                    if new_val in old_val:
-                        old_val.remove(new_val)
+                elif new_val in old_val:
+                    old_val.remove(new_val)
             elif isinstance(old_val, dict):
                 if new_val is None:
                     result = {}
@@ -1137,8 +1136,7 @@ def get_element(self, class_name, item_id, input_payload):
         result = {}
         if props is None:
             props = set(class_obj.getprops(protected=protected))
-        else:
-            if verbose > 1:
+        elif verbose > 1:
                 lp = class_obj.labelprop()
                 props.add(lp)
 

From 47d55138710fe5e9c4efde58f40cc40e5e5bb4e5 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 11 Dec 2024 13:58:27 -0500
Subject: [PATCH 060/398] chore(ruff): fix indentation level on de6b02c23ee9

forgot to reindent when merging else if to elif.
---
 roundup/rest.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/roundup/rest.py b/roundup/rest.py
index 1c64b1b10..4483e72bc 100644
--- a/roundup/rest.py
+++ b/roundup/rest.py
@@ -1137,8 +1137,8 @@ def get_element(self, class_name, item_id, input_payload):
         if props is None:
             props = set(class_obj.getprops(protected=protected))
         elif verbose > 1:
-                lp = class_obj.labelprop()
-                props.add(lp)
+            lp = class_obj.labelprop()
+            props.add(lp)
 
         result = {
             'id': itemid,

From d14f380458b70e95090e59584d24a557d131adbb Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 11 Dec 2024 14:17:01 -0500
Subject: [PATCH 061/398] chore(ruff): remove unreachable line

---
 roundup/cgi/client.py | 2 --
 1 file changed, 2 deletions(-)

diff --git a/roundup/cgi/client.py b/roundup/cgi/client.py
index fed69f58a..fd744382f 100644
--- a/roundup/cgi/client.py
+++ b/roundup/cgi/client.py
@@ -1399,8 +1399,6 @@ def is_origin_header_ok(self, api=False, credentials=False):
         return (allowed_origins and allowed_origins[0] == '*'
                 and not credentials)
 
-        return False
-
     def is_referer_header_ok(self, api=False):
         referer = self.env['HTTP_REFERER']
         # parse referer and create an origin

From d8c32f5db35e29893b24b7b7fcf02babd76a4e1e Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 11 Dec 2024 14:21:44 -0500
Subject: [PATCH 062/398] chore(ruff): replace dict(...) with equivalent {...}

---
 roundup/rest.py | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/roundup/rest.py b/roundup/rest.py
index 4483e72bc..2a741d217 100644
--- a/roundup/rest.py
+++ b/roundup/rest.py
@@ -460,7 +460,7 @@ def __init__(self, client, db):
         # would include too many actions that do not make sense in the
         # REST-API context, so for now we only permit the retire and
         # restore actions.
-        self.actions = dict(retire=actions.Retire, restore=actions.Restore)
+        self.actions = {"retire": actions.Retire, "restore": actions.Restore}
 
         # note TRACKER_WEB ends in a /
         self.base_path = '%srest' % (self.db.config.TRACKER_WEB)
@@ -731,14 +731,15 @@ def format_item(self, node, item_id, props=None, verbose=1):
                         if isinstance(v, type([])):
                             r = []
                             for working_id in v:
-                                d = dict(id=working_id, link=cp + working_id)
+                                d = {"id": working_id,
+                                     "link": cp + working_id}
                                 if verbose > 1:
                                     label = linkcls.labelprop()
                                     d[label] = linkcls.get(working_id, label)
                                 r.append(d)
                             result[pn] = r
                         else:
-                            result[pn] = dict(id=v, link=cp + v)
+                            result[pn] = {"id": v, "link": cp + v}
                             if verbose > 1:
                                 label = linkcls.labelprop()
                                 result[pn][label] = linkcls.get(v, label)
@@ -751,7 +752,7 @@ def format_item(self, node, item_id, props=None, verbose=1):
                     if verbose < 3:
                         u = self.db.config.TRACKER_WEB
                         p = u + '%s%s/' % (class_name, node.id)
-                        result[pn] = dict(link=p)
+                        result[pn] = {"link": p}
                     else:
                         result[pn] = v
                 elif isinstance(prop, hyperdb.Password):
@@ -2028,7 +2029,7 @@ def data(self, input_payload):
         uid = self.db.getuid()
         for cls in sorted(self.db.classes):
             if self.db.security.hasPermission('View', uid, cls):
-                result[cls] = dict(link=self.base_path + '/data/' + cls)
+                result[cls] = {"link": self.base_path + '/data/' + cls}
         return 200, result
 
     @Routing.route("/data", 'OPTIONS')

From c761b7d418588ea8a617dd2fe8479806fefb6b71 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 11 Dec 2024 14:29:19 -0500
Subject: [PATCH 063/398] chore(ruff): clean trailing whitespace

---
 roundup/cgi/client.py | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/roundup/cgi/client.py b/roundup/cgi/client.py
index fd744382f..47bfa4a05 100644
--- a/roundup/cgi/client.py
+++ b/roundup/cgi/client.py
@@ -1165,11 +1165,10 @@ def authenticate_bearer_token(self, challenge):
 
         for secret in self.db.config.WEB_JWT_SECRET:
             try:  # handle jwt exceptions
-                token = jwt.decode(challenge, secret,
-                                   algorithms=['HS256'],
-                                   audience=self.db.config.TRACKER_WEB,
-                                   issuer=self.db.config.TRACKER_WEB)
-                return (token)
+                return jwt.decode(challenge, secret,
+                                  algorithms=['HS256'],
+                                  audience=self.db.config.TRACKER_WEB,
+                                  issuer=self.db.config.TRACKER_WEB)
 
             except jwt.exceptions.InvalidSignatureError as err:
                 # Try more signatures.
@@ -2438,7 +2437,7 @@ def setVary(self, header):
         '''Vary header will include the new header. This will append
            if Vary exists.'''
 
-        if ('Vary' in self.additional_headers and 
+        if ('Vary' in self.additional_headers and
             header not in self.additional_headers['Vary']):
             self.additional_headers['Vary'] += ", %s" % header
         else:

From 6e2f2394e48f7c41bb69ba61b4b429e086a7bb8b Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 11 Dec 2024 15:09:44 -0500
Subject: [PATCH 064/398] chore(ruff): changes to else/elif and nested ifs to
 reduce nesting

When first banch of if clause returns/raises, remove else/elif and
inline branch instructions to main flow.

Removed nested ifs, change boolean to 'and' expressions for all nested
if statements.
---
 roundup/cgi/client.py | 47 +++++++++++++++++++++----------------------
 roundup/rest.py       | 18 ++++++++---------
 2 files changed, 31 insertions(+), 34 deletions(-)

diff --git a/roundup/cgi/client.py b/roundup/cgi/client.py
index 47bfa4a05..c31dd49e4 100644
--- a/roundup/cgi/client.py
+++ b/roundup/cgi/client.py
@@ -1335,7 +1335,7 @@ def check_anonymous_access(self):
         if isinstance(action, list):
             raise SeriousError(
                 self._('broken form: multiple @action values submitted'))
-        elif action != '':
+        if action != '':
             # '' is value when no action parameter was found so run
             # this to extract action string value when action found.
             action = action.value.lower()
@@ -1548,7 +1548,7 @@ def handle_csrf(self, api=False):
                     logger.error(logmsg)
                     raise Unauthorised(self._("Invalid Referer: %s") % (
                         referer))
-                elif enforce == 'logfailure':
+                if enforce == 'logfailure':
                     logger.warning(logmsg)
             else:
                 header_pass += 1
@@ -1567,7 +1567,7 @@ def handle_csrf(self, api=False):
                 if enforce in ('required', 'yes'):
                     logger.error(logmsg)
                     raise Unauthorised(self._("Invalid Origin %s" % origin))
-                elif enforce == 'logfailure':
+                if enforce == 'logfailure':
                     logger.warning(logmsg)
             else:
                 header_pass += 1
@@ -1587,7 +1587,7 @@ def handle_csrf(self, api=False):
                         logger.error(logmsg)
                         raise Unauthorised(self._(
                             "Invalid X-FORWARDED-HOST %s") % host)
-                    elif enforce == 'logfailure':
+                    if enforce == 'logfailure':
                         logger.warning(logmsg)
                 else:
                     header_pass += 1
@@ -1611,7 +1611,7 @@ def handle_csrf(self, api=False):
                     if enforce in ('required', 'yes'):
                         logger.error(logmsg)
                         raise Unauthorised(self._("Invalid HOST %s") % host)
-                    elif enforce == 'logfailure':
+                    if enforce == 'logfailure':
                         logger.warning(logmsg)
                 else:
                     header_pass += 1
@@ -1677,7 +1677,7 @@ def handle_csrf(self, api=False):
                 raise UsageError(self._(
                     ''"We can't validate your session (csrf failure). "
                     ''"Re-enter any unsaved data and try again."))
-            elif enforce == 'logfailure':
+            if enforce == 'logfailure':
                 # FIXME include url
                 logger.warning(self._("csrf field not supplied by user%s"),
                                current_user)
@@ -1704,7 +1704,7 @@ def handle_csrf(self, api=False):
                 raise UsageError(self._(
                     ''"We can't validate your session (csrf failure). "
                     ''"Re-enter any unsaved data and try again."))
-            elif enforce == 'logfailure':
+            if enforce == 'logfailure':
                 logger.warning(logmsg)
 
         if current_session != nonce_session:
@@ -1721,7 +1721,7 @@ def handle_csrf(self, api=False):
                 raise UsageError(self._(
                     ''"We can't validate your session (csrf failure). "
                     ''"Re-enter any unsaved data and try again."))
-            elif enforce == 'logfailure':
+            if enforce == 'logfailure':
                 logger.warning(logmsg)
 
         # we are done and the change can occur.
@@ -1833,11 +1833,11 @@ def determine_context(self, dre=dre_url):
             return
         if path[0] in ('_file', '@@file'):
             raise SendStaticFile(os.path.join(*path[1:]))
-        else:
-            self.classname = path[0]
-            if len(path) > 1:
-                # send the file identified by the designator in path[0]
-                raise SendFile(path[0])
+
+        self.classname = path[0]
+        if len(path) > 1:
+            # send the file identified by the designator in path[0]
+            raise SendFile(path[0])
 
         # see if we got a designator
         m = dre.match(self.classname)
@@ -1974,9 +1974,9 @@ def serve_static_file(self, file):
                 filename = os.path.normpath(os.path.join(p, file))
                 if os.path.isfile(filename) and filename.startswith(p):
                     break  # inner loop over list of directories
-                else:
-                    # reset filename to None as sentinel for use below.
-                    filename = None
+
+                # reset filename to None as sentinel for use below.
+                filename = None
 
             # break out of outer loop over options
             if filename:
@@ -2344,8 +2344,8 @@ def handle_action(self):
         if isinstance(action, list):
             raise SeriousError(
                 self._('broken form: multiple @action values submitted'))
-        else:
-            action = action.value.lower()
+        
+        action = action.value.lower()
 
         try:
             action_klass = self.get_action_class(action)
@@ -2354,8 +2354,8 @@ def handle_action(self):
             if isinstance(action_klass, type('')):
                 # old way of specifying actions
                 return getattr(self, action_klass)()
-            else:
-                return action_klass(self).execute()
+
+            return action_klass(self).execute()
         except (ValueError, Reject) as err:
             escape = not isinstance(err, RejectRaw)
             self.add_error_message(str(err), escape=escape)
@@ -2420,8 +2420,8 @@ def determine_content_encoding(self, list_all=False, precompressed=False):
                    (enc in accept_encoding):
                     if not list_all:
                         return enc
-                    else:
-                        encoding_list.append(enc)
+
+                    encoding_list.append(enc)
 
         # Return value must evaluate to false in boolean context if no
         # acceptable encoding is found. If an (non-identity) encoding
@@ -2430,8 +2430,7 @@ def determine_content_encoding(self, list_all=False, precompressed=False):
         #   Maybe raise a 406 from here?
         if not list_all:
             return None
-        else:
-            return encoding_list
+        return encoding_list
 
     def setVary(self, header):
         '''Vary header will include the new header. This will append
diff --git a/roundup/rest.py b/roundup/rest.py
index 2a741d217..c6a0cfb09 100644
--- a/roundup/rest.py
+++ b/roundup/rest.py
@@ -241,8 +241,7 @@ def check_etag(node, key, etags, classname="Missing", node_id="0",
 
     if have_etag_match:  # noqa: SIM103  leave for coverage reports
         return True
-    else:
-        return False
+    return False
 
 
 def obtain_etags(headers, input_payload):
@@ -1591,9 +1590,8 @@ def delete_attribute(self, class_name, item_id, attr_name, input_payload):
             if attr_name in class_obj.getprops(protected=True):
                 raise AttributeError("Attribute '%s' can not be deleted "
                                      "for class %s." % (attr_name, class_name))
-            else:
-                raise UsageError("Attribute '%s' not valid for class %s." % (
-                    attr_name, class_name))
+            raise UsageError("Attribute '%s' not valid for class %s." % (
+                attr_name, class_name))
         if attr_name in class_obj.get_required_props():
             raise UsageError("Attribute '%s' is required by class %s and can not be deleted." % (
                 attr_name, class_name))
@@ -1764,8 +1762,8 @@ def patch_attribute(self, class_name, item_id, attr_name, input_payload):
 
         prop = attr_name
         class_obj = self.db.getclass(class_name)
-        if attr_name not in class_obj.getprops(protected=False):
-            if attr_name in class_obj.getprops(protected=True):
+        if (attr_name not in class_obj.getprops(protected=False) and
+            attr_name in class_obj.getprops(protected=True)):
                 raise AttributeError("Attribute '%s' can not be updated "
                                      "for class %s." % (attr_name, class_name))
 
@@ -2127,9 +2125,9 @@ def getRateLimit(self):
         interval = self.db.config.WEB_API_INTERVAL_IN_SEC
         if calls and interval:
             return RateLimit(calls, timedelta(seconds=interval))
-        else:
-            # disable rate limiting if either parameter is 0
-            return None
+
+        # disable rate limiting if either parameter is 0
+        return None
 
     def handle_apiRateLimitExceeded(self, apiRateLimit):
         """Determine if the rate limit is exceeded.

From 138fd59da5e78b91a3acccd15fa8198a5789d922 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 11 Dec 2024 15:11:54 -0500
Subject: [PATCH 065/398] chore(ruff): replace 'type(x) == bool' with 'type(x)
 is bool'

---
 roundup/rest.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roundup/rest.py b/roundup/rest.py
index c6a0cfb09..6fe0674eb 100644
--- a/roundup/rest.py
+++ b/roundup/rest.py
@@ -2649,7 +2649,7 @@ def format_dispatch_output(self, accept_mime_type, output,
                         pass
                     elif hasattr(val, 'isoformat'):  # datetime
                         pass
-                    elif type(val) == bool:
+                    elif type(val) is bool:
                         pass
                     elif isinstance(val, dict):
                         pass

From 16a750d25ea2f74fac1d5308c26282b436e66e50 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 11 Dec 2024 15:18:36 -0500
Subject: [PATCH 066/398] chore(ruff): suppress combine branches with one or
 expression

I want to keep the comment on datetime and expressing the whole thing
as on big or statement would prevent that.

Also it reads better since I can't get formatting of multiple or
statemnts to occur one element per line.

   if (a or
       b or
       c or ...):

wants to be reformated to (a or b or ...)
---
 roundup/rest.py | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/roundup/rest.py b/roundup/rest.py
index 6fe0674eb..5e291b614 100644
--- a/roundup/rest.py
+++ b/roundup/rest.py
@@ -2645,15 +2645,15 @@ def format_dispatch_output(self, accept_mime_type, output,
                 import collections
                 for key, val in output['error'].items():
                     if isinstance(val, numbers.Number) or type(val) in \
-                       (str, unicode):
+                       (str, unicode):  # noqa: SIM114
                         pass
-                    elif hasattr(val, 'isoformat'):  # datetime
+                    elif hasattr(val, 'isoformat'):  # datetime # noqa: SIM114
                         pass
-                    elif type(val) is bool:
+                    elif type(val) is bool:  # noqa: SIM114
                         pass
-                    elif isinstance(val, dict):
+                    elif isinstance(val, dict):  # noqa: SIM114
                         pass
-                    elif isinstance(val, collections.Iterable):
+                    elif isinstance(val, collections.Iterable):  # noqa: SIM114
                         pass
                     elif val is None:
                         pass

From 3a056b3fbecfbd72b6f62e33ba2a1dfb1bd0d461 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 11 Dec 2024 15:22:03 -0500
Subject: [PATCH 067/398] chore(ruff): clean whitespace and remove unrecognized
 noqa directive.

---
 roundup/cgi/client.py | 2 +-
 roundup/rest.py       | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/roundup/cgi/client.py b/roundup/cgi/client.py
index c31dd49e4..376c6762f 100644
--- a/roundup/cgi/client.py
+++ b/roundup/cgi/client.py
@@ -2344,7 +2344,7 @@ def handle_action(self):
         if isinstance(action, list):
             raise SeriousError(
                 self._('broken form: multiple @action values submitted'))
-        
+
         action = action.value.lower()
 
         try:
diff --git a/roundup/rest.py b/roundup/rest.py
index 5e291b614..a2aacb70f 100644
--- a/roundup/rest.py
+++ b/roundup/rest.py
@@ -520,7 +520,7 @@ def props_from_args(self, cl, args, itemid=None, skip_protected=True):
             elif key not in unprotected_class_props:
                 # report bad props as this is an error.
                 raise UsageError("Property %s not found in class %s" % (key,
-                                        cl.classname))  # noqa: E128
+                                        cl.classname))
             props[key] = self.prop_from_arg(cl, key, value, itemid)
 
         return props

From e37a461496f98adf15130f2cb7616bb0c04adba4 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 11 Dec 2024 15:26:32 -0500
Subject: [PATCH 068/398] chore(ruff): sort imports.

---
 roundup/rest.py | 16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)

diff --git a/roundup/rest.py b/roundup/rest.py
index a2aacb70f..9fbccd21e 100644
--- a/roundup/rest.py
+++ b/roundup/rest.py
@@ -7,8 +7,6 @@
 
 from __future__ import print_function
 
-from datetime import timedelta
-from hashlib import md5
 import hmac
 import json
 import logging
@@ -17,20 +15,20 @@
 import sys
 import time
 import traceback
+from datetime import timedelta
+from hashlib import md5
 
 try:
     from urllib.parse import urlparse
 except ImportError:
     from urlparse import urlparse
 
-from roundup import actions
-from roundup import date
-from roundup import hyperdb
-from roundup.anypy.strings import bs2b, b2s, u2s, is_us
-from roundup.cgi.exceptions import NotFound, Unauthorised, PreconditionFailed
+from roundup import actions, date, hyperdb
+from roundup.anypy.strings import b2s, bs2b, is_us, u2s
+from roundup.cgi.exceptions import NotFound, PreconditionFailed, Unauthorised
 from roundup.exceptions import Reject, UsageError
 from roundup.i18n import _
-from roundup.rate_limit import RateLimit, Gcra
+from roundup.rate_limit import Gcra, RateLimit
 
 logger = logging.getLogger('roundup.rest')
 
@@ -2641,8 +2639,8 @@ def format_dispatch_output(self, accept_mime_type, output,
                 # capture values in error with types unsupported
                 # by dicttoxml e.g. an exception, into something it
                 # can handle
-                import numbers
                 import collections
+                import numbers
                 for key, val in output['error'].items():
                     if isinstance(val, numbers.Number) or type(val) in \
                        (str, unicode):  # noqa: SIM114

From 2331ab5db848a0c1d9555849ba3e928d2f0336fa Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 11 Dec 2024 16:15:48 -0500
Subject: [PATCH 069/398] chore(ruff): use variable not magic number.

---
 roundup/rest.py | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/roundup/rest.py b/roundup/rest.py
index 9fbccd21e..12b55cef0 100644
--- a/roundup/rest.py
+++ b/roundup/rest.py
@@ -2236,6 +2236,8 @@ def determine_output_format(self, uri):
                 error
 
         """
+        MAX_MIME_EXTENSION_LENGTH = 11  # application in /etc/mime.types
+
         # get the request format for response
         # priority : extension from uri (/rest/data/issue.json)
         #              only json or xml valid at this time.
@@ -2248,11 +2250,12 @@ def determine_output_format(self, uri):
         # such as .vcard for downloading user info can be
         # supported. This method also allow detection of mistyped
         # types like jon for json. Limit extension length to less than
-        # 10 characters to allow passing JWT via URL path. Could be
-        # useful for magic link login method or account recovery workflow,
-        # using a JWT with a short expiration time and limited rights
-        # (e.g. only password change permission))
-        if ext_type and (len(ext_type) < 10):
+        # MAX_MIME_EXTENSION_LENGTH characters to allow passing JWT
+        # via URL path. Could be useful for magic link login method or
+        # account recovery workflow, using a JWT with a short
+        # expiration time and limited rights (e.g. only password
+        # change permission))
+        if ext_type and (len(ext_type) < MAX_MIME_EXTENSION_LENGTH):
             if ext_type not in list(self.__accepted_content_type.values()):
                 self.client.response_code = 406
                 return (None, uri,

From 7c9247d3761efbdafd36bfe9ff2a0d7d730e5a1c Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 11 Dec 2024 16:24:16 -0500
Subject: [PATCH 070/398] chore(ruff): use names not magic numbers.

This one names the 32 chars as being equivalent to 256 bytes

Also adds the missing http_.client.TOO_MANY_REQUESTS under python 2 to
http_. It allows me to use a symbolic name and not have to touch
client.py code when I remove python2 support from http_.

Also the prior checkin had a bogus commit message. Sigh, time to step
away from the computer today 8-). It replaced a magic number with
MAX_MIME_EXTENSION_LENGTH which was set to a better magic number
derived by parsing extensions in /etc/mime.types.
---
 roundup/anypy/http_.py | 1 +
 roundup/cgi/client.py  | 8 ++++----
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/roundup/anypy/http_.py b/roundup/anypy/http_.py
index 5858e56e2..8975988a6 100644
--- a/roundup/anypy/http_.py
+++ b/roundup/anypy/http_.py
@@ -5,3 +5,4 @@
     # Python 2.5-2.7
     import BaseHTTPServer as server  # noqa: F401
     import httplib as client  # noqa: F401
+    client.TOO_MANY_REQUESTS = 429
diff --git a/roundup/cgi/client.py b/roundup/cgi/client.py
index 376c6762f..234bb192f 100644
--- a/roundup/cgi/client.py
+++ b/roundup/cgi/client.py
@@ -709,9 +709,8 @@ def handle_rest(self):
             return
         except RateLimitExceeded as err:
             output = s2b("%s" % str(err))
-            # PYTHON2:FIXME http_.client.TOO_MANY_REQUESTS missing
-            # python2 so use numeric code.
-            self.reject_request(output, status=429)
+            self.reject_request(output,
+                                status=http_.client.TOO_MANY_REQUESTS)
             return
 
         # verify Origin is allowed on all requests including GET.
@@ -1156,7 +1155,8 @@ def authenticate_bearer_token(self, challenge):
         # If second or later tokens are < 32 chars, the config system
         # stops the tracker from starting so insecure tokens can not
         # be used.
-        if len(self.db.config.WEB_JWT_SECRET[0]) < 32:
+        CHARS_FOR_256_BIT_KEY = 32
+        if len(self.db.config.WEB_JWT_SECRET[0]) < CHARS_FOR_256_BIT_KEY:
             # no support for jwt, this is fine.
             self.setHeader("WWW-Authenticate", "Basic")
             raise LoginError('Support for jwt disabled by admin.')

From db5312bab10e6fe68558ead1d26917cab64e9aee Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 15 Dec 2024 00:36:19 -0500
Subject: [PATCH 071/398] fix(web): issue2551381 - roundup-server parses
 multiple '?" incorrectly.

Change 'rfind()' to 'find()' to locate the first unencoded/unescaped '?'
in a URL. End the path component of the url at that point.

This matches https://www.rfc-editor.org/rfc/rfc3986#section-3.4.
---
 roundup/scripts/roundup_server.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roundup/scripts/roundup_server.py b/roundup/scripts/roundup_server.py
index 9d3ca24f5..b0f595e56 100644
--- a/roundup/scripts/roundup_server.py
+++ b/roundup/scripts/roundup_server.py
@@ -398,7 +398,7 @@ def inner_run_cgi(self):
 
             return
 
-        i = self.path.rfind('?')
+        i = self.path.find('?')
         if i >= 0:
             # rest starts with /, query is without ?
             rest, query = self.path[:i], self.path[i+1:]

From 9eb6fd67b62293397de3b394ea25e5b0ef6da4ce Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 15 Dec 2024 00:42:18 -0500
Subject: [PATCH 072/398] fix(web): issue2551381 - update changelog.

---
 CHANGES.txt | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGES.txt b/CHANGES.txt
index c846609bf..b09231b70 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -39,6 +39,8 @@ Fixed:
 - issue2551356 - Add etag header when If-Modified-Since GET request
   returns not-modified (304). Breaking change to function signature
   for client.py-Client::_serve_file(). (John Rouillard)
+- issue2551381 - roundup-server parses URI's with multiple '?"
+  incorrectly. (John Rouillard)
 
 Features:
 

From 8b8d1e3e7a7bd0812d6eea28d1640d31ef829253 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 15 Dec 2024 01:35:51 -0500
Subject: [PATCH 073/398] doc: fix typo.

---
 doc/rest.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/rest.txt b/doc/rest.txt
index 2c69ed599..1befc8ed4 100644
--- a/doc/rest.txt
+++ b/doc/rest.txt
@@ -1080,7 +1080,7 @@ gets a dictionary of keys/values for the new item. It returns the same
 parameters as the GET method after successful creation.
 
 If you perform a get on an item with ``@verbose=0``, it is in the
-correct form to use as a the payload of a post.
+correct form to use as the payload of a post.
 
 
 Safely Re-sending POST

From 0e10c25e914788814a15c0bfc4e8cbb8d31b5e36 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 15 Dec 2024 01:57:42 -0500
Subject: [PATCH 074/398] fix(web) issue2551382 - 409 not 400 errors returned

invalid integer values for @verbose, @page_* values in rest uri's
generated a 409 (Update Conflict) error not a generic 400 error.

Found it when I was working on adding fuzz testing to check error
handling for query parameters in REST url's.

This also ads the tests in test_liveserver that found the error. Also
refactored tst_liveserver to allow resuse of session login method for
the new fuzz testing class as well.
---
 CHANGES.txt             |  2 +
 roundup/rest.py         | 18 ++++++--
 test/test_liveserver.py | 96 ++++++++++++++++++++++++++++++++++++++---
 3 files changed, 108 insertions(+), 8 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index b09231b70..f5f87cab5 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -41,6 +41,8 @@ Fixed:
   for client.py-Client::_serve_file(). (John Rouillard)
 - issue2551381 - roundup-server parses URI's with multiple '?"
   incorrectly. (John Rouillard)
+- issue2551382 - invalid @verbose, @page_* values in rest uri's
+  generate 409 not 400 error. (John Rouillard)
 
 Features:
 
diff --git a/roundup/rest.py b/roundup/rest.py
index 12b55cef0..771eb9760 100644
--- a/roundup/rest.py
+++ b/roundup/rest.py
@@ -811,10 +811,18 @@ def get_collection(self, class_name, input_payload):
             value = form_field.value
             if key.startswith("@page_"):  # serve the paging purpose
                 key = key[6:]
-                value = int(value)
+                try:
+                    value = int(value)
+                except ValueError as e:
+                    raise UsageError("When using @page_%s: %s" %
+                                     (key, e.args[0]))
                 page[key] = value
             elif key == "@verbose":
-                verbose = int(value)
+                try:
+                    verbose = int(value)
+                except ValueError as e:
+                    raise UsageError("When using @verbose: %s" %
+                                     (e.args[0]))
             elif key in ["@fields", "@attrs"]:
                 f = value.split(",")
                 if len(f) == 1:
@@ -1129,7 +1137,11 @@ def get_element(self, class_name, item_id, input_payload):
                 # used only if no @fields/@attrs
                 protected = value.lower() == "true"
             elif key == "@verbose":
-                verbose = int(value)
+                try:
+                    verbose = int(value)
+                except ValueError as e:
+                    raise UsageError("When using @verbose: %s" %
+                                     (e.args[0]))
 
         result = {}
         if props is None:
diff --git a/test/test_liveserver.py b/test/test_liveserver.py
index de6033023..cd62cd382 100644
--- a/test/test_liveserver.py
+++ b/test/test_liveserver.py
@@ -20,6 +20,37 @@
     skip_requests = mark_class(pytest.mark.skip(
         reason='Skipping liveserver tests: requests library not available'))
 
+try:
+    import hypothesis
+    skip_hypothesis = lambda func, *args, **kwargs: func
+
+    # ruff: noqa: E402
+    from hypothesis import example, given, settings
+    from hypothesis.strategies import binary, characters, none, one_of, sampled_from, text
+
+except ImportError:
+    from .pytest_patcher import mark_class
+    skip_hypothesis = mark_class(pytest.mark.skip(
+        reason='Skipping hypothesis liveserver tests: hypothesis library not available'))
+
+    # define a dummy decorator that can take args
+    def noop_decorators_with_args(*args, **kwargs): 
+        def noop_decorators(func):
+            def internal():
+                pass
+            return internal
+        return noop_decorators
+
+    # define a dummy strategy
+    def noop_strategy(*args, **kwargs):
+        pass
+
+    # define the decorator functions
+    example = given = settings = noop_decorators_with_args
+    # and stratgies using in decorators
+    binary = characters = none = one_of = sampled_from = text = noop_strategy
+
+
 try:
     import brotli
     skip_brotli = lambda func, *args, **kwargs: func
@@ -149,11 +180,9 @@ def create_app(self):
             # doesn't support the max bytes to read argument.
             return RequestDispatcher(self.dirname)
 
-
-@skip_requests
-class BaseTestCases(WsgiSetup):
-    """Class with all tests to run against wsgi server. Is reused when
-       wsgi server is started with various feature flags
+class ClientSetup():
+    """ Utility programs for the client querying a server.
+        Just a login session at the moment but more to come I am sure.
     """
 
     def create_login_session(self, username="admin", password="sekrit",
@@ -176,6 +205,63 @@ def create_login_session(self, username="admin", password="sekrit",
             return session
         return session, response
 
+
+@skip_hypothesis
+class FuzzGetUrls(WsgiSetup, ClientSetup):
+
+    _max_examples = 100
+
+    @given(sampled_from(['@verbose', '@page_size', '@page_index']),
+           one_of(characters(),text(min_size=1)))
+    @settings(max_examples=_max_examples,
+              deadline=10000) # 10000ms
+    def test_class_url_param_accepting_integer_values(self, param, value):
+        """Tests all integer args for rest url. @page_* is the
+           same code for all *.
+        """
+        session, _response = self.create_login_session()
+        url = '%s/rest/data/status' % (self.url_base())
+        query = '%s=%s'  % (param, value)
+        f = session.get(url, params=query)
+        try:
+            if int(value) >= 0:
+                self.assertEqual(f.status_code, 200)
+        except ValueError:
+            if value in ['#', '&']:
+                self.assertEqual(f.status_code, 200)
+            else:
+                # invalid value for param
+                self.assertEqual(f.status_code, 400)
+
+    @given(sampled_from(['@verbose']),
+           one_of(characters(),text(min_size=1)))
+    @settings(max_examples=_max_examples,
+              deadline=10000) # 10000ms
+    def test_element_url_param_accepting_integer_values(self, param, value):
+        """Tests all integer args for rest url. @page_* is the
+           same code for all *.
+        """
+        session, _response = self.create_login_session()
+        url = '%s/rest/data/status/1' % (self.url_base())
+        query = '%s=%s'  % (param, value)
+        f = session.get(url, params=query)
+        try:
+            if int(value) >= 0:
+                self.assertEqual(f.status_code, 200)
+        except ValueError:
+            if value in ['#', '&']:
+                self.assertEqual(f.status_code, 200)
+            else:
+                # invalid value for param
+                self.assertEqual(f.status_code, 400)
+
+
+@skip_requests
+class BaseTestCases(WsgiSetup, ClientSetup):
+    """Class with all tests to run against wsgi server. Is reused when
+       wsgi server is started with various feature flags
+    """
+
     def test_cookie_attributes(self):
         session, _response = self.create_login_session()
 

From 9dfb1e5c38205e0066cb956b6f5af00ce7de4954 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 15 Dec 2024 02:34:57 -0500
Subject: [PATCH 075/398] fix(web) issue2551382 - case 1# or 1& failing.

HAndle case for integer followed by a url delimiter. e.g. 1# and 1&
---
 test/test_liveserver.py | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/test/test_liveserver.py b/test/test_liveserver.py
index cd62cd382..f47968567 100644
--- a/test/test_liveserver.py
+++ b/test/test_liveserver.py
@@ -26,7 +26,7 @@
 
     # ruff: noqa: E402
     from hypothesis import example, given, settings
-    from hypothesis.strategies import binary, characters, none, one_of, sampled_from, text
+    from hypothesis.strategies import binary, characters, emails, none, one_of, sampled_from, text
 
 except ImportError:
     from .pytest_patcher import mark_class
@@ -48,7 +48,7 @@ def noop_strategy(*args, **kwargs):
     # define the decorator functions
     example = given = settings = noop_decorators_with_args
     # and stratgies using in decorators
-    binary = characters = none = one_of = sampled_from = text = noop_strategy
+    binary = characters = emails, none = one_of = sampled_from = text = noop_strategy
 
 
 try:
@@ -213,6 +213,7 @@ class FuzzGetUrls(WsgiSetup, ClientSetup):
 
     @given(sampled_from(['@verbose', '@page_size', '@page_index']),
            one_of(characters(),text(min_size=1)))
+    @example("@verbose", "1#")
     @settings(max_examples=_max_examples,
               deadline=10000) # 10000ms
     def test_class_url_param_accepting_integer_values(self, param, value):
@@ -224,10 +225,13 @@ def test_class_url_param_accepting_integer_values(self, param, value):
         query = '%s=%s'  % (param, value)
         f = session.get(url, params=query)
         try:
+            # test case '0#'
+            if len(value) > 1 and value[-1] in ('#', '&'):
+                value = value[:-1]
             if int(value) >= 0:
                 self.assertEqual(f.status_code, 200)
         except ValueError:
-            if value in ['#', '&']:
+            if value in ('#', '&'):
                 self.assertEqual(f.status_code, 200)
             else:
                 # invalid value for param
@@ -235,6 +239,7 @@ def test_class_url_param_accepting_integer_values(self, param, value):
 
     @given(sampled_from(['@verbose']),
            one_of(characters(),text(min_size=1)))
+    @example("@verbose", "1#")
     @settings(max_examples=_max_examples,
               deadline=10000) # 10000ms
     def test_element_url_param_accepting_integer_values(self, param, value):
@@ -246,6 +251,9 @@ def test_element_url_param_accepting_integer_values(self, param, value):
         query = '%s=%s'  % (param, value)
         f = session.get(url, params=query)
         try:
+            # test case '0#'
+            if len(value) > 1 and value[-1] in ('#', '&'):
+                value = value[:-1]
             if int(value) >= 0:
                 self.assertEqual(f.status_code, 200)
         except ValueError:
@@ -255,7 +263,6 @@ def test_element_url_param_accepting_integer_values(self, param, value):
                 # invalid value for param
                 self.assertEqual(f.status_code, 400)
 
-
 @skip_requests
 class BaseTestCases(WsgiSetup, ClientSetup):
     """Class with all tests to run against wsgi server. Is reused when

From 89c98145dc42d1388f9122838bae6fb9e340a953 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 16 Dec 2024 19:19:07 -0500
Subject: [PATCH 076/398] fix(web) issue2551382 - handle crash in request call
 in test

due to invalid utf8 with surrogate. Ci reports this failure in the
requests call from the test case:

>           string = string.encode(encoding, errors)
E           UnicodeEncodeError: 'utf-8' codec can't encode character
'\ud800' in position 48: surrogates not allowed
E           Falsifying example:
test_class_url_param_accepting_integer_values(
E               self=<test.test_liveserver.FuzzGetUrls
testMethod=test_class_url_param_accepting_integer_values>,
E               param='@verbose',  # or any other generated value
E               value='\ud800',
E           )
E           Explanation:
E               These lines were always and only run by failing
examples:
E
/opt/hostedtoolcache/Python/3.13.1/x64/lib/python3.13/site-packages/requests/utils.py:675
E
E           You can reproduce this example by temporarily adding
@reproduce_failure('6.122.3', b'AAAAAQDXAA==') as a decorator on your
test case
---
 test/test_liveserver.py | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/test/test_liveserver.py b/test/test_liveserver.py
index f47968567..9d9e16494 100644
--- a/test/test_liveserver.py
+++ b/test/test_liveserver.py
@@ -25,7 +25,7 @@
     skip_hypothesis = lambda func, *args, **kwargs: func
 
     # ruff: noqa: E402
-    from hypothesis import example, given, settings
+    from hypothesis import example, given, reproduce_failure, settings
     from hypothesis.strategies import binary, characters, emails, none, one_of, sampled_from, text
 
 except ImportError:
@@ -46,7 +46,7 @@ def noop_strategy(*args, **kwargs):
         pass
 
     # define the decorator functions
-    example = given = settings = noop_decorators_with_args
+    example = given = reproduce_failure = settings = noop_decorators_with_args
     # and stratgies using in decorators
     binary = characters = emails, none = one_of = sampled_from = text = noop_strategy
 
@@ -237,8 +237,7 @@ def test_class_url_param_accepting_integer_values(self, param, value):
                 # invalid value for param
                 self.assertEqual(f.status_code, 400)
 
-    @given(sampled_from(['@verbose']),
-           one_of(characters(),text(min_size=1)))
+    @given(sampled_from(['@verbose']), text(min_size=1))
     @example("@verbose", "1#")
     @settings(max_examples=_max_examples,
               deadline=10000) # 10000ms

From 71a1d55c8cec0ee803d0cf01c18fd53136d961dd Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 16 Dec 2024 21:24:59 -0500
Subject: [PATCH 077/398] fix(web) issue2551382 - fix more integer param test
 cases

fix bad unicode in second test. Also be smarter about validating
the value I was missing correct handling of other string variants
with # or & embedded in them. E.G. 123#dfg - should return 200
as Roundup sees value 123.
---
 test/test_liveserver.py | 33 +++++++++++++++++++--------------
 1 file changed, 19 insertions(+), 14 deletions(-)

diff --git a/test/test_liveserver.py b/test/test_liveserver.py
index 9d9e16494..fd32b0c3c 100644
--- a/test/test_liveserver.py
+++ b/test/test_liveserver.py
@@ -212,8 +212,9 @@ class FuzzGetUrls(WsgiSetup, ClientSetup):
     _max_examples = 100
 
     @given(sampled_from(['@verbose', '@page_size', '@page_index']),
-           one_of(characters(),text(min_size=1)))
+           text(min_size=1))
     @example("@verbose", "1#")
+    @example("@verbose", "#1stuff")
     @settings(max_examples=_max_examples,
               deadline=10000) # 10000ms
     def test_class_url_param_accepting_integer_values(self, param, value):
@@ -225,38 +226,42 @@ def test_class_url_param_accepting_integer_values(self, param, value):
         query = '%s=%s'  % (param, value)
         f = session.get(url, params=query)
         try:
-            # test case '0#'
-            if len(value) > 1 and value[-1] in ('#', '&'):
-                value = value[:-1]
-            if int(value) >= 0:
+            # test case '0#' '12345#stuff' '12345&stuff'
+            match = re.match('(^[0-9]*)[#&]', value)
+            if match is not None:
+                value = match[1]
+            elif int(value) >= 0:
                 self.assertEqual(f.status_code, 200)
         except ValueError:
-            if value in ('#', '&'):
+            # test case '#' '#0', '&', '&anything here really'
+            if value[0] in ('#', '&'):
                 self.assertEqual(f.status_code, 200)
             else:
                 # invalid value for param
                 self.assertEqual(f.status_code, 400)
 
     @given(sampled_from(['@verbose']), text(min_size=1))
-    @example("@verbose", "1#")
+    @example("@verbose", "10#")
+    @example("@verbose", u'Ã˜\U000dd990')
     @settings(max_examples=_max_examples,
               deadline=10000) # 10000ms
     def test_element_url_param_accepting_integer_values(self, param, value):
-        """Tests all integer args for rest url. @page_* is the
-           same code for all *.
+        """Tests args accepting int for rest url.
         """
         session, _response = self.create_login_session()
         url = '%s/rest/data/status/1' % (self.url_base())
         query = '%s=%s'  % (param, value)
         f = session.get(url, params=query)
         try:
-            # test case '0#'
-            if len(value) > 1 and value[-1] in ('#', '&'):
-                value = value[:-1]
-            if int(value) >= 0:
+            # test case '0#' '12345#stuff' '12345&stuff'
+            match = re.match('(^[0-9]*)[#&]', value)
+            if match is not None:
+                value = match[1]
+            elif int(value) >= 0:
                 self.assertEqual(f.status_code, 200)
         except ValueError:
-            if value in ['#', '&']:
+            # test case '#' '#0', '&', '&anything here really'
+            if value[0] in ('#', '&'):
                 self.assertEqual(f.status_code, 200)
             else:
                 # invalid value for param

From 8011187f42d303f1ff862f72b5b95ddb3bb7a94f Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 16 Dec 2024 21:29:07 -0500
Subject: [PATCH 078/398] fix(web) issue2551382 - fix missing hypothesis case

Syntax error if hypothesis is not importable. Only affects python2 CI.
---
 test/test_liveserver.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/test_liveserver.py b/test/test_liveserver.py
index fd32b0c3c..6e6284f47 100644
--- a/test/test_liveserver.py
+++ b/test/test_liveserver.py
@@ -48,7 +48,7 @@ def noop_strategy(*args, **kwargs):
     # define the decorator functions
     example = given = reproduce_failure = settings = noop_decorators_with_args
     # and stratgies using in decorators
-    binary = characters = emails, none = one_of = sampled_from = text = noop_strategy
+    binary = characters = emails = none = one_of = sampled_from = text = noop_strategy
 
 
 try:

From a32c57e3f722f6344b16d9def838ebcce77d2de8 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Tue, 17 Dec 2024 19:42:46 -0500
Subject: [PATCH 079/398] fix(REST): issue2551383; improve errors for bad json,
 fix PUT docs

While adding fuzz testing for email addresses via REST
/rest/data/user/1/address, I had an error when setting the address to
the same value it currently had. Traced this to a bug in
userauditor.py. Fixed the bug. Documented in upgrading.txt.

While trying to track down issue, I realized invalid json was being
accepted without error. So I fixed the code that parses the json and
have it return an error. Also modified some tests that broke (used
invalid json, or passed body (e.g. DELETE) but shouldn't have. Add
tests for bad json to verify new code.

Fixed test that wasn't initializing the body_file in each loop, so the
test wasn't actually supplying a body.

Also realised PUT documentation was not correct. Output format isn't
quite like GET.

Fuss tests for email address also added.
---
 CHANGES.txt                                   | 11 ++-
 doc/rest.txt                                  | 40 +++++++-
 doc/upgrading.txt                             | 26 +++++
 roundup/rest.py                               | 18 +++-
 .../classic/detectors/userauditor.py          |  4 +
 .../templates/devel/detectors/userauditor.py  |  4 +
 .../templates/jinja2/detectors/userauditor.py |  4 +
 .../minimal/detectors/userauditor.py          |  4 +
 .../responsive/detectors/userauditor.py       |  4 +
 test/rest_common.py                           | 97 +++++++++++++++++--
 test/test_liveserver.py                       | 37 ++++++-
 11 files changed, 227 insertions(+), 22 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index f5f87cab5..746ac31cd 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -43,6 +43,12 @@ Fixed:
   incorrectly. (John Rouillard)
 - issue2551382 - invalid @verbose, @page_* values in rest uri's
   generate 409 not 400 error. (John Rouillard)
+- fix issues with rest doc and use of PUT on a property item. Response
+  is similar to use of PUT on the item, not a GET on the
+  item. Discovered while fuzz testing. (John Rouillard)
+- issue2551383 - Setting same address via REST PUT command results in
+  an error. Now the userauditor does not trigger an error if a user
+  sets the primary address to the existing value. (John Rouillard)
 
 Features:
 
@@ -71,7 +77,10 @@ Features:
   endpoint. Raw file/msg data can be retrieved using the
   /binary_content attribute and an Accept header to select the mime
   type for the data (e.g. image/png for a png file). The existing html
-  interface method still works and is supported, but is legacy.
+  interface method still works and is supported, but is legacy. (John
+  Rouillard) 
+- added fuzz testing for some code. Found issue2551382 and
+  others. (John Rouillard)
 
 2024-07-13 2.4.0
 
diff --git a/doc/rest.txt b/doc/rest.txt
index 1befc8ed4..76af6e1fa 100644
--- a/doc/rest.txt
+++ b/doc/rest.txt
@@ -1392,10 +1392,12 @@ Other Supported Methods for Items
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 The method ``PUT`` is allowed on individual items, e.g.
-``/data/issue/42`` On success it returns the same parameters as the
-respective ``GET`` method. Note that for ``PUT`` an Etag has to be
-supplied, either in the request header or as an @etag parameter. An
-example::
+``/data/issue/42`` On success it returns a data structure similar to
+the respective ``GET`` method. However it is only concerned with the
+changes that have occurred. Since it is not a full ``GET`` request, it
+doesn't include an etag or unchanged attributes. Note that for ``PUT``
+an Etag has to be supplied, either in the request header or as an
+@etag parameter. An example::
 
   curl -u admin:admin -X PUT \
      --header 'Referer: https://example.com/demo/' \
@@ -1615,7 +1617,22 @@ Other Supported Methods for fields
 
 The method ``PUT`` is allowed on a property e.g.,
 ``/data/issue/42/title``. On success it returns the same parameters as
-the respective ``GET`` method. Note that for ``PUT`` an Etag has to be
+the respective ``PUT`` method on the item. For example::
+
+  {
+    "data": {
+        "id": "42",
+        "type": "issue",
+        "link": "https://.../demo/rest/data/issue/42",
+        "attribute": {
+            "title": "this is a new title"
+        }
+    }
+  }
+
+If the new value for the title was the same as on the server, the
+attribute property would be empty since the value was not changed.
+Note that for ``PUT`` an Etag has to be
 supplied, either in the request header or as an @etag parameter.
 Example using multipart/form-data rather than json::
 
@@ -2438,3 +2455,16 @@ Rate limit tests::
 
 will show you the number of remaining requests to the REST interface
 for the user identified by password.
+
+
+Notes V2 API
+~~~~~~~~~~~~
+
+These may never be implemented but, some nits to consider.
+
+The shape of a GET and PUT/PATCH responses are different. "attributes"
+is used for GET and "attribute" is used with PATCH/PUT. A PATCH or a
+PUT can update multiple properties when used with an item endpoint.
+"attribute" kind of makes sense when used with a property endpoint
+but.... Maybe standardize on one shape so the client doesn't have to
+special case?
diff --git a/doc/upgrading.txt b/doc/upgrading.txt
index 8439ac54e..729098dd0 100644
--- a/doc/upgrading.txt
+++ b/doc/upgrading.txt
@@ -133,6 +133,32 @@ to::
 at the top of both files. The icing macro used in other tracker
 templates was renamed to frame in this tracker template.
 
+Update userauditor.py detector (recommended)
+--------------------------------------------
+
+When using the REST interface, setting the address property of the
+user to the same value it currently has resulted in an error.
+
+If you have not changed your userauditor, you can copy one from any of
+the supplied templates in the ``detectors/userauditor.py`` file. Use
+``roundup-admin templates`` to find a list of template directories.
+
+If you have changed your userauditor from the stock version, apply the
+following diff::
+
+               raise ValueError('Email address syntax is invalid
+               "%s"'%address)
+  
+           check_main = db.user.stringFind(address=address)
+  +        # allow user to set same address via rest
+  +        if check_main:
+  +            check_main = nodeid not in check_main
+  +
+         # make sure none of the alts are owned by anyone other than us (x!=nodeid)
+
+add the lines marked with ``+`` in the file in the location after
+check_main is assigned.
+
 More secure session cookie handling (info)
 ------------------------------------------
 
diff --git a/roundup/rest.py b/roundup/rest.py
index 771eb9760..1a9b94b22 100644
--- a/roundup/rest.py
+++ b/roundup/rest.py
@@ -2729,17 +2729,27 @@ class SimulateFieldStorageFromJson():
 
     '''
     def __init__(self, json_string):
-        ''' Parse the json string into an internal dict. '''
+        '''Parse the json string into an internal dict.
+
+            Because spec for rest post once exactly (POE) shows
+            posting empty content. An empty string results in an empty
+            dict, not a json parse error.
+        '''
         def raise_error_on_constant(x):
             raise ValueError("Unacceptable number: %s" % x)
+        if json_string == "":
+            self.json_dict = {}
+            self.value = None
+            return
+
         try:
             self.json_dict = json.loads(json_string,
                                     parse_constant=raise_error_on_constant)
             self.value = [self.FsValue(index, self.json_dict[index])
                           for index in self.json_dict]
-        except ValueError:
-            self.json_dict = {}
-            self.value = None
+        except (json.decoder.JSONDecodeError, ValueError) as e:
+            raise ValueError(e.args[0] + ". JSON is: " + json_string)
+
 
     class FsValue:
         '''Class that does nothing but response to a .value property '''
diff --git a/share/roundup/templates/classic/detectors/userauditor.py b/share/roundup/templates/classic/detectors/userauditor.py
index 562dce7f6..d33ca0dc1 100644
--- a/share/roundup/templates/classic/detectors/userauditor.py
+++ b/share/roundup/templates/classic/detectors/userauditor.py
@@ -68,6 +68,10 @@ def audit_user_fields(db, cl, nodeid, newvalues):
             raise ValueError('Email address syntax is invalid "%s"'%address)
 
         check_main = db.user.stringFind(address=address)
+        # allow user to set same address via rest
+        if check_main:
+            check_main = nodeid not in check_main
+
         # make sure none of the alts are owned by anyone other than us (x!=nodeid)
         check_alts = [x for x in db.user.filter(None, {'alternate_addresses' : address}) if x != nodeid]
         if check_main or check_alts:
diff --git a/share/roundup/templates/devel/detectors/userauditor.py b/share/roundup/templates/devel/detectors/userauditor.py
index 562dce7f6..d33ca0dc1 100644
--- a/share/roundup/templates/devel/detectors/userauditor.py
+++ b/share/roundup/templates/devel/detectors/userauditor.py
@@ -68,6 +68,10 @@ def audit_user_fields(db, cl, nodeid, newvalues):
             raise ValueError('Email address syntax is invalid "%s"'%address)
 
         check_main = db.user.stringFind(address=address)
+        # allow user to set same address via rest
+        if check_main:
+            check_main = nodeid not in check_main
+
         # make sure none of the alts are owned by anyone other than us (x!=nodeid)
         check_alts = [x for x in db.user.filter(None, {'alternate_addresses' : address}) if x != nodeid]
         if check_main or check_alts:
diff --git a/share/roundup/templates/jinja2/detectors/userauditor.py b/share/roundup/templates/jinja2/detectors/userauditor.py
index 562dce7f6..d33ca0dc1 100644
--- a/share/roundup/templates/jinja2/detectors/userauditor.py
+++ b/share/roundup/templates/jinja2/detectors/userauditor.py
@@ -68,6 +68,10 @@ def audit_user_fields(db, cl, nodeid, newvalues):
             raise ValueError('Email address syntax is invalid "%s"'%address)
 
         check_main = db.user.stringFind(address=address)
+        # allow user to set same address via rest
+        if check_main:
+            check_main = nodeid not in check_main
+
         # make sure none of the alts are owned by anyone other than us (x!=nodeid)
         check_alts = [x for x in db.user.filter(None, {'alternate_addresses' : address}) if x != nodeid]
         if check_main or check_alts:
diff --git a/share/roundup/templates/minimal/detectors/userauditor.py b/share/roundup/templates/minimal/detectors/userauditor.py
index 562dce7f6..d33ca0dc1 100644
--- a/share/roundup/templates/minimal/detectors/userauditor.py
+++ b/share/roundup/templates/minimal/detectors/userauditor.py
@@ -68,6 +68,10 @@ def audit_user_fields(db, cl, nodeid, newvalues):
             raise ValueError('Email address syntax is invalid "%s"'%address)
 
         check_main = db.user.stringFind(address=address)
+        # allow user to set same address via rest
+        if check_main:
+            check_main = nodeid not in check_main
+
         # make sure none of the alts are owned by anyone other than us (x!=nodeid)
         check_alts = [x for x in db.user.filter(None, {'alternate_addresses' : address}) if x != nodeid]
         if check_main or check_alts:
diff --git a/share/roundup/templates/responsive/detectors/userauditor.py b/share/roundup/templates/responsive/detectors/userauditor.py
index 562dce7f6..d33ca0dc1 100644
--- a/share/roundup/templates/responsive/detectors/userauditor.py
+++ b/share/roundup/templates/responsive/detectors/userauditor.py
@@ -68,6 +68,10 @@ def audit_user_fields(db, cl, nodeid, newvalues):
             raise ValueError('Email address syntax is invalid "%s"'%address)
 
         check_main = db.user.stringFind(address=address)
+        # allow user to set same address via rest
+        if check_main:
+            check_main = nodeid not in check_main
+
         # make sure none of the alts are owned by anyone other than us (x!=nodeid)
         check_alts = [x for x in db.user.filter(None, {'alternate_addresses' : address}) if x != nodeid]
         if check_main or check_alts:
diff --git a/test/rest_common.py b/test/rest_common.py
index 522fddda1..3ab3484ef 100644
--- a/test/rest_common.py
+++ b/test/rest_common.py
@@ -2427,6 +2427,89 @@ def testDispatchBadAccept(self):
         json_dict = json.loads(b2s(results))
         self.assertIn('Unable to parse Accept Header. Invalid param: foo. Acceptable types: */*, application/json', json_dict['error']['msg'])
 
+    def testBadJson(self):
+        '''Run some JSON we don't accept through the wringer
+        '''
+        body=b'{ "title": "Joe Doe has problems", \
+                 "nosy": [ "1", "3" ], \
+                 "assignedto": "2", \
+                 "abool": true, \
+                 "afloat": 2.3, \
+                 "anint": Infinity }'
+
+        expected={ "error":
+                   {"status": 400,
+                    "msg": ("Unacceptable number: Infinity. JSON is: "
+                            + b2s(body)),
+                   }
+        }
+
+        env = { "CONTENT_TYPE": "application/json",
+                "CONTENT_LENGTH": len(body),
+                "REQUEST_METHOD": "PUT"
+        }
+        self.server.client.env.update(env)
+        headers={"accept": "application/zot; version=1; q=0.5",
+                 "content-type": env['CONTENT_TYPE'],
+                 "content-length": env['CONTENT_LENGTH'],
+        }
+
+        self.headers=headers
+        # we need to generate a FieldStorage the looks like
+        #  FieldStorage(None, None, 'string') rather than
+        #  FieldStorage(None, None, [])
+        body_file=BytesIO(body)  # FieldStorage needs a file
+        form = client.BinaryFieldStorage(body_file,
+                                headers=headers,
+                                environ=env)
+        self.server.client.request.headers.get=self.get_header
+        results = self.server.dispatch(env["REQUEST_METHOD"],
+                            "/rest/data/issue/1",
+                            form)
+
+        self.assertEqual(json.loads(results), expected)
+
+        body=b'{ "title": "Joe Doe has problems", \
+                 nosy: [ "1", "3" ], \
+                 "assignedto": "2", \
+                 "abool": true, \
+                 "afloat": 2.3, \
+                 "anint": Infinity }'
+        self.maxDiff = None
+        expected={ "error":
+                   {"status": 400,
+                    "msg": ("Expecting property name enclosed in double "
+                            "quotes: line 1 column 53 (char 52). JSON is: "
+                            + b2s(body)),
+                   }
+        }
+
+        env = { "CONTENT_TYPE": "application/json",
+                "CONTENT_LENGTH": len(body),
+                "REQUEST_METHOD": "PUT"
+        }
+        self.server.client.env.update(env)
+        headers={"accept": "application/zot; version=1; q=0.5",
+                 "content-type": env['CONTENT_TYPE'],
+                 "content-length": env['CONTENT_LENGTH'],
+        }
+
+        self.headers=headers
+        # we need to generate a FieldStorage the looks like
+        #  FieldStorage(None, None, 'string') rather than
+        #  FieldStorage(None, None, [])
+        body_file=BytesIO(body)  # FieldStorage needs a file
+        form = client.BinaryFieldStorage(body_file,
+                                headers=headers,
+                                environ=env)
+        self.server.client.request.headers.get=self.get_header
+        results = self.server.dispatch(env["REQUEST_METHOD"],
+                            "/rest/data/issue/1",
+                            form)
+
+        self.assertEqual(json.loads(results), expected)
+
+
     def testStatsGen(self):
         # check stats being returned by put and get ops
         # using dispatch which parses the @stats query param
@@ -2835,27 +2918,20 @@ def testDispatch(self):
         etag = calculate_etag(self.db.issue.getnode("1"),
                               self.db.config['WEB_SECRET_KEY'])
         etagb = etag.strip ('"')
-        env = {"CONTENT_TYPE": "application/json",
-               "CONTENT_LEN": 0,
-               "REQUEST_METHOD": "DELETE" }
+        env = {"REQUEST_METHOD": "DELETE" }
         self.server.client.env.update(env)
         # use text/plain header and request json output by appending
         # .json to the url.
         headers={"accept": "text/plain",
-                 "content-type": env['CONTENT_TYPE'],
                  "if-match": '"%s"'%etagb,
                  "content-length": 0,
         }
         self.headers=headers
-        body_file=BytesIO(b'')  # FieldStorage needs a file
-        form = client.BinaryFieldStorage(body_file,
-                                headers=headers,
-                                environ=env)
         self.server.client.request.headers.get=self.get_header
         self.db.setCurrentUser('admin') # must be admin to delete issue
         results = self.server.dispatch('DELETE',
                             "/rest/data/issue/1.json",
-                            form)
+                            self.empty_form)
         self.assertEqual(self.server.client.response_code, 200)
         print(results)
         json_dict = json.loads(b2s(results))
@@ -3213,7 +3289,6 @@ def testMethodOverride(self):
                 "CONTENT_LENGTH": len(body),
                 "REQUEST_METHOD": "POST"
         }
-        body_file=BytesIO(body)  # FieldStorage needs a file
         self.server.client.request.headers.get=self.get_header
         for method in ( "GET", "PUT", "PATCH" ):
             headers={"accept": "application/json; version=1",
@@ -3221,6 +3296,8 @@ def testMethodOverride(self):
                      "content-length": len(body),
                      "x-http-method-override": "DElETE",
                  }
+            body_file=BytesIO(body)  # FieldStorage needs a file
+
             self.headers=headers
             form = client.BinaryFieldStorage(body_file,
                                          headers=headers,
diff --git a/test/test_liveserver.py b/test/test_liveserver.py
index 6e6284f47..ebc85912f 100644
--- a/test/test_liveserver.py
+++ b/test/test_liveserver.py
@@ -216,7 +216,7 @@ class FuzzGetUrls(WsgiSetup, ClientSetup):
     @example("@verbose", "1#")
     @example("@verbose", "#1stuff")
     @settings(max_examples=_max_examples,
-              deadline=10000) # 10000ms
+              deadline=10000) # in ms
     def test_class_url_param_accepting_integer_values(self, param, value):
         """Tests all integer args for rest url. @page_* is the
            same code for all *.
@@ -244,7 +244,7 @@ def test_class_url_param_accepting_integer_values(self, param, value):
     @example("@verbose", "10#")
     @example("@verbose", u'Ã˜\U000dd990')
     @settings(max_examples=_max_examples,
-              deadline=10000) # 10000ms
+              deadline=10000) # in ms
     def test_element_url_param_accepting_integer_values(self, param, value):
         """Tests args accepting int for rest url.
         """
@@ -267,6 +267,39 @@ def test_element_url_param_accepting_integer_values(self, param, value):
                 # invalid value for param
                 self.assertEqual(f.status_code, 400)
 
+    @given(emails())
+    @settings(max_examples=_max_examples,
+              deadline=10000) # in ms
+    def test_email_param(self,email):
+        session, _response = self.create_login_session()
+        url = '%s/rest/data/user/1/address' % (self.url_base())
+        headers = {"Accept": "application/json",
+                   "Content-Type": "application/json",
+                   "x-requested-with": "rest",
+                   "Origin": self.url_base(),
+                   "Referer": self.url_base()
+                   }
+
+                   #--header 'If-Match: "e2e6cc43c3475a4a3d9e5343617c11c3"' \
+        
+        f = session.get(url)
+        stored_email = f.json()['data']['data']
+        headers['If-Match'] = f.headers['etag']
+
+        payload = {'data': email}
+        f = session.put(url, json=payload, headers=headers)
+
+        self.assertEqual(f.status_code, 200)
+
+        if stored_email == email:
+            # if the email we are setting is the same as present, we
+            # don't make a change so the attribute dict is empty aka false.
+            self.assertEqual(f.json()['data']['attribute'], {})
+        else:
+            self.assertEqual(f.json()['data']['attribute']['address'],
+                         email)
+
+
 @skip_requests
 class BaseTestCases(WsgiSetup, ClientSetup):
     """Class with all tests to run against wsgi server. Is reused when

From 4039c145f8a35e6aba8f1ac39c272c9ba46d70b7 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Tue, 17 Dec 2024 20:45:28 -0500
Subject: [PATCH 080/398] test: add file encoding marker so python2 can run

http://python.org/dev/peps/pep-0263/
---
 test/test_liveserver.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/test/test_liveserver.py b/test/test_liveserver.py
index ebc85912f..441480e7f 100644
--- a/test/test_liveserver.py
+++ b/test/test_liveserver.py
@@ -1,3 +1,5 @@
+# -*- coding: utf-8 -*-
+
 import shutil, errno, pytest, json, gzip, mimetypes, os, re
 
 from roundup import date as rdate

From fffab9b12a80acd973dba0e410856578c7777c21 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Tue, 17 Dec 2024 21:42:45 -0500
Subject: [PATCH 081/398] fix: make rest.py still load on python2, do not test
 bad json

It's not worth fixing the test to make it work on python2.

But do define the missing JSONDecodeError as it's base class
ValueError on python2.
---
 roundup/rest.py     |  7 ++++++-
 test/rest_common.py | 10 +++++++++-
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/roundup/rest.py b/roundup/rest.py
index 1a9b94b22..3cd615819 100644
--- a/roundup/rest.py
+++ b/roundup/rest.py
@@ -18,6 +18,11 @@
 from datetime import timedelta
 from hashlib import md5
 
+try:
+    from json import JSONDecodeError
+except ImportError:
+    JSONDecodeError = ValueError
+
 try:
     from urllib.parse import urlparse
 except ImportError:
@@ -2747,7 +2752,7 @@ def raise_error_on_constant(x):
                                     parse_constant=raise_error_on_constant)
             self.value = [self.FsValue(index, self.json_dict[index])
                           for index in self.json_dict]
-        except (json.decoder.JSONDecodeError, ValueError) as e:
+        except (JSONDecodeError, ValueError) as e:
             raise ValueError(e.args[0] + ". JSON is: " + json_string)
 
 
diff --git a/test/rest_common.py b/test/rest_common.py
index 3ab3484ef..36a63cff6 100644
--- a/test/rest_common.py
+++ b/test/rest_common.py
@@ -1,6 +1,7 @@
 import pytest
 import unittest
 import shutil
+import sys
 import errno
 
 from time import sleep
@@ -63,6 +64,13 @@ def dst(self, dt):
     skip_jwt = mark_class(pytest.mark.skip(
         reason='Skipping JWT tests: jwt library not available'))
 
+if sys.version_info[0] > 2:
+    skip_on_py2 = lambda func, *args, **kwargs: func
+else:
+    from .pytest_patcher import mark_class
+    skip_on_py2 =mark_class(pytest.mark.skip(
+        reason='Skipping test on Python 2'))
+
 NEEDS_INSTANCE = 1
 
 
@@ -2427,6 +2435,7 @@ def testDispatchBadAccept(self):
         json_dict = json.loads(b2s(results))
         self.assertIn('Unable to parse Accept Header. Invalid param: foo. Acceptable types: */*, application/json', json_dict['error']['msg'])
 
+    @skip_on_py2
     def testBadJson(self):
         '''Run some JSON we don't accept through the wringer
         '''
@@ -2509,7 +2518,6 @@ def testBadJson(self):
 
         self.assertEqual(json.loads(results), expected)
 
-
     def testStatsGen(self):
         # check stats being returned by put and get ops
         # using dispatch which parses the @stats query param

From c081df2cc38e9e3f7ddbcf1fb430c23a12312a83 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 18 Dec 2024 16:24:22 -0500
Subject: [PATCH 082/398] doc: update version in doc/mysql.txt; remove bdb
 support for mysql.

Remove obsolete info from doc and code.
---
 doc/mysql.txt                  | 7 ++-----
 roundup/backends/back_mysql.py | 3 ---
 2 files changed, 2 insertions(+), 8 deletions(-)

diff --git a/doc/mysql.txt b/doc/mysql.txt
index 71edee8c2..b07b0f035 100644
--- a/doc/mysql.txt
+++ b/doc/mysql.txt
@@ -13,11 +13,8 @@ Prerequisites
 To use MySQL as the backend for storing roundup data, you also need 
 to install:
 
-1. MySQL RDBMS 4.0.18 or higher - https://www.mysql.com/. Your MySQL
-   installation MUST support InnoDB tables (or Berkeley DB (BDB) tables
-   if you have no other choice). If you're running < 4.0.18 (but not <4.0)
-   then you'll need to use BDB to pass all unit tests. Edit the
-   ``roundup/backends/back_mysql.py`` file to enable DBD instead of InnoDB.
+1. MySQL RDBMS 8.0.11 or higher - https://www.mysql.com/. Your MySQL
+   installation MUST support InnoDB tables.
 2. Python MySQL interface - https://pypi.org/project/mysqlclient/
 
 
diff --git a/roundup/backends/back_mysql.py b/roundup/backends/back_mysql.py
index 71fe26584..f2da43d30 100644
--- a/roundup/backends/back_mysql.py
+++ b/roundup/backends/back_mysql.py
@@ -145,10 +145,7 @@ class Database(rdbms_common.Database):
     implements_intersect = 0
 
     # Backend for MySQL to use.
-    # InnoDB is faster, but if you're running <4.0.16 then you'll need to
-    # use BDB to pass all unit tests.
     mysql_backend = 'InnoDB'
-    # mysql_backend = 'BDB'
 
     hyperdb_to_sql_datatypes = {
         hyperdb.String:   'TEXT',

From abe4f609f2d7ced61011a8282e7c68d949d396b2 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 18 Dec 2024 20:22:58 -0500
Subject: [PATCH 083/398] issue251338 - xapian doesn't build in CI for 3.13
 python

ubuntu-latest is ubunut-24.04.

so re-enable xapian install for 3.13.

Also remove include for python-3.12/ ubuntu-24.04 as -latest covers
it.

Clean up excludes as only python-latest is used and exclude is used
for named version not the actual version (ubuntu-latest is not
excluded by ubuntu-24.04 even thugh that's it's actual version).
---
 .github/workflows/ci-test.yml | 16 ++++------------
 1 file changed, 4 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index d2e5e4b4c..8a3831de4 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -65,7 +65,7 @@ jobs:
         #os: [ubuntu-latest, macos-latest, windows-latest]
         # ubuntu latest 22.04 12/2022
         # ubuntu latest 24.04 12/2024
-        os: [ubuntu-24.04, ubuntu-latest, ubuntu-20.04]
+        os: [ubuntu-latest]
 
         # if the ones above fail. fail the build
         experimental: [ false ]
@@ -78,10 +78,6 @@ jobs:
             #  os: ubuntu-22.04
             #  experimental: true
             
-            # test on new default 24.04 runner 3.12 for 24.04
-            - python-version: 3.12
-              os: ubuntu-24.04
-
             # 3.6 not available on new 22.04 runners, so run on 20.04 ubuntu
             - python-version: 3.6
               os: ubuntu-20.04
@@ -91,10 +87,10 @@ jobs:
               os: ubuntu-22.04
 
         exclude:
-            # skip all python versions on 20.04/24.04 except
+            # skip all python versions on explicit 20.04/24.04 unless
             # explicitly included
-            - os: ubuntu-20.04
-            - os: ubuntu-24.04
+            #- os: ubuntu-20.04
+            #- os: ubuntu-24.04
 
             # disable when testing ubuntu-24.04 to speed up
             # runs.
@@ -256,10 +252,6 @@ jobs:
               pip install Markdown; fi
 
       - name: Install xapian
-        # comment the if: line out once we start running on
-        # ubuntu-24.04. 24.04 has xapian 1.4.22 which builds
-        # correctly with python 3.13.
-        if: matrix.python-version != '3.13'
         run: |
           set -xv
           sudo apt-get install libxapian-dev

From 9649afaa38f2d227297f185572d25c19a9dfe98c Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 18 Dec 2024 20:25:35 -0500
Subject: [PATCH 084/398] test: fix syntax

empty exclude is an error.
---
 .github/workflows/ci-test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index 8a3831de4..448f9a81e 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -86,7 +86,7 @@ jobs:
             - python-version: 3.8
               os: ubuntu-22.04
 
-        exclude:
+        #exclude:
             # skip all python versions on explicit 20.04/24.04 unless
             # explicitly included
             #- os: ubuntu-20.04

From e026ca0782e9e4188f14f3b70b1afc5c4726260b Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 18 Dec 2024 21:49:48 -0500
Subject: [PATCH 085/398] refactor: extract code as method from do_import

This started by trying to fix a resource error where the os.scandir
iterator was not closed for some reason (it should have been exhausted
and close). While the ResourceWarning is fixed with:

   with os.scandir() as ...:
      indented existing code

it breaks under python2. Trying a python2 friendly option:

  dirscan = os.scandir()
  ...

  if hasattr(dirscan,'close'):
     dirscan.close()

doesn't fix the resource warning.

Using the 'with os.scandir()...' indented a nested block too far so I
extracted it into another method.

It is only this method that survives 8-(.
---
 roundup/admin.py | 65 +++++++++++++++++++++++++++++++-----------------
 1 file changed, 42 insertions(+), 23 deletions(-)

diff --git a/roundup/admin.py b/roundup/admin.py
index 04f0f29b4..fb3c3fdc2 100644
--- a/roundup/admin.py
+++ b/roundup/admin.py
@@ -1245,29 +1245,8 @@ class colon_separated(csv.excel):
 
             cl = self.get_class(classname)
 
-            # ensure that the properties and the CSV file headings match
-            with open(os.path.join(import_dir, filename), 'r') as f:
-                reader = csv.reader(f, colon_separated, lineterminator='\n')
-                file_props = None
-                maxid = 1
-                # loop through the file and create a node for each entry
-                for n, r in enumerate(reader):
-                    if file_props is None:
-                        file_props = r
-                        continue
-
-                    if self.verbose:
-                        sys.stdout.write('\rImporting %s - %s' % (classname, n))
-                        sys.stdout.flush()
-
-                    # do the import and figure the current highest nodeid
-                    nodeid = cl.import_list(file_props, r)
-                    if hasattr(cl, 'import_files') and import_files:
-                        cl.import_files(import_dir, nodeid)
-                    maxid = max(maxid, int(nodeid))
-
-                # (print to sys.stdout here to allow tests to squash it .. ugh)
-                print(file=sys.stdout)
+            maxid = self.import_class(dir_entry.path, colon_separated, cl,
+                         import_dir, import_files)
 
             # import the journals
             with open(os.path.join(import_dir, classname + '-journals.csv'), 'r') as f:
@@ -1283,6 +1262,46 @@ class colon_separated(csv.excel):
         self.db_uncommitted = True
         return 0
 
+    def import_class(self, filepath, csv_format_class, hyperdb_class,
+                     import_dir, import_files):
+        """Import class given csv class filepath, csv_format_class and
+           hyperdb_class, directory for import, and boolean to import
+           files.
+
+           Optionally import files as well if import_files is True
+           otherwise just import database data.
+
+           Returns: maxid seen in csv file
+        """
+
+        maxid = 1
+
+        # ensure that the properties and the CSV file headings match
+        with open(filepath, 'r') as f:
+            reader = csv.reader(f, csv_format_class, lineterminator='\n')
+            file_props = None
+            # loop through the file and create a node for each entry
+            for n, r in enumerate(reader):
+                if file_props is None:
+                    file_props = r
+                    continue
+
+                if self.verbose:
+                    sys.stdout.write('\rImporting %s - %s' % (
+                        hyperdb_class.classname, n))
+                    sys.stdout.flush()
+
+                # do the import and figure the current highest nodeid
+                nodeid = hyperdb_class.import_list(file_props, r)
+                if hasattr(hyperdb_class, 'import_files') and import_files:
+                    hyperdb_class.import_files(import_dir, nodeid)
+                    maxid = max(maxid, int(nodeid))
+
+                # (print to sys.stdout here to allow tests to squash it .. ugh)
+                print(file=sys.stdout)
+
+        return maxid
+
     def do_importtables(self, args):
         ''"""Usage: importtables export_dir
         This imports the database tables exported using exporttables.

From 591dea355d50536c47ec284b3e749a11a8701f2e Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 19 Dec 2024 11:41:51 -0500
Subject: [PATCH 086/398] build: use pip --no-cache-dir not --no-cache

Use the proper name even though the shorter name is recognized.
---
 scripts/Docker/Dockerfile | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/scripts/Docker/Dockerfile b/scripts/Docker/Dockerfile
index 22650fdff..39a6b1c1f 100644
--- a/scripts/Docker/Dockerfile
+++ b/scripts/Docker/Dockerfile
@@ -89,11 +89,11 @@ ARG pythonversion
 
 RUN [ -z "${VERBOSE}" ] || set -xv; \
     CWD="$PWD" && \
-    upgrades=$(python3 -m pip --no-cache --disable-pip-version-check \
+    upgrades=$(python3 -m pip --no-cache-dir --disable-pip-version-check \
 	list --outdated | awk 'NR > 2 {print $1}'); \
     if [ -n "$upgrades" ]; then \
         echo "Pip updating $upgrades"; \
-        python -m pip --no-cache --disable-pip-version-check \
+        python -m pip --no-cache-dir --disable-pip-version-check \
            install -U $upgrades < /dev/null; \
     else \
         echo "Nothing to pip update"; \
@@ -211,11 +211,11 @@ RUN apk --no-cache upgrade; \
      libstdc++ \
      libxapian \
      zstd-libs; \
-    upgrades=$(python3 -m pip --no-cache --disable-pip-version-check \
+    upgrades=$(python3 -m pip --no-cache-dir --disable-pip-version-check \
 	list --outdated | awk 'NR > 2 {print $1}'); \
     if [ -n "$upgrades" ]; then \
         echo "Pip updating $upgrades"; \
-        python -m pip --no-cache --disable-pip-version-check \
+        python -m pip --no-cache-dir --disable-pip-version-check \
            install -U $upgrades < /dev/null; \
     else \
         echo "Nothing to pip update"; \

From e34dc6871a89a4ecf2990a976e677d331f71732e Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 19 Dec 2024 17:23:04 -0500
Subject: [PATCH 087/398] chore(lint): mark unused variables in assignment with
 leading _

---
 roundup/rest.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/roundup/rest.py b/roundup/rest.py
index 3cd615819..cf8729003 100644
--- a/roundup/rest.py
+++ b/roundup/rest.py
@@ -95,7 +95,7 @@ def format_object(self, *args, **kwargs):
             code = 402  # nothing to pay, just a mark for debugging purpose
             data = 'Method under development'
         except:  # noqa: E722
-            exc, val, tb = sys.exc_info()
+            _exc, val, _tb = sys.exc_info()
             code = 400
             ts = time.ctime()
             if getattr(self.client.request, 'DEBUG_MODE', None):
@@ -295,12 +295,12 @@ def parse_accept_header(accept):
         # check for a + in the sub-type
         if '+' in subtyp:
             # if it exists, determine if the subtype is a vendor-specific type
-            vnd, sep, extra = subtyp.partition('+')
+            vnd, _sep, extra = subtyp.partition('+')
             if vnd.startswith('vnd'):
                 # and then... if it ends in something like "-v1.1" parse the
                 # version out
                 if '-v' in vnd:
-                    vnd, sep, rest = vnd.rpartition('-v')
+                    vnd, _sep, rest = vnd.rpartition('-v')
                     if len(rest):
                         # add the version as a media param
                         try:

From c072b20547c1170a85ac40d0faa656e68a262e37 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 19 Dec 2024 17:26:39 -0500
Subject: [PATCH 088/398] chore(lint): remove unneeded blank line.

---
 roundup/rest.py | 1 -
 1 file changed, 1 deletion(-)

diff --git a/roundup/rest.py b/roundup/rest.py
index cf8729003..175ee7118 100644
--- a/roundup/rest.py
+++ b/roundup/rest.py
@@ -2755,7 +2755,6 @@ def raise_error_on_constant(x):
         except (JSONDecodeError, ValueError) as e:
             raise ValueError(e.args[0] + ". JSON is: " + json_string)
 
-
     class FsValue:
         '''Class that does nothing but response to a .value property '''
         def __init__(self, name, val):

From 30041d4293aa3bc0d1434b67be4af833082a42ec Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 19 Dec 2024 17:51:48 -0500
Subject: [PATCH 089/398] doc: explicitly refer to POE lifetime in seconds.

---
 doc/rest.txt | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/doc/rest.txt b/doc/rest.txt
index 76af6e1fa..89d2bad2d 100644
--- a/doc/rest.txt
+++ b/doc/rest.txt
@@ -1171,7 +1171,8 @@ but is available if a use case requires it.
 
 This example also changes the lifetime of the POE url.  This link has
 a lifetime of 15 minutes (900 seconds). Using it after 16 minutes will
-result in a 400 error. A lifetime up to 1 hour can be specified.
+result in a 400 error. A lifetime up to 3600 seconds (1 hour) can be
+specified.
 
 POE url's are an optional mechanism. If:
 

From 994d4888052cd79ec6fad262771fa865e9711f6b Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 19 Dec 2024 17:56:24 -0500
Subject: [PATCH 090/398] chore(ruff): handle magic number warnings.

Suppressed one error as the error message that follows provides enough
context.
---
 roundup/rest.py | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/roundup/rest.py b/roundup/rest.py
index 175ee7118..9601c854f 100644
--- a/roundup/rest.py
+++ b/roundup/rest.py
@@ -109,7 +109,8 @@ def format_object(self, *args, **kwargs):
 
         # decorate it
         self.client.response_code = code
-        if code >= 400:  # any error require error format
+        ERROR_CODE_LOWER_BOUND = 400
+        if code >= ERROR_CODE_LOWER_BOUND:  # any error require error format
             logmethod = getattr(logger, self.db.config.WEB_REST_LOGGING, None)
             if logmethod:
                 logmethod("statuscode: %s" % code)
@@ -751,7 +752,8 @@ def format_item(self, node, item_id, props=None, verbose=1):
                     # Do not show the (possibly HUGE) content prop
                     # unless very verbose, we display the standard
                     # download link instead
-                    if verbose < 3:
+                    MIN_VERBOSE_LEVEL_SHOW_CONTENT = 3
+                    if verbose < MIN_VERBOSE_LEVEL_SHOW_CONTENT:
                         u = self.db.config.TRACKER_WEB
                         p = u + '%s%s/' % (class_name, node.id)
                         result[pn] = {"link": p}
@@ -1254,7 +1256,7 @@ def get_post_once_exactly(self, class_name, input_payload):
         except ValueError:
             raise UsageError("Value 'lifetime' must be an integer specify lifetime in seconds. Got %s." % input_payload['lifetime'].value)
 
-        if lifetime > 3600 or lifetime < 1:
+        if lifetime > 3600 or lifetime < 1:  # noqa: PLR2004
             raise UsageError("Value 'lifetime' must be between 1 second and 1 hour (3600 seconds). Got %s." % input_payload['lifetime'].value)
 
         try:

From e49407d198e91c4396c3e61e6742c0d2d5611f97 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 19 Dec 2024 17:58:10 -0500
Subject: [PATCH 091/398] chore(ruff): remove unused noqa comments.

---
 roundup/rest.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/roundup/rest.py b/roundup/rest.py
index 9601c854f..39d324c1f 100644
--- a/roundup/rest.py
+++ b/roundup/rest.py
@@ -695,7 +695,7 @@ def format_item(self, node, item_id, props=None, verbose=1):
         # support version 1 at this time. Set it as
         # placeholder for later use.
         if self.api_version is None:
-            version = self.__default_api_version  # noqa: F841
+            version = self.__default_api_version
         else:
             version = self.api_version  # noqa: F841
 
@@ -901,7 +901,7 @@ def get_collection(self, class_name, input_payload):
                 # Call this for the side effect of validating the key
                 # use _discard as _ is apparently a global for the translation
                 # service.
-                _discard = self.transitive_props(class_name, [key])  # noqa: F841
+                _discard = self.transitive_props(class_name, [key])
 
                 # We drop properties without search permission silently
                 # This reflects the current behavior of other roundup

From f84dec3ec7883a1178e0f0f90dab525dcb13e12a Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sat, 21 Dec 2024 15:23:12 -0500
Subject: [PATCH 092/398] chore: format schema.pys in templates so ruff is ok.

Also makes comparing them easier.
---
 share/roundup/templates/classic/schema.py    | 12 +++++++++--
 share/roundup/templates/devel/schema.py      | 22 +++++++++++++-------
 share/roundup/templates/jinja2/schema.py     | 12 +++++++++--
 share/roundup/templates/minimal/schema.py    |  5 ++++-
 share/roundup/templates/responsive/schema.py | 22 +++++++++++++-------
 5 files changed, 54 insertions(+), 19 deletions(-)

diff --git a/share/roundup/templates/classic/schema.py b/share/roundup/templates/classic/schema.py
index 30eabddff..b57ee9d28 100644
--- a/share/roundup/templates/classic/schema.py
+++ b/share/roundup/templates/classic/schema.py
@@ -103,16 +103,19 @@
 
 # May users view other user information? Comment these lines out
 # if you don't want them to
-p = db.security.addPermission(name='View', klass='user', 
+p = db.security.addPermission(name='View', klass='user',
     properties=('id', 'organisation', 'phone', 'realname', 'timezone',
     'username'))
 db.security.addPermissionToRole('User', p)
 
+
 # Users should be able to edit their own details -- this permission is
 # limited to only the situation where the Viewed or Edited item is their own.
 def own_record(db, userid, itemid):
     '''Determine whether the userid matches the item being accessed.'''
     return userid == itemid
+
+
 p = db.security.addPermission(name='View', klass='user', check=own_record,
     description="User is allowed to view their own user details")
 db.security.addPermissionToRole('User', p)
@@ -122,6 +125,7 @@ def own_record(db, userid, itemid):
     description="User is allowed to edit their own user details")
 db.security.addPermissionToRole('User', p)
 
+
 # Users should be able to edit and view their own queries. They should also
 # be able to view any marked as not private. They should not be able to
 # edit others' queries, even if they're not private
@@ -129,8 +133,12 @@ def view_query(db, userid, itemid):
     private_for = db.query.get(itemid, 'private_for')
     if not private_for: return True
     return userid == private_for
+
+
 def edit_query(db, userid, itemid):
     return userid == db.query.get(itemid, 'creator')
+
+
 p = db.security.addPermission(name='View', klass='query', check=view_query,
     description="User is allowed to view their own and public queries")
 db.security.addPermissionToRole('User', p)
@@ -181,7 +189,7 @@ def edit_query(db, userid, itemid):
 # anonymous, you should remove this entry as it can be used to perform
 # a username guessing attack against a roundup install.
 p = db.security.addPermission(name='Search', klass='user')
-db.security.addPermissionToRole ('Anonymous', p)
+db.security.addPermissionToRole('Anonymous', p)
 
 # [OPTIONAL]
 # Allow anonymous users access to create or edit "issue" items (and the
diff --git a/share/roundup/templates/devel/schema.py b/share/roundup/templates/devel/schema.py
index 30f4ccaf9..3c70b2f50 100644
--- a/share/roundup/templates/devel/schema.py
+++ b/share/roundup/templates/devel/schema.py
@@ -27,7 +27,6 @@
 revision=String())
 
 
-
 # Component
 component = Class(db, 'component',
                   name=String(),
@@ -76,7 +75,7 @@
                 name=String(),
                 description=String())
 keyword.setkey("name")
-                
+
 
 # User-defined saved searches
 query = Class(db, "query",
@@ -209,7 +208,7 @@
     db.security.addPermissionToRole(r, 'Email Access')
     db.security.addPermissionToRole(r, 'Rest Access')
     db.security.addPermissionToRole(r, 'Xmlrpc Access')
-    
+
 ##########################
 # User permissions
 ##########################
@@ -225,11 +224,12 @@
            'version', 'priority', 'status', 'resolution',
            'bug_type', 'bug', 'file', 'msg'):
     db.security.addPermissionToRole('User', 'Create', cl)
-    
+
 
 def may_edit_file(db, userid, itemid):
     return userid == db.file.get(itemid, "creator")
 
+
 p = db.security.addPermission(name='Edit', klass='file', check=may_edit_file,
     description="User is allowed to remove their own files")
 db.security.addPermissionToRole('User', p)
@@ -297,7 +297,7 @@ def may_edit_file(db, userid, itemid):
 
 # May users view other user information? Comment these lines out
 # if you don't want them to
-p = db.security.addPermission(name='View', klass='user', 
+p = db.security.addPermission(name='View', klass='user',
     properties=('id', 'organisation', 'phone', 'realname', 'timezone',
     'vcs_name', 'username'))
 db.security.addPermissionToRole('User', p)
@@ -310,11 +310,14 @@ def may_edit_file(db, userid, itemid):
 db.security.addPermissionToRole('Coordinator', 'Edit', 'user')
 db.security.addPermissionToRole('Coordinator', 'Web Roles')
 
+
 # Users should be able to edit their own details -- this permission is
 # limited to only the situation where the Viewed or Edited item is their own.
 def own_record(db, userid, itemid):
     '''Determine whether the userid matches the item being accessed.'''
     return userid == itemid
+
+
 p = db.security.addPermission(name='View', klass='user', check=own_record,
     description="User is allowed to view their own user details")
 for r in 'User', 'Developer', 'Coordinator':
@@ -326,10 +329,11 @@ def own_record(db, userid, itemid):
                 'phone', 'organisation',
                 'alternate_addresses',
                 'queries',
-                'timezone')) # Note: 'roles' excluded - users should not be able to edit their own roles. 
+                'timezone')) # Note: 'roles' excluded - users should not be able to edit their own roles.
 for r in 'User', 'Developer':
     db.security.addPermissionToRole(r, p)
 
+
 # Users should be able to edit and view their own queries. They should also
 # be able to view any marked as not private. They should not be able to
 # edit others' queries, even if they're not private
@@ -337,8 +341,12 @@ def view_query(db, userid, itemid):
     private_for = db.query.get(itemid, 'private_for')
     if not private_for: return True
     return userid == private_for
+
+
 def edit_query(db, userid, itemid):
     return userid == db.query.get(itemid, 'creator')
+
+
 p = db.security.addPermission(name='View', klass='query', check=view_query,
     description="User is allowed to view their own and public queries")
 p = db.security.addPermission(name='Search', klass='query')
@@ -387,7 +395,7 @@ def edit_query(db, userid, itemid):
 # anonymous, you should remove this entry as it can be used to perform
 # a username guessing attack against a roundup install.
 p = db.security.addPermission(name='Search', klass='user')
-db.security.addPermissionToRole ('Anonymous', p)
+db.security.addPermissionToRole('Anonymous', p)
 
 # [OPTIONAL]
 # Allow anonymous users access to create or edit "issue" items (and the
diff --git a/share/roundup/templates/jinja2/schema.py b/share/roundup/templates/jinja2/schema.py
index 30eabddff..b57ee9d28 100644
--- a/share/roundup/templates/jinja2/schema.py
+++ b/share/roundup/templates/jinja2/schema.py
@@ -103,16 +103,19 @@
 
 # May users view other user information? Comment these lines out
 # if you don't want them to
-p = db.security.addPermission(name='View', klass='user', 
+p = db.security.addPermission(name='View', klass='user',
     properties=('id', 'organisation', 'phone', 'realname', 'timezone',
     'username'))
 db.security.addPermissionToRole('User', p)
 
+
 # Users should be able to edit their own details -- this permission is
 # limited to only the situation where the Viewed or Edited item is their own.
 def own_record(db, userid, itemid):
     '''Determine whether the userid matches the item being accessed.'''
     return userid == itemid
+
+
 p = db.security.addPermission(name='View', klass='user', check=own_record,
     description="User is allowed to view their own user details")
 db.security.addPermissionToRole('User', p)
@@ -122,6 +125,7 @@ def own_record(db, userid, itemid):
     description="User is allowed to edit their own user details")
 db.security.addPermissionToRole('User', p)
 
+
 # Users should be able to edit and view their own queries. They should also
 # be able to view any marked as not private. They should not be able to
 # edit others' queries, even if they're not private
@@ -129,8 +133,12 @@ def view_query(db, userid, itemid):
     private_for = db.query.get(itemid, 'private_for')
     if not private_for: return True
     return userid == private_for
+
+
 def edit_query(db, userid, itemid):
     return userid == db.query.get(itemid, 'creator')
+
+
 p = db.security.addPermission(name='View', klass='query', check=view_query,
     description="User is allowed to view their own and public queries")
 db.security.addPermissionToRole('User', p)
@@ -181,7 +189,7 @@ def edit_query(db, userid, itemid):
 # anonymous, you should remove this entry as it can be used to perform
 # a username guessing attack against a roundup install.
 p = db.security.addPermission(name='Search', klass='user')
-db.security.addPermissionToRole ('Anonymous', p)
+db.security.addPermissionToRole('Anonymous', p)
 
 # [OPTIONAL]
 # Allow anonymous users access to create or edit "issue" items (and the
diff --git a/share/roundup/templates/minimal/schema.py b/share/roundup/templates/minimal/schema.py
index 235920f71..0c62a60d7 100644
--- a/share/roundup/templates/minimal/schema.py
+++ b/share/roundup/templates/minimal/schema.py
@@ -34,15 +34,18 @@
 
 # May users view other user information?
 # Comment these lines out if you don't want them to
-p = db.security.addPermission(name='View', klass='user', 
+p = db.security.addPermission(name='View', klass='user',
     properties=('id', 'username'))
 db.security.addPermissionToRole('User', p)
 
+
 # Users should be able to edit their own details -- this permission is
 # limited to only the situation where the Viewed or Edited item is their own.
 def own_record(db, userid, itemid):
     '''Determine whether the userid matches the item being accessed.'''
     return userid == itemid
+
+
 p = db.security.addPermission(name='View', klass='user', check=own_record,
     description="User is allowed to view their own user details")
 db.security.addPermissionToRole('User', p)
diff --git a/share/roundup/templates/responsive/schema.py b/share/roundup/templates/responsive/schema.py
index 12d4fd5d8..455056c05 100644
--- a/share/roundup/templates/responsive/schema.py
+++ b/share/roundup/templates/responsive/schema.py
@@ -27,7 +27,6 @@
 revision=String())
 
 
-
 # Component
 component = Class(db, 'component',
                   name=String(),
@@ -76,7 +75,7 @@
                 name=String(),
                 description=String())
 keyword.setkey("name")
-                
+
 
 # User-defined saved searches
 query = Class(db, "query",
@@ -209,7 +208,7 @@
     db.security.addPermissionToRole(r, 'Rest Access')
     db.security.addPermissionToRole(r, 'Xmlrpc Access')
 
-    
+
 ##########################
 # User permissions
 ##########################
@@ -225,11 +224,12 @@
            'version', 'priority', 'status', 'resolution',
            'bug_type', 'bug', 'file', 'msg'):
     db.security.addPermissionToRole('User', 'Create', cl)
-    
+
 
 def may_edit_file(db, userid, itemid):
     return userid == db.file.get(itemid, "creator")
 
+
 p = db.security.addPermission(name='Edit', klass='file', check=may_edit_file,
     description="User is allowed to remove their own files")
 db.security.addPermissionToRole('User', p)
@@ -297,7 +297,7 @@ def may_edit_file(db, userid, itemid):
 
 # May users view other user information? Comment these lines out
 # if you don't want them to
-p = db.security.addPermission(name='View', klass='user', 
+p = db.security.addPermission(name='View', klass='user',
     properties=('id', 'organisation', 'phone', 'realname', 'timezone',
     'username', 'vcs_name'))
 db.security.addPermissionToRole('User', p)
@@ -310,11 +310,14 @@ def may_edit_file(db, userid, itemid):
 db.security.addPermissionToRole('Coordinator', 'Edit', 'user')
 db.security.addPermissionToRole('Coordinator', 'Web Roles')
 
+
 # Users should be able to edit their own details -- this permission is
 # limited to only the situation where the Viewed or Edited item is their own.
 def own_record(db, userid, itemid):
     '''Determine whether the userid matches the item being accessed.'''
     return userid == itemid
+
+
 p = db.security.addPermission(name='View', klass='user', check=own_record,
     description="User is allowed to view their own user details")
 for r in 'User', 'Developer', 'Coordinator':
@@ -326,10 +329,11 @@ def own_record(db, userid, itemid):
                 'phone', 'organisation',
                 'alternate_addresses',
                 'queries',
-                'timezone')) # Note: 'roles' excluded - users should not be able to edit their own roles. 
+                'timezone')) # Note: 'roles' excluded - users should not be able to edit their own roles.
 for r in 'User', 'Developer':
     db.security.addPermissionToRole(r, p)
 
+
 # Users should be able to edit and view their own queries. They should also
 # be able to view any marked as not private. They should not be able to
 # edit others' queries, even if they're not private
@@ -337,8 +341,12 @@ def view_query(db, userid, itemid):
     private_for = db.query.get(itemid, 'private_for')
     if not private_for: return True
     return userid == private_for
+
+
 def edit_query(db, userid, itemid):
     return userid == db.query.get(itemid, 'creator')
+
+
 p = db.security.addPermission(name='View', klass='query', check=view_query,
     description="User is allowed to view their own and public queries")
 p = db.security.addPermission(name='Search', klass='query')
@@ -387,7 +395,7 @@ def edit_query(db, userid, itemid):
 # anonymous, you should remove this entry as it can be used to perform
 # a username guessing attack against a roundup install.
 p = db.security.addPermission(name='Search', klass='user')
-db.security.addPermissionToRole ('Anonymous', p)
+db.security.addPermissionToRole('Anonymous', p)
 
 # [OPTIONAL]
 # Allow anonymous users access to create or edit "issue" items (and the

From f2eadb3b3db754f8616d75b334dbe5892ead5c20 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sat, 21 Dec 2024 16:35:11 -0500
Subject: [PATCH 093/398] fix: issue2550924. clean up schema for
 devel/responsive templates.

both templates have the same schema.

Changes patches class to patch in devel schema. Change bug.issue.html
to account for patches -> patch rename. Sort property list for a
permission.

Add patch class for responsive template.

From both remove incorrect comment.
---
 share/roundup/templates/devel/html/bug.item.html | 10 +++++-----
 share/roundup/templates/devel/schema.py          |  8 ++++----
 share/roundup/templates/responsive/schema.py     |  4 ++--
 3 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/share/roundup/templates/devel/html/bug.item.html b/share/roundup/templates/devel/html/bug.item.html
index 3a1a3e929..b0c1ac107 100644
--- a/share/roundup/templates/devel/html/bug.item.html
+++ b/share/roundup/templates/devel/html/bug.item.html
@@ -176,21 +176,21 @@
 <tr tal:condition="context/is_edit_ok">
  <th><tal:block i18n:translate="">Patch</tal:block>:</th>
  <td colspan="3">
-   <input type="hidden" name="@link@patches" value="patches-1"/>
-   <input type="file" name="patches-1@content" size="35"/>
+   <input type="hidden" name="@link@patches" value="patch-1"/>
+   <input type="file" name="patch-1@content" size="35"/>
  </td>
 </tr>
 <tr tal:condition="context/is_edit_ok">
  <th><tal:block i18n:translate="">Patch Description</tal:block>:</th>
- <td colspan=3><input type="edit" name="patches-1@description" size="40"></td>
+ <td colspan=3><input type="edit" name="patch-1@description" size="40"></td>
 </tr>
 <tr tal:condition="context/is_edit_ok">
  <th><tal:block i18n:translate="">Repository</tal:block>:</th>
- <td colspan=3><input type="edit" name="patches-1@repository" size="40"></td>
+ <td colspan=3><input type="edit" name="patch-1@repository" size="40"></td>
 </tr>
 <tr tal:condition="context/is_edit_ok">
  <th><tal:block i18n:translate="">Repo. Revision</tal:block>:</th>
- <td colspan=3><input type="edit" name="patches-1@revision" size="40"></td>
+ <td colspan=3><input type="edit" name="patch-1@revision" size="40"></td>
 </tr>
 -->
 </table>
diff --git a/share/roundup/templates/devel/schema.py b/share/roundup/templates/devel/schema.py
index 3c70b2f50..6bcf45032 100644
--- a/share/roundup/templates/devel/schema.py
+++ b/share/roundup/templates/devel/schema.py
@@ -127,7 +127,7 @@
                 description=String(indexme='yes'))
 
 # Patch
-patches = FileClass(db, "patches",
+patch = FileClass(db, "patch",
                   name=String(),
                   description=String(indexme='yes'),
                   repository=String(),
@@ -144,7 +144,6 @@
 #   title = String()
 #   messages = Multilink("msg")
 #   files = Multilink("file")
-#   patches = Multilink("patches")
 #   nosy = Multilink("user")
 #   superseder = Multilink("issue")
 bug = IssueClass(db, "bug",
@@ -159,7 +158,7 @@
                  resolution=Link('resolution'),
                  superseder=Link('bug'),
                  keywords=Multilink('keyword'),
-                 patches=Multilink('patches'))
+                 patches=Multilink('patch'))
 
 # Task Type
 task_type = Class(db, 'task_type',
@@ -209,6 +208,7 @@
     db.security.addPermissionToRole(r, 'Rest Access')
     db.security.addPermissionToRole(r, 'Xmlrpc Access')
 
+
 ##########################
 # User permissions
 ##########################
@@ -299,7 +299,7 @@ def may_edit_file(db, userid, itemid):
 # if you don't want them to
 p = db.security.addPermission(name='View', klass='user',
     properties=('id', 'organisation', 'phone', 'realname', 'timezone',
-    'vcs_name', 'username'))
+    'username', 'vcs_name'))
 db.security.addPermissionToRole('User', p)
 db.security.addPermissionToRole('Developer', p)
 
diff --git a/share/roundup/templates/responsive/schema.py b/share/roundup/templates/responsive/schema.py
index 455056c05..6bcf45032 100644
--- a/share/roundup/templates/responsive/schema.py
+++ b/share/roundup/templates/responsive/schema.py
@@ -144,7 +144,6 @@
 #   title = String()
 #   messages = Multilink("msg")
 #   files = Multilink("file")
-#   patches = Multilink("patches")
 #   nosy = Multilink("user")
 #   superseder = Multilink("issue")
 bug = IssueClass(db, "bug",
@@ -158,7 +157,8 @@
                  status=Link('status'),
                  resolution=Link('resolution'),
                  superseder=Link('bug'),
-                 keywords=Multilink('keyword'))
+                 keywords=Multilink('keyword'),
+                 patches=Multilink('patch'))
 
 # Task Type
 task_type = Class(db, 'task_type',

From 4ec61e8a9499858ac3f81567acc58f643efdafdb Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sat, 21 Dec 2024 16:48:00 -0500
Subject: [PATCH 094/398] fix: html templates reference missing issue.index
 macros

issue.index doesn't exsit in this tracker template. Use bug.index.
---
 share/roundup/templates/devel/html/file.index.html  | 2 +-
 share/roundup/templates/devel/html/msg.index.html   | 2 +-
 share/roundup/templates/devel/html/patch.index.html | 4 ++--
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/share/roundup/templates/devel/html/file.index.html b/share/roundup/templates/devel/html/file.index.html
index ac4a1de60..e96e87617 100644
--- a/share/roundup/templates/devel/html/file.index.html
+++ b/share/roundup/templates/devel/html/file.index.html
@@ -23,7 +23,7 @@
   <td tal:content="file/creation">creation date</td>
  </tr>
 
- <metal:block use-macro="templates/issue.index/macros/batch-footer" />
+ <metal:block use-macro="templates/bug.index/macros/batch-footer" />
 
 </table>
 
diff --git a/share/roundup/templates/devel/html/msg.index.html b/share/roundup/templates/devel/html/msg.index.html
index 1ad4b33bd..70a781a9a 100644
--- a/share/roundup/templates/devel/html/msg.index.html
+++ b/share/roundup/templates/devel/html/msg.index.html
@@ -18,7 +18,7 @@
   </tr>
  </tal:block>
 
- <metal:block use-macro="templates/issue.index/macros/batch-footer" />
+ <metal:block use-macro="templates/bug.index/macros/batch-footer" />
 
 </table>
 </td>
diff --git a/share/roundup/templates/devel/html/patch.index.html b/share/roundup/templates/devel/html/patch.index.html
index a1869448d..4ce6b4f24 100644
--- a/share/roundup/templates/devel/html/patch.index.html
+++ b/share/roundup/templates/devel/html/patch.index.html
@@ -24,7 +24,7 @@
   <td tal:content="patch/creation">creation date</td>
  </tr>
 
- <metal:block use-macro="templates/issue.index/macros/batch-footer" />
+ <metal:block use-macro="templates/bug.index/macros/batch-footer" />
 
 </table>
 
@@ -57,7 +57,7 @@
   <td tal:content="patch/creation">creation date</td>
  </tr>
 
- <metal:block use-macro="templates/issue.index/macros/batch-footer" />
+ <metal:block use-macro="templates/bug.index/macros/batch-footer" />
 
 </table>
 

From 517673bc606a3b1297e49a07521aadc35333cafb Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sat, 21 Dec 2024 16:50:00 -0500
Subject: [PATCH 095/398] fix: html templates reference missing issue.index
 macros

issue.index doesn't exsit in the responsive template either. Use bug.index.
---
 share/roundup/templates/responsive/html/file.index.html  | 2 +-
 share/roundup/templates/responsive/html/msg.index.html   | 2 +-
 share/roundup/templates/responsive/html/patch.index.html | 4 ++--
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/share/roundup/templates/responsive/html/file.index.html b/share/roundup/templates/responsive/html/file.index.html
index 0de6c6c48..2a99d8707 100644
--- a/share/roundup/templates/responsive/html/file.index.html
+++ b/share/roundup/templates/responsive/html/file.index.html
@@ -23,7 +23,7 @@
   <td tal:content="file/creation">creation date</td>
  </tr>
 
- <metal:block use-macro="templates/issue.index/macros/batch-footer" />
+ <metal:block use-macro="templates/bug.index/macros/batch-footer" />
 
 </table>
 
diff --git a/share/roundup/templates/responsive/html/msg.index.html b/share/roundup/templates/responsive/html/msg.index.html
index 1ad4b33bd..70a781a9a 100644
--- a/share/roundup/templates/responsive/html/msg.index.html
+++ b/share/roundup/templates/responsive/html/msg.index.html
@@ -18,7 +18,7 @@
   </tr>
  </tal:block>
 
- <metal:block use-macro="templates/issue.index/macros/batch-footer" />
+ <metal:block use-macro="templates/bug.index/macros/batch-footer" />
 
 </table>
 </td>
diff --git a/share/roundup/templates/responsive/html/patch.index.html b/share/roundup/templates/responsive/html/patch.index.html
index a1869448d..4ce6b4f24 100644
--- a/share/roundup/templates/responsive/html/patch.index.html
+++ b/share/roundup/templates/responsive/html/patch.index.html
@@ -24,7 +24,7 @@
   <td tal:content="patch/creation">creation date</td>
  </tr>
 
- <metal:block use-macro="templates/issue.index/macros/batch-footer" />
+ <metal:block use-macro="templates/bug.index/macros/batch-footer" />
 
 </table>
 
@@ -57,7 +57,7 @@
   <td tal:content="patch/creation">creation date</td>
  </tr>
 
- <metal:block use-macro="templates/issue.index/macros/batch-footer" />
+ <metal:block use-macro="templates/bug.index/macros/batch-footer" />
 
 </table>
 

From 94b56280b3e5e1b3fe161b8f5b367afd004e17f4 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sat, 21 Dec 2024 17:31:04 -0500
Subject: [PATCH 096/398] chore(ruff): update scanning rules.

---
 pyproject.toml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/pyproject.toml b/pyproject.toml
index 379a4dd72..4d0054754 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -80,6 +80,8 @@ select = [
 ignore = [ 
    # raise from except hander with none or chaining; only python3
    "B904",
+   # trailing commas are getting a bit excessive
+   "COM812",
    # ### before comments is fine
    "E266",
    # ignore double vs. single quotes
@@ -95,6 +97,8 @@ ignore = [
    #"RET506",
    # use *list to expand; only python 3
    "RUF005",
+   # not using typing, so not marking mutable class values
+   "RUF012",
    # do not use contextlib.suppress rather than except: pass to suppress
    # exception. contextlib doesn't work in python2 and is slower
    "SIM105",
@@ -106,7 +110,9 @@ max-complexity = 50
 [tool.ruff.lint.per-file-ignores]
 "roundup/anypy/*.py" = ["RET505", "RET506"]
 "roundup/dehtml.py" = ["E501"]
-"roundup/rest.py" = ["E501"]
+# ruff is reporting unused parameters. Standard calling sequence
+# for all methods means some won't be used. Suppress alert ARG002.
+"roundup/rest.py" = ["ARG002", "E501"]
 "roundup/support.py" = ["E401"]
 "roundup/security.py" = ["E701"]
 "roundup/date.py" = ["E231", "E701"]

From 3dbb10801f95fee6993b91fa3dbdb296dc950974 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 23 Dec 2024 21:10:54 -0500
Subject: [PATCH 097/398] doc: clarify adding ctx argument to check command in
 schema.py

On IRC user was unsure what file was used for the 1.51 - 1.60 upgrade
section:

  Enhancement to check command for Permissions

added file name desription and example. Also marked it as optional.
Clarified that if or when it becomes required there will be a new
required upgrade direction.
---
 doc/upgrading.txt | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/doc/upgrading.txt b/doc/upgrading.txt
index 729098dd0..063ce02c7 100644
--- a/doc/upgrading.txt
+++ b/doc/upgrading.txt
@@ -2885,12 +2885,13 @@ If you haven't modified you query.item.html template, simply copy the
 query.item.html template from one of the above default templates to
 your tracker's html directory.
 
-Enhancement to check command for Permissions
---------------------------------------------
-
+Enhancement to check command for Permissions (optional)
+-------------------------------------------------------
 A new form of check function is permitted in permission definitions.
-The three argument form is still supported and will work the same
-as it always has (although it may be depricated in the future).
+An example check function is ``own_record(db, userid, itemid)`` in the
+file schema.py. The three argument form is still supported and will
+work the same as it always has (although it may be depricated in the
+future).
 
 If the check function is defined as::
 
@@ -2936,6 +2937,9 @@ parameter. This is expected to be the preferred form in the future.
 You do not need to use the ``ctx`` parameter in the function if you do
 not need it.
 
+If the new four argument form is required in the future, there will be
+required (not optional) directions on upgrading your schema.
+
 Changes to property permissions
 -------------------------------
 

From 13b739672362b884a07cd189a665be179af2aa25 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 29 Dec 2024 19:11:01 -0500
Subject: [PATCH 098/398] issue2551116 - Replace xmlrpclib (xmlrpc.client) with
 defusedxml.

defusedxml will be used to moneypatch the problematic client and
server modules.

Test added using an xml bomb.
---
 CHANGES.txt              |  3 ++
 doc/installation.txt     |  6 ++++
 doc/upgrading.txt        | 30 +++++++++++++++++++
 doc/xmlrpc.txt           |  3 +-
 roundup/anypy/xmlrpc_.py | 12 ++++++++
 roundup/cgi/client.py    |  5 ++++
 test/test_xmlrpc.py      | 64 +++++++++++++++++++++++++++++++++++++++-
 7 files changed, 121 insertions(+), 2 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index 746ac31cd..738efcb44 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -81,6 +81,9 @@ Features:
   Rouillard) 
 - added fuzz testing for some code. Found issue2551382 and
   others. (John Rouillard)
+- issue2551116 - Replace xmlrpclib (xmlrpc.client) with defusedxml.
+  Added support for defusedxml to better secure the xmlrpc
+  endpoint. (John Rouillard)
 
 2024-07-13 2.4.0
 
diff --git a/doc/installation.txt b/doc/installation.txt
index bc6f23bf5..7e05ec5ee 100644
--- a/doc/installation.txt
+++ b/doc/installation.txt
@@ -255,6 +255,11 @@ jinja2
   its TEMPLATE-INFO.txt file) you need
   to have the jinja2_ template engine installed.
 
+defusedxml
+  If you are going to enable and use the XMLRPC endpoint, you should
+  install the defusedxml_ module. It will still work with the default
+  xmlrpc standard library, but it will log a warning when used.
+
 .. _install/docutils:
 
 docutils
@@ -2371,6 +2376,7 @@ the test.
 .. _apache: https://httpd.apache.org/
 .. _brotli: https://pypi.org/project/Brotli/
 .. _`developer's guide`: developers.html
+.. _defusedxml: https://pypi.org/project/defusedxml/
 .. _docutils: https://pypi.org/project/docutils/
 .. _flup: https://pypi.org/project/flup/
 .. _gpg: https://www.gnupg.org/software/gpgme/index.html
diff --git a/doc/upgrading.txt b/doc/upgrading.txt
index 063ce02c7..e1d163d32 100644
--- a/doc/upgrading.txt
+++ b/doc/upgrading.txt
@@ -159,6 +159,36 @@ following diff::
 add the lines marked with ``+`` in the file in the location after
 check_main is assigned.
 
+Defusedxml support improves XMLRPC security (optional)
+------------------------------------------------------
+
+This release adds support for the defusedxml_ module. If it is
+installed it will be automatically used. The default xmlrpc module in
+the standard library has known issues when parsing crafted XML. It can
+take a lot of CPU time and consume large amounts of memory with small
+payloads.
+
+When the XMLRPC endpoint is used without defusedxml, it will log a
+warning to the log file. The log entry can be disabled by adding::
+
+
+    from roundup.cgi import client
+    client.WARN_FOR_MISSING_DEFUSEDXML = False
+
+to the ``interfaces.py`` file in the tracker home. (Create the file if
+it is missing.)
+
+XMLRPC access is enabled by default in the classic and other trackers.
+Upgrading to defusedxml is considered optional because the XMLRPC
+endpoint can be disabled in the tracker's ``config.ini``. Also
+``Xmlrpc Access`` can be removed from the ``Users`` role by commenting
+out a line in ``schema.py``.
+
+If you have enabled the xmlrpc endpoint, you should install
+defusedxml.
+
+.. _defusedxml: https://pypi.org/project/defusedxml/
+
 More secure session cookie handling (info)
 ------------------------------------------
 
diff --git a/doc/xmlrpc.txt b/doc/xmlrpc.txt
index bf2d939ba..fc25a983e 100644
--- a/doc/xmlrpc.txt
+++ b/doc/xmlrpc.txt
@@ -79,7 +79,8 @@ Both the standalone and embedded roundup XML endpoints used the
 default python XML parser. This parser is know to have security
 issues. For details see: https://pypi.org/project/defusedxml/.
 You may wish to use the rest interface which doesn't have the same
-issues. Patches with tests to roundup to use defusedxml are welcome.
+issues. If you install defusedxml, it will be automatically used to add
+some additional protection.
 
 .. caution::
 
diff --git a/roundup/anypy/xmlrpc_.py b/roundup/anypy/xmlrpc_.py
index 37ce7ea0c..9d39e2e07 100644
--- a/roundup/anypy/xmlrpc_.py
+++ b/roundup/anypy/xmlrpc_.py
@@ -1,6 +1,18 @@
 try:
     # Python 3+.
     from xmlrpc import client, server
+    # If client.defusedxml == False, client.py will warn that
+    # xmlrpc is insecure and defusedxml should be installed.
+    client.defusedxml=False
+    try:
+        from defusedxml import xmlrpc
+        xmlrpc.monkey_patch()
+        # figure out how to allow user to set xmlrpc.MAX_DATA = bytes
+        client.defusedxml=True
+    except ImportError:
+        # use regular xmlrpc with warnings
+        pass
+
     server.SimpleXMLRPCDispatcher
 except (ImportError, AttributeError):
     # Python 2.
diff --git a/roundup/cgi/client.py b/roundup/cgi/client.py
index 234bb192f..33679280e 100644
--- a/roundup/cgi/client.py
+++ b/roundup/cgi/client.py
@@ -101,6 +101,9 @@ def add_message(msg_list, msg, escape=True):
     msg_list.append(msg)
     return msg_list  # for unittests
 
+# if set to False via interfaces.py do not log a warning when
+# xmlrpc is used and defusedxml is not installed.
+WARN_FOR_MISSING_DEFUSEDXML = True
 
 default_err_msg = ''"""<html><head><title>An error has occurred</title></head>
 <body><h1>An error has occurred</h1>
@@ -656,6 +659,8 @@ def handle_xmlrpc(self):
             csrf_ok = False  # we had an error, failed check
 
         if csrf_ok is True:
+            if WARN_FOR_MISSING_DEFUSEDXML and (not xmlrpc_.client.defusedxml):
+                logger.warning(self._("XMLRPC endpoint is not using defusedxml. Improve security by installing defusedxml."))
             handler = xmlrpc.RoundupDispatcher(self.db,
                                                self.instance.actions,
                                                self.translator,
diff --git a/test/test_xmlrpc.py b/test/test_xmlrpc.py
index a68c18704..ae134689c 100644
--- a/test/test_xmlrpc.py
+++ b/test/test_xmlrpc.py
@@ -5,7 +5,7 @@
 #
 
 from __future__ import print_function
-import unittest, os, shutil, errno, sys, difflib, re
+import unittest, os, shutil, errno, pytest, sys, difflib, re
 
 from roundup.anypy import xmlrpc_
 MultiCall = xmlrpc_.client.MultiCall
@@ -21,6 +21,19 @@
 from .test_mysql import skip_mysql
 from .test_postgresql import skip_postgresql
 
+from .pytest_patcher import mark_class
+from roundup.anypy.xmlrpc_ import client
+
+if client.defusedxml:
+    skip_defusedxml = lambda func, *args, **kwargs: func
+
+    skip_defusedxml_used = mark_class(pytest.mark.skip(
+        reason='Skipping non-defusedxml tests: defusedxml library in use'))
+else:
+    skip_defusedxml = mark_class(pytest.mark.skip(
+        reason='Skipping defusedxml tests: defusedxml library not available'))
+    
+    skip_defusedxml_used = lambda func, *args, **kwargs: func
 
 class XmlrpcTest(object):
 
@@ -314,6 +327,55 @@ class S:
         for n, r in enumerate(result):
             self.assertEqual(r, results[n])
 
+    @skip_defusedxml
+    def testDefusedXmlBomb(self):
+        self.XmlBomb(expectIn=b"defusedxml.common.EntitiesForbidden")
+
+    @skip_defusedxml_used
+    def testNonDefusedXmlBomb(self):
+        self.XmlBomb(expectIn=b"1234567890"*511)
+
+    def XmlBomb(self, expectIn=None):
+
+        bombInput = """<?xml version='1.0'?>
+        <!DOCTYPE xmlbomb [
+        <!ENTITY a "1234567890" >
+        <!ENTITY b "&a;&a;&a;&a;&a;&a;&a;&a;">
+        <!ENTITY c "&b;&b;&b;&b;&b;&b;&b;&b;">
+        <!ENTITY d "&c;&c;&c;&c;&c;&c;&c;&c;">
+        ]>
+        <methodCall>
+        <methodName>filter</methodName>
+        <params>
+        <param>
+        <value><string>&d;</string></value>
+        </param>
+        <param>
+        <value><array><data>
+        <value><string>0</string></value>
+        <value><string>2</string></value>
+        <value><string>3</string></value>
+        </data></array></value>
+        </param>
+        <param>
+        <value><struct>
+        <member>
+        <name>username</name>
+        <value><string>demo</string></value>
+        </member>
+        </struct></value>
+        </param>
+        </params>
+        </methodCall>
+        """
+        translator = TranslationService.get_translation(
+            language=self.instance.config["TRACKER_LANGUAGE"],
+            tracker_home=self.instance.config["TRACKER_HOME"])
+        self.server = RoundupDispatcher(self.db, self.instance.actions,
+            translator, allow_none = True)
+        response = self.server.dispatch(bombInput)
+        print(response)
+        self.assertIn(expectIn, response)
 
 class anydbmXmlrpcTest(XmlrpcTest, unittest.TestCase):
     backend = 'anydbm'

From 648e3d0da766ce50422af51232880fca1c01361f Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 29 Dec 2024 19:48:42 -0500
Subject: [PATCH 099/398] issue2551116 - difusedxml support - python2 fixups.

Make sure python2 code path sets client.defusedxml so the code can
still run.

Bomb tests fail under python2. So disable test under python 2. In the
past it was due to string/byte type difference. Not worth fixing the
tests since python 2 support dropped.
---
 roundup/anypy/xmlrpc_.py | 7 ++++---
 test/test_xmlrpc.py      | 9 +++++++++
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/roundup/anypy/xmlrpc_.py b/roundup/anypy/xmlrpc_.py
index 9d39e2e07..d77d2341f 100644
--- a/roundup/anypy/xmlrpc_.py
+++ b/roundup/anypy/xmlrpc_.py
@@ -3,18 +3,19 @@
     from xmlrpc import client, server
     # If client.defusedxml == False, client.py will warn that
     # xmlrpc is insecure and defusedxml should be installed.
-    client.defusedxml=False
+    client.defusedxml = False
     try:
         from defusedxml import xmlrpc
         xmlrpc.monkey_patch()
         # figure out how to allow user to set xmlrpc.MAX_DATA = bytes
-        client.defusedxml=True
+        client.defusedxml = True
     except ImportError:
         # use regular xmlrpc with warnings
         pass
 
-    server.SimpleXMLRPCDispatcher
+    server.SimpleXMLRPCDispatcher  # noqa: B018
 except (ImportError, AttributeError):
     # Python 2.
     import SimpleXMLRPCServer as server
     import xmlrpclib as client  # noqa: F401
+    client.defusedxml = False
diff --git a/test/test_xmlrpc.py b/test/test_xmlrpc.py
index ae134689c..c3709bf8b 100644
--- a/test/test_xmlrpc.py
+++ b/test/test_xmlrpc.py
@@ -35,6 +35,13 @@
     
     skip_defusedxml_used = lambda func, *args, **kwargs: func
 
+if sys.version_info[0] > 2:
+    skip_python2 = lambda func, *args, **kwargs: func
+else:
+    skip_python2 = mark_class(pytest.mark.skip(
+        reason='Skipping test under python 2'))
+
+
 class XmlrpcTest(object):
 
     backend = None
@@ -327,10 +334,12 @@ class S:
         for n, r in enumerate(result):
             self.assertEqual(r, results[n])
 
+    @skip_python2
     @skip_defusedxml
     def testDefusedXmlBomb(self):
         self.XmlBomb(expectIn=b"defusedxml.common.EntitiesForbidden")
 
+    @skip_python2
     @skip_defusedxml_used
     def testNonDefusedXmlBomb(self):
         self.XmlBomb(expectIn=b"1234567890"*511)

From eb334a11b0f9dd47b0a6a2ffb1f02398a7e76e7e Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 30 Dec 2024 02:57:46 -0500
Subject: [PATCH 100/398] issue2551253. default hash is PBKDF2-SHA512.

The default password hashing algorithm has been upgraded to
PBKDF2-SHA512 from PBKDF2-SHA1. The default pbkdf2 rounds in the
config file has been changed to 250000.

Doc updated.
---
 CHANGES.txt              |  7 +++++++
 doc/upgrading.txt        | 37 +++++++++++++++++++++++++++++++++++++
 roundup/configuration.py |  7 ++++---
 roundup/password.py      | 21 +++++++++++++++++----
 4 files changed, 65 insertions(+), 7 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index 738efcb44..756254ab2 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -49,6 +49,13 @@ Fixed:
 - issue2551383 - Setting same address via REST PUT command results in
   an error. Now the userauditor does not trigger an error if a user
   sets the primary address to the existing value. (John Rouillard)
+- issue2551253 - Modify password PBKDF2 method to use SHA512. The
+  default password hashing algorithm has been upgraded to
+  PBKDF2-SHA512 from PBKDF2-SHA1. The default pbkdf2 rounds in the
+  config file has been changed to 250000. The admin should change it
+  manually if it is at 2 million. PBKDF2-SHA512 (PBKDF2S5) has been
+  available since release 2.3, but it required a manual step to make
+  it the default. (John Rouillard)
 
 Features:
 
diff --git a/doc/upgrading.txt b/doc/upgrading.txt
index e1d163d32..aad6e5870 100644
--- a/doc/upgrading.txt
+++ b/doc/upgrading.txt
@@ -159,6 +159,41 @@ following diff::
 add the lines marked with ``+`` in the file in the location after
 check_main is assigned.
 
+Modify config.ini password_pbkdf2_default_rounds setting (recommended)
+----------------------------------------------------------------------
+
+The method for hashing and storing passwords has been updated to use
+PBKDF2 with SHA512 hash. This change was first introduced in Roundup
+2.3 and is now the standard. If you previously added code in
+interfaces.py for a `PBKDF2 upgrade`_ to enable PBKDF2S5, you can
+remove that code now.
+
+SHA512 is a more secure hash, it requires fewer rounds to ensure
+safety. The older PBKDF2-SHA1 needed around 2 million rounds.
+
+You should update the ``password_pbkdf2_default_rounds`` setting in
+``config.ini`` to 250000. This value is higher than the OWASP
+recommendation of 210000 from three years ago. If you donâ€™t make this
+change, logins will be slow, especially for REST or XMLRPC calls.
+
+See `PBKDF2 upgrade`_ for details on how to test the algorithm's
+speed. We do not recommend reverting to the older SHA1 PBKDF2. If you
+have to do so due to a slow CPU, you can add the following to your
+tracker's ``interfaces.py``::
+
+  from roundup.password import Password
+  ## Use PBDKF2 (PBKDF2-SHA1) as default hash for passwords.
+  # That scheme is at the start of the deprecated_schemes list and ha
+  # to be removed.
+  Password.default_scheme = Password.deprecated_schemes.pop(0)
+  # Add PBKDF2S5 (PBKDF2-SHA512) as a valid scheme. Passwords
+  # using it will be rehashed to use PBDKF2.
+  Password.experimental_schemes[0] = "PBKDF2S5"
+
+If you proceed with this, you should set
+``password_pbkdf2_default_rounds`` to 2 million or more rounds to keep
+your hashed password database secure in case it gets stolen.
+
 Defusedxml support improves XMLRPC security (optional)
 ------------------------------------------------------
 
@@ -1292,6 +1327,8 @@ install an OS vendor package or some other library.
 
 .. _recommended setting of 1,300,000: https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2
 
+.. _PBKDF2 upgrade:
+
 Upgrade to PBKDF2-SHA512 from current PBKDF2-SHA1 (recommended)
 ---------------------------------------------------------------
 
diff --git a/roundup/configuration.py b/roundup/configuration.py
index 98e5949c9..ad628ba0f 100644
--- a/roundup/configuration.py
+++ b/roundup/configuration.py
@@ -1139,10 +1139,11 @@ def str2value(self, value):
             "get the error 'Error: field larger than field limit' during\n"
             "import."),
         (IntegerNumberGeqZeroOption, 'password_pbkdf2_default_rounds',
-         '2000000',
+         '250000',
             "Sets the default number of rounds used when encoding passwords\n"
-            "using the PBKDF2 scheme. Set this to a higher value on faster\n"
-            "systems which want more security.\n"
+            "using any PBKDF2 scheme. Set this to a higher value on faster\n"
+            "systems which want more security. Use a minimum of 250000\n"
+            "for PBKDF2-SHA512 which is the default hash in Roundup 2.5.\n"
             "PBKDF2 (Password-Based Key Derivation Function) is a\n"
             "password hashing mechanism that derives hash from the\n"
             "password and a random salt. For authentication this process\n"
diff --git a/roundup/password.py b/roundup/password.py
index a9fb340e0..3d77ebd30 100644
--- a/roundup/password.py
+++ b/roundup/password.py
@@ -331,7 +331,7 @@ class JournalPassword:
         version only reads the encryption scheme from the given
         encrypted password.
     """
-    default_scheme = 'PBKDF2'        # new encryptions use this scheme
+    default_scheme = 'PBKDF2S5'        # new encryptions use this scheme
     pwre = re.compile(r'{(\w+)}(.+)')
 
     def __init__(self, encrypted=''):
@@ -394,12 +394,12 @@ class Password(JournalPassword):
     1
     """
 
-    deprecated_schemes = ["SSHA", "SHA", "MD5", "plaintext"]
+    deprecated_schemes = ["PBKDF2", "SSHA", "SHA", "MD5", "plaintext"]
     if crypt:
         # place just before plaintext if crypt is available
         deprecated_schemes.insert(-1, "crypt")
-    experimental_schemes = ["PBKDF2S5"]
-    known_schemes = ["PBKDF2"] + experimental_schemes + \
+    experimental_schemes = []
+    known_schemes = ["PBKDF2S5"] + experimental_schemes + \
         deprecated_schemes
 
     def __init__(self, plaintext=None, scheme=None, encrypted=None,
@@ -442,6 +442,19 @@ def needs_migration(self, config):
                     new_rounds = 1000
             if rounds < int(new_rounds):
                 return True
+
+        if (self.scheme == "PBKDF2S5"):
+            new_rounds = config.PASSWORD_PBKDF2_DEFAULT_ROUNDS
+            if ("pytest" in sys.modules and
+                "PYTEST_CURRENT_TEST" in os.environ):
+                if ("PYTEST_USE_CONFIG" in os.environ):
+                    new_rounds = config.PASSWORD_PBKDF2_DEFAULT_ROUNDS
+                else:
+                    # for testing
+                    new_rounds = 1000
+            if rounds < int(new_rounds):
+                return True
+
         return False
 
     def unpack(self, encrypted, scheme=None, strict=False, config=None):

From 579bcb96a239cbd7e266b7ead538533fe57c221d Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 30 Dec 2024 02:59:27 -0500
Subject: [PATCH 101/398] fix: crash roundup-admin perftest password without
 rounds= argument.

If the rounds value is taken from the config file, it doesn't need to
be parsed into an int.
---
 CHANGES.txt      | 2 ++
 roundup/admin.py | 5 ++++-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index 756254ab2..e2d31e2af 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -56,6 +56,8 @@ Fixed:
   manually if it is at 2 million. PBKDF2-SHA512 (PBKDF2S5) has been
   available since release 2.3, but it required a manual step to make
   it the default. (John Rouillard)
+- fixed a crash with roundup-admin perftest password when rounds not set
+  on command line. (John Rouillard)
 
 Features:
 
diff --git a/roundup/admin.py b/roundup/admin.py
index fb3c3fdc2..01dcad2c2 100644
--- a/roundup/admin.py
+++ b/roundup/admin.py
@@ -1633,6 +1633,7 @@ def do_perftest(self, args):
         """
         from roundup.anypy.time_ import perf_counter
 
+        # default rounds from db.config is an int not str
         props = {"rounds": self.db.config.PASSWORD_PBKDF2_DEFAULT_ROUNDS,
                  "scheme": password.Password.default_scheme}
 
@@ -1649,7 +1650,9 @@ def do_perftest(self, args):
         if args[0] == "password":
             try:
                 # convert 10,000,000 or 10.000.000 to 10000000
-                r = int(re.sub('[,.]', '', props['rounds']))
+                r = int(re.sub('[,.]', '', props['rounds'])) \
+                    if  not isinstance(props['rounds'], int) \
+                        else props['rounds']
                 if r < 1000:
                     print(_("Invalid 'rounds'. Must be larger than 999."))
                     return

From c1813e8e67302ed4dc80d39fedc3fc4db343b819 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 30 Dec 2024 20:22:55 -0500
Subject: [PATCH 102/398] fix: issue2551374. Error handling for filter
 expressions.

Errors in filter expressions are now reported. The UI needs some work
but even the current code is helpful when debugging filter
expressions.

mlink_expr:

  defines/raises ExpressionError(error string template,
     context=dict())

  raises ExpressionError when it detects errors when popping arguments
  off stack

  raises ExpressionError when more than one element left on the stack
  before returning

  also ruff fix to group boolean expression with parens

back_anydbm.py, rdbms_common.py:

  catches ExpressionError, augments context with class and
  attribute being searched. raises the exception

  for both link and multilink relations

client.py

  catches ExpressionError returning a basic error page. The page is a
  dead end. There are no links or anything for the user to move
  forward. The user has to go back, possibly refresh the page (because
  the submit button may be disalbled) re-enter the query and try
  again.

  This needs to be improved.

test_liveserver.py

  test the error page generated by client.py

db_test_base

  unit tests for filter with too few arguments, too many arguments,
  check all repr and str formats.
---
 CHANGES.txt                      |   4 ++
 roundup/backends/back_anydbm.py  |  16 ++++-
 roundup/backends/rdbms_common.py |  10 ++-
 roundup/cgi/client.py            |   6 ++
 roundup/mlink_expr.py            | 104 ++++++++++++++++++++++++++++--
 test/db_test_base.py             | 107 +++++++++++++++++++++++++------
 test/test_liveserver.py          |  35 ++++++++++
 7 files changed, 252 insertions(+), 30 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index e2d31e2af..334c86122 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -58,6 +58,10 @@ Fixed:
   it the default. (John Rouillard)
 - fixed a crash with roundup-admin perftest password when rounds not set
   on command line. (John Rouillard)
+- issue2551374 - Add error handling for filter expressions. Filter
+  expression errors are now reported. The UI needs some work but
+  even the current code is helpful when debugging filter
+  expressions. (John Rouillard)
 
 Features:
 
diff --git a/roundup/backends/back_anydbm.py b/roundup/backends/back_anydbm.py
index 58feb58e6..da9cbf321 100644
--- a/roundup/backends/back_anydbm.py
+++ b/roundup/backends/back_anydbm.py
@@ -34,7 +34,7 @@
 from roundup.anypy.strings import b2s, bs2b, repr_export, eval_import, is_us
 
 from roundup import hyperdb, date, password, roundupdb, security, support
-from roundup.mlink_expr import Expression
+from roundup.mlink_expr import Expression, ExpressionError
 from roundup.backends import locking
 from roundup.i18n import _
 
@@ -1880,7 +1880,12 @@ def _filter(self, search_matches, filterspec, proptree,
                     if t == LINK:
                         # link - if this node's property doesn't appear in the
                         # filterspec's nodeid list, skip it
-                        expr = Expression(v, is_link=True)
+                        try:
+                            expr = Expression(v, is_link=True)
+                        except ExpressionError as e:
+                            e.context['class'] = cn
+                            e.context['attr'] = k
+                            raise
                         if expr.evaluate(nv):
                             match = 1
                     elif t == MULTILINK:
@@ -1895,7 +1900,12 @@ def _filter(self, search_matches, filterspec, proptree,
                         else:
                             # otherwise, make sure this node has each of the
                             # required values
-                            expr = Expression(v)
+                            try:
+                                expr = Expression(v)
+                            except ExpressionError as e:
+                                e.context['class'] = cn
+                                e.context['attr'] = k
+                                raise
                             if expr.evaluate(nv):
                                 match = 1
                     elif t == STRING:
diff --git a/roundup/backends/rdbms_common.py b/roundup/backends/rdbms_common.py
index 45e1872e4..d2360be96 100644
--- a/roundup/backends/rdbms_common.py
+++ b/roundup/backends/rdbms_common.py
@@ -72,7 +72,7 @@
 from roundup.hyperdb import String, Password, Date, Interval, Link, \
     Multilink, DatabaseError, Boolean, Number, Integer
 from roundup.i18n import _
-from roundup.mlink_expr import compile_expression
+from roundup.mlink_expr import compile_expression, ExpressionError
 
 # dummy value meaning "argument not passed"
 _marker = []
@@ -2594,6 +2594,10 @@ def collect_values(n):
                     values.append(n.x)
             expr.visit(collect_values)
             return w, values
+        except ExpressionError as e:
+            e.context['class'] = pln
+            e.context['attr'] = prp
+            raise
         except:
             pass
         # Fallback to original code
@@ -2671,6 +2675,10 @@ def collect_values(n):
             expr.visit(collect_values)
 
             return intron, values
+        except ExpressionError as e:
+            e.context['class'] = classname
+            e.context['attr'] = proptree.name
+            raise
         except:
             # fallback behavior when expression parsing above fails
             orclause = ''
diff --git a/roundup/cgi/client.py b/roundup/cgi/client.py
index 33679280e..592113782 100644
--- a/roundup/cgi/client.py
+++ b/roundup/cgi/client.py
@@ -54,6 +54,9 @@ class SysCallError(Exception):
     Unauthorised,
     UsageError,
 )
+
+from roundup.mlink_expr import ExpressionError
+
 from roundup.mailer import Mailer, MessageSendError
 
 logger = logging.getLogger('roundup')
@@ -2216,6 +2219,9 @@ def renderContext(self):
                 result = pt.render(self, None, None, **args)
             except IndexerQueryError as e:
                 result = self.renderError(e.args[0])
+            except ExpressionError as e:
+                self.add_error_message(str(e))
+                result = self.renderError(str(e))
 
             if 'Content-Type' not in self.additional_headers:
                 self.additional_headers['Content-Type'] = pt.content_type
diff --git a/roundup/mlink_expr.py b/roundup/mlink_expr.py
index b64c2a62f..197921791 100644
--- a/roundup/mlink_expr.py
+++ b/roundup/mlink_expr.py
@@ -7,6 +7,57 @@
 # see the COPYING.txt file coming with Roundup.
 #
 
+from roundup.exceptions import RoundupException
+from roundup.i18n import _
+
+opcode_names = {
+    -2: "not",
+    -3: "and",
+    -4: "or",
+}
+
+
+class ExpressionError(RoundupException):
+    """Takes two arguments.
+
+        ExpressionError(template, context={})
+
+    The repr of ExpressionError is:
+
+        template % context
+
+    """
+
+    # only works on python 3
+    #def __init__(self, *args, context=None):
+    #    super().__init__(*args)
+    #    self.context = context if isinstance(context, dict) else {}
+
+    # works python 2 and 3
+    def __init__(self, *args, **kwargs):
+        super(RoundupException, self).__init__(*args)
+        self.context = {}
+        if 'context' in kwargs and isinstance(kwargs['context'], dict):
+            self.context = kwargs['context']
+
+        # Skip testing for a bad call to ExpressionError
+        # keywords = [x for x in list(kwargs) if x != "context"]
+        #if len(keywords) != 0:
+        #        raise ValueError("unknown keyword argument(s) passed to ExpressionError: %s" % keywords)
+
+    def __str__(self):
+        try:
+            return self.args[0] % self.context
+        except KeyError:
+            return "%s: context=%s" % (self.args[0], self.context)
+
+    def __repr__(self):
+        try:
+            return self.args[0] % self.context
+        except KeyError:
+            return "%s: context=%s" % (self.args[0], self.context)
+
+
 class Binary:
 
     def __init__(self, x, y):
@@ -38,6 +89,9 @@ def evaluate(self, v):
     def visit(self, visitor):
         visitor(self)
 
+    def __repr__(self):
+        return "Value %s" % self.x
+
 
 class Empty(Unary):
 
@@ -47,6 +101,9 @@ def evaluate(self, v):
     def visit(self, visitor):
         visitor(self)
 
+    def __repr__(self):
+        return "ISEMPTY(-1)"
+
 
 class Not(Unary):
 
@@ -56,6 +113,9 @@ def evaluate(self, v):
     def generate(self, atom):
         return "NOT(%s)" % self.x.generate(atom)
 
+    def __repr__(self):
+        return "NOT(%s)" % self.x
+
 
 class Or(Binary):
 
@@ -67,6 +127,9 @@ def generate(self, atom):
             self.x.generate(atom),
             self.y.generate(atom))
 
+    def __repr__(self):
+        return "(%s OR %s)" % (self.y, self.x)
+
 
 class And(Binary):
 
@@ -78,17 +141,44 @@ def generate(self, atom):
             self.x.generate(atom),
             self.y.generate(atom))
 
+    def __repr__(self):
+        return "(%s AND %s)" % (self.y, self.x)
+
 
 def compile_expression(opcodes):
 
     stack = []
     push, pop = stack.append, stack.pop
-    for opcode in opcodes:
-        if   opcode == -1: push(Empty(opcode))      # noqa: E271,E701
-        elif opcode == -2: push(Not(pop()))         # noqa: E701
-        elif opcode == -3: push(And(pop(), pop()))  # noqa: E701
-        elif opcode == -4: push(Or(pop(), pop()))   # noqa: E701
-        else:              push(Equals(opcode))     # noqa: E701
+    try:
+        for position, opcode in enumerate(opcodes):     # noqa: B007
+            if   opcode == -1: push(Empty(opcode))      # noqa: E271,E701
+            elif opcode == -2: push(Not(pop()))         # noqa: E701
+            elif opcode == -3: push(And(pop(), pop()))  # noqa: E701
+            elif opcode == -4: push(Or(pop(), pop()))   # noqa: E701
+            else:              push(Equals(opcode))     # noqa: E701
+    except IndexError:
+        raise ExpressionError(
+            _("There was an error searching %(class)s by %(attr)s using: "
+              "%(opcodes)s. "
+              "The operator %(opcode)s (%(opcodename)s) at position "
+              "%(position)d has too few arguments."),
+            context={
+                "opcode": opcode,
+                "opcodename": opcode_names[opcode],
+                "position": position + 1,
+                "opcodes": opcodes,
+            })
+    if len(stack) != 1:
+        # Too many arguments - I don't think stack can be zero length
+        raise ExpressionError(
+            _("There was an error searching %(class)s by %(attr)s using: "
+              "%(opcodes)s. "
+              "There are too many arguments for the existing operators. The "
+              "values on the stack are: %(stack)s"),
+            context={
+                "opcodes": opcodes,
+                "stack": stack,
+            })
 
     return pop()
 
@@ -104,7 +194,7 @@ def __init__(self, v, is_link=False):
             compiled = compile_expression(opcodes)
             if is_link:
                 self.evaluate = lambda x: compiled.evaluate(
-                    x and [int(x)] or [])
+                    (x and [int(x)]) or [])
             else:
                 self.evaluate = lambda x: compiled.evaluate([int(y) for y in x])
         except (ValueError, TypeError):
diff --git a/test/db_test_base.py b/test/db_test_base.py
index d3d87e22b..51c7b4e13 100644
--- a/test/db_test_base.py
+++ b/test/db_test_base.py
@@ -41,6 +41,7 @@
 from roundup.cgi.engine_zopetal import RoundupPageTemplate
 from roundup.cgi.templating import HTMLItem
 from roundup.exceptions import UsageError, Reject
+from roundup.mlink_expr import ExpressionError
 
 from roundup.anypy.strings import b2s, s2b, u2s
 from roundup.anypy.cmp_ import NoneAndDictComparable
@@ -2048,6 +2049,43 @@ def testFilteringLink(self):
             ae(filt(None, {a: ['-1', None]}, ('+','id'), grp), ['3','4'])
             ae(filt(None, {a: ['1', None]}, ('+','id'), grp), ['1', '3','4'])
 
+    def testFilteringBrokenLinkExpression(self):
+        ae, iiter = self.filteringSetup()
+        a = 'assignedto'
+        for filt in iiter():
+            with self.assertRaises(ExpressionError) as e:
+                filt(None, {a: ['1', '-3']}, ('+','status'))
+            self.assertIn("position 2", str(e.exception))
+            # verify all tokens are consumed
+            self.assertNotIn("%", str(e.exception))
+            self.assertNotIn("%", repr(e.exception))
+
+            with self.assertRaises(ExpressionError) as e:
+                filt(None, {a: ['0', '1', '2', '3', '-3', '-4']},
+                     ('+','status'))
+            self.assertIn("values on the stack are: [Value 0,",
+                          str(e.exception))
+            self.assertNotIn("%", str(e.exception))
+            self.assertNotIn("%", repr(e.exception))
+
+            with self.assertRaises(ExpressionError) as e:
+                # expression tests _repr_ for every operator and
+                # three values
+                filt(None, {a: ['-1', '1', '2', '3', '-3', '-2', '-4']},
+                     ('+','status'))
+            result = str(e.exception)
+            self.assertIn(" AND ", result)
+            self.assertIn(" OR ", result)
+            self.assertIn("NOT(", result)
+            self.assertIn("ISEMPTY(-1)", result)
+            # trigger a KeyError and verify fallback format
+            # is correct. It includes the template with %(name)s tokens,
+            del(e.exception.context['class'])
+            self.assertIn("values on the stack are: %(stack)s",
+                          str(e.exception))
+            self.assertIn("values on the stack are: %(stack)s",
+                          repr(e.exception))
+
     def testFilteringLinkExpression(self):
         ae, iiter = self.filteringSetup()
         a = 'assignedto'
@@ -2074,25 +2112,6 @@ def testFilteringLinkExpression(self):
             ae(filt(None, {a: ['1','-2','2','-2','-4']}, ('+',a)),
                 ['3','4','1','2'])
 
-    def NOtestFilteringLinkInvalid(self):
-        """Test invalid filter expressions.
-           Code must be written to generate an exception for these.
-           Then this code must be changed to test the exception.
-           See issue 2551374 in the roundup tracker.
-        """
-        ae, iiter = self.filteringSetup()
-        a = 'assignedto'
-        # filt(??, filter expression, sort order)
-        # ae = self.assertEqual(val1, val2)
-        for filt in iiter():
-            # -2 is missing an operand
-            ae(filt(None, {a: ['-2','2','-2','-4']},
-                    ('+',a)), [])
-            # 3 is left on the stack
-            ae(filt(None, {a: ['3','2','-2']},
-                    ('+',a)), [])
-
-
     def testFilteringRevLink(self):
         ae, iiter = self.filteringSetupTransitiveSearch('user')
         # We have
@@ -2228,6 +2247,56 @@ def testFilteringMultilink(self):
             ae(filt(None, {'nosy': ['1','2']}, ('+', 'status'),
                 ('-', 'deadline')), ['4', '3'])
 
+    def testFilteringBrokenMultilinkExpression(self):
+        ae, iiter = self.filteringSetup()
+        kw1 = self.db.keyword.create(name='Key1')
+        kw2 = self.db.keyword.create(name='Key2')
+        kw3 = self.db.keyword.create(name='Key3')
+        kw4 = self.db.keyword.create(name='Key4')
+        self.db.issue.set('1', keywords=[kw1, kw2])
+        self.db.issue.set('2', keywords=[kw1, kw3])
+        self.db.issue.set('3', keywords=[kw2, kw3, kw4])
+        self.db.issue.set('4', keywords=[kw1, kw2, kw4])
+        self.db.commit()
+        kw = 'keywords'
+        for filt in iiter():
+            with self.assertRaises(ExpressionError) as e:
+                filt(None, {kw: ['1', '-3']}, ('+','status'))
+            self.assertIn("searching issue by keywords", str(e.exception))
+            self.assertIn("position 2", str(e.exception))
+            # verify all tokens are consumed
+            self.assertNotIn("%", str(e.exception))
+            self.assertNotIn("%", repr(e.exception))
+
+            with self.assertRaises(ExpressionError) as e:
+                filt(None, {kw: ['0', '1', '2', '3', '-3', '-4']},
+                     ('+','status'))
+            self.assertIn("searching issue by keywords", str(e.exception))
+            self.assertIn("values on the stack are: [Value 0,",
+                          str(e.exception))
+            self.assertNotIn("%", str(e.exception))
+            self.assertNotIn("%", repr(e.exception))
+
+            with self.assertRaises(ExpressionError) as e:
+                # expression tests _repr_ for every operator and
+                # three values
+                filt(None, {kw: ['-1', '1', '2', '3', '-3', '-2', '-4']},
+                     ('+','status'))
+            result = str(e.exception)
+            self.assertIn("searching issue by keywords", result)
+            self.assertIn(" AND ", result)
+            self.assertIn(" OR ", result)
+            self.assertIn("NOT(", result)
+            self.assertIn("ISEMPTY(-1)", result)
+            # trigger a KeyError and verify fallback format
+            # is correct. It includes the template with %(name)s tokens,
+            del(e.exception.context['class'])
+            self.assertIn("values on the stack are: %(stack)s",
+                          str(e.exception))
+            self.assertIn("values on the stack are: %(stack)s",
+                          repr(e.exception))
+
+
     def testFilteringMultilinkExpression(self):
         ae, iiter = self.filteringSetup()
         kw1 = self.db.keyword.create(name='Key1')
diff --git a/test/test_liveserver.py b/test/test_liveserver.py
index 441480e7f..f5e3d5405 100644
--- a/test/test_liveserver.py
+++ b/test/test_liveserver.py
@@ -351,6 +351,41 @@ def test_query(self):
         # of the footer is missing.
         self.assertNotIn('out of', f.text)
 
+    def test_broken_query(self):
+        # query link item
+        current_user_query = (
+            "@columns=title,id,activity,status,assignedto&"
+            "@sort=activity&@group=priority&@filter=creator&"
+            "@pagesize=50&@startwith=0&creator=-2&"
+            "@dispname=Test1")
+
+        session, _response = self.create_login_session()
+        f = session.get(self.url_base()+'/issue?' + current_user_query)
+
+        # verify the query has run by looking for the query name
+        # print(f.text)
+        self.assertIn('Error when searching issue by creator using: '
+                      '[-2]. The operator -2 (not) at position 1 has '
+                      'too few arguments.',
+                      f.text)
+
+    def test_broken_multiink_query(self):
+        # query multilink item
+        current_user_query = (
+            "@columns=title,id,activity,status,assignedto"
+            "&keyword=-3&@sort=activity&@group=priority"
+            "&@pagesize=50&@startwith=0&@template=index|search"
+            "&@action=search")
+        session, _response = self.create_login_session()
+        f = session.get(self.url_base()+'/issue?' + current_user_query)
+
+        # verify the query has run by looking for the query name
+        print(f.text)
+        self.assertIn('Error when searching issue by keyword using: '
+                      '[-3]. The operator -3 (and) at position 1 has '
+                      'too few arguments.',
+                      f.text)
+
     def test_start_page(self):
         """ simple test that verifies that the server can serve a start page.
         """

From 8a1219a62267f7dbe5446c1579e665ca1f8075c6 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 30 Dec 2024 20:30:26 -0500
Subject: [PATCH 103/398] test: missed change in error wording.

---
 test/test_liveserver.py | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/test/test_liveserver.py b/test/test_liveserver.py
index f5e3d5405..b97489351 100644
--- a/test/test_liveserver.py
+++ b/test/test_liveserver.py
@@ -364,10 +364,11 @@ def test_broken_query(self):
 
         # verify the query has run by looking for the query name
         # print(f.text)
-        self.assertIn('Error when searching issue by creator using: '
+        self.assertIn('There was an error searching issue by creator using: '
                       '[-2]. The operator -2 (not) at position 1 has '
                       'too few arguments.',
                       f.text)
+        self.assertEqual(f.status_code, 400)
 
     def test_broken_multiink_query(self):
         # query multilink item
@@ -381,10 +382,11 @@ def test_broken_multiink_query(self):
 
         # verify the query has run by looking for the query name
         print(f.text)
-        self.assertIn('Error when searching issue by keyword using: '
+        self.assertIn('There was an error searching issue by keyword using: '
                       '[-3]. The operator -3 (and) at position 1 has '
                       'too few arguments.',
                       f.text)
+        self.assertEqual(f.status_code, 400)
 
     def test_start_page(self):
         """ simple test that verifies that the server can serve a start page.

From 55018215fb4d49a040c37bd12cf33834fbd3d1be Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 30 Dec 2024 20:54:46 -0500
Subject: [PATCH 104/398] test: issue2551253. fix test for default hash is
 PBKDF2-SHA512.

Some rest responses include the password field which includes the hash method.
---
 test/rest_common.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/test/rest_common.py b/test/rest_common.py
index 36a63cff6..f6923af3f 100644
--- a/test/rest_common.py
+++ b/test/rest_common.py
@@ -928,7 +928,7 @@ def testOutputFormat(self):
             {'id': '2',
              'username': 'anonymous',
              'link': 'http://tracker.example/cgi-bin/roundup.cgi/bugs/rest/data/user/2'},
-            {'password': '[password hidden scheme PBKDF2]',
+            {'password': '[password hidden scheme PBKDF2S5]',
              'id': '3',
              'queries': [],
              'username': 'joe',
@@ -953,7 +953,7 @@ def testOutputFormat(self):
                 'creator': {'id': '1',
                             'link': 'http://tracker.example/cgi-bin/roundup.cgi/bugs/rest/data/user/1',
                             'username': 'admin'},
-                'password': '[password hidden scheme PBKDF2]',
+                'password': '[password hidden scheme PBKDF2S5]',
                 'queries': [],
                 'username': 'joe'
             }

From c92aad5f2ab99654dc8abeeb049772fce6d6941f Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 30 Dec 2024 21:03:01 -0500
Subject: [PATCH 105/398] test: fix failing test setup for change in PBKDF2
 rounds.

---
 test/test_admin.py | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/test/test_admin.py b/test/test_admin.py
index 58829dc28..e6387098e 100644
--- a/test/test_admin.py
+++ b/test/test_admin.py
@@ -692,7 +692,8 @@ def testUpdateconfigPbkdf2(self):
 
         ### test replacement of old default value
         replace_in_file(self.dirname + "/config.ini",
-                        "= 2000000", "= 10000")
+                        "= 250000", "= 10000")
+
         with captured_output() as (out, err):
             sys.argv=['main', '-i', self.dirname, 'update',
                       self.dirname + "/config2.ini"]
@@ -700,13 +701,13 @@ def testUpdateconfigPbkdf2(self):
 
         out = out.getvalue().strip()
         print(out)
-        expected = "from old default of 10000 to new default of 2000000."
+        expected = "from old default of 10000 to new default of 250000."
 
         self.assertIn(expected, out)
         self.assertTrue(os.path.isfile(self.dirname + "/config2.ini"))
         self.assertEqual(find_in_file(self.dirname + "/config2.ini",
-                                     "^password_.*= 2000000$"),
-                         "password_pbkdf2_default_rounds = 2000000")
+                                     "^password_.*= 250000$"),
+                         "password_pbkdf2_default_rounds = 250000")
 
         # Reopen the db closed by previous call
         self.admin=AdminTool()
@@ -722,7 +723,7 @@ def testUpdateconfigPbkdf2(self):
         out = out.getvalue().strip()
         print(out)
         expected = ("Update 'password_pbkdf2_default_rounds' to a number "
-                    "equal to or larger\n  than 2000000.")
+                    "equal to or larger\n  than 250000.")
 
         self.assertIn(expected, out)
         self.assertTrue(os.path.isfile(self.dirname + "/config2.ini"))

From b90f3e537b67ff8d27c17b04521064cdf1d4a191 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 30 Dec 2024 21:17:59 -0500
Subject: [PATCH 106/398] test: fix failing test setup for change in PBKDF2
 rounds.

---
 test/test_cgi.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/test_cgi.py b/test/test_cgi.py
index e99bc59a5..c9968d8e0 100644
--- a/test/test_cgi.py
+++ b/test/test_cgi.py
@@ -623,7 +623,7 @@ def testPasswordConfigOption(self):
         self.db.commit()
         actions.LoginAction(cl).handle()
         pw = self.db.user.get(chef, 'password')
-        self.assertEqual('PBKDF2', pw.scheme)
+        self.assertEqual('PBKDF2S5', pw.scheme)
         self.assertEqual(1000, password.pbkdf2_unpack(pw.password)[0])
         cl.db.close()
 

From 3d2fecd3726e1ec529de04d378e2a1c73af146a3 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 30 Dec 2024 22:51:46 -0500
Subject: [PATCH 107/398] chore(translation): update roundup.pot and .po files

---
 locale/de.po       | 403 +++++++++++++++++++++++++--------------------
 locale/en.po       | 402 ++++++++++++++++++++++++--------------------
 locale/es.po       | 403 +++++++++++++++++++++++++--------------------
 locale/fr.po       | 403 +++++++++++++++++++++++++--------------------
 locale/hu.po       | 402 ++++++++++++++++++++++++--------------------
 locale/it.po       | 402 ++++++++++++++++++++++++--------------------
 locale/ja.po       | 402 ++++++++++++++++++++++++--------------------
 locale/lt.po       | 403 +++++++++++++++++++++++++--------------------
 locale/nb.po       | 403 +++++++++++++++++++++++++--------------------
 locale/roundup.pot | 396 +++++++++++++++++++++++++-------------------
 locale/ru.po       | 403 +++++++++++++++++++++++++--------------------
 locale/zh_CN.po    | 403 +++++++++++++++++++++++++--------------------
 locale/zh_TW.po    | 403 +++++++++++++++++++++++++--------------------
 13 files changed, 2930 insertions(+), 2298 deletions(-)

diff --git a/locale/de.po b/locale/de.po
index c7af1df9f..f86e1023b 100644
--- a/locale/de.po
+++ b/locale/de.po
@@ -5,9 +5,9 @@
 #
 msgid ""
 msgstr ""
-"Project-Id-Version: Roundup 2.4.0\n"
+"Project-Id-Version: Roundup 2.5.0\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
-"POT-Creation-Date: 2024-08-07 21:43-0400\n"
+"POT-Creation-Date: 2024-12-30 22:49-0500\n"
 "PO-Revision-Date: 2016-04-11 09:13+0200\n"
 "Last-Translator: Tobias Herp <tobias.herp@gmx.de>\n"
 "Language-Team: German Translators <roundup-devel@lists.sourceforge.net>\n"
@@ -85,8 +85,8 @@ msgstr ""
 msgid "Enable verbose output: tracing, descriptions...\n"
 msgstr ""
 
-#: ../roundup/admin.py:175 ../roundup/admin.py:1188 ../roundup/admin.py:1836
-#: ../roundup/admin.py:1868 ../roundup/admin.py:175:1188 :1836:1868
+#: ../roundup/admin.py:175 ../roundup/admin.py:1188 ../roundup/admin.py:1858
+#: ../roundup/admin.py:1890 ../roundup/admin.py:175:1188 :1858:1890
 #, python-format
 msgid "no such class \"%(classname)s\""
 msgstr "Die Klasse \"%(classname)s\" existiert nicht"
@@ -305,14 +305,14 @@ msgid "%s:"
 msgstr "%s:"
 
 # ../roundup/admin.py:336 :382
-#: ../roundup/admin.py:439 ../roundup/admin.py:1396
-#: ../roundup/admin.py:439:1396
+#: ../roundup/admin.py:439 ../roundup/admin.py:1415
+#: ../roundup/admin.py:439:1415
 msgid "Templates:"
 msgstr "Vorlagen:"
 
 # ../roundup/admin.py:339 :393
-#: ../roundup/admin.py:442 ../roundup/admin.py:1406
-#: ../roundup/admin.py:442:1406
+#: ../roundup/admin.py:442 ../roundup/admin.py:1425
+#: ../roundup/admin.py:442:1425
 msgid "Back ends:"
 msgstr "Datenbanken:"
 
@@ -365,11 +365,11 @@ msgstr ""
 #: ../roundup/admin.py:482 ../roundup/admin.py:555 ../roundup/admin.py:606
 #: ../roundup/admin.py:733 ../roundup/admin.py:806 ../roundup/admin.py:851
 #: ../roundup/admin.py:902 ../roundup/admin.py:999 ../roundup/admin.py:1216
-#: ../roundup/admin.py:1369 ../roundup/admin.py:1497 ../roundup/admin.py:1580
-#: ../roundup/admin.py:1703 ../roundup/admin.py:1826 ../roundup/admin.py:1858
-#: ../roundup/admin.py:1974 ../roundup/admin.py:2028 ../roundup/admin.py:2076
-#: ../roundup/admin.py:482:555 :1216:1369:1497 :1580:1703 :1826:1858 :1974:2028
-#: :2076 :606:733 :806:851 :902:999
+#: ../roundup/admin.py:1388 ../roundup/admin.py:1516 ../roundup/admin.py:1599
+#: ../roundup/admin.py:1725 ../roundup/admin.py:1848 ../roundup/admin.py:1880
+#: ../roundup/admin.py:1996 ../roundup/admin.py:2050 ../roundup/admin.py:2098
+#: ../roundup/admin.py:482:555 :1216:1388:1516 :1599:1725 :1848:1880 :1996:2050
+#: :2098 :606:733 :806:851 :902:999
 msgid "Not enough arguments supplied"
 msgstr "Zu wenig Parameter Ã¼bergeben"
 
@@ -519,9 +519,9 @@ msgid "Class %(curclassname)s has no property %(pn)s in %(propname)s."
 msgstr "Die Klasse \"%(curclassname)s\" hat keine Eigenschaft \"%(propname)s\""
 
 # ../roundup/admin.py:631 :669 :822 :834 :888
-#: ../roundup/admin.py:791 ../roundup/admin.py:840 ../roundup/admin.py:1517
-#: ../roundup/admin.py:1530 ../roundup/admin.py:2098
-#: ../roundup/admin.py:791:840 :1517:1530:2098
+#: ../roundup/admin.py:791 ../roundup/admin.py:840 ../roundup/admin.py:1536
+#: ../roundup/admin.py:1549 ../roundup/admin.py:2120
+#: ../roundup/admin.py:791:840 :1536:1549:2120
 #, python-format
 msgid "%(classname)s has no property \"%(propname)s\""
 msgstr "Die Klasse \"%(classname)s\" hat keine Eigenschaft \"%(propname)s\""
@@ -606,8 +606,8 @@ msgstr ""
 "hier nicht ausgewertet."
 
 # ../roundup/admin.py:539 :951 :1000 :1022
-#: ../roundup/admin.py:942 ../roundup/admin.py:1190 ../roundup/admin.py:1842
-#: ../roundup/admin.py:1870 ../roundup/admin.py:942:1190 :1842:1870
+#: ../roundup/admin.py:942 ../roundup/admin.py:1190 ../roundup/admin.py:1864
+#: ../roundup/admin.py:1892 ../roundup/admin.py:942:1190 :1864:1892
 #, python-format
 msgid "no such %(classname)s node \"%(nodeid)s\""
 msgstr ""
@@ -764,7 +764,7 @@ msgstr ""
 "        verbergen).\n"
 "        "
 
-#: ../roundup/admin.py:1287
+#: ../roundup/admin.py:1306
 msgid ""
 "Usage: importtables export_dir\n"
 "        This imports the database tables exported using exporttables.\n"
@@ -774,7 +774,7 @@ msgid ""
 msgstr ""
 
 #. password
-#: ../roundup/admin.py:1295
+#: ../roundup/admin.py:1314
 msgid ""
 "Usage: initialise [adminpw]\n"
 "        Initialise a new Roundup tracker.\n"
@@ -792,23 +792,23 @@ msgstr ""
 "        Die Funktion dbinit.init() wird aufgerufen\n"
 "        "
 
-#: ../roundup/admin.py:1309
+#: ../roundup/admin.py:1328
 msgid "Admin Password: "
 msgstr "Administratorpasswort: "
 
-#: ../roundup/admin.py:1310
+#: ../roundup/admin.py:1329
 msgid "       Confirm: "
 msgstr "  Wiederholen: "
 
-#: ../roundup/admin.py:1314
+#: ../roundup/admin.py:1333
 msgid "Instance home does not exist"
 msgstr "Tracker-Verzeichnis existiert nicht"
 
-#: ../roundup/admin.py:1318
+#: ../roundup/admin.py:1337
 msgid "Instance has not been installed"
 msgstr "Tracker-Instanz wurde nicht installiert"
 
-#: ../roundup/admin.py:1326
+#: ../roundup/admin.py:1345
 msgid ""
 "WARNING: The database is already initialised!\n"
 "If you re-initialise it, you will lose all the data!\n"
@@ -818,7 +818,7 @@ msgstr ""
 "Eine erneute Initialisierung lÃ¶scht sÃ¤mtliche Daten!\n"
 "Wirklich lÃ¶schen? Y/N: "
 
-#: ../roundup/admin.py:1346
+#: ../roundup/admin.py:1365
 msgid ""
 "Usage: install [template [backend [key=val[,key=val]]]]\n"
 "        Install a new Roundup tracker.\n"
@@ -871,12 +871,12 @@ msgstr ""
 "        Siehe auch unter dem Hilfethema \"initopts\".\n"
 "        "
 
-#: ../roundup/admin.py:1375
+#: ../roundup/admin.py:1394
 #, python-format
 msgid "Instance home parent directory \"%(parent)s\" does not exist"
 msgstr "Das angegebene Tracker-Verzeichnis \"%(parent)s\" existiert nicht"
 
-#: ../roundup/admin.py:1384
+#: ../roundup/admin.py:1403
 #, python-format
 msgid ""
 "WARNING: There appears to be a tracker in \"%(tracker_home)s\"!\n"
@@ -887,22 +887,22 @@ msgstr ""
 "installiert zu sein! Eine erneute Installation lÃ¶scht sÃ¤mtliche Daten!\n"
 "Wirklich lÃ¶schen? Y/N: "
 
-#: ../roundup/admin.py:1397
+#: ../roundup/admin.py:1416
 #, fuzzy
 msgid "Select template"
 msgstr "Vorlagensatz auswÃ¤hlen [classic]:"
 
-#: ../roundup/admin.py:1407
+#: ../roundup/admin.py:1426
 #, fuzzy
 msgid "Select backend"
 msgstr "Datenbank auswÃ¤hlen [anydbm]"
 
-#: ../roundup/admin.py:1418
+#: ../roundup/admin.py:1437
 #, python-format
 msgid "Error in configuration settings: \"%s\""
 msgstr "Fehler in der Konfiguration: \"%s\""
 
-#: ../roundup/admin.py:1451
+#: ../roundup/admin.py:1470
 #, fuzzy, python-format
 msgid ""
 "\n"
@@ -914,11 +914,11 @@ msgstr ""
 " Sie sollten nun die Konfigurationsdatei des Trackers bearbeiten:\n"
 "   %(config_file)s"
 
-#: ../roundup/admin.py:1461
+#: ../roundup/admin.py:1480
 msgid " ... at a minimum, you must set following options:"
 msgstr " ... passen sie zumindest folgende Optionen an:"
 
-#: ../roundup/admin.py:1466
+#: ../roundup/admin.py:1485
 #, python-format
 msgid ""
 "\n"
@@ -944,7 +944,7 @@ msgstr ""
 " AnschlieÃŸend MÃœSSEN Sie \"roundup-admin initialise\" ausfÃ¼hren.\n"
 "---------------------------------------------------------------------------\n"
 
-#: ../roundup/admin.py:1482
+#: ../roundup/admin.py:1501
 msgid ""
 "Usage: list classname [property]\n"
 "        List the instances of a class.\n"
@@ -975,17 +975,17 @@ msgstr ""
 "aufgelistet.\n"
 "        "
 
-#: ../roundup/admin.py:1495
+#: ../roundup/admin.py:1514
 msgid "Too many arguments supplied"
 msgstr "Sie haben zuviele Argumente Ã¼bergeben"
 
-#: ../roundup/admin.py:1528
+#: ../roundup/admin.py:1547
 #, python-format
 msgid "%(nodeid)4s: %(value)s"
 msgstr "%(nodeid)4s: %(value)s"
 
 #. noqa: ARG002  - args unused
-#: ../roundup/admin.py:1535
+#: ../roundup/admin.py:1554
 #, fuzzy
 msgid ""
 "Usage: migrate\n"
@@ -1028,17 +1028,17 @@ msgstr ""
 "        es nicht nÃ¶tig ist; also gewÃ¶hnen Sie es sich einfach an.\n"
 "        "
 
-#: ../roundup/admin.py:1555
+#: ../roundup/admin.py:1574
 #, python-format
 msgid "Tracker updated to schema version %s."
 msgstr ""
 
-#: ../roundup/admin.py:1559
+#: ../roundup/admin.py:1578
 #, fuzzy, python-format
 msgid "No migration action required. At schema version %s."
 msgstr "Keine Migration notwendig"
 
-#: ../roundup/admin.py:1564
+#: ../roundup/admin.py:1583
 #, fuzzy
 msgid ""
 "Usage: pack period | date\n"
@@ -1076,11 +1076,11 @@ msgstr ""
 "\n"
 "        "
 
-#: ../roundup/admin.py:1590
+#: ../roundup/admin.py:1609
 msgid "Invalid format"
 msgstr "UngÃ¼ltiges Format"
 
-#: ../roundup/admin.py:1601
+#: ../roundup/admin.py:1620
 msgid ""
 "Usage: perftest [mode] [arguments]*\n"
 "        Time operations in Roundup.\n"
@@ -1098,25 +1098,25 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1635
+#: ../roundup/admin.py:1657
 msgid "Invalid 'rounds'. Must be larger than 999."
 msgstr ""
 
-#: ../roundup/admin.py:1639
+#: ../roundup/admin.py:1661
 #, python-format
 msgid "Invalid 'rounds'. It must be an integer not: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1666
+#: ../roundup/admin.py:1688
 msgid "scheme does not support rounds."
 msgstr ""
 
-#: ../roundup/admin.py:1669
+#: ../roundup/admin.py:1691
 #, python-format
 msgid "Hash time: %(time)0.9f seconds, scheme: %(scheme)s, rounds: %(rounds)s"
 msgstr ""
 
-#: ../roundup/admin.py:1675
+#: ../roundup/admin.py:1697
 msgid ""
 "Usage: pragma setting=value | 'list'\n"
 "        Set internal admin settings to a value.\n"
@@ -1145,49 +1145,49 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1710
+#: ../roundup/admin.py:1732
 #, python-format
 msgid "Argument must be setting=value, was given: %s."
 msgstr ""
 
-#: ../roundup/admin.py:1713
+#: ../roundup/admin.py:1735
 msgid "Current settings and values (NYI - not yet implemented):"
 msgstr ""
 
-#: ../roundup/admin.py:1724
+#: ../roundup/admin.py:1746
 msgid ""
 "      Help for this pragma is missing. Please report it to the Roundup "
 "project.\n"
 msgstr ""
 
-#: ../roundup/admin.py:1730
+#: ../roundup/admin.py:1752
 #, fuzzy, python-format
 msgid "Unknown setting %s. Try \"pragma list\"."
 msgstr "Benutzername unbekannt"
 
-#: ../roundup/admin.py:1740
+#: ../roundup/admin.py:1762
 #, python-format
 msgid "Incorrect value for boolean setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1747
+#: ../roundup/admin.py:1769
 #, python-format
 msgid "Incorrect value for integer setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1754
+#: ../roundup/admin.py:1776
 #, python-format
 msgid ""
 "Incorrect value for setting %(setting)s: %(value)s. Should be no, both, or "
 "only."
 msgstr ""
 
-#: ../roundup/admin.py:1764
+#: ../roundup/admin.py:1786
 #, python-format
 msgid "Internal error: pragma can not handle values of type: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1773
+#: ../roundup/admin.py:1795
 #, fuzzy
 msgid ""
 "Usage: reindex [classname|classname:#-#|designator]*\n"
@@ -1211,17 +1211,17 @@ msgstr ""
 "        normalerweise automatisch.\n"
 "        "
 
-#: ../roundup/admin.py:1795
+#: ../roundup/admin.py:1817
 #, python-format
 msgid "no such item \"%(designator)s\""
 msgstr "Der Eintrag \"%(designator)s\" existiert nicht"
 
-#: ../roundup/admin.py:1805
+#: ../roundup/admin.py:1827
 #, fuzzy, python-format
 msgid "no such item \"%(class)s%(id)s\""
 msgstr "Der Eintrag \"%(class)s%(id)s\" existiert nicht"
 
-#: ../roundup/admin.py:1817
+#: ../roundup/admin.py:1839
 #, fuzzy
 msgid ""
 "Usage: restore designator[,designator]*\n"
@@ -1240,7 +1240,7 @@ msgstr ""
 "        fÃ¼r die Benutzer wieder sichtbar.\n"
 "        "
 
-#: ../roundup/admin.py:1848
+#: ../roundup/admin.py:1870
 #, fuzzy
 msgid ""
 "Usage: retire designator[,designator]*\n"
@@ -1262,7 +1262,7 @@ msgstr ""
 "        "
 
 #. noqa: ARG002 - args unused
-#: ../roundup/admin.py:1876
+#: ../roundup/admin.py:1898
 msgid ""
 "Usage: rollback\n"
 "        Undo all changes that are pending commit to the database.\n"
@@ -1281,7 +1281,7 @@ msgstr ""
 "        verworfen.\n"
 "        "
 
-#: ../roundup/admin.py:1889
+#: ../roundup/admin.py:1911
 msgid ""
 "Usage: security [Role name]\n"
 "        Display the Permissions available to one or all Roles.\n"
@@ -1294,48 +1294,48 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1904
+#: ../roundup/admin.py:1926
 #, fuzzy, python-format
 msgid "No such Role \"%(role)s\"\n"
 msgstr "Die Rolle \"%(role)s\" existiert nicht "
 
-#: ../roundup/admin.py:1910
+#: ../roundup/admin.py:1932
 #, fuzzy, python-format
 msgid "New Web users get the Roles \"%(role)s\"\n"
 msgstr "Neue Web-Benutzer erhalten die Rollen \"%(role)s\""
 
-#: ../roundup/admin.py:1913
+#: ../roundup/admin.py:1935
 #, fuzzy, python-format
 msgid "New Web users get the Role \"%(role)s\"\n"
 msgstr "Neue Web-Benutzer erhalten die Rolle \"%(role)s\""
 
-#: ../roundup/admin.py:1917
+#: ../roundup/admin.py:1939
 #, fuzzy, python-format
 msgid "New Email users get the Roles \"%(role)s\"\n"
 msgstr "Neue E-Mail-Benutzer erhalten die Rollen \"%(role)s\""
 
-#: ../roundup/admin.py:1919
+#: ../roundup/admin.py:1941
 #, fuzzy, python-format
 msgid "New Email users get the Role \"%(role)s\"\n"
 msgstr "Neue E-Mail-Benutzer erhalten die Rolle \"%(role)s\""
 
-#: ../roundup/admin.py:1922
+#: ../roundup/admin.py:1944
 #, fuzzy, python-format
 msgid "Role \"%(name)s\":\n"
 msgstr "Rolle \"%(name)s\":"
 
-#: ../roundup/admin.py:1928
+#: ../roundup/admin.py:1950
 #, fuzzy
 msgid " %(description)s (%(name)s for \"%(klass)s\""
 msgstr "%(description)s (%(name)s einzig fÃ¼r \"%(klass)s\")"
 
-#: ../roundup/admin.py:1928
+#: ../roundup/admin.py:1950
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\": %(properties)s only)\n"
 msgstr ""
 " %(description)s (%(name)s fÃ¼r \"%(klass)s\": ausschlieÃŸlich %(properties)s)"
 
-#: ../roundup/admin.py:1941
+#: ../roundup/admin.py:1963
 #, python-format
 msgid ""
 "\n"
@@ -1343,17 +1343,17 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/admin.py:1947
+#: ../roundup/admin.py:1969
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\" only)\n"
 msgstr "%(description)s (%(name)s einzig fÃ¼r \"%(klass)s\")"
 
-#: ../roundup/admin.py:1950
+#: ../roundup/admin.py:1972
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s)\n"
 msgstr " %(description)s (%(name)s)"
 
-#: ../roundup/admin.py:1954
+#: ../roundup/admin.py:1976
 #, fuzzy
 msgid ""
 "Usage: set items property=value [property=value ...]\n"
@@ -1390,7 +1390,7 @@ msgstr ""
 "(\"1,2,3\").\n"
 "        "
 
-#: ../roundup/admin.py:2022
+#: ../roundup/admin.py:2044
 msgid ""
 "Usage: specification classname\n"
 "        Show the properties for a classname.\n"
@@ -1404,17 +1404,17 @@ msgstr ""
 "        Zeigt sÃ¤mtliche Eigenschaften der Klasse auf.\n"
 "        "
 
-#: ../roundup/admin.py:2041
+#: ../roundup/admin.py:2063
 #, fuzzy, python-format
 msgid "%(key)s: %(value)s (key property)\n"
 msgstr "%(key)s: %(value)s (SchlÃ¼sseleigenschaft)"
 
-#: ../roundup/admin.py:2044
+#: ../roundup/admin.py:2066
 #, fuzzy, python-format
 msgid "%(key)s: %(value)s\n"
 msgstr "%(key)s: %(value)s"
 
-#: ../roundup/admin.py:2047
+#: ../roundup/admin.py:2069
 msgid ""
 "Usage: table classname [property[,property]*]\n"
 "        List the instances of a class in tabular form.\n"
@@ -1477,17 +1477,17 @@ msgstr ""
 "\n"
 "        "
 
-#: ../roundup/admin.py:2093
+#: ../roundup/admin.py:2115
 #, python-format
 msgid "\"%(spec)s\" not name:width"
 msgstr "\"%(spec)s\" entspricht nicht dem Format Eigenschaft:Breite"
 
-#: ../roundup/admin.py:2115
+#: ../roundup/admin.py:2137
 #, python-format
 msgid "\"%(spec)s\" does not have an integer width: \"%(width)s\""
 msgstr ""
 
-#: ../roundup/admin.py:2151
+#: ../roundup/admin.py:2173
 msgid ""
 "Usage: templates [trace_search]\n"
 "        List templates and their installed directories.\n"
@@ -1497,7 +1497,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2179
+#: ../roundup/admin.py:2201
 #, fuzzy
 msgid ""
 "Usage: updateconfig <filename>\n"
@@ -1513,34 +1513,34 @@ msgstr ""
 "        "
 
 # ../roundup/cgi/actions.py:546 :556
-#: ../roundup/admin.py:2188 ../roundup/cgi/actions.py:886
+#: ../roundup/admin.py:2210 ../roundup/cgi/actions.py:886
 #: ../roundup/cgi/actions.py:897 ../roundup/cgi/actions.py:1099
 #: ../roundup/cgi/actions.py:1113 ../roundup/cgi/actions.py:886:897 :1099:1113
 #, python-format
 msgid "Error: %s"
 msgstr "Fehler: %s"
 
-#: ../roundup/admin.py:2220
+#: ../roundup/admin.py:2242
 #, python-format
 msgid "Unknown command \"%(command)s\" (\"help commands\" for a list)"
 msgstr "Der Befehl \"%(command)s\" existiert nicht (siehe \"help commands\")"
 
-#: ../roundup/admin.py:2226
+#: ../roundup/admin.py:2248
 #, python-format
 msgid "Multiple commands match \"%(command)s\": %(list)s"
 msgstr "Zur AbkÃ¼rzung \"%(command)s\" passen mehrere Befehle: %(list)s"
 
-#: ../roundup/admin.py:2241
+#: ../roundup/admin.py:2263
 msgid "Enter tracker home: "
 msgstr "Tracker-Verzeichnis: "
 
-#: ../roundup/admin.py:2270 ../roundup/admin.py:2274
-#: ../roundup/admin.py:2270:2274
+#: ../roundup/admin.py:2292 ../roundup/admin.py:2296
+#: ../roundup/admin.py:2292:2296
 #, python-format
 msgid "Error: Couldn't open tracker: %(message)s"
 msgstr "Fehler: Die Tracker-Instanz konnte nicht geÃ¶ffnet werden: %(message)s"
 
-#: ../roundup/admin.py:2322
+#: ../roundup/admin.py:2344
 #, python-format
 msgid ""
 "Roundup %s ready for input.\n"
@@ -1549,15 +1549,15 @@ msgstr ""
 "Roundup %s ist bereit.\n"
 "Schreiben Sie \"help\", um zur Hilfe zu gelangen."
 
-#: ../roundup/admin.py:2355
+#: ../roundup/admin.py:2377
 msgid "Note: command history and editing not available"
 msgstr "Bemerkung: Befehlsverlauf/-bearbeitung mÃ¶glicherweise nicht verfÃ¼gbar"
 
-#: ../roundup/admin.py:2361
+#: ../roundup/admin.py:2383
 msgid "exit..."
 msgstr "beenden..."
 
-#: ../roundup/admin.py:2374
+#: ../roundup/admin.py:2396
 msgid "There are unsaved changes. Commit them (y/N)? "
 msgstr "Es gibt noch ungespeicherte Ã„nderungen. Ã„nderungen speichern (y/N)?"
 
@@ -1588,23 +1588,23 @@ msgstr ""
 "Konnte die Datenbank nicht Ã¶ffnen - das erforderliche Modul '%s' ist nicht "
 "verfÃ¼gbar"
 
-#: ../roundup/backends/back_anydbm.py:871
-#: ../roundup/backends/back_anydbm.py:884
-#: ../roundup/backends/back_anydbm.py:1158
-#: ../roundup/backends/back_anydbm.py:1193
-#: ../roundup/backends/back_anydbm.py:1422
-#: ../roundup/backends/back_anydbm.py:1440
-#: ../roundup/backends/back_anydbm.py:1487
-#: ../roundup/backends/back_anydbm.py:2123
-#: ../roundup/backends/back_anydbm.py:871:884
+#: ../roundup/backends/back_anydbm.py:873
+#: ../roundup/backends/back_anydbm.py:886
+#: ../roundup/backends/back_anydbm.py:1160
+#: ../roundup/backends/back_anydbm.py:1195
+#: ../roundup/backends/back_anydbm.py:1424
+#: ../roundup/backends/back_anydbm.py:1442
+#: ../roundup/backends/back_anydbm.py:1489
+#: ../roundup/backends/back_anydbm.py:2135
+#: ../roundup/backends/back_anydbm.py:873:886
 #: ../roundup/backends/rdbms_common.py:1720
 #: ../roundup/backends/rdbms_common.py:1967
 #: ../roundup/backends/rdbms_common.py:2206
 #: ../roundup/backends/rdbms_common.py:2226
 #: ../roundup/backends/rdbms_common.py:2279
-#: ../roundup/backends/rdbms_common.py:3246
-#: ../roundup/backends/rdbms_common.py:1720:1967 :1158:1193 :1422:1440:1487
-#: :2123 :2206:2226 :2279:3246
+#: ../roundup/backends/rdbms_common.py:3254
+#: ../roundup/backends/rdbms_common.py:1720:1967 :1160:1195 :1424:1442:1489
+#: :2135 :2206:2226 :2279:3254
 msgid "Database open read-only"
 msgstr "Datenbank nur zum Lesen geÃ¶ffnet"
 
@@ -2004,13 +2004,13 @@ msgstr "UngÃ¼ltiger Benutzername"
 msgid "You do not have permission to login"
 msgstr "Sie sind nicht berechtigt, sich anzumelden"
 
-#: ../roundup/cgi/actions.py:1577 ../roundup/cgi/actions.py:1761
-#: ../roundup/cgi/actions.py:1577:1761
+#: ../roundup/cgi/actions.py:1577 ../roundup/cgi/actions.py:1757
+#: ../roundup/cgi/actions.py:1577:1757
 #, python-format
 msgid "Column \"%(column)s\" not found in %(class)s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1832
+#: ../roundup/cgi/actions.py:1822
 #, python-format
 msgid "You do not have permission to view %(class)s"
 msgstr "Sie sind nicht berechtigt, EintrÃ¤ge der Klasse \"%(class)s\" zu lesen"
@@ -2103,7 +2103,7 @@ msgstr "in <strong>%s</strong>"
 msgid "<em>undefined</em>"
 msgstr "<em>nicht definiert</em>"
 
-#: ../roundup/cgi/client.py:105
+#: ../roundup/cgi/client.py:111
 msgid ""
 "<html><head><title>An error has occurred</title></head>\n"
 "<body><h1>An error has occurred</h1>\n"
@@ -2117,148 +2117,154 @@ msgstr ""
 "Admistratoren wurden benachrichtigt.</p>\n"
 "</body></html>"
 
-#: ../roundup/cgi/client.py:717 ../roundup/cgi/client.py:1635
-#: ../roundup/cgi/client.py:717:1635
+#: ../roundup/cgi/client.py:666
+msgid ""
+"XMLRPC endpoint is not using defusedxml. Improve security by installing "
+"defusedxml."
+msgstr ""
+
+#: ../roundup/cgi/client.py:728 ../roundup/cgi/client.py:1646
+#: ../roundup/cgi/client.py:728:1646
 msgid "Required Header Missing"
 msgstr ""
 
-#: ../roundup/cgi/client.py:719
+#: ../roundup/cgi/client.py:731
 #, fuzzy
 msgid "Client is not allowed to use Rest Interface."
 msgstr "Gast-Benutzer sind nicht berechtigt, das Web-Interface zu benutzen."
 
-#: ../roundup/cgi/client.py:971
+#: ../roundup/cgi/client.py:985
 msgid "Form Error: "
 msgstr "Formular-Fehler: "
 
-#: ../roundup/cgi/client.py:1064
+#: ../roundup/cgi/client.py:1078
 #, python-format
 msgid "Unrecognized charset: %r"
 msgstr "Zeichensatz nicht erkannt: %r"
 
-#: ../roundup/cgi/client.py:1331 ../roundup/cgi/client.py:2294
-#: ../roundup/cgi/client.py:1331:2294
+#: ../roundup/cgi/client.py:1345 ../roundup/cgi/client.py:2357
+#: ../roundup/cgi/client.py:1345:2357
 msgid "broken form: multiple @action values submitted"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1348
+#: ../roundup/cgi/client.py:1362
 msgid "Anonymous users are not allowed to use the web interface"
 msgstr "Gast-Benutzer sind nicht berechtigt, das Web-Interface zu benutzen."
 
-#: ../roundup/cgi/client.py:1496
+#: ../roundup/cgi/client.py:1507
 msgid "Referer header not available."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1500
+#: ../roundup/cgi/client.py:1511
 #, python-format
 msgid "csrf key used with wrong method from: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1529
+#: ../roundup/cgi/client.py:1540
 #, python-format
 msgid "csrf header %(header)s required but missing for user%(userid)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1533
+#: ../roundup/cgi/client.py:1544
 #, python-format
 msgid "Missing header: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1541
+#: ../roundup/cgi/client.py:1552
 #, python-format
 msgid "csrf Referer header check failed for user%(userid)s. Value=%(referer)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1546
+#: ../roundup/cgi/client.py:1557
 #, fuzzy, python-format
 msgid "Invalid Referer: %s"
 msgstr "UngÃ¼ltiger Benutzername %s"
 
-#: ../roundup/cgi/client.py:1561
+#: ../roundup/cgi/client.py:1572
 #, python-format
 msgid "csrf Origin header check failed for user%(userid)s. Value=%(origin)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1566
+#: ../roundup/cgi/client.py:1577
 #, fuzzy, python-format
 msgid "Invalid Origin %s"
 msgstr "UngÃ¼ltiger Benutzername %s"
 
-#: ../roundup/cgi/client.py:1580
+#: ../roundup/cgi/client.py:1591
 #, python-format
 msgid ""
 "csrf X-FORWARDED-HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1586
+#: ../roundup/cgi/client.py:1597
 #, python-format
 msgid "Invalid X-FORWARDED-HOST %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1605
+#: ../roundup/cgi/client.py:1616
 #, python-format
 msgid "csrf HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1610
+#: ../roundup/cgi/client.py:1621
 #, fuzzy, python-format
 msgid "Invalid HOST %s"
 msgstr "UngÃ¼ltige Anforderung %s"
 
-#: ../roundup/cgi/client.py:1618
+#: ../roundup/cgi/client.py:1629
 msgid "Csrf: unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1619
+#: ../roundup/cgi/client.py:1630
 msgid "Unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1632
+#: ../roundup/cgi/client.py:1643
 #, python-format
 msgid "csrf X-REQUESTED-WITH xmlrpc required header check failed for user%s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1673
+#: ../roundup/cgi/client.py:1684
 #, python-format
 msgid "Required csrf field missing for user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1675 ../roundup/cgi/client.py:1702
-#: ../roundup/cgi/client.py:1719 ../roundup/cgi/client.py:1675:1702:1719
+#: ../roundup/cgi/client.py:1686 ../roundup/cgi/client.py:1713
+#: ../roundup/cgi/client.py:1730 ../roundup/cgi/client.py:1686:1713:1730
 msgid ""
 "We can't validate your session (csrf failure). Re-enter any unsaved data and "
 "try again."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1679
+#: ../roundup/cgi/client.py:1690
 #, python-format
 msgid "csrf field not supplied by user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1691
+#: ../roundup/cgi/client.py:1702
 #, python-format
 msgid ""
 "Csrf mismatch user: current user %(user)s != stored user %(stored)s, current "
 "session, stored session: %(cur_sess)s,%(stor_sess)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1709
+#: ../roundup/cgi/client.py:1720
 #, python-format
 msgid ""
 "Csrf mismatch user: current session %(curr_sess)s != stored session "
 "%(stor_sess)s, current user/stored user is: %(user)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1901
+#: ../roundup/cgi/client.py:1912
 msgid "You are not allowed to view this file."
 msgstr "Sie sind nicht berechtigt, diese Seite anzuzeigen."
 
-#: ../roundup/cgi/client.py:2172
+#: ../roundup/cgi/client.py:2235
 #, python-format
 msgid "%(starttag)sTime elapsed: %(seconds)fs%(endtag)s\n"
 msgstr "%(starttag)sBenÃ¶tigte Zeit: %(seconds)fs%(endtag)s\n"
 
-#: ../roundup/cgi/client.py:2176
+#: ../roundup/cgi/client.py:2239
 #, python-format
 msgid ""
 "%(starttag)sCache hits: %(cache_hits)d, misses %(cache_misses)d. Loading "
@@ -2267,7 +2273,7 @@ msgstr ""
 "%(starttag)sCache benutzt: %(cache_hits)d, verfehlt: %(cache_misses)d. "
 "EintrÃ¤ge laden: %(get_items)fs; filtern: %(filtering)fs.%(endtag)s\n"
 
-#: ../roundup/cgi/client.py:2716
+#: ../roundup/cgi/client.py:2778
 #, python-format
 msgid ""
 "Cache failure: compressed file %(compressed)s is older than its source file "
@@ -2686,17 +2692,17 @@ msgstr "\"%s\" ist kein gÃ¼ltiger Bezeichner"
 msgid "Not a property name: %s"
 msgstr "Keine Eigenschaft: %s"
 
-#: ../roundup/hyperdb.py:1984
+#: ../roundup/hyperdb.py:2038
 #, fuzzy, python-format
 msgid "property %(property)s: %(value)r is not a %(classname)s."
 msgstr "Der Wert \"%(value)s\" ist nicht in der Liste fÃ¼r \"%(property)s\""
 
-#: ../roundup/hyperdb.py:1990
+#: ../roundup/hyperdb.py:2044
 #, python-format
 msgid "you may only enter ID values for property %s"
 msgstr "Sie kÃ¶nnen fÃ¼r die Eigenschaft %s  nur IDs eingeben"
 
-#: ../roundup/hyperdb.py:2025
+#: ../roundup/hyperdb.py:2079
 #, fuzzy, python-format
 msgid "%(property)r is not a property of %(classname)s"
 msgstr "%r ist keine Eigenschaft von %s"
@@ -3023,6 +3029,22 @@ msgstr ""
 msgid "not of form [arg=value,value,...;arg=value,value,...]"
 msgstr "entspricht nicht der Form [arg=wert,wert,...;arg=wert,wert,...]"
 
+#: ../roundup/mlink_expr.py:161
+#, python-format
+msgid ""
+"There was an error searching %(class)s by %(attr)s using: %(opcodes)s. The "
+"operator %(opcode)s (%(opcodename)s) at position %(position)d has too few "
+"arguments."
+msgstr ""
+
+#: ../roundup/mlink_expr.py:174
+#, python-format
+msgid ""
+"There was an error searching %(class)s by %(attr)s using: %(opcodes)s. There "
+"are too many arguments for the existing operators. The values on the stack "
+"are: %(stack)s"
+msgstr ""
+
 #: ../roundup/pygettext.py:401
 #, python-format
 msgid "*** %(file)s:%(lineno)s: Seen unexpected token \"%(token)s\""
@@ -3080,42 +3102,63 @@ msgstr ""
 msgid "morethanonestring"
 msgstr ""
 
-#: ../roundup/rest.py:410
+#: ../roundup/rest.py:417
 #, python-format
 msgid "Method %(m)s not allowed. Allowed: %(a)s"
 msgstr ""
 
-#: ../roundup/rest.py:948
+#: ../roundup/rest.py:964
 #, python-format
 msgid ""
 "Page size %(page_size)s must be less than admin limit on query result size: "
 "%(max_size)s."
 msgstr ""
 
-#: ../roundup/rest.py:1193
+#: ../roundup/rest.py:1211
 #, fuzzy, python-format
 msgid "Invalid attribute %s"
 msgstr "UngÃ¼ltiger Benutzername %s"
 
-#: ../roundup/rest.py:2182
+#: ../roundup/rest.py:2199
 #, python-format
 msgid "Api rate limits exceeded. Please wait: %s seconds."
 msgstr ""
 
-#: ../roundup/rest.py:2258
+#: ../roundup/rest.py:2283
 #, python-format
 msgid ""
-"Unable to parse Accept Header. %(error)s. Acceptable types: "
+"Content type '%s' requested in URL is not available.\n"
+"Acceptable types: %s\n"
+msgstr ""
+
+#: ../roundup/rest.py:2304
+#, python-format
+msgid ""
+"Unable to parse Accept Header. %(error)s. Acceptable types: */*, "
 "%(acceptable_types)s"
 msgstr ""
 
-#: ../roundup/rest.py:2441
+#: ../roundup/rest.py:2376 ../roundup/rest.py:2597 ../roundup/rest.py:2376:2597
 #, python-format
 msgid ""
 "Unrecognized api version: %s. See /rest without specifying api version for "
 "supported versions."
 msgstr ""
 
+#: ../roundup/rest.py:2411 ../roundup/rest.py:2420 ../roundup/rest.py:2411:2420
+#, python-format
+msgid ""
+"Requested content type(s) '%s' not available.\n"
+"Acceptable mime types are: */*, %s"
+msgstr ""
+
+#: ../roundup/rest.py:2696
+msgid ""
+"Internal error while formatting response.\n"
+"accept_mime_type is not defined. This should\n"
+"never happen\n"
+msgstr ""
+
 #: ../roundup/roundupdb.py:140
 #, python-format
 msgid "Username '%s' already exists."
@@ -3278,33 +3321,33 @@ msgstr ""
 "Fehler: Als E-Mail-Quelle muss \"mailbox\", \"pop\", \"pops\", \"apop\", "
 "\"imap\" oder \"imaps\" gewÃ¤hlt werden"
 
-#: ../roundup/scripts/roundup_server.py:112
+#: ../roundup/scripts/roundup_server.py:113
 msgid "WARNING: generating temporary SSL certificate"
 msgstr "WARNUNG: erzeuge temporÃ¤res SSL-Zertifikat"
 
-#: ../roundup/scripts/roundup_server.py:143
+#: ../roundup/scripts/roundup_server.py:144
 #, python-format
 msgid "Unable to find/use key from file: %(pemfile)s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:144
+#: ../roundup/scripts/roundup_server.py:145
 msgid ""
 "Does it have a private key surrounded by '-----BEGIN PRIVATE KEY-----' and\n"
 "  '-----END PRIVATE KEY-----' markers?"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:149
+#: ../roundup/scripts/roundup_server.py:150
 #, python-format
 msgid "Unable to find/use certificate from file: %(pemfile)s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:150
+#: ../roundup/scripts/roundup_server.py:151
 msgid ""
 "Does it have a certificate surrounded by '-----BEGIN CERTIFICATE-----' and\n"
 "  '-----END CERTIFICATE-----' markers?"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:344
+#: ../roundup/scripts/roundup_server.py:345
 msgid ""
 "<html><head><title>Roundup trackers index</title></head>\n"
 "<body><h1>Roundup trackers index</h1><ol>\n"
@@ -3312,63 +3355,63 @@ msgstr ""
 "<html><head><title>Roundup Tracker-Liste</title></head>\n"
 "<body><h1>Roundup Tracker-Liste</h1><ol>\n"
 
-#: ../roundup/scripts/roundup_server.py:570
+#: ../roundup/scripts/roundup_server.py:587
 #, fuzzy, python-format
 msgid "Error: %(type)s: %(value)s"
 msgstr "%(type)s: %(value)s"
 
-#: ../roundup/scripts/roundup_server.py:582
+#: ../roundup/scripts/roundup_server.py:599
 msgid "WARNING: ignoring \"-g\" argument, not root"
 msgstr ""
 "WARNUNG: die Option \"-g\" wird ignoriert, da Sie nicht Administrator sind"
 
-#: ../roundup/scripts/roundup_server.py:588
+#: ../roundup/scripts/roundup_server.py:605
 msgid "Can't change groups - no grp module"
 msgstr "Die Gruppe kann nicht gewechselt werden - das Modul grp fehlt"
 
-#: ../roundup/scripts/roundup_server.py:597
+#: ../roundup/scripts/roundup_server.py:614
 #, python-format
 msgid "Group %(group)s doesn't exist"
 msgstr "Die Gruppe %(group)s existiert nicht"
 
-#: ../roundup/scripts/roundup_server.py:609
+#: ../roundup/scripts/roundup_server.py:626
 msgid "Can't run as root!"
 msgstr ""
 "Dieser Prozess kann nicht unter dem Administrator-Konto (\"root\") laufen!"
 
-#: ../roundup/scripts/roundup_server.py:612
+#: ../roundup/scripts/roundup_server.py:629
 msgid "WARNING: ignoring \"-u\" argument, not root"
 msgstr ""
 "WARNUNG: die Option \"-u\" wird ignoriert, da Sie nicht Administrator sind"
 
-#: ../roundup/scripts/roundup_server.py:618
+#: ../roundup/scripts/roundup_server.py:635
 msgid "Can't change users - no pwd module"
 msgstr "Der Benutzer kann nicht gewechselt werden - das Modul pwd fehlt"
 
-#: ../roundup/scripts/roundup_server.py:627
+#: ../roundup/scripts/roundup_server.py:644
 #, python-format
 msgid "User %(user)s doesn't exist"
 msgstr "Der Benutzer %(user)s existiert nicht"
 
-#: ../roundup/scripts/roundup_server.py:833
+#: ../roundup/scripts/roundup_server.py:856
 #, python-format
 msgid "Multiprocess mode \"%s\" is not available, switching to single-process"
 msgstr ""
 "Der Multiprozessmodus \"%s\" ist nicht verfÃ¼gbar, Einprozessmodus aktiviert"
 
-#: ../roundup/scripts/roundup_server.py:861
+#: ../roundup/scripts/roundup_server.py:884
 #, python-format
 msgid "Unable to bind to port %s, port already in use."
 msgstr "Start des Servers auf Port %s schlug fehl. Port bereits verwendet."
 
-#: ../roundup/scripts/roundup_server.py:865
+#: ../roundup/scripts/roundup_server.py:888
 #, fuzzy, python-format
 msgid ""
 "Unable to bind to port %(port)s, access not allowed, errno: %(errno)s %(msg)s"
 msgstr ""
 "Start des Servers auf Port %(port)s schlug fehl. Port bereits verwendet."
 
-#: ../roundup/scripts/roundup_server.py:944
+#: ../roundup/scripts/roundup_server.py:967
 msgid ""
 " -c <Command>  Windows Service options.\n"
 "               If you want to run the server as a Windows Service, you\n"
@@ -3384,13 +3427,15 @@ msgstr ""
 "               Zudem mÃ¼ssen Sie die Logfile-Option aktivieren.\n"
 "               \"roundup-server -c help\" zeigt eine weitere Hilfe zum Thema."
 
-#: ../roundup/scripts/roundup_server.py:951
+#: ../roundup/scripts/roundup_server.py:974
+#, fuzzy
 msgid ""
 " -u <UID>      runs the Roundup web server as this UID\n"
 " -g <GID>      runs the Roundup web server as this GID\n"
 " -d <PIDfile>  run the server in the background and write the server's PID\n"
 "               to the file indicated by PIDfile. The -l option *must* be\n"
-"               specified if -d is used."
+"               specified if -d is used.\n"
+" -D            run the server in the foreground even when -d is used."
 msgstr ""
 " -u <UID>      Startet den Roundup-Server mit dieser Benutzernummer\n"
 " -g <GID>      Startet den Roundup-Server mit dieser Gruppennummer\n"
@@ -3398,7 +3443,7 @@ msgstr ""
 "               die Prozess-ID in die Datei PIDDatei.\n"
 "               Die Option -l muss dann auch angegeben werden."
 
-#: ../roundup/scripts/roundup_server.py:958
+#: ../roundup/scripts/roundup_server.py:982
 #, fuzzy, python-format
 msgid ""
 "\n"
@@ -3423,6 +3468,10 @@ msgid ""
 "mode\n"
 " -s            enable SSL\n"
 " -L            http request logging uses python logging (roundup.http)\n"
+" -P            log client address/name using reverse proxy X-Forwarded-For\n"
+"               header and not the connection IP (which is the reverse "
+"proxy).\n"
+"               Appends a '+' sign to the logged address/name.\n"
 " -e <fname>    PEM file containing SSL key and certificate\n"
 " -t <mode>     multiprocess mode (default: %(mp_def)s).\n"
 "               Allowed values: %(mp_types)s.\n"
@@ -3520,21 +3569,21 @@ msgstr ""
 "   URLs Probleme bereiten kÃ¶nnten. Am besten verwenden Sie nur Buchstaben, \n"
 "   Zahlen und \"-_\".\n"
 
-#: ../roundup/scripts/roundup_server.py:1135
+#: ../roundup/scripts/roundup_server.py:1162
 msgid "Instances must be name=home"
 msgstr "Instanzen mÃ¼ssen als Tracker-Name=Tracker-Verzeichnis angegeben werden"
 
-#: ../roundup/scripts/roundup_server.py:1149
+#: ../roundup/scripts/roundup_server.py:1176
 #, python-format
 msgid "Configuration saved to %s"
 msgstr "Konfiguration in der Datei %s gespeichert"
 
-#: ../roundup/scripts/roundup_server.py:1167
+#: ../roundup/scripts/roundup_server.py:1194
 msgid "Sorry, you can't run the server as a daemon on this Operating System"
 msgstr ""
 "Auf diesem Betriebssystem kann der Server nicht als Hintergrundprozess laufen"
 
-#: ../roundup/scripts/roundup_server.py:1187
+#: ../roundup/scripts/roundup_server.py:1214
 #, python-format
 msgid "Roundup server started on %(HOST)s:%(PORT)s"
 msgstr "Der Roundup-Server wurde unter %(HOST)s:%(PORT)s gestartet"
diff --git a/locale/en.po b/locale/en.po
index 0b19da6ff..d8543b461 100644
--- a/locale/en.po
+++ b/locale/en.po
@@ -9,9 +9,9 @@
 #
 msgid ""
 msgstr ""
-"Project-Id-Version: Roundup 2.4.0\n"
+"Project-Id-Version: Roundup 2.5.0\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
-"POT-Creation-Date: 2024-08-07 21:43-0400\n"
+"POT-Creation-Date: 2024-12-30 22:49-0500\n"
 "PO-Revision-Date: 2004-11-20 13:47+0200\n"
 "Last-Translator: Not applicable\n"
 "Language-Team: English\n"
@@ -85,8 +85,8 @@ msgstr ""
 msgid "Enable verbose output: tracing, descriptions...\n"
 msgstr ""
 
-#: ../roundup/admin.py:175 ../roundup/admin.py:1188 ../roundup/admin.py:1836
-#: ../roundup/admin.py:1868 ../roundup/admin.py:175:1188 :1836:1868
+#: ../roundup/admin.py:175 ../roundup/admin.py:1188 ../roundup/admin.py:1858
+#: ../roundup/admin.py:1890 ../roundup/admin.py:175:1188 :1858:1890
 #, python-format
 msgid "no such class \"%(classname)s\""
 msgstr ""
@@ -217,13 +217,13 @@ msgstr ""
 msgid "%s:"
 msgstr ""
 
-#: ../roundup/admin.py:439 ../roundup/admin.py:1396
-#: ../roundup/admin.py:439:1396
+#: ../roundup/admin.py:439 ../roundup/admin.py:1415
+#: ../roundup/admin.py:439:1415
 msgid "Templates:"
 msgstr ""
 
-#: ../roundup/admin.py:442 ../roundup/admin.py:1406
-#: ../roundup/admin.py:442:1406
+#: ../roundup/admin.py:442 ../roundup/admin.py:1425
+#: ../roundup/admin.py:442:1425
 msgid "Back ends:"
 msgstr ""
 
@@ -257,11 +257,11 @@ msgstr ""
 #: ../roundup/admin.py:482 ../roundup/admin.py:555 ../roundup/admin.py:606
 #: ../roundup/admin.py:733 ../roundup/admin.py:806 ../roundup/admin.py:851
 #: ../roundup/admin.py:902 ../roundup/admin.py:999 ../roundup/admin.py:1216
-#: ../roundup/admin.py:1369 ../roundup/admin.py:1497 ../roundup/admin.py:1580
-#: ../roundup/admin.py:1703 ../roundup/admin.py:1826 ../roundup/admin.py:1858
-#: ../roundup/admin.py:1974 ../roundup/admin.py:2028 ../roundup/admin.py:2076
-#: ../roundup/admin.py:482:555 :1216:1369:1497 :1580:1703 :1826:1858 :1974:2028
-#: :2076 :606:733 :806:851 :902:999
+#: ../roundup/admin.py:1388 ../roundup/admin.py:1516 ../roundup/admin.py:1599
+#: ../roundup/admin.py:1725 ../roundup/admin.py:1848 ../roundup/admin.py:1880
+#: ../roundup/admin.py:1996 ../roundup/admin.py:2050 ../roundup/admin.py:2098
+#: ../roundup/admin.py:482:555 :1216:1388:1516 :1599:1725 :1848:1880 :1996:2050
+#: :2098 :606:733 :806:851 :902:999
 msgid "Not enough arguments supplied"
 msgstr ""
 
@@ -365,9 +365,9 @@ msgstr ""
 msgid "Class %(curclassname)s has no property %(pn)s in %(propname)s."
 msgstr ""
 
-#: ../roundup/admin.py:791 ../roundup/admin.py:840 ../roundup/admin.py:1517
-#: ../roundup/admin.py:1530 ../roundup/admin.py:2098
-#: ../roundup/admin.py:791:840 :1517:1530:2098
+#: ../roundup/admin.py:791 ../roundup/admin.py:840 ../roundup/admin.py:1536
+#: ../roundup/admin.py:1549 ../roundup/admin.py:2120
+#: ../roundup/admin.py:791:840 :1536:1549:2120
 #, python-format
 msgid "%(classname)s has no property \"%(propname)s\""
 msgstr ""
@@ -429,8 +429,8 @@ msgstr ""
 msgid "property %s is not of type Multilink or Link so -d flag does not apply."
 msgstr ""
 
-#: ../roundup/admin.py:942 ../roundup/admin.py:1190 ../roundup/admin.py:1842
-#: ../roundup/admin.py:1870 ../roundup/admin.py:942:1190 :1842:1870
+#: ../roundup/admin.py:942 ../roundup/admin.py:1190 ../roundup/admin.py:1864
+#: ../roundup/admin.py:1892 ../roundup/admin.py:942:1190 :1864:1892
 #, python-format
 msgid "no such %(classname)s node \"%(nodeid)s\""
 msgstr ""
@@ -545,7 +545,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1287
+#: ../roundup/admin.py:1306
 msgid ""
 "Usage: importtables export_dir\n"
 "        This imports the database tables exported using exporttables.\n"
@@ -555,7 +555,7 @@ msgid ""
 msgstr ""
 
 #. password
-#: ../roundup/admin.py:1295
+#: ../roundup/admin.py:1314
 msgid ""
 "Usage: initialise [adminpw]\n"
 "        Initialise a new Roundup tracker.\n"
@@ -566,30 +566,30 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1309
+#: ../roundup/admin.py:1328
 msgid "Admin Password: "
 msgstr ""
 
-#: ../roundup/admin.py:1310
+#: ../roundup/admin.py:1329
 msgid "       Confirm: "
 msgstr ""
 
-#: ../roundup/admin.py:1314
+#: ../roundup/admin.py:1333
 msgid "Instance home does not exist"
 msgstr ""
 
-#: ../roundup/admin.py:1318
+#: ../roundup/admin.py:1337
 msgid "Instance has not been installed"
 msgstr ""
 
-#: ../roundup/admin.py:1326
+#: ../roundup/admin.py:1345
 msgid ""
 "WARNING: The database is already initialised!\n"
 "If you re-initialise it, you will lose all the data!\n"
 "Erase it? Y/N: "
 msgstr ""
 
-#: ../roundup/admin.py:1346
+#: ../roundup/admin.py:1365
 msgid ""
 "Usage: install [template [backend [key=val[,key=val]]]]\n"
 "        Install a new Roundup tracker.\n"
@@ -615,12 +615,12 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1375
+#: ../roundup/admin.py:1394
 #, python-format
 msgid "Instance home parent directory \"%(parent)s\" does not exist"
 msgstr ""
 
-#: ../roundup/admin.py:1384
+#: ../roundup/admin.py:1403
 #, python-format
 msgid ""
 "WARNING: There appears to be a tracker in \"%(tracker_home)s\"!\n"
@@ -628,20 +628,20 @@ msgid ""
 "Erase it? Y/N: "
 msgstr ""
 
-#: ../roundup/admin.py:1397
+#: ../roundup/admin.py:1416
 msgid "Select template"
 msgstr ""
 
-#: ../roundup/admin.py:1407
+#: ../roundup/admin.py:1426
 msgid "Select backend"
 msgstr ""
 
-#: ../roundup/admin.py:1418
+#: ../roundup/admin.py:1437
 #, python-format
 msgid "Error in configuration settings: \"%s\""
 msgstr ""
 
-#: ../roundup/admin.py:1451
+#: ../roundup/admin.py:1470
 #, python-format
 msgid ""
 "\n"
@@ -650,11 +650,11 @@ msgid ""
 "   %(config_file)s"
 msgstr ""
 
-#: ../roundup/admin.py:1461
+#: ../roundup/admin.py:1480
 msgid " ... at a minimum, you must set following options:"
 msgstr ""
 
-#: ../roundup/admin.py:1466
+#: ../roundup/admin.py:1485
 #, python-format
 msgid ""
 "\n"
@@ -671,7 +671,7 @@ msgid ""
 "---------------------------------------------------------------------------\n"
 msgstr ""
 
-#: ../roundup/admin.py:1482
+#: ../roundup/admin.py:1501
 msgid ""
 "Usage: list classname [property]\n"
 "        List the instances of a class.\n"
@@ -687,17 +687,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1495
+#: ../roundup/admin.py:1514
 msgid "Too many arguments supplied"
 msgstr ""
 
-#: ../roundup/admin.py:1528
+#: ../roundup/admin.py:1547
 #, python-format
 msgid "%(nodeid)4s: %(value)s"
 msgstr ""
 
 #. noqa: ARG002  - args unused
-#: ../roundup/admin.py:1535
+#: ../roundup/admin.py:1554
 msgid ""
 "Usage: migrate\n"
 "        Update a tracker's database to be compatible with the Roundup\n"
@@ -720,17 +720,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1555
+#: ../roundup/admin.py:1574
 #, python-format
 msgid "Tracker updated to schema version %s."
 msgstr ""
 
-#: ../roundup/admin.py:1559
+#: ../roundup/admin.py:1578
 #, python-format
 msgid "No migration action required. At schema version %s."
 msgstr ""
 
-#: ../roundup/admin.py:1564
+#: ../roundup/admin.py:1583
 msgid ""
 "Usage: pack period | date\n"
 "        Remove journal entries older than the date/period.\n"
@@ -750,11 +750,11 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1590
+#: ../roundup/admin.py:1609
 msgid "Invalid format"
 msgstr ""
 
-#: ../roundup/admin.py:1601
+#: ../roundup/admin.py:1620
 msgid ""
 "Usage: perftest [mode] [arguments]*\n"
 "        Time operations in Roundup.\n"
@@ -772,25 +772,25 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1635
+#: ../roundup/admin.py:1657
 msgid "Invalid 'rounds'. Must be larger than 999."
 msgstr ""
 
-#: ../roundup/admin.py:1639
+#: ../roundup/admin.py:1661
 #, python-format
 msgid "Invalid 'rounds'. It must be an integer not: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1666
+#: ../roundup/admin.py:1688
 msgid "scheme does not support rounds."
 msgstr ""
 
-#: ../roundup/admin.py:1669
+#: ../roundup/admin.py:1691
 #, python-format
 msgid "Hash time: %(time)0.9f seconds, scheme: %(scheme)s, rounds: %(rounds)s"
 msgstr ""
 
-#: ../roundup/admin.py:1675
+#: ../roundup/admin.py:1697
 msgid ""
 "Usage: pragma setting=value | 'list'\n"
 "        Set internal admin settings to a value.\n"
@@ -819,49 +819,49 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1710
+#: ../roundup/admin.py:1732
 #, python-format
 msgid "Argument must be setting=value, was given: %s."
 msgstr ""
 
-#: ../roundup/admin.py:1713
+#: ../roundup/admin.py:1735
 msgid "Current settings and values (NYI - not yet implemented):"
 msgstr ""
 
-#: ../roundup/admin.py:1724
+#: ../roundup/admin.py:1746
 msgid ""
 "      Help for this pragma is missing. Please report it to the Roundup "
 "project.\n"
 msgstr ""
 
-#: ../roundup/admin.py:1730
+#: ../roundup/admin.py:1752
 #, python-format
 msgid "Unknown setting %s. Try \"pragma list\"."
 msgstr ""
 
-#: ../roundup/admin.py:1740
+#: ../roundup/admin.py:1762
 #, python-format
 msgid "Incorrect value for boolean setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1747
+#: ../roundup/admin.py:1769
 #, python-format
 msgid "Incorrect value for integer setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1754
+#: ../roundup/admin.py:1776
 #, python-format
 msgid ""
 "Incorrect value for setting %(setting)s: %(value)s. Should be no, both, or "
 "only."
 msgstr ""
 
-#: ../roundup/admin.py:1764
+#: ../roundup/admin.py:1786
 #, python-format
 msgid "Internal error: pragma can not handle values of type: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1773
+#: ../roundup/admin.py:1795
 msgid ""
 "Usage: reindex [classname|classname:#-#|designator]*\n"
 "        Re-generate a tracker's search indexes.\n"
@@ -878,17 +878,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1795
+#: ../roundup/admin.py:1817
 #, python-format
 msgid "no such item \"%(designator)s\""
 msgstr ""
 
-#: ../roundup/admin.py:1805
+#: ../roundup/admin.py:1827
 #, python-format
 msgid "no such item \"%(class)s%(id)s\""
 msgstr ""
 
-#: ../roundup/admin.py:1817
+#: ../roundup/admin.py:1839
 msgid ""
 "Usage: restore designator[,designator]*\n"
 "        Restore the retired node specified by designator.\n"
@@ -900,7 +900,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1848
+#: ../roundup/admin.py:1870
 msgid ""
 "Usage: retire designator[,designator]*\n"
 "        Retire the node specified by designator.\n"
@@ -914,7 +914,7 @@ msgid ""
 msgstr ""
 
 #. noqa: ARG002 - args unused
-#: ../roundup/admin.py:1876
+#: ../roundup/admin.py:1898
 msgid ""
 "Usage: rollback\n"
 "        Undo all changes that are pending commit to the database.\n"
@@ -926,7 +926,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1889
+#: ../roundup/admin.py:1911
 msgid ""
 "Usage: security [Role name]\n"
 "        Display the Permissions available to one or all Roles.\n"
@@ -939,46 +939,46 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1904
+#: ../roundup/admin.py:1926
 #, python-format
 msgid "No such Role \"%(role)s\"\n"
 msgstr ""
 
-#: ../roundup/admin.py:1910
+#: ../roundup/admin.py:1932
 #, python-format
 msgid "New Web users get the Roles \"%(role)s\"\n"
 msgstr ""
 
-#: ../roundup/admin.py:1913
+#: ../roundup/admin.py:1935
 #, python-format
 msgid "New Web users get the Role \"%(role)s\"\n"
 msgstr ""
 
-#: ../roundup/admin.py:1917
+#: ../roundup/admin.py:1939
 #, python-format
 msgid "New Email users get the Roles \"%(role)s\"\n"
 msgstr ""
 
-#: ../roundup/admin.py:1919
+#: ../roundup/admin.py:1941
 #, python-format
 msgid "New Email users get the Role \"%(role)s\"\n"
 msgstr ""
 
-#: ../roundup/admin.py:1922
+#: ../roundup/admin.py:1944
 #, python-format
 msgid "Role \"%(name)s\":\n"
 msgstr ""
 
-#: ../roundup/admin.py:1928
+#: ../roundup/admin.py:1950
 msgid " %(description)s (%(name)s for \"%(klass)s\""
 msgstr ""
 
-#: ../roundup/admin.py:1928
+#: ../roundup/admin.py:1950
 #, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\": %(properties)s only)\n"
 msgstr ""
 
-#: ../roundup/admin.py:1941
+#: ../roundup/admin.py:1963
 #, python-format
 msgid ""
 "\n"
@@ -986,17 +986,17 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/admin.py:1947
+#: ../roundup/admin.py:1969
 #, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\" only)\n"
 msgstr ""
 
-#: ../roundup/admin.py:1950
+#: ../roundup/admin.py:1972
 #, python-format
 msgid " %(description)s (%(name)s)\n"
 msgstr ""
 
-#: ../roundup/admin.py:1954
+#: ../roundup/admin.py:1976
 msgid ""
 "Usage: set items property=value [property=value ...]\n"
 "        Set the given properties of one or more items(s).\n"
@@ -1017,7 +1017,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2022
+#: ../roundup/admin.py:2044
 msgid ""
 "Usage: specification classname\n"
 "        Show the properties for a classname.\n"
@@ -1026,17 +1026,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2041
+#: ../roundup/admin.py:2063
 #, python-format
 msgid "%(key)s: %(value)s (key property)\n"
 msgstr ""
 
-#: ../roundup/admin.py:2044
+#: ../roundup/admin.py:2066
 #, python-format
 msgid "%(key)s: %(value)s\n"
 msgstr ""
 
-#: ../roundup/admin.py:2047
+#: ../roundup/admin.py:2069
 msgid ""
 "Usage: table classname [property[,property]*]\n"
 "        List the instances of a class in tabular form.\n"
@@ -1068,17 +1068,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2093
+#: ../roundup/admin.py:2115
 #, python-format
 msgid "\"%(spec)s\" not name:width"
 msgstr ""
 
-#: ../roundup/admin.py:2115
+#: ../roundup/admin.py:2137
 #, python-format
 msgid "\"%(spec)s\" does not have an integer width: \"%(width)s\""
 msgstr ""
 
-#: ../roundup/admin.py:2151
+#: ../roundup/admin.py:2173
 msgid ""
 "Usage: templates [trace_search]\n"
 "        List templates and their installed directories.\n"
@@ -1088,7 +1088,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2179
+#: ../roundup/admin.py:2201
 msgid ""
 "Usage: updateconfig <filename>\n"
 "        Merge existing tracker config with new settings.\n"
@@ -1098,49 +1098,49 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2188 ../roundup/cgi/actions.py:886
+#: ../roundup/admin.py:2210 ../roundup/cgi/actions.py:886
 #: ../roundup/cgi/actions.py:897 ../roundup/cgi/actions.py:1099
 #: ../roundup/cgi/actions.py:1113 ../roundup/cgi/actions.py:886:897 :1099:1113
 #, python-format
 msgid "Error: %s"
 msgstr ""
 
-#: ../roundup/admin.py:2220
+#: ../roundup/admin.py:2242
 #, python-format
 msgid "Unknown command \"%(command)s\" (\"help commands\" for a list)"
 msgstr ""
 
-#: ../roundup/admin.py:2226
+#: ../roundup/admin.py:2248
 #, python-format
 msgid "Multiple commands match \"%(command)s\": %(list)s"
 msgstr ""
 
-#: ../roundup/admin.py:2241
+#: ../roundup/admin.py:2263
 msgid "Enter tracker home: "
 msgstr ""
 
-#: ../roundup/admin.py:2270 ../roundup/admin.py:2274
-#: ../roundup/admin.py:2270:2274
+#: ../roundup/admin.py:2292 ../roundup/admin.py:2296
+#: ../roundup/admin.py:2292:2296
 #, python-format
 msgid "Error: Couldn't open tracker: %(message)s"
 msgstr ""
 
-#: ../roundup/admin.py:2322
+#: ../roundup/admin.py:2344
 #, python-format
 msgid ""
 "Roundup %s ready for input.\n"
 "Type \"help\" for help."
 msgstr ""
 
-#: ../roundup/admin.py:2355
+#: ../roundup/admin.py:2377
 msgid "Note: command history and editing not available"
 msgstr ""
 
-#: ../roundup/admin.py:2361
+#: ../roundup/admin.py:2383
 msgid "exit..."
 msgstr ""
 
-#: ../roundup/admin.py:2374
+#: ../roundup/admin.py:2396
 msgid "There are unsaved changes. Commit them (y/N)? "
 msgstr ""
 
@@ -1167,23 +1167,23 @@ msgstr ""
 msgid "Couldn't open database - the required module '%s' is not available"
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:871
-#: ../roundup/backends/back_anydbm.py:884
-#: ../roundup/backends/back_anydbm.py:1158
-#: ../roundup/backends/back_anydbm.py:1193
-#: ../roundup/backends/back_anydbm.py:1422
-#: ../roundup/backends/back_anydbm.py:1440
-#: ../roundup/backends/back_anydbm.py:1487
-#: ../roundup/backends/back_anydbm.py:2123
-#: ../roundup/backends/back_anydbm.py:871:884
+#: ../roundup/backends/back_anydbm.py:873
+#: ../roundup/backends/back_anydbm.py:886
+#: ../roundup/backends/back_anydbm.py:1160
+#: ../roundup/backends/back_anydbm.py:1195
+#: ../roundup/backends/back_anydbm.py:1424
+#: ../roundup/backends/back_anydbm.py:1442
+#: ../roundup/backends/back_anydbm.py:1489
+#: ../roundup/backends/back_anydbm.py:2135
+#: ../roundup/backends/back_anydbm.py:873:886
 #: ../roundup/backends/rdbms_common.py:1720
 #: ../roundup/backends/rdbms_common.py:1967
 #: ../roundup/backends/rdbms_common.py:2206
 #: ../roundup/backends/rdbms_common.py:2226
 #: ../roundup/backends/rdbms_common.py:2279
-#: ../roundup/backends/rdbms_common.py:3246
-#: ../roundup/backends/rdbms_common.py:1720:1967 :1158:1193 :1422:1440:1487
-#: :2123 :2206:2226 :2279:3246
+#: ../roundup/backends/rdbms_common.py:3254
+#: ../roundup/backends/rdbms_common.py:1720:1967 :1160:1195 :1424:1442:1489
+#: :2135 :2206:2226 :2279:3254
 msgid "Database open read-only"
 msgstr ""
 
@@ -1567,13 +1567,13 @@ msgstr ""
 msgid "You do not have permission to login"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1577 ../roundup/cgi/actions.py:1761
-#: ../roundup/cgi/actions.py:1577:1761
+#: ../roundup/cgi/actions.py:1577 ../roundup/cgi/actions.py:1757
+#: ../roundup/cgi/actions.py:1577:1757
 #, python-format
 msgid "Column \"%(column)s\" not found in %(class)s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1832
+#: ../roundup/cgi/actions.py:1822
 #, python-format
 msgid "You do not have permission to view %(class)s"
 msgstr ""
@@ -1649,7 +1649,7 @@ msgstr ""
 msgid "<em>undefined</em>"
 msgstr ""
 
-#: ../roundup/cgi/client.py:105
+#: ../roundup/cgi/client.py:111
 msgid ""
 "<html><head><title>An error has occurred</title></head>\n"
 "<body><h1>An error has occurred</h1>\n"
@@ -1658,154 +1658,160 @@ msgid ""
 "</body></html>"
 msgstr ""
 
-#: ../roundup/cgi/client.py:717 ../roundup/cgi/client.py:1635
-#: ../roundup/cgi/client.py:717:1635
+#: ../roundup/cgi/client.py:666
+msgid ""
+"XMLRPC endpoint is not using defusedxml. Improve security by installing "
+"defusedxml."
+msgstr ""
+
+#: ../roundup/cgi/client.py:728 ../roundup/cgi/client.py:1646
+#: ../roundup/cgi/client.py:728:1646
 msgid "Required Header Missing"
 msgstr ""
 
-#: ../roundup/cgi/client.py:719
+#: ../roundup/cgi/client.py:731
 msgid "Client is not allowed to use Rest Interface."
 msgstr ""
 
-#: ../roundup/cgi/client.py:971
+#: ../roundup/cgi/client.py:985
 msgid "Form Error: "
 msgstr ""
 
-#: ../roundup/cgi/client.py:1064
+#: ../roundup/cgi/client.py:1078
 #, python-format
 msgid "Unrecognized charset: %r"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1331 ../roundup/cgi/client.py:2294
-#: ../roundup/cgi/client.py:1331:2294
+#: ../roundup/cgi/client.py:1345 ../roundup/cgi/client.py:2357
+#: ../roundup/cgi/client.py:1345:2357
 msgid "broken form: multiple @action values submitted"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1348
+#: ../roundup/cgi/client.py:1362
 msgid "Anonymous users are not allowed to use the web interface"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1496
+#: ../roundup/cgi/client.py:1507
 msgid "Referer header not available."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1500
+#: ../roundup/cgi/client.py:1511
 #, python-format
 msgid "csrf key used with wrong method from: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1529
+#: ../roundup/cgi/client.py:1540
 #, python-format
 msgid "csrf header %(header)s required but missing for user%(userid)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1533
+#: ../roundup/cgi/client.py:1544
 #, python-format
 msgid "Missing header: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1541
+#: ../roundup/cgi/client.py:1552
 #, python-format
 msgid "csrf Referer header check failed for user%(userid)s. Value=%(referer)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1546
+#: ../roundup/cgi/client.py:1557
 #, python-format
 msgid "Invalid Referer: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1561
+#: ../roundup/cgi/client.py:1572
 #, python-format
 msgid "csrf Origin header check failed for user%(userid)s. Value=%(origin)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1566
+#: ../roundup/cgi/client.py:1577
 #, python-format
 msgid "Invalid Origin %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1580
+#: ../roundup/cgi/client.py:1591
 #, python-format
 msgid ""
 "csrf X-FORWARDED-HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1586
+#: ../roundup/cgi/client.py:1597
 #, python-format
 msgid "Invalid X-FORWARDED-HOST %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1605
+#: ../roundup/cgi/client.py:1616
 #, python-format
 msgid "csrf HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1610
+#: ../roundup/cgi/client.py:1621
 #, python-format
 msgid "Invalid HOST %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1618
+#: ../roundup/cgi/client.py:1629
 msgid "Csrf: unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1619
+#: ../roundup/cgi/client.py:1630
 msgid "Unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1632
+#: ../roundup/cgi/client.py:1643
 #, python-format
 msgid "csrf X-REQUESTED-WITH xmlrpc required header check failed for user%s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1673
+#: ../roundup/cgi/client.py:1684
 #, python-format
 msgid "Required csrf field missing for user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1675 ../roundup/cgi/client.py:1702
-#: ../roundup/cgi/client.py:1719 ../roundup/cgi/client.py:1675:1702:1719
+#: ../roundup/cgi/client.py:1686 ../roundup/cgi/client.py:1713
+#: ../roundup/cgi/client.py:1730 ../roundup/cgi/client.py:1686:1713:1730
 msgid ""
 "We can't validate your session (csrf failure). Re-enter any unsaved data and "
 "try again."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1679
+#: ../roundup/cgi/client.py:1690
 #, python-format
 msgid "csrf field not supplied by user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1691
+#: ../roundup/cgi/client.py:1702
 #, python-format
 msgid ""
 "Csrf mismatch user: current user %(user)s != stored user %(stored)s, current "
 "session, stored session: %(cur_sess)s,%(stor_sess)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1709
+#: ../roundup/cgi/client.py:1720
 #, python-format
 msgid ""
 "Csrf mismatch user: current session %(curr_sess)s != stored session "
 "%(stor_sess)s, current user/stored user is: %(user)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1901
+#: ../roundup/cgi/client.py:1912
 msgid "You are not allowed to view this file."
 msgstr ""
 
-#: ../roundup/cgi/client.py:2172
+#: ../roundup/cgi/client.py:2235
 #, python-format
 msgid "%(starttag)sTime elapsed: %(seconds)fs%(endtag)s\n"
 msgstr ""
 
-#: ../roundup/cgi/client.py:2176
+#: ../roundup/cgi/client.py:2239
 #, python-format
 msgid ""
 "%(starttag)sCache hits: %(cache_hits)d, misses %(cache_misses)d. Loading "
 "items: %(get_items)f secs. Filtering: %(filtering)f secs.%(endtag)s\n"
 msgstr ""
 
-#: ../roundup/cgi/client.py:2716
+#: ../roundup/cgi/client.py:2778
 #, python-format
 msgid ""
 "Cache failure: compressed file %(compressed)s is older than its source file "
@@ -2198,17 +2204,17 @@ msgstr ""
 msgid "Not a property name: %s"
 msgstr ""
 
-#: ../roundup/hyperdb.py:1984
+#: ../roundup/hyperdb.py:2038
 #, python-format
 msgid "property %(property)s: %(value)r is not a %(classname)s."
 msgstr ""
 
-#: ../roundup/hyperdb.py:1990
+#: ../roundup/hyperdb.py:2044
 #, python-format
 msgid "you may only enter ID values for property %s"
 msgstr ""
 
-#: ../roundup/hyperdb.py:2025
+#: ../roundup/hyperdb.py:2079
 #, python-format
 msgid "%(property)r is not a property of %(classname)s"
 msgstr ""
@@ -2446,6 +2452,22 @@ msgstr ""
 msgid "not of form [arg=value,value,...;arg=value,value,...]"
 msgstr ""
 
+#: ../roundup/mlink_expr.py:161
+#, python-format
+msgid ""
+"There was an error searching %(class)s by %(attr)s using: %(opcodes)s. The "
+"operator %(opcode)s (%(opcodename)s) at position %(position)d has too few "
+"arguments."
+msgstr ""
+
+#: ../roundup/mlink_expr.py:174
+#, python-format
+msgid ""
+"There was an error searching %(class)s by %(attr)s using: %(opcodes)s. There "
+"are too many arguments for the existing operators. The values on the stack "
+"are: %(stack)s"
+msgstr ""
+
 #: ../roundup/pygettext.py:401
 #, python-format
 msgid "*** %(file)s:%(lineno)s: Seen unexpected token \"%(token)s\""
@@ -2503,42 +2525,63 @@ msgstr ""
 msgid "morethanonestring"
 msgstr ""
 
-#: ../roundup/rest.py:410
+#: ../roundup/rest.py:417
 #, python-format
 msgid "Method %(m)s not allowed. Allowed: %(a)s"
 msgstr ""
 
-#: ../roundup/rest.py:948
+#: ../roundup/rest.py:964
 #, python-format
 msgid ""
 "Page size %(page_size)s must be less than admin limit on query result size: "
 "%(max_size)s."
 msgstr ""
 
-#: ../roundup/rest.py:1193
+#: ../roundup/rest.py:1211
 #, python-format
 msgid "Invalid attribute %s"
 msgstr ""
 
-#: ../roundup/rest.py:2182
+#: ../roundup/rest.py:2199
 #, python-format
 msgid "Api rate limits exceeded. Please wait: %s seconds."
 msgstr ""
 
-#: ../roundup/rest.py:2258
+#: ../roundup/rest.py:2283
 #, python-format
 msgid ""
-"Unable to parse Accept Header. %(error)s. Acceptable types: "
+"Content type '%s' requested in URL is not available.\n"
+"Acceptable types: %s\n"
+msgstr ""
+
+#: ../roundup/rest.py:2304
+#, python-format
+msgid ""
+"Unable to parse Accept Header. %(error)s. Acceptable types: */*, "
 "%(acceptable_types)s"
 msgstr ""
 
-#: ../roundup/rest.py:2441
+#: ../roundup/rest.py:2376 ../roundup/rest.py:2597 ../roundup/rest.py:2376:2597
 #, python-format
 msgid ""
 "Unrecognized api version: %s. See /rest without specifying api version for "
 "supported versions."
 msgstr ""
 
+#: ../roundup/rest.py:2411 ../roundup/rest.py:2420 ../roundup/rest.py:2411:2420
+#, python-format
+msgid ""
+"Requested content type(s) '%s' not available.\n"
+"Acceptable mime types are: */*, %s"
+msgstr ""
+
+#: ../roundup/rest.py:2696
+msgid ""
+"Internal error while formatting response.\n"
+"accept_mime_type is not defined. This should\n"
+"never happen\n"
+msgstr ""
+
 #: ../roundup/roundupdb.py:140
 #, python-format
 msgid "Username '%s' already exists."
@@ -2690,90 +2733,90 @@ msgid ""
 "\"imap\", \"imaps\",  \"imaps_cram\", or \"imaps_oauth\""
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:112
+#: ../roundup/scripts/roundup_server.py:113
 msgid "WARNING: generating temporary SSL certificate"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:143
+#: ../roundup/scripts/roundup_server.py:144
 #, python-format
 msgid "Unable to find/use key from file: %(pemfile)s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:144
+#: ../roundup/scripts/roundup_server.py:145
 msgid ""
 "Does it have a private key surrounded by '-----BEGIN PRIVATE KEY-----' and\n"
 "  '-----END PRIVATE KEY-----' markers?"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:149
+#: ../roundup/scripts/roundup_server.py:150
 #, python-format
 msgid "Unable to find/use certificate from file: %(pemfile)s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:150
+#: ../roundup/scripts/roundup_server.py:151
 msgid ""
 "Does it have a certificate surrounded by '-----BEGIN CERTIFICATE-----' and\n"
 "  '-----END CERTIFICATE-----' markers?"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:344
+#: ../roundup/scripts/roundup_server.py:345
 msgid ""
 "<html><head><title>Roundup trackers index</title></head>\n"
 "<body><h1>Roundup trackers index</h1><ol>\n"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:570
+#: ../roundup/scripts/roundup_server.py:587
 #, python-format
 msgid "Error: %(type)s: %(value)s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:582
+#: ../roundup/scripts/roundup_server.py:599
 msgid "WARNING: ignoring \"-g\" argument, not root"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:588
+#: ../roundup/scripts/roundup_server.py:605
 msgid "Can't change groups - no grp module"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:597
+#: ../roundup/scripts/roundup_server.py:614
 #, python-format
 msgid "Group %(group)s doesn't exist"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:609
+#: ../roundup/scripts/roundup_server.py:626
 msgid "Can't run as root!"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:612
+#: ../roundup/scripts/roundup_server.py:629
 msgid "WARNING: ignoring \"-u\" argument, not root"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:618
+#: ../roundup/scripts/roundup_server.py:635
 msgid "Can't change users - no pwd module"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:627
+#: ../roundup/scripts/roundup_server.py:644
 #, python-format
 msgid "User %(user)s doesn't exist"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:833
+#: ../roundup/scripts/roundup_server.py:856
 #, python-format
 msgid "Multiprocess mode \"%s\" is not available, switching to single-process"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:861
+#: ../roundup/scripts/roundup_server.py:884
 #, python-format
 msgid "Unable to bind to port %s, port already in use."
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:865
+#: ../roundup/scripts/roundup_server.py:888
 #, python-format
 msgid ""
 "Unable to bind to port %(port)s, access not allowed, errno: %(errno)s %(msg)s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:944
+#: ../roundup/scripts/roundup_server.py:967
 msgid ""
 " -c <Command>  Windows Service options.\n"
 "               If you want to run the server as a Windows Service, you\n"
@@ -2783,16 +2826,17 @@ msgid ""
 "               specifics."
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:951
+#: ../roundup/scripts/roundup_server.py:974
 msgid ""
 " -u <UID>      runs the Roundup web server as this UID\n"
 " -g <GID>      runs the Roundup web server as this GID\n"
 " -d <PIDfile>  run the server in the background and write the server's PID\n"
 "               to the file indicated by PIDfile. The -l option *must* be\n"
-"               specified if -d is used."
+"               specified if -d is used.\n"
+" -D            run the server in the foreground even when -d is used."
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:958
+#: ../roundup/scripts/roundup_server.py:982
 #, python-format
 msgid ""
 "\n"
@@ -2817,6 +2861,10 @@ msgid ""
 "mode\n"
 " -s            enable SSL\n"
 " -L            http request logging uses python logging (roundup.http)\n"
+" -P            log client address/name using reverse proxy X-Forwarded-For\n"
+"               header and not the connection IP (which is the reverse "
+"proxy).\n"
+"               Appends a '+' sign to the logged address/name.\n"
 " -e <fname>    PEM file containing SSL key and certificate\n"
 " -t <mode>     multiprocess mode (default: %(mp_def)s).\n"
 "               Allowed values: %(mp_types)s.\n"
@@ -2861,20 +2909,20 @@ msgid ""
 "   any url-unsafe characters like spaces, as these confuse IE.\n"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:1135
+#: ../roundup/scripts/roundup_server.py:1162
 msgid "Instances must be name=home"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:1149
+#: ../roundup/scripts/roundup_server.py:1176
 #, python-format
 msgid "Configuration saved to %s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:1167
+#: ../roundup/scripts/roundup_server.py:1194
 msgid "Sorry, you can't run the server as a daemon on this Operating System"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:1187
+#: ../roundup/scripts/roundup_server.py:1214
 #, python-format
 msgid "Roundup server started on %(HOST)s:%(PORT)s"
 msgstr ""
diff --git a/locale/es.po b/locale/es.po
index 0970e768a..f1d582e98 100644
--- a/locale/es.po
+++ b/locale/es.po
@@ -5,9 +5,9 @@
 #
 msgid ""
 msgstr ""
-"Project-Id-Version: Roundup 2.4.0\n"
+"Project-Id-Version: Roundup 2.5.0\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
-"POT-Creation-Date: 2024-08-07 21:43-0400\n"
+"POT-Creation-Date: 2024-12-30 22:49-0500\n"
 "PO-Revision-Date: 2013-10-31 10:45+0100\n"
 "Last-Translator: Ramiro Morales <rm0@gmx.net>\n"
 "Language-Team: Spanish Translators <roundup-devel@lists.sourceforge.net>\n"
@@ -84,8 +84,8 @@ msgid "Enable verbose output: tracing, descriptions...\n"
 msgstr ""
 
 # ../roundup/admin.py:85 :955 :1004 :1026
-#: ../roundup/admin.py:175 ../roundup/admin.py:1188 ../roundup/admin.py:1836
-#: ../roundup/admin.py:1868 ../roundup/admin.py:175:1188 :1836:1868
+#: ../roundup/admin.py:175 ../roundup/admin.py:1188 ../roundup/admin.py:1858
+#: ../roundup/admin.py:1890 ../roundup/admin.py:175:1188 :1858:1890
 #, python-format
 msgid "no such class \"%(classname)s\""
 msgstr "la clase \"%(classname)s\" no existe"
@@ -330,14 +330,14 @@ msgid "%s:"
 msgstr "%s:"
 
 # ../roundup/admin.py:338 :387
-#: ../roundup/admin.py:439 ../roundup/admin.py:1396
-#: ../roundup/admin.py:439:1396
+#: ../roundup/admin.py:439 ../roundup/admin.py:1415
+#: ../roundup/admin.py:439:1415
 msgid "Templates:"
 msgstr "Plantillas:"
 
 # ../roundup/admin.py:341 :398
-#: ../roundup/admin.py:442 ../roundup/admin.py:1406
-#: ../roundup/admin.py:442:1406
+#: ../roundup/admin.py:442 ../roundup/admin.py:1425
+#: ../roundup/admin.py:442:1425
 msgid "Back ends:"
 msgstr "Motor de almacenamiento"
 
@@ -391,11 +391,11 @@ msgstr ""
 #: ../roundup/admin.py:482 ../roundup/admin.py:555 ../roundup/admin.py:606
 #: ../roundup/admin.py:733 ../roundup/admin.py:806 ../roundup/admin.py:851
 #: ../roundup/admin.py:902 ../roundup/admin.py:999 ../roundup/admin.py:1216
-#: ../roundup/admin.py:1369 ../roundup/admin.py:1497 ../roundup/admin.py:1580
-#: ../roundup/admin.py:1703 ../roundup/admin.py:1826 ../roundup/admin.py:1858
-#: ../roundup/admin.py:1974 ../roundup/admin.py:2028 ../roundup/admin.py:2076
-#: ../roundup/admin.py:482:555 :1216:1369:1497 :1580:1703 :1826:1858 :1974:2028
-#: :2076 :606:733 :806:851 :902:999
+#: ../roundup/admin.py:1388 ../roundup/admin.py:1516 ../roundup/admin.py:1599
+#: ../roundup/admin.py:1725 ../roundup/admin.py:1848 ../roundup/admin.py:1880
+#: ../roundup/admin.py:1996 ../roundup/admin.py:2050 ../roundup/admin.py:2098
+#: ../roundup/admin.py:482:555 :1216:1388:1516 :1599:1725 :1848:1880 :1996:2050
+#: :2098 :606:733 :806:851 :902:999
 msgid "Not enough arguments supplied"
 msgstr "No se proveyó una cantidad suficiente de argumentos"
 
@@ -545,9 +545,9 @@ msgid "Class %(curclassname)s has no property %(pn)s in %(propname)s."
 msgstr "%(classname)s no posee la propiedad \"%(propname)s\""
 
 # ../roundup/admin.py:675 :828 :840 :894
-#: ../roundup/admin.py:791 ../roundup/admin.py:840 ../roundup/admin.py:1517
-#: ../roundup/admin.py:1530 ../roundup/admin.py:2098
-#: ../roundup/admin.py:791:840 :1517:1530:2098
+#: ../roundup/admin.py:791 ../roundup/admin.py:840 ../roundup/admin.py:1536
+#: ../roundup/admin.py:1549 ../roundup/admin.py:2120
+#: ../roundup/admin.py:791:840 :1536:1549:2120
 #, python-format
 msgid "%(classname)s has no property \"%(propname)s\""
 msgstr "%(classname)s no posee la propiedad \"%(propname)s\""
@@ -636,8 +636,8 @@ msgstr ""
 "no puede usarse."
 
 # ../roundup/admin.py:559 :957 :1006 :1028
-#: ../roundup/admin.py:942 ../roundup/admin.py:1190 ../roundup/admin.py:1842
-#: ../roundup/admin.py:1870 ../roundup/admin.py:942:1190 :1842:1870
+#: ../roundup/admin.py:942 ../roundup/admin.py:1190 ../roundup/admin.py:1864
+#: ../roundup/admin.py:1892 ../roundup/admin.py:942:1190 :1864:1892
 #, python-format
 msgid "no such %(classname)s node \"%(nodeid)s\""
 msgstr "no existe nodo de clase %(classname)s llamado  \"%(nodeid)s\""
@@ -792,7 +792,7 @@ msgstr ""
 "        tediosamente, retirar toda los datos viejos.)\n"
 "        "
 
-#: ../roundup/admin.py:1287
+#: ../roundup/admin.py:1306
 msgid ""
 "Usage: importtables export_dir\n"
 "        This imports the database tables exported using exporttables.\n"
@@ -802,7 +802,7 @@ msgid ""
 msgstr ""
 
 #. password
-#: ../roundup/admin.py:1295
+#: ../roundup/admin.py:1314
 msgid ""
 "Usage: initialise [adminpw]\n"
 "        Initialise a new Roundup tracker.\n"
@@ -821,23 +821,23 @@ msgstr ""
 "        Ejecuta la función de inicialización dbinit.init() del tracker\n"
 "        "
 
-#: ../roundup/admin.py:1309
+#: ../roundup/admin.py:1328
 msgid "Admin Password: "
 msgstr "Contraseña de administración: "
 
-#: ../roundup/admin.py:1310
+#: ../roundup/admin.py:1329
 msgid "       Confirm: "
 msgstr "       Confirmar: "
 
-#: ../roundup/admin.py:1314
+#: ../roundup/admin.py:1333
 msgid "Instance home does not exist"
 msgstr "El directorio base de la instancia no existe"
 
-#: ../roundup/admin.py:1318
+#: ../roundup/admin.py:1337
 msgid "Instance has not been installed"
 msgstr "La instancia no ha sido instalada"
 
-#: ../roundup/admin.py:1326
+#: ../roundup/admin.py:1345
 msgid ""
 "WARNING: The database is already initialised!\n"
 "If you re-initialise it, you will lose all the data!\n"
@@ -847,7 +847,7 @@ msgstr ""
 "Si la reinicializa, perderá toda la información!\n"
 "Eliminar la misma? Y/N: "
 
-#: ../roundup/admin.py:1346
+#: ../roundup/admin.py:1365
 msgid ""
 "Usage: install [template [backend [key=val[,key=val]]]]\n"
 "        Install a new Roundup tracker.\n"
@@ -903,14 +903,14 @@ msgstr ""
 "        Vea también initopts help.\n"
 "        "
 
-#: ../roundup/admin.py:1375
+#: ../roundup/admin.py:1394
 #, python-format
 msgid "Instance home parent directory \"%(parent)s\" does not exist"
 msgstr ""
 "El directorio padre \"%(parent)s\" del directorio base de la instancia no "
 "existe"
 
-#: ../roundup/admin.py:1384
+#: ../roundup/admin.py:1403
 #, python-format
 msgid ""
 "WARNING: There appears to be a tracker in \"%(tracker_home)s\"!\n"
@@ -921,22 +921,22 @@ msgstr ""
 "Si Ud. lo reinstala, perderá toda la información relacionada al mismo!\n"
 "Elimino la misma? Y/N: "
 
-#: ../roundup/admin.py:1397
+#: ../roundup/admin.py:1416
 #, fuzzy
 msgid "Select template"
 msgstr "Seleccione la plantilla [classic]: "
 
-#: ../roundup/admin.py:1407
+#: ../roundup/admin.py:1426
 #, fuzzy
 msgid "Select backend"
 msgstr "Selecccione el motor de almacenamiento [anydbm]: "
 
-#: ../roundup/admin.py:1418
+#: ../roundup/admin.py:1437
 #, python-format
 msgid "Error in configuration settings: \"%s\""
 msgstr "Error en opciones de configuración: \"%s\""
 
-#: ../roundup/admin.py:1451
+#: ../roundup/admin.py:1470
 #, python-format
 msgid ""
 "\n"
@@ -949,11 +949,11 @@ msgstr ""
 " Ud. debe ahora editar el fichero de configuración del tracker:\n"
 "   %(config_file)s"
 
-#: ../roundup/admin.py:1461
+#: ../roundup/admin.py:1480
 msgid " ... at a minimum, you must set following options:"
 msgstr " ... como mínimo, debe configurar las siguientes opciones:"
 
-#: ../roundup/admin.py:1466
+#: ../roundup/admin.py:1485
 #, python-format
 msgid ""
 "\n"
@@ -981,7 +981,7 @@ msgstr ""
 " completado los pasos arriba descriptos.\n"
 "---------------------------------------------------------------------------\n"
 
-#: ../roundup/admin.py:1482
+#: ../roundup/admin.py:1501
 msgid ""
 "Usage: list classname [property]\n"
 "        List the instances of a class.\n"
@@ -1011,17 +1011,17 @@ msgstr ""
 "clase.\n"
 "        "
 
-#: ../roundup/admin.py:1495
+#: ../roundup/admin.py:1514
 msgid "Too many arguments supplied"
 msgstr "Demasiados argumentos"
 
-#: ../roundup/admin.py:1528
+#: ../roundup/admin.py:1547
 #, python-format
 msgid "%(nodeid)4s: %(value)s"
 msgstr "%(nodeid)4s: %(value)s"
 
 #. noqa: ARG002  - args unused
-#: ../roundup/admin.py:1535
+#: ../roundup/admin.py:1554
 msgid ""
 "Usage: migrate\n"
 "        Update a tracker's database to be compatible with the Roundup\n"
@@ -1044,17 +1044,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1555
+#: ../roundup/admin.py:1574
 #, python-format
 msgid "Tracker updated to schema version %s."
 msgstr ""
 
-#: ../roundup/admin.py:1559
+#: ../roundup/admin.py:1578
 #, python-format
 msgid "No migration action required. At schema version %s."
 msgstr ""
 
-#: ../roundup/admin.py:1564
+#: ../roundup/admin.py:1583
 #, fuzzy
 msgid ""
 "Usage: pack period | date\n"
@@ -1092,11 +1092,11 @@ msgstr ""
 "\n"
 "        "
 
-#: ../roundup/admin.py:1590
+#: ../roundup/admin.py:1609
 msgid "Invalid format"
 msgstr "Formato inválido"
 
-#: ../roundup/admin.py:1601
+#: ../roundup/admin.py:1620
 msgid ""
 "Usage: perftest [mode] [arguments]*\n"
 "        Time operations in Roundup.\n"
@@ -1114,25 +1114,25 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1635
+#: ../roundup/admin.py:1657
 msgid "Invalid 'rounds'. Must be larger than 999."
 msgstr ""
 
-#: ../roundup/admin.py:1639
+#: ../roundup/admin.py:1661
 #, python-format
 msgid "Invalid 'rounds'. It must be an integer not: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1666
+#: ../roundup/admin.py:1688
 msgid "scheme does not support rounds."
 msgstr ""
 
-#: ../roundup/admin.py:1669
+#: ../roundup/admin.py:1691
 #, python-format
 msgid "Hash time: %(time)0.9f seconds, scheme: %(scheme)s, rounds: %(rounds)s"
 msgstr ""
 
-#: ../roundup/admin.py:1675
+#: ../roundup/admin.py:1697
 msgid ""
 "Usage: pragma setting=value | 'list'\n"
 "        Set internal admin settings to a value.\n"
@@ -1161,49 +1161,49 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1710
+#: ../roundup/admin.py:1732
 #, python-format
 msgid "Argument must be setting=value, was given: %s."
 msgstr ""
 
-#: ../roundup/admin.py:1713
+#: ../roundup/admin.py:1735
 msgid "Current settings and values (NYI - not yet implemented):"
 msgstr ""
 
-#: ../roundup/admin.py:1724
+#: ../roundup/admin.py:1746
 msgid ""
 "      Help for this pragma is missing. Please report it to the Roundup "
 "project.\n"
 msgstr ""
 
-#: ../roundup/admin.py:1730
+#: ../roundup/admin.py:1752
 #, fuzzy, python-format
 msgid "Unknown setting %s. Try \"pragma list\"."
 msgstr "Usuario desconocido"
 
-#: ../roundup/admin.py:1740
+#: ../roundup/admin.py:1762
 #, python-format
 msgid "Incorrect value for boolean setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1747
+#: ../roundup/admin.py:1769
 #, python-format
 msgid "Incorrect value for integer setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1754
+#: ../roundup/admin.py:1776
 #, python-format
 msgid ""
 "Incorrect value for setting %(setting)s: %(value)s. Should be no, both, or "
 "only."
 msgstr ""
 
-#: ../roundup/admin.py:1764
+#: ../roundup/admin.py:1786
 #, python-format
 msgid "Internal error: pragma can not handle values of type: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1773
+#: ../roundup/admin.py:1795
 #, fuzzy
 msgid ""
 "Usage: reindex [classname|classname:#-#|designator]*\n"
@@ -1227,17 +1227,17 @@ msgstr ""
 "        Es un comando que por lo general se ejecuta automáticamente.\n"
 "        "
 
-#: ../roundup/admin.py:1795
+#: ../roundup/admin.py:1817
 #, python-format
 msgid "no such item \"%(designator)s\""
 msgstr "no existe un ítem llamado \"%(designator)s\""
 
-#: ../roundup/admin.py:1805
+#: ../roundup/admin.py:1827
 #, fuzzy, python-format
 msgid "no such item \"%(class)s%(id)s\""
 msgstr "no existe un ítem llamado \"%(designator)s\""
 
-#: ../roundup/admin.py:1817
+#: ../roundup/admin.py:1839
 #, fuzzy
 msgid ""
 "Usage: restore designator[,designator]*\n"
@@ -1256,7 +1256,7 @@ msgstr ""
 "        para los usuarios.\n"
 "        "
 
-#: ../roundup/admin.py:1848
+#: ../roundup/admin.py:1870
 #, fuzzy
 msgid ""
 "Usage: retire designator[,designator]*\n"
@@ -1278,7 +1278,7 @@ msgstr ""
 "        "
 
 #. noqa: ARG002 - args unused
-#: ../roundup/admin.py:1876
+#: ../roundup/admin.py:1898
 msgid ""
 "Usage: rollback\n"
 "        Undo all changes that are pending commit to the database.\n"
@@ -1300,7 +1300,7 @@ msgstr ""
 "        no introduciría cambios en la base de datos.\n"
 "        "
 
-#: ../roundup/admin.py:1889
+#: ../roundup/admin.py:1911
 msgid ""
 "Usage: security [Role name]\n"
 "        Display the Permissions available to one or all Roles.\n"
@@ -1313,49 +1313,49 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1904
+#: ../roundup/admin.py:1926
 #, fuzzy, python-format
 msgid "No such Role \"%(role)s\"\n"
 msgstr "No existe un Rol llamado \"%(role)s\""
 
-#: ../roundup/admin.py:1910
+#: ../roundup/admin.py:1932
 #, fuzzy, python-format
 msgid "New Web users get the Roles \"%(role)s\"\n"
 msgstr "Los nuevos usuarios creados vía Web obtiene los Roles \"%(role)s\""
 
-#: ../roundup/admin.py:1913
+#: ../roundup/admin.py:1935
 #, fuzzy, python-format
 msgid "New Web users get the Role \"%(role)s\"\n"
 msgstr "Los nuevos usuarios creados vía Web obtienen el Rol \"%(role)s\""
 
-#: ../roundup/admin.py:1917
+#: ../roundup/admin.py:1939
 #, fuzzy, python-format
 msgid "New Email users get the Roles \"%(role)s\"\n"
 msgstr ""
 "Los nuevos usuarios creados vía e-mail obtienen los Roles  \"%(role)s\""
 
-#: ../roundup/admin.py:1919
+#: ../roundup/admin.py:1941
 #, fuzzy, python-format
 msgid "New Email users get the Role \"%(role)s\"\n"
 msgstr "Los nuevos usuarios creados vía e-mail obtienen el Rol \"%(role)s\""
 
-#: ../roundup/admin.py:1922
+#: ../roundup/admin.py:1944
 #, fuzzy, python-format
 msgid "Role \"%(name)s\":\n"
 msgstr "Rol \"%(name)s\":"
 
-#: ../roundup/admin.py:1928
+#: ../roundup/admin.py:1950
 #, fuzzy
 msgid " %(description)s (%(name)s for \"%(klass)s\""
 msgstr " %(description)s (%(name)s para \"%(klass)s\" solamente)"
 
-#: ../roundup/admin.py:1928
+#: ../roundup/admin.py:1950
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\": %(properties)s only)\n"
 msgstr ""
 " %(description)s (%(name)s para \"%(klass)s\": %(properties)s solamente)"
 
-#: ../roundup/admin.py:1941
+#: ../roundup/admin.py:1963
 #, python-format
 msgid ""
 "\n"
@@ -1363,17 +1363,17 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/admin.py:1947
+#: ../roundup/admin.py:1969
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\" only)\n"
 msgstr " %(description)s (%(name)s para \"%(klass)s\" solamente)"
 
-#: ../roundup/admin.py:1950
+#: ../roundup/admin.py:1972
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s)\n"
 msgstr " %(description)s (%(name)s)"
 
-#: ../roundup/admin.py:1954
+#: ../roundup/admin.py:1976
 #, fuzzy
 msgid ""
 "Usage: set items property=value [property=value ...]\n"
@@ -1408,7 +1408,7 @@ msgstr ""
 "        asociados como números separados por comas (\"1,2,3\").\n"
 "        "
 
-#: ../roundup/admin.py:2022
+#: ../roundup/admin.py:2044
 msgid ""
 "Usage: specification classname\n"
 "        Show the properties for a classname.\n"
@@ -1422,17 +1422,17 @@ msgstr ""
 "        Visualiza las propiedades para una cierta clase.\n"
 "        "
 
-#: ../roundup/admin.py:2041
+#: ../roundup/admin.py:2063
 #, fuzzy, python-format
 msgid "%(key)s: %(value)s (key property)\n"
 msgstr "%(key)s: %(value)s (propiedad de clave)"
 
-#: ../roundup/admin.py:2044
+#: ../roundup/admin.py:2066
 #, fuzzy, python-format
 msgid "%(key)s: %(value)s\n"
 msgstr "%(key)s: %(value)s"
 
-#: ../roundup/admin.py:2047
+#: ../roundup/admin.py:2069
 msgid ""
 "Usage: table classname [property[,property]*]\n"
 "        List the instances of a class in tabular form.\n"
@@ -1496,17 +1496,17 @@ msgstr ""
 "        caracteres.\n"
 "        "
 
-#: ../roundup/admin.py:2093
+#: ../roundup/admin.py:2115
 #, python-format
 msgid "\"%(spec)s\" not name:width"
 msgstr "\"%(spec)s\" no es de la forma nombre:longitud"
 
-#: ../roundup/admin.py:2115
+#: ../roundup/admin.py:2137
 #, python-format
 msgid "\"%(spec)s\" does not have an integer width: \"%(width)s\""
 msgstr ""
 
-#: ../roundup/admin.py:2151
+#: ../roundup/admin.py:2173
 msgid ""
 "Usage: templates [trace_search]\n"
 "        List templates and their installed directories.\n"
@@ -1516,7 +1516,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2179
+#: ../roundup/admin.py:2201
 #, fuzzy
 msgid ""
 "Usage: updateconfig <filename>\n"
@@ -1533,36 +1533,36 @@ msgstr ""
 "        "
 
 # ../roundup/cgi/actions.py:579 :590 :761 :780
-#: ../roundup/admin.py:2188 ../roundup/cgi/actions.py:886
+#: ../roundup/admin.py:2210 ../roundup/cgi/actions.py:886
 #: ../roundup/cgi/actions.py:897 ../roundup/cgi/actions.py:1099
 #: ../roundup/cgi/actions.py:1113 ../roundup/cgi/actions.py:886:897 :1099:1113
 #, python-format
 msgid "Error: %s"
 msgstr "Error: %s"
 
-#: ../roundup/admin.py:2220
+#: ../roundup/admin.py:2242
 #, python-format
 msgid "Unknown command \"%(command)s\" (\"help commands\" for a list)"
 msgstr ""
 "Comando desconocido \"%(command)s\" (tipee \"help commands\" para obtener "
 "una lista)"
 
-#: ../roundup/admin.py:2226
+#: ../roundup/admin.py:2248
 #, python-format
 msgid "Multiple commands match \"%(command)s\": %(list)s"
 msgstr "Coinciden mas de un comando \"%(command)s\": %(list)s"
 
-#: ../roundup/admin.py:2241
+#: ../roundup/admin.py:2263
 msgid "Enter tracker home: "
 msgstr "Ingrese directorio base del tracker: "
 
-#: ../roundup/admin.py:2270 ../roundup/admin.py:2274
-#: ../roundup/admin.py:2270:2274
+#: ../roundup/admin.py:2292 ../roundup/admin.py:2296
+#: ../roundup/admin.py:2292:2296
 #, python-format
 msgid "Error: Couldn't open tracker: %(message)s"
 msgstr "Error: No se pudo abrir el tracker: %(message)s"
 
-#: ../roundup/admin.py:2322
+#: ../roundup/admin.py:2344
 #, python-format
 msgid ""
 "Roundup %s ready for input.\n"
@@ -1571,15 +1571,15 @@ msgstr ""
 "Roundup %s listo para comandos.\n"
 "Tipee \"help\" para ayuda."
 
-#: ../roundup/admin.py:2355
+#: ../roundup/admin.py:2377
 msgid "Note: command history and editing not available"
 msgstr "Nota: historia y edición de comandos no disponible"
 
-#: ../roundup/admin.py:2361
+#: ../roundup/admin.py:2383
 msgid "exit..."
 msgstr "salir..."
 
-#: ../roundup/admin.py:2374
+#: ../roundup/admin.py:2396
 msgid "There are unsaved changes. Commit them (y/N)? "
 msgstr "Hay cambios sin guardar. Debo guardar los mismos (y/N)? "
 
@@ -1606,23 +1606,23 @@ msgstr ""
 msgid "Couldn't open database - the required module '%s' is not available"
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:871
-#: ../roundup/backends/back_anydbm.py:884
-#: ../roundup/backends/back_anydbm.py:1158
-#: ../roundup/backends/back_anydbm.py:1193
-#: ../roundup/backends/back_anydbm.py:1422
-#: ../roundup/backends/back_anydbm.py:1440
-#: ../roundup/backends/back_anydbm.py:1487
-#: ../roundup/backends/back_anydbm.py:2123
-#: ../roundup/backends/back_anydbm.py:871:884
+#: ../roundup/backends/back_anydbm.py:873
+#: ../roundup/backends/back_anydbm.py:886
+#: ../roundup/backends/back_anydbm.py:1160
+#: ../roundup/backends/back_anydbm.py:1195
+#: ../roundup/backends/back_anydbm.py:1424
+#: ../roundup/backends/back_anydbm.py:1442
+#: ../roundup/backends/back_anydbm.py:1489
+#: ../roundup/backends/back_anydbm.py:2135
+#: ../roundup/backends/back_anydbm.py:873:886
 #: ../roundup/backends/rdbms_common.py:1720
 #: ../roundup/backends/rdbms_common.py:1967
 #: ../roundup/backends/rdbms_common.py:2206
 #: ../roundup/backends/rdbms_common.py:2226
 #: ../roundup/backends/rdbms_common.py:2279
-#: ../roundup/backends/rdbms_common.py:3246
-#: ../roundup/backends/rdbms_common.py:1720:1967 :1158:1193 :1422:1440:1487
-#: :2123 :2206:2226 :2279:3246
+#: ../roundup/backends/rdbms_common.py:3254
+#: ../roundup/backends/rdbms_common.py:1720:1967 :1160:1195 :1424:1442:1489
+#: :2135 :2206:2226 :2279:3254
 msgid "Database open read-only"
 msgstr ""
 
@@ -2020,13 +2020,13 @@ msgstr "nombre de usuario 
 msgid "You do not have permission to login"
 msgstr "Ud. no tiene permiso para ingresar al sistema"
 
-#: ../roundup/cgi/actions.py:1577 ../roundup/cgi/actions.py:1761
-#: ../roundup/cgi/actions.py:1577:1761
+#: ../roundup/cgi/actions.py:1577 ../roundup/cgi/actions.py:1757
+#: ../roundup/cgi/actions.py:1577:1757
 #, python-format
 msgid "Column \"%(column)s\" not found in %(class)s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1832
+#: ../roundup/cgi/actions.py:1822
 #, fuzzy, python-format
 msgid "You do not have permission to view %(class)s"
 msgstr "Ud. no posee los permisos necesarios para editar %(class)s"
@@ -2117,7 +2117,7 @@ msgstr "en <strong>%s</strong>"
 msgid "<em>undefined</em>"
 msgstr "<em>indefinido/a</em>"
 
-#: ../roundup/cgi/client.py:105
+#: ../roundup/cgi/client.py:111
 msgid ""
 "<html><head><title>An error has occurred</title></head>\n"
 "<body><h1>An error has occurred</h1>\n"
@@ -2132,150 +2132,156 @@ msgstr ""
 "p>\n"
 "</body></html>"
 
-#: ../roundup/cgi/client.py:717 ../roundup/cgi/client.py:1635
-#: ../roundup/cgi/client.py:717:1635
+#: ../roundup/cgi/client.py:666
+msgid ""
+"XMLRPC endpoint is not using defusedxml. Improve security by installing "
+"defusedxml."
+msgstr ""
+
+#: ../roundup/cgi/client.py:728 ../roundup/cgi/client.py:1646
+#: ../roundup/cgi/client.py:728:1646
 msgid "Required Header Missing"
 msgstr ""
 
-#: ../roundup/cgi/client.py:719
+#: ../roundup/cgi/client.py:731
 #, fuzzy
 msgid "Client is not allowed to use Rest Interface."
 msgstr "Los usuarios anonimos no tienen permitido usar esta interfaz Web"
 
-#: ../roundup/cgi/client.py:971
+#: ../roundup/cgi/client.py:985
 msgid "Form Error: "
 msgstr "Error de formulario"
 
-#: ../roundup/cgi/client.py:1064
+#: ../roundup/cgi/client.py:1078
 #, python-format
 msgid "Unrecognized charset: %r"
 msgstr "Conjunto de caracteres desconocido: %r"
 
-#: ../roundup/cgi/client.py:1331 ../roundup/cgi/client.py:2294
-#: ../roundup/cgi/client.py:1331:2294
+#: ../roundup/cgi/client.py:1345 ../roundup/cgi/client.py:2357
+#: ../roundup/cgi/client.py:1345:2357
 msgid "broken form: multiple @action values submitted"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1348
+#: ../roundup/cgi/client.py:1362
 msgid "Anonymous users are not allowed to use the web interface"
 msgstr "Los usuarios anonimos no tienen permitido usar esta interfaz Web"
 
-#: ../roundup/cgi/client.py:1496
+#: ../roundup/cgi/client.py:1507
 msgid "Referer header not available."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1500
+#: ../roundup/cgi/client.py:1511
 #, python-format
 msgid "csrf key used with wrong method from: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1529
+#: ../roundup/cgi/client.py:1540
 #, python-format
 msgid "csrf header %(header)s required but missing for user%(userid)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1533
+#: ../roundup/cgi/client.py:1544
 #, python-format
 msgid "Missing header: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1541
+#: ../roundup/cgi/client.py:1552
 #, python-format
 msgid "csrf Referer header check failed for user%(userid)s. Value=%(referer)s"
 msgstr ""
 
 # ../roundup/cgi/actions.py:891 :895
-#: ../roundup/cgi/client.py:1546
+#: ../roundup/cgi/client.py:1557
 #, fuzzy, python-format
 msgid "Invalid Referer: %s"
 msgstr "nombre de usuario ó contraseña inválidos"
 
-#: ../roundup/cgi/client.py:1561
+#: ../roundup/cgi/client.py:1572
 #, python-format
 msgid "csrf Origin header check failed for user%(userid)s. Value=%(origin)s"
 msgstr ""
 
 # ../roundup/cgi/actions.py:891 :895
-#: ../roundup/cgi/client.py:1566
+#: ../roundup/cgi/client.py:1577
 #, fuzzy, python-format
 msgid "Invalid Origin %s"
 msgstr "nombre de usuario ó contraseña inválidos"
 
-#: ../roundup/cgi/client.py:1580
+#: ../roundup/cgi/client.py:1591
 #, python-format
 msgid ""
 "csrf X-FORWARDED-HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1586
+#: ../roundup/cgi/client.py:1597
 #, python-format
 msgid "Invalid X-FORWARDED-HOST %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1605
+#: ../roundup/cgi/client.py:1616
 #, python-format
 msgid "csrf HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1610
+#: ../roundup/cgi/client.py:1621
 #, python-format
 msgid "Invalid HOST %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1618
+#: ../roundup/cgi/client.py:1629
 msgid "Csrf: unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1619
+#: ../roundup/cgi/client.py:1630
 msgid "Unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1632
+#: ../roundup/cgi/client.py:1643
 #, python-format
 msgid "csrf X-REQUESTED-WITH xmlrpc required header check failed for user%s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1673
+#: ../roundup/cgi/client.py:1684
 #, python-format
 msgid "Required csrf field missing for user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1675 ../roundup/cgi/client.py:1702
-#: ../roundup/cgi/client.py:1719 ../roundup/cgi/client.py:1675:1702:1719
+#: ../roundup/cgi/client.py:1686 ../roundup/cgi/client.py:1713
+#: ../roundup/cgi/client.py:1730 ../roundup/cgi/client.py:1686:1713:1730
 msgid ""
 "We can't validate your session (csrf failure). Re-enter any unsaved data and "
 "try again."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1679
+#: ../roundup/cgi/client.py:1690
 #, python-format
 msgid "csrf field not supplied by user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1691
+#: ../roundup/cgi/client.py:1702
 #, python-format
 msgid ""
 "Csrf mismatch user: current user %(user)s != stored user %(stored)s, current "
 "session, stored session: %(cur_sess)s,%(stor_sess)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1709
+#: ../roundup/cgi/client.py:1720
 #, python-format
 msgid ""
 "Csrf mismatch user: current session %(curr_sess)s != stored session "
 "%(stor_sess)s, current user/stored user is: %(user)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1901
+#: ../roundup/cgi/client.py:1912
 msgid "You are not allowed to view this file."
 msgstr "Ud. no tiene permitido ver este fichero"
 
-#: ../roundup/cgi/client.py:2172
+#: ../roundup/cgi/client.py:2235
 #, python-format
 msgid "%(starttag)sTime elapsed: %(seconds)fs%(endtag)s\n"
 msgstr "%(starttag)sTiempo transcurrido: %(seconds)fs%(endtag)s\n"
 
-#: ../roundup/cgi/client.py:2176
+#: ../roundup/cgi/client.py:2239
 #, python-format
 msgid ""
 "%(starttag)sCache hits: %(cache_hits)d, misses %(cache_misses)d. Loading "
@@ -2284,7 +2290,7 @@ msgstr ""
 "%(starttag)sAciertos Cache: %(cache_hits)d, no aciertos %(cache_misses)d. "
 "Cargando items: %(get_items)f secs. Filtrado: %(filtering)f secs.%(endtag)s\n"
 
-#: ../roundup/cgi/client.py:2716
+#: ../roundup/cgi/client.py:2778
 #, python-format
 msgid ""
 "Cache failure: compressed file %(compressed)s is older than its source file "
@@ -2710,19 +2716,19 @@ msgstr ""
 msgid "Not a property name: %s"
 msgstr ""
 
-#: ../roundup/hyperdb.py:1984
+#: ../roundup/hyperdb.py:2038
 #, fuzzy, python-format
 msgid "property %(property)s: %(value)r is not a %(classname)s."
 msgstr ""
 "propiedad \"%(propname)s\": \"%(value)s\" no se encuentra en este momento en "
 "la lista"
 
-#: ../roundup/hyperdb.py:1990
+#: ../roundup/hyperdb.py:2044
 #, python-format
 msgid "you may only enter ID values for property %s"
 msgstr ""
 
-#: ../roundup/hyperdb.py:2025
+#: ../roundup/hyperdb.py:2079
 #, python-format
 msgid "%(property)r is not a property of %(classname)s"
 msgstr ""
@@ -3044,6 +3050,22 @@ msgstr ""
 msgid "not of form [arg=value,value,...;arg=value,value,...]"
 msgstr "no es de la forma [arg=valor,valor,...;arg=valor,valor,...]"
 
+#: ../roundup/mlink_expr.py:161
+#, python-format
+msgid ""
+"There was an error searching %(class)s by %(attr)s using: %(opcodes)s. The "
+"operator %(opcode)s (%(opcodename)s) at position %(position)d has too few "
+"arguments."
+msgstr ""
+
+#: ../roundup/mlink_expr.py:174
+#, python-format
+msgid ""
+"There was an error searching %(class)s by %(attr)s using: %(opcodes)s. There "
+"are too many arguments for the existing operators. The values on the stack "
+"are: %(stack)s"
+msgstr ""
+
 #: ../roundup/pygettext.py:401
 #, python-format
 msgid "*** %(file)s:%(lineno)s: Seen unexpected token \"%(token)s\""
@@ -3102,12 +3124,12 @@ msgstr ""
 msgid "morethanonestring"
 msgstr ""
 
-#: ../roundup/rest.py:410
+#: ../roundup/rest.py:417
 #, python-format
 msgid "Method %(m)s not allowed. Allowed: %(a)s"
 msgstr ""
 
-#: ../roundup/rest.py:948
+#: ../roundup/rest.py:964
 #, python-format
 msgid ""
 "Page size %(page_size)s must be less than admin limit on query result size: "
@@ -3115,30 +3137,51 @@ msgid ""
 msgstr ""
 
 # ../roundup/cgi/actions.py:891 :895
-#: ../roundup/rest.py:1193
+#: ../roundup/rest.py:1211
 #, fuzzy, python-format
 msgid "Invalid attribute %s"
 msgstr "nombre de usuario ó contraseña inválidos"
 
-#: ../roundup/rest.py:2182
+#: ../roundup/rest.py:2199
 #, python-format
 msgid "Api rate limits exceeded. Please wait: %s seconds."
 msgstr ""
 
-#: ../roundup/rest.py:2258
+#: ../roundup/rest.py:2283
 #, python-format
 msgid ""
-"Unable to parse Accept Header. %(error)s. Acceptable types: "
+"Content type '%s' requested in URL is not available.\n"
+"Acceptable types: %s\n"
+msgstr ""
+
+#: ../roundup/rest.py:2304
+#, python-format
+msgid ""
+"Unable to parse Accept Header. %(error)s. Acceptable types: */*, "
 "%(acceptable_types)s"
 msgstr ""
 
-#: ../roundup/rest.py:2441
+#: ../roundup/rest.py:2376 ../roundup/rest.py:2597 ../roundup/rest.py:2376:2597
 #, python-format
 msgid ""
 "Unrecognized api version: %s. See /rest without specifying api version for "
 "supported versions."
 msgstr ""
 
+#: ../roundup/rest.py:2411 ../roundup/rest.py:2420 ../roundup/rest.py:2411:2420
+#, python-format
+msgid ""
+"Requested content type(s) '%s' not available.\n"
+"Acceptable mime types are: */*, %s"
+msgstr ""
+
+#: ../roundup/rest.py:2696
+msgid ""
+"Internal error while formatting response.\n"
+"accept_mime_type is not defined. This should\n"
+"never happen\n"
+msgstr ""
+
 #: ../roundup/roundupdb.py:140
 #, python-format
 msgid "Username '%s' already exists."
@@ -3300,33 +3343,33 @@ msgstr ""
 "Error: EL origen debe ser \"mailbox\", \"pop\", \"apop\", \"imap\" o \"imaps"
 "\""
 
-#: ../roundup/scripts/roundup_server.py:112
+#: ../roundup/scripts/roundup_server.py:113
 msgid "WARNING: generating temporary SSL certificate"
 msgstr "ATENCION: generando certificado SLL temporario"
 
-#: ../roundup/scripts/roundup_server.py:143
+#: ../roundup/scripts/roundup_server.py:144
 #, python-format
 msgid "Unable to find/use key from file: %(pemfile)s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:144
+#: ../roundup/scripts/roundup_server.py:145
 msgid ""
 "Does it have a private key surrounded by '-----BEGIN PRIVATE KEY-----' and\n"
 "  '-----END PRIVATE KEY-----' markers?"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:149
+#: ../roundup/scripts/roundup_server.py:150
 #, python-format
 msgid "Unable to find/use certificate from file: %(pemfile)s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:150
+#: ../roundup/scripts/roundup_server.py:151
 msgid ""
 "Does it have a certificate surrounded by '-----BEGIN CERTIFICATE-----' and\n"
 "  '-----END CERTIFICATE-----' markers?"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:344
+#: ../roundup/scripts/roundup_server.py:345
 msgid ""
 "<html><head><title>Roundup trackers index</title></head>\n"
 "<body><h1>Roundup trackers index</h1><ol>\n"
@@ -3334,59 +3377,59 @@ msgstr ""
 "<html><head><title>Índice de trackers Roundup</title></head>\n"
 "<body><h1>Índice de trackers Roundup</h1><ol>\n"
 
-#: ../roundup/scripts/roundup_server.py:570
+#: ../roundup/scripts/roundup_server.py:587
 #, fuzzy, python-format
 msgid "Error: %(type)s: %(value)s"
 msgstr "%(key)s: %(value)s"
 
-#: ../roundup/scripts/roundup_server.py:582
+#: ../roundup/scripts/roundup_server.py:599
 msgid "WARNING: ignoring \"-g\" argument, not root"
 msgstr "ATENCIÓN: ignorando argumento \"-g\" , Ud. no es root"
 
-#: ../roundup/scripts/roundup_server.py:588
+#: ../roundup/scripts/roundup_server.py:605
 msgid "Can't change groups - no grp module"
 msgstr "No puede cambiar grupos - el módulo grp no está presente"
 
-#: ../roundup/scripts/roundup_server.py:597
+#: ../roundup/scripts/roundup_server.py:614
 #, python-format
 msgid "Group %(group)s doesn't exist"
 msgstr "El grupo %(group)s no existe"
 
-#: ../roundup/scripts/roundup_server.py:609
+#: ../roundup/scripts/roundup_server.py:626
 msgid "Can't run as root!"
 msgstr "No puede ejecutarse como root!"
 
-#: ../roundup/scripts/roundup_server.py:612
+#: ../roundup/scripts/roundup_server.py:629
 msgid "WARNING: ignoring \"-u\" argument, not root"
 msgstr "ATENCIÓN: ignorando argumento \"-u\", Ud. no es root"
 
-#: ../roundup/scripts/roundup_server.py:618
+#: ../roundup/scripts/roundup_server.py:635
 msgid "Can't change users - no pwd module"
 msgstr "No puedo cambiar usuarios - no existe el módulo pwd"
 
-#: ../roundup/scripts/roundup_server.py:627
+#: ../roundup/scripts/roundup_server.py:644
 #, python-format
 msgid "User %(user)s doesn't exist"
 msgstr "El usuario %(user)s no existe"
 
-#: ../roundup/scripts/roundup_server.py:833
+#: ../roundup/scripts/roundup_server.py:856
 #, python-format
 msgid "Multiprocess mode \"%s\" is not available, switching to single-process"
 msgstr ""
 "El modo multiproceso \"%s\" no está disponible, conmutado a proceso simple"
 
-#: ../roundup/scripts/roundup_server.py:861
+#: ../roundup/scripts/roundup_server.py:884
 #, python-format
 msgid "Unable to bind to port %s, port already in use."
 msgstr "Imposible asociarse al puerto %s, el mismo ya está en uso."
 
-#: ../roundup/scripts/roundup_server.py:865
+#: ../roundup/scripts/roundup_server.py:888
 #, fuzzy, python-format
 msgid ""
 "Unable to bind to port %(port)s, access not allowed, errno: %(errno)s %(msg)s"
 msgstr "Imposible asociarse al puerto %s, el mismo ya está en uso."
 
-#: ../roundup/scripts/roundup_server.py:944
+#: ../roundup/scripts/roundup_server.py:967
 msgid ""
 " -c <Command>  Windows Service options.\n"
 "               If you want to run the server as a Windows Service, you\n"
@@ -3408,13 +3451,15 @@ msgstr ""
 "para\n"
 "               Servicios Web."
 
-#: ../roundup/scripts/roundup_server.py:951
+#: ../roundup/scripts/roundup_server.py:974
+#, fuzzy
 msgid ""
 " -u <UID>      runs the Roundup web server as this UID\n"
 " -g <GID>      runs the Roundup web server as this GID\n"
 " -d <PIDfile>  run the server in the background and write the server's PID\n"
 "               to the file indicated by PIDfile. The -l option *must* be\n"
-"               specified if -d is used."
+"               specified if -d is used.\n"
+" -D            run the server in the foreground even when -d is used."
 msgstr ""
 " -u <UID>      ejecuta el servidor web de Roundup como este UID\n"
 " -g <GID>      ejecuta el servidor web de Roundup como este GID\n"
@@ -3423,7 +3468,7 @@ msgstr ""
 "               PID del servidor en el fichero especificado por PIDfile.\n"
 "               La opción -l *debe* ser especificada si se usa la opción -d."
 
-#: ../roundup/scripts/roundup_server.py:958
+#: ../roundup/scripts/roundup_server.py:982
 #, fuzzy, python-format
 msgid ""
 "\n"
@@ -3448,6 +3493,10 @@ msgid ""
 "mode\n"
 " -s            enable SSL\n"
 " -L            http request logging uses python logging (roundup.http)\n"
+" -P            log client address/name using reverse proxy X-Forwarded-For\n"
+"               header and not the connection IP (which is the reverse "
+"proxy).\n"
+"               Appends a '+' sign to the logged address/name.\n"
 " -e <fname>    PEM file containing SSL key and certificate\n"
 " -t <mode>     multiprocess mode (default: %(mp_def)s).\n"
 "               Allowed values: %(mp_types)s.\n"
@@ -3558,22 +3607,22 @@ msgstr ""
 "   caracteres tales como espacios, dado que los mismos confunden a Internet "
 "Explorer.\n"
 
-#: ../roundup/scripts/roundup_server.py:1135
+#: ../roundup/scripts/roundup_server.py:1162
 msgid "Instances must be name=home"
 msgstr "Las Instancias debe ser de la forma nombre=directorio base"
 
-#: ../roundup/scripts/roundup_server.py:1149
+#: ../roundup/scripts/roundup_server.py:1176
 #, python-format
 msgid "Configuration saved to %s"
 msgstr "Configuración guardada en %s"
 
-#: ../roundup/scripts/roundup_server.py:1167
+#: ../roundup/scripts/roundup_server.py:1194
 msgid "Sorry, you can't run the server as a daemon on this Operating System"
 msgstr ""
 "Lo siento, no puede ejecutar el servidor como un demonio en este Sistema "
 "Operativo"
 
-#: ../roundup/scripts/roundup_server.py:1187
+#: ../roundup/scripts/roundup_server.py:1214
 #, python-format
 msgid "Roundup server started on %(HOST)s:%(PORT)s"
 msgstr "servidor Roundup iniciado en %(HOST)s:%(PORT)s"
diff --git a/locale/fr.po b/locale/fr.po
index bd975a864..92f7b0063 100644
--- a/locale/fr.po
+++ b/locale/fr.po
@@ -8,9 +8,9 @@
 #
 msgid ""
 msgstr ""
-"Project-Id-Version: Roundup 2.4.0\n"
+"Project-Id-Version: Roundup 2.5.0\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
-"POT-Creation-Date: 2024-08-07 21:43-0400\n"
+"POT-Creation-Date: 2024-12-30 22:49-0500\n"
 "PO-Revision-Date: 2013-10-31 12:19+0100\n"
 "Last-Translator: Stephane Raimbault <stephane.raimbault@gmail.com>\n"
 "Language-Team: GNOME French Team <gnomefr@traduc.org>\n"
@@ -88,8 +88,8 @@ msgstr ""
 
 # ../roundup/admin.py:85 :979 :1028 :1050
 # ../roundup/admin.py:1052 ../roundup/admin.py:85:981 :1030:1052
-#: ../roundup/admin.py:175 ../roundup/admin.py:1188 ../roundup/admin.py:1836
-#: ../roundup/admin.py:1868 ../roundup/admin.py:175:1188 :1836:1868
+#: ../roundup/admin.py:175 ../roundup/admin.py:1188 ../roundup/admin.py:1858
+#: ../roundup/admin.py:1890 ../roundup/admin.py:175:1188 :1858:1890
 #, python-format
 msgid "no such class \"%(classname)s\""
 msgstr "aucune classe nommée « %(classname)s »"
@@ -330,15 +330,15 @@ msgstr "%s
 
 # ../roundup/admin.py:338 :394
 # ../roundup/admin.py:340 ../roundup/admin.py:396 ../roundup/admin.py:340:396
-#: ../roundup/admin.py:439 ../roundup/admin.py:1396
-#: ../roundup/admin.py:439:1396
+#: ../roundup/admin.py:439 ../roundup/admin.py:1415
+#: ../roundup/admin.py:439:1415
 msgid "Templates:"
 msgstr "Modèles :"
 
 # ../roundup/admin.py:341 :405
 # ../roundup/admin.py:343 ../roundup/admin.py:407 ../roundup/admin.py:343:407
-#: ../roundup/admin.py:442 ../roundup/admin.py:1406
-#: ../roundup/admin.py:442:1406
+#: ../roundup/admin.py:442 ../roundup/admin.py:1425
+#: ../roundup/admin.py:442:1425
 msgid "Back ends:"
 msgstr "Moteurs de stockage :"
 
@@ -395,11 +395,11 @@ msgstr ""
 #: ../roundup/admin.py:482 ../roundup/admin.py:555 ../roundup/admin.py:606
 #: ../roundup/admin.py:733 ../roundup/admin.py:806 ../roundup/admin.py:851
 #: ../roundup/admin.py:902 ../roundup/admin.py:999 ../roundup/admin.py:1216
-#: ../roundup/admin.py:1369 ../roundup/admin.py:1497 ../roundup/admin.py:1580
-#: ../roundup/admin.py:1703 ../roundup/admin.py:1826 ../roundup/admin.py:1858
-#: ../roundup/admin.py:1974 ../roundup/admin.py:2028 ../roundup/admin.py:2076
-#: ../roundup/admin.py:482:555 :1216:1369:1497 :1580:1703 :1826:1858 :1974:2028
-#: :2076 :606:733 :806:851 :902:999
+#: ../roundup/admin.py:1388 ../roundup/admin.py:1516 ../roundup/admin.py:1599
+#: ../roundup/admin.py:1725 ../roundup/admin.py:1848 ../roundup/admin.py:1880
+#: ../roundup/admin.py:1996 ../roundup/admin.py:2050 ../roundup/admin.py:2098
+#: ../roundup/admin.py:482:555 :1216:1388:1516 :1599:1725 :1848:1880 :1996:2050
+#: :2098 :606:733 :806:851 :902:999
 msgid "Not enough arguments supplied"
 msgstr "Pas suffisamment d'arguments fournis"
 
@@ -545,9 +545,9 @@ msgstr "%(classname)s n'a pas de propri
 
 # ../roundup/admin.py:699 :852 :864 :918
 # ../roundup/admin.py:920 ../roundup/admin.py:701:854 :866:920
-#: ../roundup/admin.py:791 ../roundup/admin.py:840 ../roundup/admin.py:1517
-#: ../roundup/admin.py:1530 ../roundup/admin.py:2098
-#: ../roundup/admin.py:791:840 :1517:1530:2098
+#: ../roundup/admin.py:791 ../roundup/admin.py:840 ../roundup/admin.py:1536
+#: ../roundup/admin.py:1549 ../roundup/admin.py:2120
+#: ../roundup/admin.py:791:840 :1536:1549:2120
 #, python-format
 msgid "%(classname)s has no property \"%(propname)s\""
 msgstr "%(classname)s n'a pas de propriété « %(propname)s »"
@@ -635,8 +635,8 @@ msgstr ""
 
 # ../roundup/admin.py:581 :981 :1030 :1052
 # ../roundup/admin.py:1054 ../roundup/admin.py:583:983 :1032:1054
-#: ../roundup/admin.py:942 ../roundup/admin.py:1190 ../roundup/admin.py:1842
-#: ../roundup/admin.py:1870 ../roundup/admin.py:942:1190 :1842:1870
+#: ../roundup/admin.py:942 ../roundup/admin.py:1190 ../roundup/admin.py:1864
+#: ../roundup/admin.py:1892 ../roundup/admin.py:942:1190 :1864:1892
 #, python-format
 msgid "no such %(classname)s node \"%(nodeid)s\""
 msgstr "le noeud « %(nodeid)s » de classe « %(classname)s » n'existe pas"
@@ -792,7 +792,7 @@ msgstr ""
 "        plus péniblement, « abandonnez » toutes les anciennes données).\n"
 "        "
 
-#: ../roundup/admin.py:1287
+#: ../roundup/admin.py:1306
 msgid ""
 "Usage: importtables export_dir\n"
 "        This imports the database tables exported using exporttables.\n"
@@ -802,7 +802,7 @@ msgid ""
 msgstr ""
 
 #. password
-#: ../roundup/admin.py:1295
+#: ../roundup/admin.py:1314
 msgid ""
 "Usage: initialise [adminpw]\n"
 "        Initialise a new Roundup tracker.\n"
@@ -821,23 +821,23 @@ msgstr ""
 "        Exécute la fonction d'initialisation dbinit.init() du pisteur.\n"
 "        "
 
-#: ../roundup/admin.py:1309
+#: ../roundup/admin.py:1328
 msgid "Admin Password: "
 msgstr "Mot de passe administrateur : "
 
-#: ../roundup/admin.py:1310
+#: ../roundup/admin.py:1329
 msgid "       Confirm: "
 msgstr "       Confirmez : "
 
-#: ../roundup/admin.py:1314
+#: ../roundup/admin.py:1333
 msgid "Instance home does not exist"
 msgstr "Le répertoire racine de l'instance n'existe pas"
 
-#: ../roundup/admin.py:1318
+#: ../roundup/admin.py:1337
 msgid "Instance has not been installed"
 msgstr "L'instance n'a pas été installée"
 
-#: ../roundup/admin.py:1326
+#: ../roundup/admin.py:1345
 msgid ""
 "WARNING: The database is already initialised!\n"
 "If you re-initialise it, you will lose all the data!\n"
@@ -847,7 +847,7 @@ msgstr ""
 "Si vous la réinitialisez, vous perdrez toutes les données !\n"
 "Supprimez la base de données (Y/N) ? "
 
-#: ../roundup/admin.py:1346
+#: ../roundup/admin.py:1365
 #, fuzzy
 msgid ""
 "Usage: install [template [backend [key=val[,key=val]]]]\n"
@@ -902,12 +902,12 @@ msgstr ""
 "        Consultez également l'aide sur « initopts ».\n"
 "        "
 
-#: ../roundup/admin.py:1375
+#: ../roundup/admin.py:1394
 #, python-format
 msgid "Instance home parent directory \"%(parent)s\" does not exist"
 msgstr "Le répertoire parent « %(parent)s » de l'instance de base n'existe pas"
 
-#: ../roundup/admin.py:1384
+#: ../roundup/admin.py:1403
 #, python-format
 msgid ""
 "WARNING: There appears to be a tracker in \"%(tracker_home)s\"!\n"
@@ -919,22 +919,22 @@ msgstr ""
 "Si vous le réinstallez, vous perdrez toutes les données !\n"
 "Supprimer le pisteur (Y/N) ? "
 
-#: ../roundup/admin.py:1397
+#: ../roundup/admin.py:1416
 #, fuzzy
 msgid "Select template"
 msgstr "Sélection du modèle [classic] : "
 
-#: ../roundup/admin.py:1407
+#: ../roundup/admin.py:1426
 #, fuzzy
 msgid "Select backend"
 msgstr "Sélection du moteur de stockage [anydbm]: "
 
-#: ../roundup/admin.py:1418
+#: ../roundup/admin.py:1437
 #, python-format
 msgid "Error in configuration settings: \"%s\""
 msgstr "Erreur dans les paramètres de la configuration : « %s »"
 
-#: ../roundup/admin.py:1451
+#: ../roundup/admin.py:1470
 #, python-format
 msgid ""
 "\n"
@@ -947,11 +947,11 @@ msgstr ""
 " Vous devez maintenant modifier le fichier de configuration du pisteur :\n"
 "    %(config_file)s"
 
-#: ../roundup/admin.py:1461
+#: ../roundup/admin.py:1480
 msgid " ... at a minimum, you must set following options:"
 msgstr " ou au minimum, vous devez définir les options suivantes :"
 
-#: ../roundup/admin.py:1466
+#: ../roundup/admin.py:1485
 #, python-format
 msgid ""
 "\n"
@@ -983,7 +983,7 @@ msgstr ""
 " que vous avez réalisé les étapes précédentes.\n"
 "---------------------------------------------------------------------------\n"
 
-#: ../roundup/admin.py:1482
+#: ../roundup/admin.py:1501
 msgid ""
 "Usage: list classname [property]\n"
 "        List the instances of a class.\n"
@@ -1013,17 +1013,17 @@ msgstr ""
 "        propriété pour chaque instance de cette classe.\n"
 "        "
 
-#: ../roundup/admin.py:1495
+#: ../roundup/admin.py:1514
 msgid "Too many arguments supplied"
 msgstr "Trop d'arguments fournis"
 
-#: ../roundup/admin.py:1528
+#: ../roundup/admin.py:1547
 #, python-format
 msgid "%(nodeid)4s: %(value)s"
 msgstr "%(nodeid)4s : %(value)s"
 
 #. noqa: ARG002  - args unused
-#: ../roundup/admin.py:1535
+#: ../roundup/admin.py:1554
 msgid ""
 "Usage: migrate\n"
 "        Update a tracker's database to be compatible with the Roundup\n"
@@ -1046,17 +1046,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1555
+#: ../roundup/admin.py:1574
 #, python-format
 msgid "Tracker updated to schema version %s."
 msgstr ""
 
-#: ../roundup/admin.py:1559
+#: ../roundup/admin.py:1578
 #, python-format
 msgid "No migration action required. At schema version %s."
 msgstr ""
 
-#: ../roundup/admin.py:1564
+#: ../roundup/admin.py:1583
 #, fuzzy
 msgid ""
 "Usage: pack period | date\n"
@@ -1097,11 +1097,11 @@ msgstr ""
 "\n"
 "        "
 
-#: ../roundup/admin.py:1590
+#: ../roundup/admin.py:1609
 msgid "Invalid format"
 msgstr "Format non valide"
 
-#: ../roundup/admin.py:1601
+#: ../roundup/admin.py:1620
 msgid ""
 "Usage: perftest [mode] [arguments]*\n"
 "        Time operations in Roundup.\n"
@@ -1119,25 +1119,25 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1635
+#: ../roundup/admin.py:1657
 msgid "Invalid 'rounds'. Must be larger than 999."
 msgstr ""
 
-#: ../roundup/admin.py:1639
+#: ../roundup/admin.py:1661
 #, python-format
 msgid "Invalid 'rounds'. It must be an integer not: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1666
+#: ../roundup/admin.py:1688
 msgid "scheme does not support rounds."
 msgstr ""
 
-#: ../roundup/admin.py:1669
+#: ../roundup/admin.py:1691
 #, python-format
 msgid "Hash time: %(time)0.9f seconds, scheme: %(scheme)s, rounds: %(rounds)s"
 msgstr ""
 
-#: ../roundup/admin.py:1675
+#: ../roundup/admin.py:1697
 msgid ""
 "Usage: pragma setting=value | 'list'\n"
 "        Set internal admin settings to a value.\n"
@@ -1166,49 +1166,49 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1710
+#: ../roundup/admin.py:1732
 #, python-format
 msgid "Argument must be setting=value, was given: %s."
 msgstr ""
 
-#: ../roundup/admin.py:1713
+#: ../roundup/admin.py:1735
 msgid "Current settings and values (NYI - not yet implemented):"
 msgstr ""
 
-#: ../roundup/admin.py:1724
+#: ../roundup/admin.py:1746
 msgid ""
 "      Help for this pragma is missing. Please report it to the Roundup "
 "project.\n"
 msgstr ""
 
-#: ../roundup/admin.py:1730
+#: ../roundup/admin.py:1752
 #, fuzzy, python-format
 msgid "Unknown setting %s. Try \"pragma list\"."
 msgstr "Nom d'utilisateur inconnu"
 
-#: ../roundup/admin.py:1740
+#: ../roundup/admin.py:1762
 #, python-format
 msgid "Incorrect value for boolean setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1747
+#: ../roundup/admin.py:1769
 #, python-format
 msgid "Incorrect value for integer setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1754
+#: ../roundup/admin.py:1776
 #, python-format
 msgid ""
 "Incorrect value for setting %(setting)s: %(value)s. Should be no, both, or "
 "only."
 msgstr ""
 
-#: ../roundup/admin.py:1764
+#: ../roundup/admin.py:1786
 #, python-format
 msgid "Internal error: pragma can not handle values of type: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1773
+#: ../roundup/admin.py:1795
 #, fuzzy
 msgid ""
 "Usage: reindex [classname|classname:#-#|designator]*\n"
@@ -1232,17 +1232,17 @@ msgstr ""
 "        Cette opération est normalement effectuer automatiquement.\n"
 "        "
 
-#: ../roundup/admin.py:1795
+#: ../roundup/admin.py:1817
 #, python-format
 msgid "no such item \"%(designator)s\""
 msgstr "pas d'élément « %(designator)s »"
 
-#: ../roundup/admin.py:1805
+#: ../roundup/admin.py:1827
 #, fuzzy, python-format
 msgid "no such item \"%(class)s%(id)s\""
 msgstr "pas d'élément « %(designator)s »"
 
-#: ../roundup/admin.py:1817
+#: ../roundup/admin.py:1839
 #, fuzzy
 msgid ""
 "Usage: restore designator[,designator]*\n"
@@ -1262,7 +1262,7 @@ msgstr ""
 "        utilisateurs.\n"
 "        "
 
-#: ../roundup/admin.py:1848
+#: ../roundup/admin.py:1870
 #, fuzzy
 msgid ""
 "Usage: retire designator[,designator]*\n"
@@ -1284,7 +1284,7 @@ msgstr ""
 "        "
 
 #. noqa: ARG002 - args unused
-#: ../roundup/admin.py:1876
+#: ../roundup/admin.py:1898
 msgid ""
 "Usage: rollback\n"
 "        Undo all changes that are pending commit to the database.\n"
@@ -1307,7 +1307,7 @@ msgstr ""
 "        base de données.\n"
 "        "
 
-#: ../roundup/admin.py:1889
+#: ../roundup/admin.py:1911
 msgid ""
 "Usage: security [Role name]\n"
 "        Display the Permissions available to one or all Roles.\n"
@@ -1320,48 +1320,48 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1904
+#: ../roundup/admin.py:1926
 #, fuzzy, python-format
 msgid "No such Role \"%(role)s\"\n"
 msgstr "Ce rôle « %(role)s » n'existe pas"
 
-#: ../roundup/admin.py:1910
+#: ../roundup/admin.py:1932
 #, fuzzy, python-format
 msgid "New Web users get the Roles \"%(role)s\"\n"
 msgstr "Les nouveaux utilisateurs Web ont les rôles « %(role)s »"
 
-#: ../roundup/admin.py:1913
+#: ../roundup/admin.py:1935
 #, fuzzy, python-format
 msgid "New Web users get the Role \"%(role)s\"\n"
 msgstr "Les nouveaux utilisateurs Web ont le rôle « %(role)s »"
 
-#: ../roundup/admin.py:1917
+#: ../roundup/admin.py:1939
 #, fuzzy, python-format
 msgid "New Email users get the Roles \"%(role)s\"\n"
 msgstr "Les nouveaux utilisateurs Courriel ont les rôles « %(role)s »"
 
-#: ../roundup/admin.py:1919
+#: ../roundup/admin.py:1941
 #, fuzzy, python-format
 msgid "New Email users get the Role \"%(role)s\"\n"
 msgstr "Les nouveaux utilisateurs Courriel ont le rôle « %(role)s »"
 
-#: ../roundup/admin.py:1922
+#: ../roundup/admin.py:1944
 #, fuzzy, python-format
 msgid "Role \"%(name)s\":\n"
 msgstr "Rôle « %(name)s » :"
 
-#: ../roundup/admin.py:1928
+#: ../roundup/admin.py:1950
 #, fuzzy
 msgid " %(description)s (%(name)s for \"%(klass)s\""
 msgstr " %(description)s (%(name)s pour « %(klass)s » uniquement)"
 
-#: ../roundup/admin.py:1928
+#: ../roundup/admin.py:1950
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\": %(properties)s only)\n"
 msgstr ""
 " %(description)s (%(name)s pour « %(klass)s » : %(properties)s uniquement)"
 
-#: ../roundup/admin.py:1941
+#: ../roundup/admin.py:1963
 #, python-format
 msgid ""
 "\n"
@@ -1369,17 +1369,17 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/admin.py:1947
+#: ../roundup/admin.py:1969
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\" only)\n"
 msgstr " %(description)s (%(name)s pour « %(klass)s » uniquement)"
 
-#: ../roundup/admin.py:1950
+#: ../roundup/admin.py:1972
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s)\n"
 msgstr " %(description)s (%(name)s)"
 
-#: ../roundup/admin.py:1954
+#: ../roundup/admin.py:1976
 #, fuzzy
 msgid ""
 "Usage: set items property=value [property=value ...]\n"
@@ -1414,7 +1414,7 @@ msgstr ""
 "        ce lien sont indiqués comme des nombres séparés par des\n"
 "        virgules (par ex. « 1,2,3 »)."
 
-#: ../roundup/admin.py:2022
+#: ../roundup/admin.py:2044
 msgid ""
 "Usage: specification classname\n"
 "        Show the properties for a classname.\n"
@@ -1428,17 +1428,17 @@ msgstr ""
 "        Cette commande énumère les propriétés de la classe nommée.\n"
 "        "
 
-#: ../roundup/admin.py:2041
+#: ../roundup/admin.py:2063
 #, fuzzy, python-format
 msgid "%(key)s: %(value)s (key property)\n"
 msgstr "%(key)s : %(value)s (propriété clé)"
 
-#: ../roundup/admin.py:2044
+#: ../roundup/admin.py:2066
 #, fuzzy, python-format
 msgid "%(key)s: %(value)s\n"
 msgstr "%(key)s : %(value)s"
 
-#: ../roundup/admin.py:2047
+#: ../roundup/admin.py:2069
 msgid ""
 "Usage: table classname [property[,property]*]\n"
 "        List the instances of a class in tabular form.\n"
@@ -1500,17 +1500,17 @@ msgstr ""
 "        donnera une colonne « Name » large de 4 caractères.\n"
 "        "
 
-#: ../roundup/admin.py:2093
+#: ../roundup/admin.py:2115
 #, python-format
 msgid "\"%(spec)s\" not name:width"
 msgstr "« %(spec)s » ne correspond pas au format « nom:largeur »"
 
-#: ../roundup/admin.py:2115
+#: ../roundup/admin.py:2137
 #, python-format
 msgid "\"%(spec)s\" does not have an integer width: \"%(width)s\""
 msgstr ""
 
-#: ../roundup/admin.py:2151
+#: ../roundup/admin.py:2173
 msgid ""
 "Usage: templates [trace_search]\n"
 "        List templates and their installed directories.\n"
@@ -1520,7 +1520,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2179
+#: ../roundup/admin.py:2201
 #, fuzzy
 msgid ""
 "Usage: updateconfig <filename>\n"
@@ -1537,34 +1537,34 @@ msgstr ""
 
 # ../roundup/cgi/actions.py:596 :607 :778 :797
 # ../roundup/cgi/actions.py:596:607 :778:797
-#: ../roundup/admin.py:2188 ../roundup/cgi/actions.py:886
+#: ../roundup/admin.py:2210 ../roundup/cgi/actions.py:886
 #: ../roundup/cgi/actions.py:897 ../roundup/cgi/actions.py:1099
 #: ../roundup/cgi/actions.py:1113 ../roundup/cgi/actions.py:886:897 :1099:1113
 #, python-format
 msgid "Error: %s"
 msgstr "Erreur : %s"
 
-#: ../roundup/admin.py:2220
+#: ../roundup/admin.py:2242
 #, python-format
 msgid "Unknown command \"%(command)s\" (\"help commands\" for a list)"
 msgstr "Commande inconnue « %(command)s » (« help commands » pour la liste)"
 
-#: ../roundup/admin.py:2226
+#: ../roundup/admin.py:2248
 #, python-format
 msgid "Multiple commands match \"%(command)s\": %(list)s"
 msgstr "Plusieurs commandes correspondent à « %(command)s » : %(list)s"
 
-#: ../roundup/admin.py:2241
+#: ../roundup/admin.py:2263
 msgid "Enter tracker home: "
 msgstr "Saisissez le répertoire racine du pisteur : "
 
-#: ../roundup/admin.py:2270 ../roundup/admin.py:2274
-#: ../roundup/admin.py:2270:2274
+#: ../roundup/admin.py:2292 ../roundup/admin.py:2296
+#: ../roundup/admin.py:2292:2296
 #, python-format
 msgid "Error: Couldn't open tracker: %(message)s"
 msgstr "Erreur : impossible d'ouvrir le pisteur, %(message)s"
 
-#: ../roundup/admin.py:2322
+#: ../roundup/admin.py:2344
 #, python-format
 msgid ""
 "Roundup %s ready for input.\n"
@@ -1573,15 +1573,15 @@ msgstr ""
 "Roundup %s est prêt pour la saisie.\n"
 "Saisissez « help » pour l'aide."
 
-#: ../roundup/admin.py:2355
+#: ../roundup/admin.py:2377
 msgid "Note: command history and editing not available"
 msgstr "Note : l'historique et l'édition des commandes n'est pas disponible"
 
-#: ../roundup/admin.py:2361
+#: ../roundup/admin.py:2383
 msgid "exit..."
 msgstr "sortie..."
 
-#: ../roundup/admin.py:2374
+#: ../roundup/admin.py:2396
 msgid "There are unsaved changes. Commit them (y/N)? "
 msgstr "Des changements n'ont pas été enregistrés, les valider (y/N) ?"
 
@@ -1608,23 +1608,23 @@ msgstr ""
 msgid "Couldn't open database - the required module '%s' is not available"
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:871
-#: ../roundup/backends/back_anydbm.py:884
-#: ../roundup/backends/back_anydbm.py:1158
-#: ../roundup/backends/back_anydbm.py:1193
-#: ../roundup/backends/back_anydbm.py:1422
-#: ../roundup/backends/back_anydbm.py:1440
-#: ../roundup/backends/back_anydbm.py:1487
-#: ../roundup/backends/back_anydbm.py:2123
-#: ../roundup/backends/back_anydbm.py:871:884
+#: ../roundup/backends/back_anydbm.py:873
+#: ../roundup/backends/back_anydbm.py:886
+#: ../roundup/backends/back_anydbm.py:1160
+#: ../roundup/backends/back_anydbm.py:1195
+#: ../roundup/backends/back_anydbm.py:1424
+#: ../roundup/backends/back_anydbm.py:1442
+#: ../roundup/backends/back_anydbm.py:1489
+#: ../roundup/backends/back_anydbm.py:2135
+#: ../roundup/backends/back_anydbm.py:873:886
 #: ../roundup/backends/rdbms_common.py:1720
 #: ../roundup/backends/rdbms_common.py:1967
 #: ../roundup/backends/rdbms_common.py:2206
 #: ../roundup/backends/rdbms_common.py:2226
 #: ../roundup/backends/rdbms_common.py:2279
-#: ../roundup/backends/rdbms_common.py:3246
-#: ../roundup/backends/rdbms_common.py:1720:1967 :1158:1193 :1422:1440:1487
-#: :2123 :2206:2226 :2279:3246
+#: ../roundup/backends/rdbms_common.py:3254
+#: ../roundup/backends/rdbms_common.py:1720:1967 :1160:1195 :1424:1442:1489
+#: :2135 :2206:2226 :2279:3254
 msgid "Database open read-only"
 msgstr ""
 
@@ -2028,13 +2028,13 @@ msgstr "Tentative de connexion non valide"
 msgid "You do not have permission to login"
 msgstr "Vous n'avez la permission de vous connecter"
 
-#: ../roundup/cgi/actions.py:1577 ../roundup/cgi/actions.py:1761
-#: ../roundup/cgi/actions.py:1577:1761
+#: ../roundup/cgi/actions.py:1577 ../roundup/cgi/actions.py:1757
+#: ../roundup/cgi/actions.py:1577:1757
 #, python-format
 msgid "Column \"%(column)s\" not found in %(class)s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1832
+#: ../roundup/cgi/actions.py:1822
 #, fuzzy, python-format
 msgid "You do not have permission to view %(class)s"
 msgstr "Vous n'avez pas la permission de modifier %(class)s"
@@ -2127,7 +2127,7 @@ msgstr "dans <strong>%s</strong>"
 msgid "<em>undefined</em>"
 msgstr "<em>indéfini</em>"
 
-#: ../roundup/cgi/client.py:105
+#: ../roundup/cgi/client.py:111
 msgid ""
 "<html><head><title>An error has occurred</title></head>\n"
 "<body><h1>An error has occurred</h1>\n"
@@ -2141,154 +2141,160 @@ msgstr ""
 "Les administrateurs du pisteur ont été notifiés du problème.</p>\n"
 "</body></html>"
 
-#: ../roundup/cgi/client.py:717 ../roundup/cgi/client.py:1635
-#: ../roundup/cgi/client.py:717:1635
+#: ../roundup/cgi/client.py:666
+msgid ""
+"XMLRPC endpoint is not using defusedxml. Improve security by installing "
+"defusedxml."
+msgstr ""
+
+#: ../roundup/cgi/client.py:728 ../roundup/cgi/client.py:1646
+#: ../roundup/cgi/client.py:728:1646
 msgid "Required Header Missing"
 msgstr ""
 
-#: ../roundup/cgi/client.py:719
+#: ../roundup/cgi/client.py:731
 #, fuzzy
 msgid "Client is not allowed to use Rest Interface."
 msgstr ""
 "Les utilisateurs anonymes ne sont pas autorisés à utiliser l'interface Web"
 
-#: ../roundup/cgi/client.py:971
+#: ../roundup/cgi/client.py:985
 msgid "Form Error: "
 msgstr "Erreur de formulaire : "
 
-#: ../roundup/cgi/client.py:1064
+#: ../roundup/cgi/client.py:1078
 #, python-format
 msgid "Unrecognized charset: %r"
 msgstr "Jeu de caractères non reconnu : %r"
 
-#: ../roundup/cgi/client.py:1331 ../roundup/cgi/client.py:2294
-#: ../roundup/cgi/client.py:1331:2294
+#: ../roundup/cgi/client.py:1345 ../roundup/cgi/client.py:2357
+#: ../roundup/cgi/client.py:1345:2357
 msgid "broken form: multiple @action values submitted"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1348
+#: ../roundup/cgi/client.py:1362
 msgid "Anonymous users are not allowed to use the web interface"
 msgstr ""
 "Les utilisateurs anonymes ne sont pas autorisés à utiliser l'interface Web"
 
-#: ../roundup/cgi/client.py:1496
+#: ../roundup/cgi/client.py:1507
 msgid "Referer header not available."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1500
+#: ../roundup/cgi/client.py:1511
 #, python-format
 msgid "csrf key used with wrong method from: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1529
+#: ../roundup/cgi/client.py:1540
 #, python-format
 msgid "csrf header %(header)s required but missing for user%(userid)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1533
+#: ../roundup/cgi/client.py:1544
 #, python-format
 msgid "Missing header: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1541
+#: ../roundup/cgi/client.py:1552
 #, python-format
 msgid "csrf Referer header check failed for user%(userid)s. Value=%(referer)s"
 msgstr ""
 
 # ../roundup/cgi/actions.py:930 :934
 # ../roundup/cgi/actions.py:930:934
-#: ../roundup/cgi/client.py:1546
+#: ../roundup/cgi/client.py:1557
 #, fuzzy, python-format
 msgid "Invalid Referer: %s"
 msgstr "Tentative de connexion non valide"
 
-#: ../roundup/cgi/client.py:1561
+#: ../roundup/cgi/client.py:1572
 #, python-format
 msgid "csrf Origin header check failed for user%(userid)s. Value=%(origin)s"
 msgstr ""
 
 # ../roundup/cgi/actions.py:930 :934
 # ../roundup/cgi/actions.py:930:934
-#: ../roundup/cgi/client.py:1566
+#: ../roundup/cgi/client.py:1577
 #, fuzzy, python-format
 msgid "Invalid Origin %s"
 msgstr "Tentative de connexion non valide"
 
-#: ../roundup/cgi/client.py:1580
+#: ../roundup/cgi/client.py:1591
 #, python-format
 msgid ""
 "csrf X-FORWARDED-HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1586
+#: ../roundup/cgi/client.py:1597
 #, python-format
 msgid "Invalid X-FORWARDED-HOST %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1605
+#: ../roundup/cgi/client.py:1616
 #, python-format
 msgid "csrf HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1610
+#: ../roundup/cgi/client.py:1621
 #, python-format
 msgid "Invalid HOST %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1618
+#: ../roundup/cgi/client.py:1629
 msgid "Csrf: unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1619
+#: ../roundup/cgi/client.py:1630
 msgid "Unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1632
+#: ../roundup/cgi/client.py:1643
 #, python-format
 msgid "csrf X-REQUESTED-WITH xmlrpc required header check failed for user%s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1673
+#: ../roundup/cgi/client.py:1684
 #, python-format
 msgid "Required csrf field missing for user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1675 ../roundup/cgi/client.py:1702
-#: ../roundup/cgi/client.py:1719 ../roundup/cgi/client.py:1675:1702:1719
+#: ../roundup/cgi/client.py:1686 ../roundup/cgi/client.py:1713
+#: ../roundup/cgi/client.py:1730 ../roundup/cgi/client.py:1686:1713:1730
 msgid ""
 "We can't validate your session (csrf failure). Re-enter any unsaved data and "
 "try again."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1679
+#: ../roundup/cgi/client.py:1690
 #, python-format
 msgid "csrf field not supplied by user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1691
+#: ../roundup/cgi/client.py:1702
 #, python-format
 msgid ""
 "Csrf mismatch user: current user %(user)s != stored user %(stored)s, current "
 "session, stored session: %(cur_sess)s,%(stor_sess)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1709
+#: ../roundup/cgi/client.py:1720
 #, python-format
 msgid ""
 "Csrf mismatch user: current session %(curr_sess)s != stored session "
 "%(stor_sess)s, current user/stored user is: %(user)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1901
+#: ../roundup/cgi/client.py:1912
 msgid "You are not allowed to view this file."
 msgstr "Vous n'êtes pas autorisé à voir ce fichier"
 
-#: ../roundup/cgi/client.py:2172
+#: ../roundup/cgi/client.py:2235
 #, python-format
 msgid "%(starttag)sTime elapsed: %(seconds)fs%(endtag)s\n"
 msgstr "%(starttag)sTemps écoulé: %(seconds)fs%(endtag)s\n"
 
-#: ../roundup/cgi/client.py:2176
+#: ../roundup/cgi/client.py:2239
 #, python-format
 msgid ""
 "%(starttag)sCache hits: %(cache_hits)d, misses %(cache_misses)d. Loading "
@@ -2298,7 +2304,7 @@ msgstr ""
 "Chargement d'éléments : %(get_items)f secondes. Filtrage : %(filtering)f "
 "secondes.%(endtag)s\n"
 
-#: ../roundup/cgi/client.py:2716
+#: ../roundup/cgi/client.py:2778
 #, python-format
 msgid ""
 "Cache failure: compressed file %(compressed)s is older than its source file "
@@ -2733,19 +2739,19 @@ msgstr ""
 msgid "Not a property name: %s"
 msgstr ""
 
-#: ../roundup/hyperdb.py:1984
+#: ../roundup/hyperdb.py:2038
 #, fuzzy, python-format
 msgid "property %(property)s: %(value)r is not a %(classname)s."
 msgstr ""
 "propriété « %(propname)s » : « %(value)s » n'est pas actuellement dans la "
 "liste"
 
-#: ../roundup/hyperdb.py:1990
+#: ../roundup/hyperdb.py:2044
 #, python-format
 msgid "you may only enter ID values for property %s"
 msgstr ""
 
-#: ../roundup/hyperdb.py:2025
+#: ../roundup/hyperdb.py:2079
 #, python-format
 msgid "%(property)r is not a property of %(classname)s"
 msgstr ""
@@ -3068,6 +3074,22 @@ msgstr ""
 msgid "not of form [arg=value,value,...;arg=value,value,...]"
 msgstr "pas de la forme [arg=value,value,...;arg=value,value,...]"
 
+#: ../roundup/mlink_expr.py:161
+#, python-format
+msgid ""
+"There was an error searching %(class)s by %(attr)s using: %(opcodes)s. The "
+"operator %(opcode)s (%(opcodename)s) at position %(position)d has too few "
+"arguments."
+msgstr ""
+
+#: ../roundup/mlink_expr.py:174
+#, python-format
+msgid ""
+"There was an error searching %(class)s by %(attr)s using: %(opcodes)s. There "
+"are too many arguments for the existing operators. The values on the stack "
+"are: %(stack)s"
+msgstr ""
+
 #: ../roundup/pygettext.py:401
 #, python-format
 msgid "*** %(file)s:%(lineno)s: Seen unexpected token \"%(token)s\""
@@ -3127,12 +3149,12 @@ msgstr ""
 msgid "morethanonestring"
 msgstr ""
 
-#: ../roundup/rest.py:410
+#: ../roundup/rest.py:417
 #, python-format
 msgid "Method %(m)s not allowed. Allowed: %(a)s"
 msgstr ""
 
-#: ../roundup/rest.py:948
+#: ../roundup/rest.py:964
 #, python-format
 msgid ""
 "Page size %(page_size)s must be less than admin limit on query result size: "
@@ -3141,30 +3163,51 @@ msgstr ""
 
 # ../roundup/cgi/actions.py:930 :934
 # ../roundup/cgi/actions.py:930:934
-#: ../roundup/rest.py:1193
+#: ../roundup/rest.py:1211
 #, fuzzy, python-format
 msgid "Invalid attribute %s"
 msgstr "Tentative de connexion non valide"
 
-#: ../roundup/rest.py:2182
+#: ../roundup/rest.py:2199
 #, python-format
 msgid "Api rate limits exceeded. Please wait: %s seconds."
 msgstr ""
 
-#: ../roundup/rest.py:2258
+#: ../roundup/rest.py:2283
 #, python-format
 msgid ""
-"Unable to parse Accept Header. %(error)s. Acceptable types: "
+"Content type '%s' requested in URL is not available.\n"
+"Acceptable types: %s\n"
+msgstr ""
+
+#: ../roundup/rest.py:2304
+#, python-format
+msgid ""
+"Unable to parse Accept Header. %(error)s. Acceptable types: */*, "
 "%(acceptable_types)s"
 msgstr ""
 
-#: ../roundup/rest.py:2441
+#: ../roundup/rest.py:2376 ../roundup/rest.py:2597 ../roundup/rest.py:2376:2597
 #, python-format
 msgid ""
 "Unrecognized api version: %s. See /rest without specifying api version for "
 "supported versions."
 msgstr ""
 
+#: ../roundup/rest.py:2411 ../roundup/rest.py:2420 ../roundup/rest.py:2411:2420
+#, python-format
+msgid ""
+"Requested content type(s) '%s' not available.\n"
+"Acceptable mime types are: */*, %s"
+msgstr ""
+
+#: ../roundup/rest.py:2696
+msgid ""
+"Internal error while formatting response.\n"
+"accept_mime_type is not defined. This should\n"
+"never happen\n"
+msgstr ""
+
 #: ../roundup/roundupdb.py:140
 #, python-format
 msgid "Username '%s' already exists."
@@ -3324,33 +3367,33 @@ msgstr ""
 "Erreur : la source doit être « mailbox », « pop », « apop », « imap » ou "
 "« imaps »"
 
-#: ../roundup/scripts/roundup_server.py:112
+#: ../roundup/scripts/roundup_server.py:113
 msgid "WARNING: generating temporary SSL certificate"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:143
+#: ../roundup/scripts/roundup_server.py:144
 #, python-format
 msgid "Unable to find/use key from file: %(pemfile)s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:144
+#: ../roundup/scripts/roundup_server.py:145
 msgid ""
 "Does it have a private key surrounded by '-----BEGIN PRIVATE KEY-----' and\n"
 "  '-----END PRIVATE KEY-----' markers?"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:149
+#: ../roundup/scripts/roundup_server.py:150
 #, python-format
 msgid "Unable to find/use certificate from file: %(pemfile)s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:150
+#: ../roundup/scripts/roundup_server.py:151
 msgid ""
 "Does it have a certificate surrounded by '-----BEGIN CERTIFICATE-----' and\n"
 "  '-----END CERTIFICATE-----' markers?"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:344
+#: ../roundup/scripts/roundup_server.py:345
 msgid ""
 "<html><head><title>Roundup trackers index</title></head>\n"
 "<body><h1>Roundup trackers index</h1><ol>\n"
@@ -3358,64 +3401,64 @@ msgstr ""
 "<html><head><title>Index des pisteurs Roundup</title></head>\n"
 "<body><h1>Index des pisteurs Roundup</h1><ol>\n"
 
-#: ../roundup/scripts/roundup_server.py:570
+#: ../roundup/scripts/roundup_server.py:587
 #, fuzzy, python-format
 msgid "Error: %(type)s: %(value)s"
 msgstr "%(key)s : %(value)s"
 
-#: ../roundup/scripts/roundup_server.py:582
+#: ../roundup/scripts/roundup_server.py:599
 msgid "WARNING: ignoring \"-g\" argument, not root"
 msgstr ""
 "ATTENTION : le paramètre « -g » est ignoré, vous n'êtes pas superutilisateur "
 "(« root »)"
 
-#: ../roundup/scripts/roundup_server.py:588
+#: ../roundup/scripts/roundup_server.py:605
 msgid "Can't change groups - no grp module"
 msgstr "Impossible de changer les groupes - le module grp n'est pas présent"
 
-#: ../roundup/scripts/roundup_server.py:597
+#: ../roundup/scripts/roundup_server.py:614
 #, python-format
 msgid "Group %(group)s doesn't exist"
 msgstr "Le groupe %(group)s n'existe pas"
 
-#: ../roundup/scripts/roundup_server.py:609
+#: ../roundup/scripts/roundup_server.py:626
 msgid "Can't run as root!"
 msgstr "Impossible d'exécuter en tant que superutilisateur (\"root\")"
 
-#: ../roundup/scripts/roundup_server.py:612
+#: ../roundup/scripts/roundup_server.py:629
 msgid "WARNING: ignoring \"-u\" argument, not root"
 msgstr ""
 "ATTENTION: le paramètre \"-u\" est ignoré, vous n'êtes pas superutilisateur "
 "(\"root\")"
 
-#: ../roundup/scripts/roundup_server.py:618
+#: ../roundup/scripts/roundup_server.py:635
 msgid "Can't change users - no pwd module"
 msgstr ""
 "Impossible de changer les utilisateurs - le module pwd n'est pas présent"
 
-#: ../roundup/scripts/roundup_server.py:627
+#: ../roundup/scripts/roundup_server.py:644
 #, python-format
 msgid "User %(user)s doesn't exist"
 msgstr "L'utilisateur %(user)s n'existe pas"
 
-#: ../roundup/scripts/roundup_server.py:833
+#: ../roundup/scripts/roundup_server.py:856
 #, python-format
 msgid "Multiprocess mode \"%s\" is not available, switching to single-process"
 msgstr ""
 "Le mode multiprocessus \"%s\" n'existe pas, passage en mode processus unique"
 
-#: ../roundup/scripts/roundup_server.py:861
+#: ../roundup/scripts/roundup_server.py:884
 #, python-format
 msgid "Unable to bind to port %s, port already in use."
 msgstr "Impossible de s'attacher au port %s, le port est déjà utilisé"
 
-#: ../roundup/scripts/roundup_server.py:865
+#: ../roundup/scripts/roundup_server.py:888
 #, fuzzy, python-format
 msgid ""
 "Unable to bind to port %(port)s, access not allowed, errno: %(errno)s %(msg)s"
 msgstr "Impossible de s'attacher au port %s, le port est déjà utilisé"
 
-#: ../roundup/scripts/roundup_server.py:944
+#: ../roundup/scripts/roundup_server.py:967
 msgid ""
 " -c <Command>  Windows Service options.\n"
 "               If you want to run the server as a Windows Service, you\n"
@@ -3434,13 +3477,15 @@ msgstr ""
 "               La commande « roundup-server -c help » donne les\n"
 "               spécificités du service Windows."
 
-#: ../roundup/scripts/roundup_server.py:951
+#: ../roundup/scripts/roundup_server.py:974
+#, fuzzy
 msgid ""
 " -u <UID>      runs the Roundup web server as this UID\n"
 " -g <GID>      runs the Roundup web server as this GID\n"
 " -d <PIDfile>  run the server in the background and write the server's PID\n"
 "               to the file indicated by PIDfile. The -l option *must* be\n"
-"               specified if -d is used."
+"               specified if -d is used.\n"
+" -D            run the server in the foreground even when -d is used."
 msgstr ""
 " -u <UID>      démarre le serveur Web de Roundup sous l'identificateur\n"
 "               d'utilisateur UID\"\n"
@@ -3453,7 +3498,7 @@ msgstr ""
 "PID\n"
 "               L'option -l option *doit* être spécifiée si -d est utilisé."
 
-#: ../roundup/scripts/roundup_server.py:958
+#: ../roundup/scripts/roundup_server.py:982
 #, fuzzy, python-format
 msgid ""
 "\n"
@@ -3478,6 +3523,10 @@ msgid ""
 "mode\n"
 " -s            enable SSL\n"
 " -L            http request logging uses python logging (roundup.http)\n"
+" -P            log client address/name using reverse proxy X-Forwarded-For\n"
+"               header and not the connection IP (which is the reverse "
+"proxy).\n"
+"               Appends a '+' sign to the logged address/name.\n"
 " -e <fname>    PEM file containing SSL key and certificate\n"
 " -t <mode>     multiprocess mode (default: %(mp_def)s).\n"
 "               Allowed values: %(mp_types)s.\n"
@@ -3576,22 +3625,22 @@ msgstr ""
 "    souhaité. Assurez-vous que « name » ne contienne pas de caractères\n"
 "    inappropriés pour une URL, comme les espaces qui perturbe IE.\n"
 
-#: ../roundup/scripts/roundup_server.py:1135
+#: ../roundup/scripts/roundup_server.py:1162
 msgid "Instances must be name=home"
 msgstr "Les instances doivent être nom=base-du-pisteur"
 
-#: ../roundup/scripts/roundup_server.py:1149
+#: ../roundup/scripts/roundup_server.py:1176
 #, python-format
 msgid "Configuration saved to %s"
 msgstr "Configuration sauvegardée dans %s"
 
-#: ../roundup/scripts/roundup_server.py:1167
+#: ../roundup/scripts/roundup_server.py:1194
 msgid "Sorry, you can't run the server as a daemon on this Operating System"
 msgstr ""
 "Désolé, vous ne pouvez pas démarrer le serveur en tâche de fond avec ce "
 "système d'exploitation"
 
-#: ../roundup/scripts/roundup_server.py:1187
+#: ../roundup/scripts/roundup_server.py:1214
 #, python-format
 msgid "Roundup server started on %(HOST)s:%(PORT)s"
 msgstr "Le serveur Roundup est démarré sur %(HOST)s:%(PORT)s"
diff --git a/locale/hu.po b/locale/hu.po
index c481a5113..861d808e5 100644
--- a/locale/hu.po
+++ b/locale/hu.po
@@ -6,9 +6,9 @@
 # kilo aka Gabor Kmetyko <kg_kilo@freemail.hu>, 2007.
 msgid ""
 msgstr ""
-"Project-Id-Version: Roundup 2.4.0\n"
+"Project-Id-Version: Roundup 2.5.0\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
-"POT-Creation-Date: 2024-08-07 21:43-0400\n"
+"POT-Creation-Date: 2024-12-30 22:49-0500\n"
 "PO-Revision-Date: 2013-10-31 12:19+0100\n"
 "Last-Translator: kilo aka Gabor Kmetyko <kg_kilo@freemail.hu>\n"
 "Language-Team: Hungarian\n"
@@ -84,8 +84,8 @@ msgid "Enable verbose output: tracing, descriptions...\n"
 msgstr ""
 
 # ../roundup/admin.py:85 :981 :1030 :1052
-#: ../roundup/admin.py:175 ../roundup/admin.py:1188 ../roundup/admin.py:1836
-#: ../roundup/admin.py:1868 ../roundup/admin.py:175:1188 :1836:1868
+#: ../roundup/admin.py:175 ../roundup/admin.py:1188 ../roundup/admin.py:1858
+#: ../roundup/admin.py:1890 ../roundup/admin.py:175:1188 :1858:1890
 #, python-format
 msgid "no such class \"%(classname)s\""
 msgstr "nincs \"%(classname)s\" osztÃ¡ly"
@@ -245,14 +245,14 @@ msgid "%s:"
 msgstr "%s:"
 
 # ../roundup/admin.py:340 :396
-#: ../roundup/admin.py:439 ../roundup/admin.py:1396
-#: ../roundup/admin.py:439:1396
+#: ../roundup/admin.py:439 ../roundup/admin.py:1415
+#: ../roundup/admin.py:439:1415
 msgid "Templates:"
 msgstr "Sablonok:"
 
 # ../roundup/admin.py:343 :407
-#: ../roundup/admin.py:442 ../roundup/admin.py:1406
-#: ../roundup/admin.py:442:1406
+#: ../roundup/admin.py:442 ../roundup/admin.py:1425
+#: ../roundup/admin.py:442:1425
 msgid "Back ends:"
 msgstr "AdatbÃ¡zis hÃ¡tterek:"
 
@@ -288,11 +288,11 @@ msgstr ""
 #: ../roundup/admin.py:482 ../roundup/admin.py:555 ../roundup/admin.py:606
 #: ../roundup/admin.py:733 ../roundup/admin.py:806 ../roundup/admin.py:851
 #: ../roundup/admin.py:902 ../roundup/admin.py:999 ../roundup/admin.py:1216
-#: ../roundup/admin.py:1369 ../roundup/admin.py:1497 ../roundup/admin.py:1580
-#: ../roundup/admin.py:1703 ../roundup/admin.py:1826 ../roundup/admin.py:1858
-#: ../roundup/admin.py:1974 ../roundup/admin.py:2028 ../roundup/admin.py:2076
-#: ../roundup/admin.py:482:555 :1216:1369:1497 :1580:1703 :1826:1858 :1974:2028
-#: :2076 :606:733 :806:851 :902:999
+#: ../roundup/admin.py:1388 ../roundup/admin.py:1516 ../roundup/admin.py:1599
+#: ../roundup/admin.py:1725 ../roundup/admin.py:1848 ../roundup/admin.py:1880
+#: ../roundup/admin.py:1996 ../roundup/admin.py:2050 ../roundup/admin.py:2098
+#: ../roundup/admin.py:482:555 :1216:1388:1516 :1599:1725 :1848:1880 :1996:2050
+#: :2098 :606:733 :806:851 :902:999
 msgid "Not enough arguments supplied"
 msgstr "Nincs megadva elÃ©g argumentum"
 
@@ -405,9 +405,9 @@ msgid "Class %(curclassname)s has no property %(pn)s in %(propname)s."
 msgstr "%(classname)s-nek nincs \"%(propname)s\" tulajdonsÃ¡ga"
 
 # ../roundup/admin.py:701 :854 :866 :920
-#: ../roundup/admin.py:791 ../roundup/admin.py:840 ../roundup/admin.py:1517
-#: ../roundup/admin.py:1530 ../roundup/admin.py:2098
-#: ../roundup/admin.py:791:840 :1517:1530:2098
+#: ../roundup/admin.py:791 ../roundup/admin.py:840 ../roundup/admin.py:1536
+#: ../roundup/admin.py:1549 ../roundup/admin.py:2120
+#: ../roundup/admin.py:791:840 :1536:1549:2120
 #, python-format
 msgid "%(classname)s has no property \"%(propname)s\""
 msgstr "%(classname)s-nek nincs \"%(propname)s\" tulajdonsÃ¡ga"
@@ -486,8 +486,8 @@ msgstr ""
 "alkalmazhatÃ³."
 
 # ../roundup/admin.py:583 :983 :1032 :1054
-#: ../roundup/admin.py:942 ../roundup/admin.py:1190 ../roundup/admin.py:1842
-#: ../roundup/admin.py:1870 ../roundup/admin.py:942:1190 :1842:1870
+#: ../roundup/admin.py:942 ../roundup/admin.py:1190 ../roundup/admin.py:1864
+#: ../roundup/admin.py:1892 ../roundup/admin.py:942:1190 :1864:1892
 #, python-format
 msgid "no such %(classname)s node \"%(nodeid)s\""
 msgstr "nincs \"%(nodeid)s\" %(classname)s csomÃ³pont"
@@ -618,7 +618,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1287
+#: ../roundup/admin.py:1306
 msgid ""
 "Usage: importtables export_dir\n"
 "        This imports the database tables exported using exporttables.\n"
@@ -628,7 +628,7 @@ msgid ""
 msgstr ""
 
 #. password
-#: ../roundup/admin.py:1295
+#: ../roundup/admin.py:1314
 msgid ""
 "Usage: initialise [adminpw]\n"
 "        Initialise a new Roundup tracker.\n"
@@ -646,23 +646,23 @@ msgstr ""
 "        VÃ©grehajtja az adatbÃ¡zist inicializÃ¡lÃ³ dbinit.init() rutint\n"
 "        "
 
-#: ../roundup/admin.py:1309
+#: ../roundup/admin.py:1328
 msgid "Admin Password: "
 msgstr "AdminisztrÃ¡tori jelszÃ³: "
 
-#: ../roundup/admin.py:1310
+#: ../roundup/admin.py:1329
 msgid "       Confirm: "
 msgstr "       MegerÅ‘sÃ­tÃ©s "
 
-#: ../roundup/admin.py:1314
+#: ../roundup/admin.py:1333
 msgid "Instance home does not exist"
 msgstr "A pÃ©ldÃ¡ny kÃ¶nyvtÃ¡ra nem lÃ©tezik"
 
-#: ../roundup/admin.py:1318
+#: ../roundup/admin.py:1337
 msgid "Instance has not been installed"
 msgstr "A pÃ©ldÃ¡ny nem lett installÃ¡lva"
 
-#: ../roundup/admin.py:1326
+#: ../roundup/admin.py:1345
 msgid ""
 "WARNING: The database is already initialised!\n"
 "If you re-initialise it, you will lose all the data!\n"
@@ -672,7 +672,7 @@ msgstr ""
 "ÃšjrainicializÃ¡lÃ¡s esetÃ©n minden adat elvÃ©sz!\n"
 "TÃ¶rli? Y/N: "
 
-#: ../roundup/admin.py:1346
+#: ../roundup/admin.py:1365
 msgid ""
 "Usage: install [template [backend [key=val[,key=val]]]]\n"
 "        Install a new Roundup tracker.\n"
@@ -698,12 +698,12 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1375
+#: ../roundup/admin.py:1394
 #, python-format
 msgid "Instance home parent directory \"%(parent)s\" does not exist"
 msgstr "PÃ©ldÃ¡ny kÃ¶nyvtÃ¡r szÃ¼lÅ‘je (\"%(parent)s\") nem lÃ©tezik"
 
-#: ../roundup/admin.py:1384
+#: ../roundup/admin.py:1403
 #, python-format
 msgid ""
 "WARNING: There appears to be a tracker in \"%(tracker_home)s\"!\n"
@@ -715,22 +715,22 @@ msgstr ""
 "Ha Ãºjra installÃ¡lod, minden adat elveszik!\n"
 "TÃ¶rÃ¶ljem? Y/N: "
 
-#: ../roundup/admin.py:1397
+#: ../roundup/admin.py:1416
 #, fuzzy
 msgid "Select template"
 msgstr "Sablon vÃ¡lasztÃ¡sa [classic]: "
 
-#: ../roundup/admin.py:1407
+#: ../roundup/admin.py:1426
 #, fuzzy
 msgid "Select backend"
 msgstr "AdatbÃ¡zis hÃ¡ttÃ©r vÃ¡lasztÃ¡sa [anydbm]: "
 
-#: ../roundup/admin.py:1418
+#: ../roundup/admin.py:1437
 #, python-format
 msgid "Error in configuration settings: \"%s\""
 msgstr "Hiba a konfigurÃ¡ciÃ³s beÃ¡llÃ­tÃ¡sokban: \"%s\""
 
-#: ../roundup/admin.py:1451
+#: ../roundup/admin.py:1470
 #, python-format
 msgid ""
 "\n"
@@ -743,11 +743,11 @@ msgstr ""
 " Most kell szerkesztened a konfigurÃ¡ciÃ³s fÃ¡jlt:\n"
 "   %(config_file)s"
 
-#: ../roundup/admin.py:1461
+#: ../roundup/admin.py:1480
 msgid " ... at a minimum, you must set following options:"
 msgstr " ... legalÃ¡bb a kÃ¶vetkezÅ‘ opciÃ³kat kell beÃ¡llÃ­tani:"
 
-#: ../roundup/admin.py:1466
+#: ../roundup/admin.py:1485
 #, python-format
 msgid ""
 "\n"
@@ -764,7 +764,7 @@ msgid ""
 "---------------------------------------------------------------------------\n"
 msgstr ""
 
-#: ../roundup/admin.py:1482
+#: ../roundup/admin.py:1501
 msgid ""
 "Usage: list classname [property]\n"
 "        List the instances of a class.\n"
@@ -780,17 +780,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1495
+#: ../roundup/admin.py:1514
 msgid "Too many arguments supplied"
 msgstr "TÃºl sok argumentum kerÃ¼lt megadÃ¡sra"
 
-#: ../roundup/admin.py:1528
+#: ../roundup/admin.py:1547
 #, python-format
 msgid "%(nodeid)4s: %(value)s"
 msgstr "%(nodeid)4s: %(value)s"
 
 #. noqa: ARG002  - args unused
-#: ../roundup/admin.py:1535
+#: ../roundup/admin.py:1554
 msgid ""
 "Usage: migrate\n"
 "        Update a tracker's database to be compatible with the Roundup\n"
@@ -813,17 +813,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1555
+#: ../roundup/admin.py:1574
 #, python-format
 msgid "Tracker updated to schema version %s."
 msgstr ""
 
-#: ../roundup/admin.py:1559
+#: ../roundup/admin.py:1578
 #, python-format
 msgid "No migration action required. At schema version %s."
 msgstr ""
 
-#: ../roundup/admin.py:1564
+#: ../roundup/admin.py:1583
 msgid ""
 "Usage: pack period | date\n"
 "        Remove journal entries older than the date/period.\n"
@@ -843,11 +843,11 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1590
+#: ../roundup/admin.py:1609
 msgid "Invalid format"
 msgstr "HibÃ¡s formÃ¡tum"
 
-#: ../roundup/admin.py:1601
+#: ../roundup/admin.py:1620
 msgid ""
 "Usage: perftest [mode] [arguments]*\n"
 "        Time operations in Roundup.\n"
@@ -865,25 +865,25 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1635
+#: ../roundup/admin.py:1657
 msgid "Invalid 'rounds'. Must be larger than 999."
 msgstr ""
 
-#: ../roundup/admin.py:1639
+#: ../roundup/admin.py:1661
 #, python-format
 msgid "Invalid 'rounds'. It must be an integer not: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1666
+#: ../roundup/admin.py:1688
 msgid "scheme does not support rounds."
 msgstr ""
 
-#: ../roundup/admin.py:1669
+#: ../roundup/admin.py:1691
 #, python-format
 msgid "Hash time: %(time)0.9f seconds, scheme: %(scheme)s, rounds: %(rounds)s"
 msgstr ""
 
-#: ../roundup/admin.py:1675
+#: ../roundup/admin.py:1697
 msgid ""
 "Usage: pragma setting=value | 'list'\n"
 "        Set internal admin settings to a value.\n"
@@ -912,49 +912,49 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1710
+#: ../roundup/admin.py:1732
 #, python-format
 msgid "Argument must be setting=value, was given: %s."
 msgstr ""
 
-#: ../roundup/admin.py:1713
+#: ../roundup/admin.py:1735
 msgid "Current settings and values (NYI - not yet implemented):"
 msgstr ""
 
-#: ../roundup/admin.py:1724
+#: ../roundup/admin.py:1746
 msgid ""
 "      Help for this pragma is missing. Please report it to the Roundup "
 "project.\n"
 msgstr ""
 
-#: ../roundup/admin.py:1730
+#: ../roundup/admin.py:1752
 #, fuzzy, python-format
 msgid "Unknown setting %s. Try \"pragma list\"."
 msgstr "Ismeretlen felhasznÃ¡lÃ³nÃ©v"
 
-#: ../roundup/admin.py:1740
+#: ../roundup/admin.py:1762
 #, python-format
 msgid "Incorrect value for boolean setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1747
+#: ../roundup/admin.py:1769
 #, python-format
 msgid "Incorrect value for integer setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1754
+#: ../roundup/admin.py:1776
 #, python-format
 msgid ""
 "Incorrect value for setting %(setting)s: %(value)s. Should be no, both, or "
 "only."
 msgstr ""
 
-#: ../roundup/admin.py:1764
+#: ../roundup/admin.py:1786
 #, python-format
 msgid "Internal error: pragma can not handle values of type: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1773
+#: ../roundup/admin.py:1795
 msgid ""
 "Usage: reindex [classname|classname:#-#|designator]*\n"
 "        Re-generate a tracker's search indexes.\n"
@@ -971,17 +971,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1795
+#: ../roundup/admin.py:1817
 #, python-format
 msgid "no such item \"%(designator)s\""
 msgstr "nincs ilyen elem: \"%(designator)s\""
 
-#: ../roundup/admin.py:1805
+#: ../roundup/admin.py:1827
 #, fuzzy, python-format
 msgid "no such item \"%(class)s%(id)s\""
 msgstr "nincs ilyen elem: \"%(designator)s\""
 
-#: ../roundup/admin.py:1817
+#: ../roundup/admin.py:1839
 msgid ""
 "Usage: restore designator[,designator]*\n"
 "        Restore the retired node specified by designator.\n"
@@ -993,7 +993,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1848
+#: ../roundup/admin.py:1870
 msgid ""
 "Usage: retire designator[,designator]*\n"
 "        Retire the node specified by designator.\n"
@@ -1007,7 +1007,7 @@ msgid ""
 msgstr ""
 
 #. noqa: ARG002 - args unused
-#: ../roundup/admin.py:1876
+#: ../roundup/admin.py:1898
 msgid ""
 "Usage: rollback\n"
 "        Undo all changes that are pending commit to the database.\n"
@@ -1019,7 +1019,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1889
+#: ../roundup/admin.py:1911
 msgid ""
 "Usage: security [Role name]\n"
 "        Display the Permissions available to one or all Roles.\n"
@@ -1032,47 +1032,47 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1904
+#: ../roundup/admin.py:1926
 #, fuzzy, python-format
 msgid "No such Role \"%(role)s\"\n"
 msgstr "Nincs ilyen szerepkÃ¶r: \"%(role)s\""
 
-#: ../roundup/admin.py:1910
+#: ../roundup/admin.py:1932
 #, fuzzy, python-format
 msgid "New Web users get the Roles \"%(role)s\"\n"
 msgstr "Ãšj web felhasznÃ¡lÃ³k ezeket a szerepkÃ¶rÃ¶ket kapjÃ¡k: \"%(role)s\""
 
-#: ../roundup/admin.py:1913
+#: ../roundup/admin.py:1935
 #, fuzzy, python-format
 msgid "New Web users get the Role \"%(role)s\"\n"
 msgstr "Ãšj web felhasznÃ¡lÃ³k ezt a szerepkÃ¶rt kapjÃ¡k \"%(role)s\""
 
-#: ../roundup/admin.py:1917
+#: ../roundup/admin.py:1939
 #, fuzzy, python-format
 msgid "New Email users get the Roles \"%(role)s\"\n"
 msgstr "Ãšj e-mail felhasznÃ¡lÃ³k ezeket a szerepkÃ¶rÃ¶ket kapjÃ¡k: \"%(role)s\""
 
-#: ../roundup/admin.py:1919
+#: ../roundup/admin.py:1941
 #, fuzzy, python-format
 msgid "New Email users get the Role \"%(role)s\"\n"
 msgstr "Ãšj e-mail felhasznÃ¡lÃ³k ezt a szerepkÃ¶rt kapjÃ¡k: \"%(role)s\""
 
-#: ../roundup/admin.py:1922
+#: ../roundup/admin.py:1944
 #, fuzzy, python-format
 msgid "Role \"%(name)s\":\n"
 msgstr "\"%(name)s\" szerepkÃ¶r:"
 
-#: ../roundup/admin.py:1928
+#: ../roundup/admin.py:1950
 #, fuzzy
 msgid " %(description)s (%(name)s for \"%(klass)s\""
 msgstr " %(description)s (%(name)s)"
 
-#: ../roundup/admin.py:1928
+#: ../roundup/admin.py:1950
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\": %(properties)s only)\n"
 msgstr " %(description)s (%(name)s)"
 
-#: ../roundup/admin.py:1941
+#: ../roundup/admin.py:1963
 #, python-format
 msgid ""
 "\n"
@@ -1080,17 +1080,17 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/admin.py:1947
+#: ../roundup/admin.py:1969
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\" only)\n"
 msgstr " %(description)s (%(name)s)"
 
-#: ../roundup/admin.py:1950
+#: ../roundup/admin.py:1972
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s)\n"
 msgstr " %(description)s (%(name)s)"
 
-#: ../roundup/admin.py:1954
+#: ../roundup/admin.py:1976
 msgid ""
 "Usage: set items property=value [property=value ...]\n"
 "        Set the given properties of one or more items(s).\n"
@@ -1111,7 +1111,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2022
+#: ../roundup/admin.py:2044
 msgid ""
 "Usage: specification classname\n"
 "        Show the properties for a classname.\n"
@@ -1125,17 +1125,17 @@ msgstr ""
 "        ListÃ¡zza az adott osztÃ¡ly tulajdonsÃ¡gait.\n"
 "        "
 
-#: ../roundup/admin.py:2041
+#: ../roundup/admin.py:2063
 #, fuzzy, python-format
 msgid "%(key)s: %(value)s (key property)\n"
 msgstr "%(key)s: %(value)s (kulcs tulajdonsÃ¡g)"
 
-#: ../roundup/admin.py:2044
+#: ../roundup/admin.py:2066
 #, fuzzy, python-format
 msgid "%(key)s: %(value)s\n"
 msgstr "%(key)s: %(value)s"
 
-#: ../roundup/admin.py:2047
+#: ../roundup/admin.py:2069
 msgid ""
 "Usage: table classname [property[,property]*]\n"
 "        List the instances of a class in tabular form.\n"
@@ -1167,17 +1167,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2093
+#: ../roundup/admin.py:2115
 #, python-format
 msgid "\"%(spec)s\" not name:width"
 msgstr "\"%(spec)s\" nem nÃ©v:hossz formÃ¡tumÃº"
 
-#: ../roundup/admin.py:2115
+#: ../roundup/admin.py:2137
 #, python-format
 msgid "\"%(spec)s\" does not have an integer width: \"%(width)s\""
 msgstr ""
 
-#: ../roundup/admin.py:2151
+#: ../roundup/admin.py:2173
 msgid ""
 "Usage: templates [trace_search]\n"
 "        List templates and their installed directories.\n"
@@ -1187,7 +1187,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2179
+#: ../roundup/admin.py:2201
 #, fuzzy
 msgid ""
 "Usage: updateconfig <filename>\n"
@@ -1204,37 +1204,37 @@ msgstr ""
 "        "
 
 # ../roundup/cgi/actions.py:596 :607 :778 :797
-#: ../roundup/admin.py:2188 ../roundup/cgi/actions.py:886
+#: ../roundup/admin.py:2210 ../roundup/cgi/actions.py:886
 #: ../roundup/cgi/actions.py:897 ../roundup/cgi/actions.py:1099
 #: ../roundup/cgi/actions.py:1113 ../roundup/cgi/actions.py:886:897 :1099:1113
 #, python-format
 msgid "Error: %s"
 msgstr "Hiba: %s"
 
-#: ../roundup/admin.py:2220
+#: ../roundup/admin.py:2242
 #, python-format
 msgid "Unknown command \"%(command)s\" (\"help commands\" for a list)"
 msgstr ""
 "\"%(command)s\": ismeretlen parancs (\"help commands\" parancsok "
 "listÃ¡zÃ¡sÃ¡hoz)"
 
-#: ../roundup/admin.py:2226
+#: ../roundup/admin.py:2248
 #, python-format
 msgid "Multiple commands match \"%(command)s\": %(list)s"
 msgstr ""
 "TÃ¶bb parancs is illeszkedik a megadott \"%(command)s\" parancsra: %(list)s"
 
-#: ../roundup/admin.py:2241
+#: ../roundup/admin.py:2263
 msgid "Enter tracker home: "
 msgstr "Adja meg a hibakÃ¶vetÅ‘ kÃ¶nyvtÃ¡rÃ¡t: "
 
-#: ../roundup/admin.py:2270 ../roundup/admin.py:2274
-#: ../roundup/admin.py:2270:2274
+#: ../roundup/admin.py:2292 ../roundup/admin.py:2296
+#: ../roundup/admin.py:2292:2296
 #, python-format
 msgid "Error: Couldn't open tracker: %(message)s"
 msgstr "Hiba: HibakÃ¶vetÅ‘ megnyitÃ¡sa sikertelen: %(message)s"
 
-#: ../roundup/admin.py:2322
+#: ../roundup/admin.py:2344
 #, python-format
 msgid ""
 "Roundup %s ready for input.\n"
@@ -1243,15 +1243,15 @@ msgstr ""
 "A Roundup %s fogadÃ³kÃ©sz.\n"
 "SegÃ­tsÃ©gÃ©rt gÃ©peljen \"help\"-et."
 
-#: ../roundup/admin.py:2355
+#: ../roundup/admin.py:2377
 msgid "Note: command history and editing not available"
 msgstr "MegjegyzÃ©s: a parancsok tÃ¶rtÃ©nete Ã©s szerkesztÃ©se nem elÃ©rhetÅ‘"
 
-#: ../roundup/admin.py:2361
+#: ../roundup/admin.py:2383
 msgid "exit..."
 msgstr "kilÃ©pÃ©s..."
 
-#: ../roundup/admin.py:2374
+#: ../roundup/admin.py:2396
 msgid "There are unsaved changes. Commit them (y/N)? "
 msgstr "Vannak nem mentett vÃ¡ltoztatÃ¡sok. Elmenti Å‘ket (y/N)? "
 
@@ -1282,23 +1282,23 @@ msgstr ""
 # ../roundup/backends/back_metakit.py:567:834
 # ../roundup/backends/rdbms_common.py:1320:1549 :1267:1285 :1331:1901
 # :1755:1775 :1828:2436 :866:1601
-#: ../roundup/backends/back_anydbm.py:871
-#: ../roundup/backends/back_anydbm.py:884
-#: ../roundup/backends/back_anydbm.py:1158
-#: ../roundup/backends/back_anydbm.py:1193
-#: ../roundup/backends/back_anydbm.py:1422
-#: ../roundup/backends/back_anydbm.py:1440
-#: ../roundup/backends/back_anydbm.py:1487
-#: ../roundup/backends/back_anydbm.py:2123
-#: ../roundup/backends/back_anydbm.py:871:884
+#: ../roundup/backends/back_anydbm.py:873
+#: ../roundup/backends/back_anydbm.py:886
+#: ../roundup/backends/back_anydbm.py:1160
+#: ../roundup/backends/back_anydbm.py:1195
+#: ../roundup/backends/back_anydbm.py:1424
+#: ../roundup/backends/back_anydbm.py:1442
+#: ../roundup/backends/back_anydbm.py:1489
+#: ../roundup/backends/back_anydbm.py:2135
+#: ../roundup/backends/back_anydbm.py:873:886
 #: ../roundup/backends/rdbms_common.py:1720
 #: ../roundup/backends/rdbms_common.py:1967
 #: ../roundup/backends/rdbms_common.py:2206
 #: ../roundup/backends/rdbms_common.py:2226
 #: ../roundup/backends/rdbms_common.py:2279
-#: ../roundup/backends/rdbms_common.py:3246
-#: ../roundup/backends/rdbms_common.py:1720:1967 :1158:1193 :1422:1440:1487
-#: :2123 :2206:2226 :2279:3246
+#: ../roundup/backends/rdbms_common.py:3254
+#: ../roundup/backends/rdbms_common.py:1720:1967 :1160:1195 :1424:1442:1489
+#: :2135 :2206:2226 :2279:3254
 msgid "Database open read-only"
 msgstr ""
 
@@ -1692,13 +1692,13 @@ msgstr "HibÃ¡s bejelentkezÃ©s"
 msgid "You do not have permission to login"
 msgstr "Nincs jogosultsÃ¡ga bejelentkezni"
 
-#: ../roundup/cgi/actions.py:1577 ../roundup/cgi/actions.py:1761
-#: ../roundup/cgi/actions.py:1577:1761
+#: ../roundup/cgi/actions.py:1577 ../roundup/cgi/actions.py:1757
+#: ../roundup/cgi/actions.py:1577:1757
 #, python-format
 msgid "Column \"%(column)s\" not found in %(class)s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1832
+#: ../roundup/cgi/actions.py:1822
 #, fuzzy, python-format
 msgid "You do not have permission to view %(class)s"
 msgstr "Nincs jogosultsÃ¡ga szerkeszteni %(class)s-t"
@@ -1783,7 +1783,7 @@ msgstr "<strong>%s</strong>-ban"
 msgid "<em>undefined</em>"
 msgstr "<em>nem definiÃ¡lt</em>"
 
-#: ../roundup/cgi/client.py:105
+#: ../roundup/cgi/client.py:111
 msgid ""
 "<html><head><title>An error has occurred</title></head>\n"
 "<body><h1>An error has occurred</h1>\n"
@@ -1797,150 +1797,156 @@ msgstr ""
 "A hibakÃ¶vetÅ‘ karbantartÃ³i Ã©rtesÃ­tÃ©st kaptak a problÃ©mÃ¡rÃ³l.</p>\n"
 "</body></html>"
 
-#: ../roundup/cgi/client.py:717 ../roundup/cgi/client.py:1635
-#: ../roundup/cgi/client.py:717:1635
+#: ../roundup/cgi/client.py:666
+msgid ""
+"XMLRPC endpoint is not using defusedxml. Improve security by installing "
+"defusedxml."
+msgstr ""
+
+#: ../roundup/cgi/client.py:728 ../roundup/cgi/client.py:1646
+#: ../roundup/cgi/client.py:728:1646
 msgid "Required Header Missing"
 msgstr ""
 
-#: ../roundup/cgi/client.py:719
+#: ../roundup/cgi/client.py:731
 #, fuzzy
 msgid "Client is not allowed to use Rest Interface."
 msgstr "Anonim felhasznÃ¡lÃ³k nem hasznÃ¡lhatjÃ¡k a webes felÃ¼letet"
 
-#: ../roundup/cgi/client.py:971
+#: ../roundup/cgi/client.py:985
 msgid "Form Error: "
 msgstr "Å°rlap hiba: "
 
-#: ../roundup/cgi/client.py:1064
+#: ../roundup/cgi/client.py:1078
 #, python-format
 msgid "Unrecognized charset: %r"
 msgstr "Ismeretlen karakterkÃ©szlet: %r"
 
-#: ../roundup/cgi/client.py:1331 ../roundup/cgi/client.py:2294
-#: ../roundup/cgi/client.py:1331:2294
+#: ../roundup/cgi/client.py:1345 ../roundup/cgi/client.py:2357
+#: ../roundup/cgi/client.py:1345:2357
 msgid "broken form: multiple @action values submitted"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1348
+#: ../roundup/cgi/client.py:1362
 msgid "Anonymous users are not allowed to use the web interface"
 msgstr "Anonim felhasznÃ¡lÃ³k nem hasznÃ¡lhatjÃ¡k a webes felÃ¼letet"
 
-#: ../roundup/cgi/client.py:1496
+#: ../roundup/cgi/client.py:1507
 msgid "Referer header not available."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1500
+#: ../roundup/cgi/client.py:1511
 #, python-format
 msgid "csrf key used with wrong method from: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1529
+#: ../roundup/cgi/client.py:1540
 #, python-format
 msgid "csrf header %(header)s required but missing for user%(userid)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1533
+#: ../roundup/cgi/client.py:1544
 #, python-format
 msgid "Missing header: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1541
+#: ../roundup/cgi/client.py:1552
 #, python-format
 msgid "csrf Referer header check failed for user%(userid)s. Value=%(referer)s"
 msgstr ""
 
 # ../roundup/cgi/actions.py:930 :934
-#: ../roundup/cgi/client.py:1546
+#: ../roundup/cgi/client.py:1557
 #, fuzzy, python-format
 msgid "Invalid Referer: %s"
 msgstr "HibÃ¡s bejelentkezÃ©s"
 
-#: ../roundup/cgi/client.py:1561
+#: ../roundup/cgi/client.py:1572
 #, python-format
 msgid "csrf Origin header check failed for user%(userid)s. Value=%(origin)s"
 msgstr ""
 
 # ../roundup/cgi/actions.py:930 :934
-#: ../roundup/cgi/client.py:1566
+#: ../roundup/cgi/client.py:1577
 #, fuzzy, python-format
 msgid "Invalid Origin %s"
 msgstr "HibÃ¡s bejelentkezÃ©s"
 
-#: ../roundup/cgi/client.py:1580
+#: ../roundup/cgi/client.py:1591
 #, python-format
 msgid ""
 "csrf X-FORWARDED-HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1586
+#: ../roundup/cgi/client.py:1597
 #, python-format
 msgid "Invalid X-FORWARDED-HOST %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1605
+#: ../roundup/cgi/client.py:1616
 #, python-format
 msgid "csrf HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1610
+#: ../roundup/cgi/client.py:1621
 #, python-format
 msgid "Invalid HOST %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1618
+#: ../roundup/cgi/client.py:1629
 msgid "Csrf: unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1619
+#: ../roundup/cgi/client.py:1630
 msgid "Unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1632
+#: ../roundup/cgi/client.py:1643
 #, python-format
 msgid "csrf X-REQUESTED-WITH xmlrpc required header check failed for user%s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1673
+#: ../roundup/cgi/client.py:1684
 #, python-format
 msgid "Required csrf field missing for user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1675 ../roundup/cgi/client.py:1702
-#: ../roundup/cgi/client.py:1719 ../roundup/cgi/client.py:1675:1702:1719
+#: ../roundup/cgi/client.py:1686 ../roundup/cgi/client.py:1713
+#: ../roundup/cgi/client.py:1730 ../roundup/cgi/client.py:1686:1713:1730
 msgid ""
 "We can't validate your session (csrf failure). Re-enter any unsaved data and "
 "try again."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1679
+#: ../roundup/cgi/client.py:1690
 #, python-format
 msgid "csrf field not supplied by user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1691
+#: ../roundup/cgi/client.py:1702
 #, python-format
 msgid ""
 "Csrf mismatch user: current user %(user)s != stored user %(stored)s, current "
 "session, stored session: %(cur_sess)s,%(stor_sess)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1709
+#: ../roundup/cgi/client.py:1720
 #, python-format
 msgid ""
 "Csrf mismatch user: current session %(curr_sess)s != stored session "
 "%(stor_sess)s, current user/stored user is: %(user)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1901
+#: ../roundup/cgi/client.py:1912
 msgid "You are not allowed to view this file."
 msgstr "Nem nÃ©zheti meg ezt a fÃ¡jlt."
 
-#: ../roundup/cgi/client.py:2172
+#: ../roundup/cgi/client.py:2235
 #, python-format
 msgid "%(starttag)sTime elapsed: %(seconds)fs%(endtag)s\n"
 msgstr "%(starttag)sEltelt idÅ‘: %(seconds)fs%(endtag)s\n"
 
-#: ../roundup/cgi/client.py:2176
+#: ../roundup/cgi/client.py:2239
 #, python-format
 msgid ""
 "%(starttag)sCache hits: %(cache_hits)d, misses %(cache_misses)d. Loading "
@@ -1949,7 +1955,7 @@ msgstr ""
 "%(starttag)sCache talÃ¡latok: %(cache_hits)d, tÃ©vedÃ©s %(cache_misses)d. "
 "Elemek betÃ¶ltÃ©se: %(get_items)f mp. SzÅ±rÃ©s: %(filtering)f mp.%(endtag)s\n"
 
-#: ../roundup/cgi/client.py:2716
+#: ../roundup/cgi/client.py:2778
 #, python-format
 msgid ""
 "Cache failure: compressed file %(compressed)s is older than its source file "
@@ -2368,17 +2374,17 @@ msgstr ""
 msgid "Not a property name: %s"
 msgstr ""
 
-#: ../roundup/hyperdb.py:1984
+#: ../roundup/hyperdb.py:2038
 #, fuzzy, python-format
 msgid "property %(property)s: %(value)r is not a %(classname)s."
 msgstr "\"%(propname)s\" tulajdonsÃ¡g: \"%(value)s\" jelenleg nincs a listÃ¡ban"
 
-#: ../roundup/hyperdb.py:1990
+#: ../roundup/hyperdb.py:2044
 #, python-format
 msgid "you may only enter ID values for property %s"
 msgstr ""
 
-#: ../roundup/hyperdb.py:2025
+#: ../roundup/hyperdb.py:2079
 #, python-format
 msgid "%(property)r is not a property of %(classname)s"
 msgstr ""
@@ -2669,6 +2675,22 @@ msgstr ""
 msgid "not of form [arg=value,value,...;arg=value,value,...]"
 msgstr "nem [arg=Ã©rtÃ©k,Ã©rtÃ©k,...;arg=Ã©rtÃ©k,Ã©rtÃ©k,...] formÃ¡tumÃº"
 
+#: ../roundup/mlink_expr.py:161
+#, python-format
+msgid ""
+"There was an error searching %(class)s by %(attr)s using: %(opcodes)s. The "
+"operator %(opcode)s (%(opcodename)s) at position %(position)d has too few "
+"arguments."
+msgstr ""
+
+#: ../roundup/mlink_expr.py:174
+#, python-format
+msgid ""
+"There was an error searching %(class)s by %(attr)s using: %(opcodes)s. There "
+"are too many arguments for the existing operators. The values on the stack "
+"are: %(stack)s"
+msgstr ""
+
 #: ../roundup/pygettext.py:401
 #, python-format
 msgid "*** %(file)s:%(lineno)s: Seen unexpected token \"%(token)s\""
@@ -2727,12 +2749,12 @@ msgstr ""
 msgid "morethanonestring"
 msgstr ""
 
-#: ../roundup/rest.py:410
+#: ../roundup/rest.py:417
 #, python-format
 msgid "Method %(m)s not allowed. Allowed: %(a)s"
 msgstr ""
 
-#: ../roundup/rest.py:948
+#: ../roundup/rest.py:964
 #, python-format
 msgid ""
 "Page size %(page_size)s must be less than admin limit on query result size: "
@@ -2740,30 +2762,51 @@ msgid ""
 msgstr ""
 
 # ../roundup/cgi/actions.py:930 :934
-#: ../roundup/rest.py:1193
+#: ../roundup/rest.py:1211
 #, fuzzy, python-format
 msgid "Invalid attribute %s"
 msgstr "HibÃ¡s bejelentkezÃ©s"
 
-#: ../roundup/rest.py:2182
+#: ../roundup/rest.py:2199
 #, python-format
 msgid "Api rate limits exceeded. Please wait: %s seconds."
 msgstr ""
 
-#: ../roundup/rest.py:2258
+#: ../roundup/rest.py:2283
 #, python-format
 msgid ""
-"Unable to parse Accept Header. %(error)s. Acceptable types: "
+"Content type '%s' requested in URL is not available.\n"
+"Acceptable types: %s\n"
+msgstr ""
+
+#: ../roundup/rest.py:2304
+#, python-format
+msgid ""
+"Unable to parse Accept Header. %(error)s. Acceptable types: */*, "
 "%(acceptable_types)s"
 msgstr ""
 
-#: ../roundup/rest.py:2441
+#: ../roundup/rest.py:2376 ../roundup/rest.py:2597 ../roundup/rest.py:2376:2597
 #, python-format
 msgid ""
 "Unrecognized api version: %s. See /rest without specifying api version for "
 "supported versions."
 msgstr ""
 
+#: ../roundup/rest.py:2411 ../roundup/rest.py:2420 ../roundup/rest.py:2411:2420
+#, python-format
+msgid ""
+"Requested content type(s) '%s' not available.\n"
+"Acceptable mime types are: */*, %s"
+msgstr ""
+
+#: ../roundup/rest.py:2696
+msgid ""
+"Internal error while formatting response.\n"
+"accept_mime_type is not defined. This should\n"
+"never happen\n"
+msgstr ""
+
 #: ../roundup/roundupdb.py:140
 #, python-format
 msgid "Username '%s' already exists."
@@ -2920,33 +2963,33 @@ msgstr ""
 "Hiba: A forrÃ¡s a kÃ¶vetkezÅ‘k egyike kell legyen: \"mailbox\", \"pop\", \"apop"
 "\", \"imap\" vagy \"imaps\""
 
-#: ../roundup/scripts/roundup_server.py:112
+#: ../roundup/scripts/roundup_server.py:113
 msgid "WARNING: generating temporary SSL certificate"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:143
+#: ../roundup/scripts/roundup_server.py:144
 #, python-format
 msgid "Unable to find/use key from file: %(pemfile)s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:144
+#: ../roundup/scripts/roundup_server.py:145
 msgid ""
 "Does it have a private key surrounded by '-----BEGIN PRIVATE KEY-----' and\n"
 "  '-----END PRIVATE KEY-----' markers?"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:149
+#: ../roundup/scripts/roundup_server.py:150
 #, python-format
 msgid "Unable to find/use certificate from file: %(pemfile)s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:150
+#: ../roundup/scripts/roundup_server.py:151
 msgid ""
 "Does it have a certificate surrounded by '-----BEGIN CERTIFICATE-----' and\n"
 "  '-----END CERTIFICATE-----' markers?"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:344
+#: ../roundup/scripts/roundup_server.py:345
 msgid ""
 "<html><head><title>Roundup trackers index</title></head>\n"
 "<body><h1>Roundup trackers index</h1><ol>\n"
@@ -2954,58 +2997,58 @@ msgstr ""
 "<html><head><title>Roundup hibakÃ¶vetÅ‘k listÃ¡ja</title></head>\n"
 "<body><h1>Roundup hibakÃ¶vetÅ‘k listÃ¡ja</h1><ol>\n"
 
-#: ../roundup/scripts/roundup_server.py:570
+#: ../roundup/scripts/roundup_server.py:587
 #, fuzzy, python-format
 msgid "Error: %(type)s: %(value)s"
 msgstr "%(key)s: %(value)s"
 
-#: ../roundup/scripts/roundup_server.py:582
+#: ../roundup/scripts/roundup_server.py:599
 msgid "WARNING: ignoring \"-g\" argument, not root"
 msgstr "FIGYELEM: \"-g\" opciÃ³ figyelmen kÃ­vÃ¼l hagyÃ¡sra kerÃ¼lt, nem root"
 
-#: ../roundup/scripts/roundup_server.py:588
+#: ../roundup/scripts/roundup_server.py:605
 msgid "Can't change groups - no grp module"
 msgstr "Nem lehet csoportot vÃ¡ltani - nincs meg a grp modul"
 
-#: ../roundup/scripts/roundup_server.py:597
+#: ../roundup/scripts/roundup_server.py:614
 #, python-format
 msgid "Group %(group)s doesn't exist"
 msgstr "%(group)s csoport nem lÃ©tezik"
 
-#: ../roundup/scripts/roundup_server.py:609
+#: ../roundup/scripts/roundup_server.py:626
 msgid "Can't run as root!"
 msgstr "Nem futhat root-kÃ©nt!"
 
-#: ../roundup/scripts/roundup_server.py:612
+#: ../roundup/scripts/roundup_server.py:629
 msgid "WARNING: ignoring \"-u\" argument, not root"
 msgstr "FIGYELEM: \"-u\" opciÃ³ figyelmen kÃ­vÃ¼l hagyÃ¡sra kerÃ¼lt, nem root"
 
-#: ../roundup/scripts/roundup_server.py:618
+#: ../roundup/scripts/roundup_server.py:635
 msgid "Can't change users - no pwd module"
 msgstr "FelhasznÃ¡lÃ³vÃ¡ltÃ¡s nem sikerÃ¼lt - nincs pwd modul"
 
-#: ../roundup/scripts/roundup_server.py:627
+#: ../roundup/scripts/roundup_server.py:644
 #, python-format
 msgid "User %(user)s doesn't exist"
 msgstr "A(z) %(user)s felhasznÃ¡lÃ³ nem lÃ©tezik"
 
-#: ../roundup/scripts/roundup_server.py:833
+#: ../roundup/scripts/roundup_server.py:856
 #, python-format
 msgid "Multiprocess mode \"%s\" is not available, switching to single-process"
 msgstr "\"%s\" tÃ¶bbszÃ¡lÃº mÃ³d nem Ã©rhetÅ‘ el, Ã¡ttÃ©rÃ©s egyszÃ¡lÃº mÃ³dra"
 
-#: ../roundup/scripts/roundup_server.py:861
+#: ../roundup/scripts/roundup_server.py:884
 #, python-format
 msgid "Unable to bind to port %s, port already in use."
 msgstr "Nem sikerÃ¼lt a(z) %s portra csatlakozni, a port mÃ¡r hasznÃ¡latban van."
 
-#: ../roundup/scripts/roundup_server.py:865
+#: ../roundup/scripts/roundup_server.py:888
 #, fuzzy, python-format
 msgid ""
 "Unable to bind to port %(port)s, access not allowed, errno: %(errno)s %(msg)s"
 msgstr "Nem sikerÃ¼lt a(z) %s portra csatlakozni, a port mÃ¡r hasznÃ¡latban van."
 
-#: ../roundup/scripts/roundup_server.py:944
+#: ../roundup/scripts/roundup_server.py:967
 msgid ""
 " -c <Command>  Windows Service options.\n"
 "               If you want to run the server as a Windows Service, you\n"
@@ -3015,16 +3058,17 @@ msgid ""
 "               specifics."
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:951
+#: ../roundup/scripts/roundup_server.py:974
 msgid ""
 " -u <UID>      runs the Roundup web server as this UID\n"
 " -g <GID>      runs the Roundup web server as this GID\n"
 " -d <PIDfile>  run the server in the background and write the server's PID\n"
 "               to the file indicated by PIDfile. The -l option *must* be\n"
-"               specified if -d is used."
+"               specified if -d is used.\n"
+" -D            run the server in the foreground even when -d is used."
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:958
+#: ../roundup/scripts/roundup_server.py:982
 #, python-format
 msgid ""
 "\n"
@@ -3049,6 +3093,10 @@ msgid ""
 "mode\n"
 " -s            enable SSL\n"
 " -L            http request logging uses python logging (roundup.http)\n"
+" -P            log client address/name using reverse proxy X-Forwarded-For\n"
+"               header and not the connection IP (which is the reverse "
+"proxy).\n"
+"               Appends a '+' sign to the logged address/name.\n"
 " -e <fname>    PEM file containing SSL key and certificate\n"
 " -t <mode>     multiprocess mode (default: %(mp_def)s).\n"
 "               Allowed values: %(mp_types)s.\n"
@@ -3093,21 +3141,21 @@ msgid ""
 "   any url-unsafe characters like spaces, as these confuse IE.\n"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:1135
+#: ../roundup/scripts/roundup_server.py:1162
 msgid "Instances must be name=home"
 msgstr "A pÃ©ldÃ¡nyoknak nÃ©v=home formÃ¡ban kell lenniÃ¼k"
 
-#: ../roundup/scripts/roundup_server.py:1149
+#: ../roundup/scripts/roundup_server.py:1176
 #, python-format
 msgid "Configuration saved to %s"
 msgstr "BeÃ¡llÃ­tÃ¡sok elmentve ide: %s"
 
-#: ../roundup/scripts/roundup_server.py:1167
+#: ../roundup/scripts/roundup_server.py:1194
 msgid "Sorry, you can't run the server as a daemon on this Operating System"
 msgstr ""
 "ElnÃ©zÃ©st, ezen az operÃ¡ciÃ³s rendszeren a szerver nem indÃ­thatÃ³ dÃ©monkÃ©nt"
 
-#: ../roundup/scripts/roundup_server.py:1187
+#: ../roundup/scripts/roundup_server.py:1214
 #, python-format
 msgid "Roundup server started on %(HOST)s:%(PORT)s"
 msgstr "Roundup server elindÃ­tva a(z) %(HOST)s:%(PORT)s gÃ©pen"
diff --git a/locale/it.po b/locale/it.po
index 1274ea4e6..b11d9324f 100644
--- a/locale/it.po
+++ b/locale/it.po
@@ -5,9 +5,9 @@
 #
 msgid ""
 msgstr ""
-"Project-Id-Version: Roundup 2.4.0\n"
+"Project-Id-Version: Roundup 2.5.0\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
-"POT-Creation-Date: 2024-08-07 21:43-0400\n"
+"POT-Creation-Date: 2024-12-30 22:49-0500\n"
 "PO-Revision-Date: 2013-10-31 12:20+0100\n"
 "Last-Translator: Marco Ghidinelli <marco.ghidinelli@ing.unibs.it>\n"
 "Language-Team: italian <it@li.org>\n"
@@ -83,8 +83,8 @@ msgid "Enable verbose output: tracing, descriptions...\n"
 msgstr ""
 
 # ../roundup/admin.py:1052 ../roundup/admin.py:85:981 :1030:1052
-#: ../roundup/admin.py:175 ../roundup/admin.py:1188 ../roundup/admin.py:1836
-#: ../roundup/admin.py:1868 ../roundup/admin.py:175:1188 :1836:1868
+#: ../roundup/admin.py:175 ../roundup/admin.py:1188 ../roundup/admin.py:1858
+#: ../roundup/admin.py:1890 ../roundup/admin.py:175:1188 :1858:1890
 #, python-format
 msgid "no such class \"%(classname)s\""
 msgstr "classe \"%(classname)s\" mancante"
@@ -222,14 +222,14 @@ msgid "%s:"
 msgstr "%s:"
 
 # ../roundup/admin.py:340 ../roundup/admin.py:396 ../roundup/admin.py:340:396
-#: ../roundup/admin.py:439 ../roundup/admin.py:1396
-#: ../roundup/admin.py:439:1396
+#: ../roundup/admin.py:439 ../roundup/admin.py:1415
+#: ../roundup/admin.py:439:1415
 msgid "Templates:"
 msgstr "Modelli predefiniti:"
 
 # ../roundup/admin.py:343 ../roundup/admin.py:407 ../roundup/admin.py:343:407
-#: ../roundup/admin.py:442 ../roundup/admin.py:1406
-#: ../roundup/admin.py:442:1406
+#: ../roundup/admin.py:442 ../roundup/admin.py:1425
+#: ../roundup/admin.py:442:1425
 msgid "Back ends:"
 msgstr "Back ends:"
 
@@ -265,11 +265,11 @@ msgstr ""
 #: ../roundup/admin.py:482 ../roundup/admin.py:555 ../roundup/admin.py:606
 #: ../roundup/admin.py:733 ../roundup/admin.py:806 ../roundup/admin.py:851
 #: ../roundup/admin.py:902 ../roundup/admin.py:999 ../roundup/admin.py:1216
-#: ../roundup/admin.py:1369 ../roundup/admin.py:1497 ../roundup/admin.py:1580
-#: ../roundup/admin.py:1703 ../roundup/admin.py:1826 ../roundup/admin.py:1858
-#: ../roundup/admin.py:1974 ../roundup/admin.py:2028 ../roundup/admin.py:2076
-#: ../roundup/admin.py:482:555 :1216:1369:1497 :1580:1703 :1826:1858 :1974:2028
-#: :2076 :606:733 :806:851 :902:999
+#: ../roundup/admin.py:1388 ../roundup/admin.py:1516 ../roundup/admin.py:1599
+#: ../roundup/admin.py:1725 ../roundup/admin.py:1848 ../roundup/admin.py:1880
+#: ../roundup/admin.py:1996 ../roundup/admin.py:2050 ../roundup/admin.py:2098
+#: ../roundup/admin.py:482:555 :1216:1388:1516 :1599:1725 :1848:1880 :1996:2050
+#: :2098 :606:733 :806:851 :902:999
 msgid "Not enough arguments supplied"
 msgstr "Non sono stati forniti abbastanza argomenti"
 
@@ -375,9 +375,9 @@ msgid "Class %(curclassname)s has no property %(pn)s in %(propname)s."
 msgstr "la classe %(classname)s non ha la proprietÃ  \"%(propname)s\""
 
 # ../roundup/admin.py:920 ../roundup/admin.py:701:854 :866:920
-#: ../roundup/admin.py:791 ../roundup/admin.py:840 ../roundup/admin.py:1517
-#: ../roundup/admin.py:1530 ../roundup/admin.py:2098
-#: ../roundup/admin.py:791:840 :1517:1530:2098
+#: ../roundup/admin.py:791 ../roundup/admin.py:840 ../roundup/admin.py:1536
+#: ../roundup/admin.py:1549 ../roundup/admin.py:2120
+#: ../roundup/admin.py:791:840 :1536:1549:2120
 #, python-format
 msgid "%(classname)s has no property \"%(propname)s\""
 msgstr "la classe %(classname)s non ha la proprietÃ  \"%(propname)s\""
@@ -441,8 +441,8 @@ msgid "property %s is not of type Multilink or Link so -d flag does not apply."
 msgstr ""
 
 # ../roundup/admin.py:1054 ../roundup/admin.py:583:983 :1032:1054
-#: ../roundup/admin.py:942 ../roundup/admin.py:1190 ../roundup/admin.py:1842
-#: ../roundup/admin.py:1870 ../roundup/admin.py:942:1190 :1842:1870
+#: ../roundup/admin.py:942 ../roundup/admin.py:1190 ../roundup/admin.py:1864
+#: ../roundup/admin.py:1892 ../roundup/admin.py:942:1190 :1864:1892
 #, python-format
 msgid "no such %(classname)s node \"%(nodeid)s\""
 msgstr ""
@@ -558,7 +558,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1287
+#: ../roundup/admin.py:1306
 msgid ""
 "Usage: importtables export_dir\n"
 "        This imports the database tables exported using exporttables.\n"
@@ -568,7 +568,7 @@ msgid ""
 msgstr ""
 
 #. password
-#: ../roundup/admin.py:1295
+#: ../roundup/admin.py:1314
 msgid ""
 "Usage: initialise [adminpw]\n"
 "        Initialise a new Roundup tracker.\n"
@@ -579,30 +579,30 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1309
+#: ../roundup/admin.py:1328
 msgid "Admin Password: "
 msgstr "Password dell'amministratore"
 
-#: ../roundup/admin.py:1310
+#: ../roundup/admin.py:1329
 msgid "       Confirm: "
 msgstr "       Conferma: "
 
-#: ../roundup/admin.py:1314
+#: ../roundup/admin.py:1333
 msgid "Instance home does not exist"
 msgstr "La home dell'istanza non esiste"
 
-#: ../roundup/admin.py:1318
+#: ../roundup/admin.py:1337
 msgid "Instance has not been installed"
 msgstr "L'istanza non Ã¨ stata installata"
 
-#: ../roundup/admin.py:1326
+#: ../roundup/admin.py:1345
 msgid ""
 "WARNING: The database is already initialised!\n"
 "If you re-initialise it, you will lose all the data!\n"
 "Erase it? Y/N: "
 msgstr ""
 
-#: ../roundup/admin.py:1346
+#: ../roundup/admin.py:1365
 msgid ""
 "Usage: install [template [backend [key=val[,key=val]]]]\n"
 "        Install a new Roundup tracker.\n"
@@ -628,12 +628,12 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1375
+#: ../roundup/admin.py:1394
 #, python-format
 msgid "Instance home parent directory \"%(parent)s\" does not exist"
 msgstr "la directory radice dell'istanza \"%(parent)s\" non esiste"
 
-#: ../roundup/admin.py:1384
+#: ../roundup/admin.py:1403
 #, python-format
 msgid ""
 "WARNING: There appears to be a tracker in \"%(tracker_home)s\"!\n"
@@ -644,22 +644,22 @@ msgstr ""
 "Se verrÃ  reinstallata, tutti i dati precedentemente salvati andranno persi\n"
 "Cancellare la directory specificata? Y/N: "
 
-#: ../roundup/admin.py:1397
+#: ../roundup/admin.py:1416
 #, fuzzy
 msgid "Select template"
 msgstr "Seleziona il modello predefinito [classic]: "
 
-#: ../roundup/admin.py:1407
+#: ../roundup/admin.py:1426
 #, fuzzy
 msgid "Select backend"
 msgstr "Seleziona il backend [anydbm]: "
 
-#: ../roundup/admin.py:1418
+#: ../roundup/admin.py:1437
 #, python-format
 msgid "Error in configuration settings: \"%s\""
 msgstr "Erorre nei settaggi di configurazione: \"%s\""
 
-#: ../roundup/admin.py:1451
+#: ../roundup/admin.py:1470
 #, python-format
 msgid ""
 "\n"
@@ -668,11 +668,11 @@ msgid ""
 "   %(config_file)s"
 msgstr ""
 
-#: ../roundup/admin.py:1461
+#: ../roundup/admin.py:1480
 msgid " ... at a minimum, you must set following options:"
 msgstr " ... devono essere configurate almeno le seguenti opzioni:"
 
-#: ../roundup/admin.py:1466
+#: ../roundup/admin.py:1485
 #, python-format
 msgid ""
 "\n"
@@ -689,7 +689,7 @@ msgid ""
 "---------------------------------------------------------------------------\n"
 msgstr ""
 
-#: ../roundup/admin.py:1482
+#: ../roundup/admin.py:1501
 msgid ""
 "Usage: list classname [property]\n"
 "        List the instances of a class.\n"
@@ -705,17 +705,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1495
+#: ../roundup/admin.py:1514
 msgid "Too many arguments supplied"
 msgstr ""
 
-#: ../roundup/admin.py:1528
+#: ../roundup/admin.py:1547
 #, python-format
 msgid "%(nodeid)4s: %(value)s"
 msgstr ""
 
 #. noqa: ARG002  - args unused
-#: ../roundup/admin.py:1535
+#: ../roundup/admin.py:1554
 msgid ""
 "Usage: migrate\n"
 "        Update a tracker's database to be compatible with the Roundup\n"
@@ -738,17 +738,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1555
+#: ../roundup/admin.py:1574
 #, python-format
 msgid "Tracker updated to schema version %s."
 msgstr ""
 
-#: ../roundup/admin.py:1559
+#: ../roundup/admin.py:1578
 #, python-format
 msgid "No migration action required. At schema version %s."
 msgstr ""
 
-#: ../roundup/admin.py:1564
+#: ../roundup/admin.py:1583
 msgid ""
 "Usage: pack period | date\n"
 "        Remove journal entries older than the date/period.\n"
@@ -768,11 +768,11 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1590
+#: ../roundup/admin.py:1609
 msgid "Invalid format"
 msgstr ""
 
-#: ../roundup/admin.py:1601
+#: ../roundup/admin.py:1620
 msgid ""
 "Usage: perftest [mode] [arguments]*\n"
 "        Time operations in Roundup.\n"
@@ -790,25 +790,25 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1635
+#: ../roundup/admin.py:1657
 msgid "Invalid 'rounds'. Must be larger than 999."
 msgstr ""
 
-#: ../roundup/admin.py:1639
+#: ../roundup/admin.py:1661
 #, python-format
 msgid "Invalid 'rounds'. It must be an integer not: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1666
+#: ../roundup/admin.py:1688
 msgid "scheme does not support rounds."
 msgstr ""
 
-#: ../roundup/admin.py:1669
+#: ../roundup/admin.py:1691
 #, python-format
 msgid "Hash time: %(time)0.9f seconds, scheme: %(scheme)s, rounds: %(rounds)s"
 msgstr ""
 
-#: ../roundup/admin.py:1675
+#: ../roundup/admin.py:1697
 msgid ""
 "Usage: pragma setting=value | 'list'\n"
 "        Set internal admin settings to a value.\n"
@@ -837,49 +837,49 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1710
+#: ../roundup/admin.py:1732
 #, python-format
 msgid "Argument must be setting=value, was given: %s."
 msgstr ""
 
-#: ../roundup/admin.py:1713
+#: ../roundup/admin.py:1735
 msgid "Current settings and values (NYI - not yet implemented):"
 msgstr ""
 
-#: ../roundup/admin.py:1724
+#: ../roundup/admin.py:1746
 msgid ""
 "      Help for this pragma is missing. Please report it to the Roundup "
 "project.\n"
 msgstr ""
 
-#: ../roundup/admin.py:1730
+#: ../roundup/admin.py:1752
 #, fuzzy, python-format
 msgid "Unknown setting %s. Try \"pragma list\"."
 msgstr "Nome Utente sconosciuto"
 
-#: ../roundup/admin.py:1740
+#: ../roundup/admin.py:1762
 #, python-format
 msgid "Incorrect value for boolean setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1747
+#: ../roundup/admin.py:1769
 #, python-format
 msgid "Incorrect value for integer setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1754
+#: ../roundup/admin.py:1776
 #, python-format
 msgid ""
 "Incorrect value for setting %(setting)s: %(value)s. Should be no, both, or "
 "only."
 msgstr ""
 
-#: ../roundup/admin.py:1764
+#: ../roundup/admin.py:1786
 #, python-format
 msgid "Internal error: pragma can not handle values of type: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1773
+#: ../roundup/admin.py:1795
 msgid ""
 "Usage: reindex [classname|classname:#-#|designator]*\n"
 "        Re-generate a tracker's search indexes.\n"
@@ -896,18 +896,18 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1795
+#: ../roundup/admin.py:1817
 #, python-format
 msgid "no such item \"%(designator)s\""
 msgstr ""
 
 # ../roundup/admin.py:1052 ../roundup/admin.py:85:981 :1030:1052
-#: ../roundup/admin.py:1805
+#: ../roundup/admin.py:1827
 #, fuzzy, python-format
 msgid "no such item \"%(class)s%(id)s\""
 msgstr "classe \"%(classname)s\" mancante"
 
-#: ../roundup/admin.py:1817
+#: ../roundup/admin.py:1839
 msgid ""
 "Usage: restore designator[,designator]*\n"
 "        Restore the retired node specified by designator.\n"
@@ -919,7 +919,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1848
+#: ../roundup/admin.py:1870
 msgid ""
 "Usage: retire designator[,designator]*\n"
 "        Retire the node specified by designator.\n"
@@ -933,7 +933,7 @@ msgid ""
 msgstr ""
 
 #. noqa: ARG002 - args unused
-#: ../roundup/admin.py:1876
+#: ../roundup/admin.py:1898
 msgid ""
 "Usage: rollback\n"
 "        Undo all changes that are pending commit to the database.\n"
@@ -945,7 +945,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1889
+#: ../roundup/admin.py:1911
 msgid ""
 "Usage: security [Role name]\n"
 "        Display the Permissions available to one or all Roles.\n"
@@ -958,46 +958,46 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1904
+#: ../roundup/admin.py:1926
 #, fuzzy, python-format
 msgid "No such Role \"%(role)s\"\n"
 msgstr "Non Ã¨ presente il ruolo \"%(role)s\""
 
-#: ../roundup/admin.py:1910
+#: ../roundup/admin.py:1932
 #, fuzzy, python-format
 msgid "New Web users get the Roles \"%(role)s\"\n"
 msgstr "I nuovi utenti Web otterranno i ruoli \"%(role)s\""
 
-#: ../roundup/admin.py:1913
+#: ../roundup/admin.py:1935
 #, fuzzy, python-format
 msgid "New Web users get the Role \"%(role)s\"\n"
 msgstr "I nuovi utenti Web otterranno il ruolo \"%(role)s)\""
 
-#: ../roundup/admin.py:1917
+#: ../roundup/admin.py:1939
 #, fuzzy, python-format
 msgid "New Email users get the Roles \"%(role)s\"\n"
 msgstr "I nuovi utenti Email otterranno i ruoli \"%(role)s)\""
 
-#: ../roundup/admin.py:1919
+#: ../roundup/admin.py:1941
 #, fuzzy, python-format
 msgid "New Email users get the Role \"%(role)s\"\n"
 msgstr "I nuovi utenti Email otterranno il ruolo \"%(role)s\""
 
-#: ../roundup/admin.py:1922
+#: ../roundup/admin.py:1944
 #, fuzzy, python-format
 msgid "Role \"%(name)s\":\n"
 msgstr "Ruolo \"%(name)s\":"
 
-#: ../roundup/admin.py:1928
+#: ../roundup/admin.py:1950
 msgid " %(description)s (%(name)s for \"%(klass)s\""
 msgstr ""
 
-#: ../roundup/admin.py:1928
+#: ../roundup/admin.py:1950
 #, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\": %(properties)s only)\n"
 msgstr ""
 
-#: ../roundup/admin.py:1941
+#: ../roundup/admin.py:1963
 #, python-format
 msgid ""
 "\n"
@@ -1005,17 +1005,17 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/admin.py:1947
+#: ../roundup/admin.py:1969
 #, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\" only)\n"
 msgstr ""
 
-#: ../roundup/admin.py:1950
+#: ../roundup/admin.py:1972
 #, python-format
 msgid " %(description)s (%(name)s)\n"
 msgstr ""
 
-#: ../roundup/admin.py:1954
+#: ../roundup/admin.py:1976
 msgid ""
 "Usage: set items property=value [property=value ...]\n"
 "        Set the given properties of one or more items(s).\n"
@@ -1036,7 +1036,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2022
+#: ../roundup/admin.py:2044
 msgid ""
 "Usage: specification classname\n"
 "        Show the properties for a classname.\n"
@@ -1045,17 +1045,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2041
+#: ../roundup/admin.py:2063
 #, fuzzy, python-format
 msgid "%(key)s: %(value)s (key property)\n"
 msgstr "%(key)s %(value)s (chiave)"
 
-#: ../roundup/admin.py:2044
+#: ../roundup/admin.py:2066
 #, fuzzy, python-format
 msgid "%(key)s: %(value)s\n"
 msgstr "%(key)s:Â·%(value)s"
 
-#: ../roundup/admin.py:2047
+#: ../roundup/admin.py:2069
 msgid ""
 "Usage: table classname [property[,property]*]\n"
 "        List the instances of a class in tabular form.\n"
@@ -1087,17 +1087,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2093
+#: ../roundup/admin.py:2115
 #, python-format
 msgid "\"%(spec)s\" not name:width"
 msgstr ""
 
-#: ../roundup/admin.py:2115
+#: ../roundup/admin.py:2137
 #, python-format
 msgid "\"%(spec)s\" does not have an integer width: \"%(width)s\""
 msgstr ""
 
-#: ../roundup/admin.py:2151
+#: ../roundup/admin.py:2173
 msgid ""
 "Usage: templates [trace_search]\n"
 "        List templates and their installed directories.\n"
@@ -1107,7 +1107,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2179
+#: ../roundup/admin.py:2201
 msgid ""
 "Usage: updateconfig <filename>\n"
 "        Merge existing tracker config with new settings.\n"
@@ -1118,49 +1118,49 @@ msgid ""
 msgstr ""
 
 # ../roundup/cgi/actions.py:597:608 :779:798
-#: ../roundup/admin.py:2188 ../roundup/cgi/actions.py:886
+#: ../roundup/admin.py:2210 ../roundup/cgi/actions.py:886
 #: ../roundup/cgi/actions.py:897 ../roundup/cgi/actions.py:1099
 #: ../roundup/cgi/actions.py:1113 ../roundup/cgi/actions.py:886:897 :1099:1113
 #, python-format
 msgid "Error: %s"
 msgstr "Errore: %s"
 
-#: ../roundup/admin.py:2220
+#: ../roundup/admin.py:2242
 #, python-format
 msgid "Unknown command \"%(command)s\" (\"help commands\" for a list)"
 msgstr ""
 
-#: ../roundup/admin.py:2226
+#: ../roundup/admin.py:2248
 #, python-format
 msgid "Multiple commands match \"%(command)s\": %(list)s"
 msgstr ""
 
-#: ../roundup/admin.py:2241
+#: ../roundup/admin.py:2263
 msgid "Enter tracker home: "
 msgstr ""
 
-#: ../roundup/admin.py:2270 ../roundup/admin.py:2274
-#: ../roundup/admin.py:2270:2274
+#: ../roundup/admin.py:2292 ../roundup/admin.py:2296
+#: ../roundup/admin.py:2292:2296
 #, python-format
 msgid "Error: Couldn't open tracker: %(message)s"
 msgstr ""
 
-#: ../roundup/admin.py:2322
+#: ../roundup/admin.py:2344
 #, python-format
 msgid ""
 "Roundup %s ready for input.\n"
 "Type \"help\" for help."
 msgstr ""
 
-#: ../roundup/admin.py:2355
+#: ../roundup/admin.py:2377
 msgid "Note: command history and editing not available"
 msgstr ""
 
-#: ../roundup/admin.py:2361
+#: ../roundup/admin.py:2383
 msgid "exit..."
 msgstr ""
 
-#: ../roundup/admin.py:2374
+#: ../roundup/admin.py:2396
 msgid "There are unsaved changes. Commit them (y/N)? "
 msgstr ""
 
@@ -1187,23 +1187,23 @@ msgstr ""
 msgid "Couldn't open database - the required module '%s' is not available"
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:871
-#: ../roundup/backends/back_anydbm.py:884
-#: ../roundup/backends/back_anydbm.py:1158
-#: ../roundup/backends/back_anydbm.py:1193
-#: ../roundup/backends/back_anydbm.py:1422
-#: ../roundup/backends/back_anydbm.py:1440
-#: ../roundup/backends/back_anydbm.py:1487
-#: ../roundup/backends/back_anydbm.py:2123
-#: ../roundup/backends/back_anydbm.py:871:884
+#: ../roundup/backends/back_anydbm.py:873
+#: ../roundup/backends/back_anydbm.py:886
+#: ../roundup/backends/back_anydbm.py:1160
+#: ../roundup/backends/back_anydbm.py:1195
+#: ../roundup/backends/back_anydbm.py:1424
+#: ../roundup/backends/back_anydbm.py:1442
+#: ../roundup/backends/back_anydbm.py:1489
+#: ../roundup/backends/back_anydbm.py:2135
+#: ../roundup/backends/back_anydbm.py:873:886
 #: ../roundup/backends/rdbms_common.py:1720
 #: ../roundup/backends/rdbms_common.py:1967
 #: ../roundup/backends/rdbms_common.py:2206
 #: ../roundup/backends/rdbms_common.py:2226
 #: ../roundup/backends/rdbms_common.py:2279
-#: ../roundup/backends/rdbms_common.py:3246
-#: ../roundup/backends/rdbms_common.py:1720:1967 :1158:1193 :1422:1440:1487
-#: :2123 :2206:2226 :2279:3246
+#: ../roundup/backends/rdbms_common.py:3254
+#: ../roundup/backends/rdbms_common.py:1720:1967 :1160:1195 :1424:1442:1489
+#: :2135 :2206:2226 :2279:3254
 msgid "Database open read-only"
 msgstr ""
 
@@ -1600,13 +1600,13 @@ msgstr "Login invalida"
 msgid "You do not have permission to login"
 msgstr "Non hai il permesso per eseguire la login"
 
-#: ../roundup/cgi/actions.py:1577 ../roundup/cgi/actions.py:1761
-#: ../roundup/cgi/actions.py:1577:1761
+#: ../roundup/cgi/actions.py:1577 ../roundup/cgi/actions.py:1757
+#: ../roundup/cgi/actions.py:1577:1757
 #, python-format
 msgid "Column \"%(column)s\" not found in %(class)s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1832
+#: ../roundup/cgi/actions.py:1822
 #, fuzzy, python-format
 msgid "You do not have permission to view %(class)s"
 msgstr "Non hai i permessi per modificare i %(class)s"
@@ -1697,7 +1697,7 @@ msgstr "in <strong>%s</strong>"
 msgid "<em>undefined</em>"
 msgstr "<em>indefinito</em>"
 
-#: ../roundup/cgi/client.py:105
+#: ../roundup/cgi/client.py:111
 msgid ""
 "<html><head><title>An error has occurred</title></head>\n"
 "<body><h1>An error has occurred</h1>\n"
@@ -1711,159 +1711,165 @@ msgstr ""
 "La notifica del problema Ã¨ stata notificata al manutentore del tracker.</p>\n"
 "</body></html>"
 
-#: ../roundup/cgi/client.py:717 ../roundup/cgi/client.py:1635
-#: ../roundup/cgi/client.py:717:1635
+#: ../roundup/cgi/client.py:666
+msgid ""
+"XMLRPC endpoint is not using defusedxml. Improve security by installing "
+"defusedxml."
+msgstr ""
+
+#: ../roundup/cgi/client.py:728 ../roundup/cgi/client.py:1646
+#: ../roundup/cgi/client.py:728:1646
 msgid "Required Header Missing"
 msgstr ""
 
-#: ../roundup/cgi/client.py:719
+#: ../roundup/cgi/client.py:731
 #, fuzzy
 msgid "Client is not allowed to use Rest Interface."
 msgstr ""
 "Gli utenti anonimi non hanno il permesso di utilizzare l'interfaccia web"
 
-#: ../roundup/cgi/client.py:971
+#: ../roundup/cgi/client.py:985
 msgid "Form Error: "
 msgstr "Errore nella Form: "
 
-#: ../roundup/cgi/client.py:1064
+#: ../roundup/cgi/client.py:1078
 #, python-format
 msgid "Unrecognized charset: %r"
 msgstr "Codice di carattere sconosciuto: %r"
 
-#: ../roundup/cgi/client.py:1331 ../roundup/cgi/client.py:2294
-#: ../roundup/cgi/client.py:1331:2294
+#: ../roundup/cgi/client.py:1345 ../roundup/cgi/client.py:2357
+#: ../roundup/cgi/client.py:1345:2357
 msgid "broken form: multiple @action values submitted"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1348
+#: ../roundup/cgi/client.py:1362
 msgid "Anonymous users are not allowed to use the web interface"
 msgstr ""
 "Gli utenti anonimi non hanno il permesso di utilizzare l'interfaccia web"
 
-#: ../roundup/cgi/client.py:1496
+#: ../roundup/cgi/client.py:1507
 msgid "Referer header not available."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1500
+#: ../roundup/cgi/client.py:1511
 #, python-format
 msgid "csrf key used with wrong method from: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1529
+#: ../roundup/cgi/client.py:1540
 #, python-format
 msgid "csrf header %(header)s required but missing for user%(userid)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1533
+#: ../roundup/cgi/client.py:1544
 #, python-format
 msgid "Missing header: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1541
+#: ../roundup/cgi/client.py:1552
 #, python-format
 msgid "csrf Referer header check failed for user%(userid)s. Value=%(referer)s"
 msgstr ""
 
 # ../roundup/cgi/actions.py:931:935
-#: ../roundup/cgi/client.py:1546
+#: ../roundup/cgi/client.py:1557
 #, fuzzy, python-format
 msgid "Invalid Referer: %s"
 msgstr "Login invalida"
 
-#: ../roundup/cgi/client.py:1561
+#: ../roundup/cgi/client.py:1572
 #, python-format
 msgid "csrf Origin header check failed for user%(userid)s. Value=%(origin)s"
 msgstr ""
 
 # ../roundup/cgi/actions.py:931:935
-#: ../roundup/cgi/client.py:1566
+#: ../roundup/cgi/client.py:1577
 #, fuzzy, python-format
 msgid "Invalid Origin %s"
 msgstr "Login invalida"
 
-#: ../roundup/cgi/client.py:1580
+#: ../roundup/cgi/client.py:1591
 #, python-format
 msgid ""
 "csrf X-FORWARDED-HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1586
+#: ../roundup/cgi/client.py:1597
 #, python-format
 msgid "Invalid X-FORWARDED-HOST %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1605
+#: ../roundup/cgi/client.py:1616
 #, python-format
 msgid "csrf HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1610
+#: ../roundup/cgi/client.py:1621
 #, python-format
 msgid "Invalid HOST %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1618
+#: ../roundup/cgi/client.py:1629
 msgid "Csrf: unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1619
+#: ../roundup/cgi/client.py:1630
 msgid "Unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1632
+#: ../roundup/cgi/client.py:1643
 #, python-format
 msgid "csrf X-REQUESTED-WITH xmlrpc required header check failed for user%s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1673
+#: ../roundup/cgi/client.py:1684
 #, python-format
 msgid "Required csrf field missing for user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1675 ../roundup/cgi/client.py:1702
-#: ../roundup/cgi/client.py:1719 ../roundup/cgi/client.py:1675:1702:1719
+#: ../roundup/cgi/client.py:1686 ../roundup/cgi/client.py:1713
+#: ../roundup/cgi/client.py:1730 ../roundup/cgi/client.py:1686:1713:1730
 msgid ""
 "We can't validate your session (csrf failure). Re-enter any unsaved data and "
 "try again."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1679
+#: ../roundup/cgi/client.py:1690
 #, python-format
 msgid "csrf field not supplied by user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1691
+#: ../roundup/cgi/client.py:1702
 #, python-format
 msgid ""
 "Csrf mismatch user: current user %(user)s != stored user %(stored)s, current "
 "session, stored session: %(cur_sess)s,%(stor_sess)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1709
+#: ../roundup/cgi/client.py:1720
 #, python-format
 msgid ""
 "Csrf mismatch user: current session %(curr_sess)s != stored session "
 "%(stor_sess)s, current user/stored user is: %(user)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1901
+#: ../roundup/cgi/client.py:1912
 msgid "You are not allowed to view this file."
 msgstr "Non si dispone dei permessi per visualizzare questo file."
 
-#: ../roundup/cgi/client.py:2172
+#: ../roundup/cgi/client.py:2235
 #, python-format
 msgid "%(starttag)sTime elapsed: %(seconds)fs%(endtag)s\n"
 msgstr "%(starttag)sTempo trascorso: %(seconds)fs%(endtag)s\n"
 
-#: ../roundup/cgi/client.py:2176
+#: ../roundup/cgi/client.py:2239
 #, python-format
 msgid ""
 "%(starttag)sCache hits: %(cache_hits)d, misses %(cache_misses)d. Loading "
 "items: %(get_items)f secs. Filtering: %(filtering)f secs.%(endtag)s\n"
 msgstr ""
 
-#: ../roundup/cgi/client.py:2716
+#: ../roundup/cgi/client.py:2778
 #, python-format
 msgid ""
 "Cache failure: compressed file %(compressed)s is older than its source file "
@@ -2288,18 +2294,18 @@ msgstr ""
 msgid "Not a property name: %s"
 msgstr ""
 
-#: ../roundup/hyperdb.py:1984
+#: ../roundup/hyperdb.py:2038
 #, fuzzy, python-format
 msgid "property %(property)s: %(value)r is not a %(classname)s."
 msgstr ""
 "la proprietÃ  \"%(propname)s\": \"%(value)s\" non Ã¨ al momento nella lista"
 
-#: ../roundup/hyperdb.py:1990
+#: ../roundup/hyperdb.py:2044
 #, python-format
 msgid "you may only enter ID values for property %s"
 msgstr ""
 
-#: ../roundup/hyperdb.py:2025
+#: ../roundup/hyperdb.py:2079
 #, python-format
 msgid "%(property)r is not a property of %(classname)s"
 msgstr ""
@@ -2610,6 +2616,22 @@ msgstr ""
 msgid "not of form [arg=value,value,...;arg=value,value,...]"
 msgstr "Non nel formato [arg=valore,valore,...;arg=valore,valore,...]"
 
+#: ../roundup/mlink_expr.py:161
+#, python-format
+msgid ""
+"There was an error searching %(class)s by %(attr)s using: %(opcodes)s. The "
+"operator %(opcode)s (%(opcodename)s) at position %(position)d has too few "
+"arguments."
+msgstr ""
+
+#: ../roundup/mlink_expr.py:174
+#, python-format
+msgid ""
+"There was an error searching %(class)s by %(attr)s using: %(opcodes)s. There "
+"are too many arguments for the existing operators. The values on the stack "
+"are: %(stack)s"
+msgstr ""
+
 #: ../roundup/pygettext.py:401
 #, python-format
 msgid "*** %(file)s:%(lineno)s: Seen unexpected token \"%(token)s\""
@@ -2668,12 +2690,12 @@ msgstr ""
 msgid "morethanonestring"
 msgstr ""
 
-#: ../roundup/rest.py:410
+#: ../roundup/rest.py:417
 #, python-format
 msgid "Method %(m)s not allowed. Allowed: %(a)s"
 msgstr ""
 
-#: ../roundup/rest.py:948
+#: ../roundup/rest.py:964
 #, python-format
 msgid ""
 "Page size %(page_size)s must be less than admin limit on query result size: "
@@ -2681,30 +2703,51 @@ msgid ""
 msgstr ""
 
 # ../roundup/cgi/actions.py:931:935
-#: ../roundup/rest.py:1193
+#: ../roundup/rest.py:1211
 #, fuzzy, python-format
 msgid "Invalid attribute %s"
 msgstr "Login invalida"
 
-#: ../roundup/rest.py:2182
+#: ../roundup/rest.py:2199
 #, python-format
 msgid "Api rate limits exceeded. Please wait: %s seconds."
 msgstr ""
 
-#: ../roundup/rest.py:2258
+#: ../roundup/rest.py:2283
 #, python-format
 msgid ""
-"Unable to parse Accept Header. %(error)s. Acceptable types: "
+"Content type '%s' requested in URL is not available.\n"
+"Acceptable types: %s\n"
+msgstr ""
+
+#: ../roundup/rest.py:2304
+#, python-format
+msgid ""
+"Unable to parse Accept Header. %(error)s. Acceptable types: */*, "
 "%(acceptable_types)s"
 msgstr ""
 
-#: ../roundup/rest.py:2441
+#: ../roundup/rest.py:2376 ../roundup/rest.py:2597 ../roundup/rest.py:2376:2597
 #, python-format
 msgid ""
 "Unrecognized api version: %s. See /rest without specifying api version for "
 "supported versions."
 msgstr ""
 
+#: ../roundup/rest.py:2411 ../roundup/rest.py:2420 ../roundup/rest.py:2411:2420
+#, python-format
+msgid ""
+"Requested content type(s) '%s' not available.\n"
+"Acceptable mime types are: */*, %s"
+msgstr ""
+
+#: ../roundup/rest.py:2696
+msgid ""
+"Internal error while formatting response.\n"
+"accept_mime_type is not defined. This should\n"
+"never happen\n"
+msgstr ""
+
 #: ../roundup/roundupdb.py:140
 #, python-format
 msgid "Username '%s' already exists."
@@ -2870,33 +2913,33 @@ msgstr ""
 "Errore: la sorgente deve essere una tra \"mailbox\", \"pop\", \"apop\", "
 "\"imap\" o \"imaps\""
 
-#: ../roundup/scripts/roundup_server.py:112
+#: ../roundup/scripts/roundup_server.py:113
 msgid "WARNING: generating temporary SSL certificate"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:143
+#: ../roundup/scripts/roundup_server.py:144
 #, python-format
 msgid "Unable to find/use key from file: %(pemfile)s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:144
+#: ../roundup/scripts/roundup_server.py:145
 msgid ""
 "Does it have a private key surrounded by '-----BEGIN PRIVATE KEY-----' and\n"
 "  '-----END PRIVATE KEY-----' markers?"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:149
+#: ../roundup/scripts/roundup_server.py:150
 #, python-format
 msgid "Unable to find/use certificate from file: %(pemfile)s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:150
+#: ../roundup/scripts/roundup_server.py:151
 msgid ""
 "Does it have a certificate surrounded by '-----BEGIN CERTIFICATE-----' and\n"
 "  '-----END CERTIFICATE-----' markers?"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:344
+#: ../roundup/scripts/roundup_server.py:345
 msgid ""
 "<html><head><title>Roundup trackers index</title></head>\n"
 "<body><h1>Roundup trackers index</h1><ol>\n"
@@ -2904,60 +2947,60 @@ msgstr ""
 "<html><head><title>indice dei ticket Roundup</title></head>\n"
 "<body><h1>indice dei ticket Roundup</h1><ol>\n"
 
-#: ../roundup/scripts/roundup_server.py:570
+#: ../roundup/scripts/roundup_server.py:587
 #, fuzzy, python-format
 msgid "Error: %(type)s: %(value)s"
 msgstr "%(key)s:Â·%(value)s"
 
-#: ../roundup/scripts/roundup_server.py:582
+#: ../roundup/scripts/roundup_server.py:599
 msgid "WARNING: ignoring \"-g\" argument, not root"
 msgstr "ATTENZIONE: ignoro il parametro \"-g\", non sei root"
 
-#: ../roundup/scripts/roundup_server.py:588
+#: ../roundup/scripts/roundup_server.py:605
 msgid "Can't change groups - no grp module"
 msgstr "Non Ã¨ possibile cambiare gruppo - nessun modulo grp"
 
-#: ../roundup/scripts/roundup_server.py:597
+#: ../roundup/scripts/roundup_server.py:614
 #, python-format
 msgid "Group %(group)s doesn't exist"
 msgstr "Il gruppo %(group)s non esiste"
 
-#: ../roundup/scripts/roundup_server.py:609
+#: ../roundup/scripts/roundup_server.py:626
 msgid "Can't run as root!"
 msgstr "Non puÃ² essere eseguito come root!"
 
-#: ../roundup/scripts/roundup_server.py:612
+#: ../roundup/scripts/roundup_server.py:629
 msgid "WARNING: ignoring \"-u\" argument, not root"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:618
+#: ../roundup/scripts/roundup_server.py:635
 msgid "Can't change users - no pwd module"
 msgstr "Non Ã¨ possibile cambiare utente - nessun modulo pwd"
 
-#: ../roundup/scripts/roundup_server.py:627
+#: ../roundup/scripts/roundup_server.py:644
 #, python-format
 msgid "User %(user)s doesn't exist"
 msgstr "L'utente %(user)s non esiste"
 
-#: ../roundup/scripts/roundup_server.py:833
+#: ../roundup/scripts/roundup_server.py:856
 #, python-format
 msgid "Multiprocess mode \"%s\" is not available, switching to single-process"
 msgstr ""
 "La modalitÃ  multiprocesso \"%s\" non Ã¨ disponibile, viene utilizzata quella "
 "a singolo processo"
 
-#: ../roundup/scripts/roundup_server.py:861
+#: ../roundup/scripts/roundup_server.py:884
 #, python-format
 msgid "Unable to bind to port %s, port already in use."
 msgstr "Impossibile bindare alla porta %s, la porta risulta giÃ  in uso."
 
-#: ../roundup/scripts/roundup_server.py:865
+#: ../roundup/scripts/roundup_server.py:888
 #, fuzzy, python-format
 msgid ""
 "Unable to bind to port %(port)s, access not allowed, errno: %(errno)s %(msg)s"
 msgstr "Impossibile bindare alla porta %s, la porta risulta giÃ  in uso."
 
-#: ../roundup/scripts/roundup_server.py:944
+#: ../roundup/scripts/roundup_server.py:967
 msgid ""
 " -c <Command>  Windows Service options.\n"
 "               If you want to run the server as a Windows Service, you\n"
@@ -2967,16 +3010,17 @@ msgid ""
 "               specifics."
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:951
+#: ../roundup/scripts/roundup_server.py:974
 msgid ""
 " -u <UID>      runs the Roundup web server as this UID\n"
 " -g <GID>      runs the Roundup web server as this GID\n"
 " -d <PIDfile>  run the server in the background and write the server's PID\n"
 "               to the file indicated by PIDfile. The -l option *must* be\n"
-"               specified if -d is used."
+"               specified if -d is used.\n"
+" -D            run the server in the foreground even when -d is used."
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:958
+#: ../roundup/scripts/roundup_server.py:982
 #, python-format
 msgid ""
 "\n"
@@ -3001,6 +3045,10 @@ msgid ""
 "mode\n"
 " -s            enable SSL\n"
 " -L            http request logging uses python logging (roundup.http)\n"
+" -P            log client address/name using reverse proxy X-Forwarded-For\n"
+"               header and not the connection IP (which is the reverse "
+"proxy).\n"
+"               Appends a '+' sign to the logged address/name.\n"
 " -e <fname>    PEM file containing SSL key and certificate\n"
 " -t <mode>     multiprocess mode (default: %(mp_def)s).\n"
 "               Allowed values: %(mp_types)s.\n"
@@ -3045,22 +3093,22 @@ msgid ""
 "   any url-unsafe characters like spaces, as these confuse IE.\n"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:1135
+#: ../roundup/scripts/roundup_server.py:1162
 msgid "Instances must be name=home"
 msgstr "L'istanza deve essere nel formato nome=home"
 
-#: ../roundup/scripts/roundup_server.py:1149
+#: ../roundup/scripts/roundup_server.py:1176
 #, python-format
 msgid "Configuration saved to %s"
 msgstr "Configurazione salvata in %s"
 
-#: ../roundup/scripts/roundup_server.py:1167
+#: ../roundup/scripts/roundup_server.py:1194
 msgid "Sorry, you can't run the server as a daemon on this Operating System"
 msgstr ""
 "Spiacente, non Ã¨ possibile utilizzare il server come demone su questo "
 "sistema operativo."
 
-#: ../roundup/scripts/roundup_server.py:1187
+#: ../roundup/scripts/roundup_server.py:1214
 #, python-format
 msgid "Roundup server started on %(HOST)s:%(PORT)s"
 msgstr "Il server Roundup Ã¨ stato attivato su %(HOST)s:%(PORT)s"
diff --git a/locale/ja.po b/locale/ja.po
index 634a76d61..73cdf6220 100644
--- a/locale/ja.po
+++ b/locale/ja.po
@@ -5,9 +5,9 @@
 #
 msgid ""
 msgstr ""
-"Project-Id-Version: Roundup 2.4.0\n"
+"Project-Id-Version: Roundup 2.5.0\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
-"POT-Creation-Date: 2024-08-07 21:43-0400\n"
+"POT-Creation-Date: 2024-12-30 22:49-0500\n"
 "PO-Revision-Date: 2013-10-31 12:20+0100\n"
 "Last-Translator: Yasushi Iwata <iwata@know-net.co.jp>\n"
 "Language-Team: Yasushi Iwata <iwata@know-net.co.jp>\n"
@@ -82,8 +82,8 @@ msgstr ""
 msgid "Enable verbose output: tracing, descriptions...\n"
 msgstr ""
 
-#: ../roundup/admin.py:175 ../roundup/admin.py:1188 ../roundup/admin.py:1836
-#: ../roundup/admin.py:1868 ../roundup/admin.py:175:1188 :1836:1868
+#: ../roundup/admin.py:175 ../roundup/admin.py:1188 ../roundup/admin.py:1858
+#: ../roundup/admin.py:1890 ../roundup/admin.py:175:1188 :1858:1890
 #, python-format
 msgid "no such class \"%(classname)s\""
 msgstr ""
@@ -214,13 +214,13 @@ msgstr ""
 msgid "%s:"
 msgstr ""
 
-#: ../roundup/admin.py:439 ../roundup/admin.py:1396
-#: ../roundup/admin.py:439:1396
+#: ../roundup/admin.py:439 ../roundup/admin.py:1415
+#: ../roundup/admin.py:439:1415
 msgid "Templates:"
 msgstr ""
 
-#: ../roundup/admin.py:442 ../roundup/admin.py:1406
-#: ../roundup/admin.py:442:1406
+#: ../roundup/admin.py:442 ../roundup/admin.py:1425
+#: ../roundup/admin.py:442:1425
 msgid "Back ends:"
 msgstr ""
 
@@ -254,11 +254,11 @@ msgstr ""
 #: ../roundup/admin.py:482 ../roundup/admin.py:555 ../roundup/admin.py:606
 #: ../roundup/admin.py:733 ../roundup/admin.py:806 ../roundup/admin.py:851
 #: ../roundup/admin.py:902 ../roundup/admin.py:999 ../roundup/admin.py:1216
-#: ../roundup/admin.py:1369 ../roundup/admin.py:1497 ../roundup/admin.py:1580
-#: ../roundup/admin.py:1703 ../roundup/admin.py:1826 ../roundup/admin.py:1858
-#: ../roundup/admin.py:1974 ../roundup/admin.py:2028 ../roundup/admin.py:2076
-#: ../roundup/admin.py:482:555 :1216:1369:1497 :1580:1703 :1826:1858 :1974:2028
-#: :2076 :606:733 :806:851 :902:999
+#: ../roundup/admin.py:1388 ../roundup/admin.py:1516 ../roundup/admin.py:1599
+#: ../roundup/admin.py:1725 ../roundup/admin.py:1848 ../roundup/admin.py:1880
+#: ../roundup/admin.py:1996 ../roundup/admin.py:2050 ../roundup/admin.py:2098
+#: ../roundup/admin.py:482:555 :1216:1388:1516 :1599:1725 :1848:1880 :1996:2050
+#: :2098 :606:733 :806:851 :902:999
 msgid "Not enough arguments supplied"
 msgstr ""
 
@@ -362,9 +362,9 @@ msgstr ""
 msgid "Class %(curclassname)s has no property %(pn)s in %(propname)s."
 msgstr ""
 
-#: ../roundup/admin.py:791 ../roundup/admin.py:840 ../roundup/admin.py:1517
-#: ../roundup/admin.py:1530 ../roundup/admin.py:2098
-#: ../roundup/admin.py:791:840 :1517:1530:2098
+#: ../roundup/admin.py:791 ../roundup/admin.py:840 ../roundup/admin.py:1536
+#: ../roundup/admin.py:1549 ../roundup/admin.py:2120
+#: ../roundup/admin.py:791:840 :1536:1549:2120
 #, python-format
 msgid "%(classname)s has no property \"%(propname)s\""
 msgstr ""
@@ -426,8 +426,8 @@ msgstr ""
 msgid "property %s is not of type Multilink or Link so -d flag does not apply."
 msgstr ""
 
-#: ../roundup/admin.py:942 ../roundup/admin.py:1190 ../roundup/admin.py:1842
-#: ../roundup/admin.py:1870 ../roundup/admin.py:942:1190 :1842:1870
+#: ../roundup/admin.py:942 ../roundup/admin.py:1190 ../roundup/admin.py:1864
+#: ../roundup/admin.py:1892 ../roundup/admin.py:942:1190 :1864:1892
 #, python-format
 msgid "no such %(classname)s node \"%(nodeid)s\""
 msgstr ""
@@ -543,7 +543,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1287
+#: ../roundup/admin.py:1306
 msgid ""
 "Usage: importtables export_dir\n"
 "        This imports the database tables exported using exporttables.\n"
@@ -553,7 +553,7 @@ msgid ""
 msgstr ""
 
 #. password
-#: ../roundup/admin.py:1295
+#: ../roundup/admin.py:1314
 msgid ""
 "Usage: initialise [adminpw]\n"
 "        Initialise a new Roundup tracker.\n"
@@ -564,30 +564,30 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1309
+#: ../roundup/admin.py:1328
 msgid "Admin Password: "
 msgstr ""
 
-#: ../roundup/admin.py:1310
+#: ../roundup/admin.py:1329
 msgid "       Confirm: "
 msgstr ""
 
-#: ../roundup/admin.py:1314
+#: ../roundup/admin.py:1333
 msgid "Instance home does not exist"
 msgstr ""
 
-#: ../roundup/admin.py:1318
+#: ../roundup/admin.py:1337
 msgid "Instance has not been installed"
 msgstr ""
 
-#: ../roundup/admin.py:1326
+#: ../roundup/admin.py:1345
 msgid ""
 "WARNING: The database is already initialised!\n"
 "If you re-initialise it, you will lose all the data!\n"
 "Erase it? Y/N: "
 msgstr ""
 
-#: ../roundup/admin.py:1346
+#: ../roundup/admin.py:1365
 msgid ""
 "Usage: install [template [backend [key=val[,key=val]]]]\n"
 "        Install a new Roundup tracker.\n"
@@ -613,12 +613,12 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1375
+#: ../roundup/admin.py:1394
 #, python-format
 msgid "Instance home parent directory \"%(parent)s\" does not exist"
 msgstr ""
 
-#: ../roundup/admin.py:1384
+#: ../roundup/admin.py:1403
 #, python-format
 msgid ""
 "WARNING: There appears to be a tracker in \"%(tracker_home)s\"!\n"
@@ -626,20 +626,20 @@ msgid ""
 "Erase it? Y/N: "
 msgstr ""
 
-#: ../roundup/admin.py:1397
+#: ../roundup/admin.py:1416
 msgid "Select template"
 msgstr ""
 
-#: ../roundup/admin.py:1407
+#: ../roundup/admin.py:1426
 msgid "Select backend"
 msgstr ""
 
-#: ../roundup/admin.py:1418
+#: ../roundup/admin.py:1437
 #, python-format
 msgid "Error in configuration settings: \"%s\""
 msgstr ""
 
-#: ../roundup/admin.py:1451
+#: ../roundup/admin.py:1470
 #, python-format
 msgid ""
 "\n"
@@ -648,11 +648,11 @@ msgid ""
 "   %(config_file)s"
 msgstr ""
 
-#: ../roundup/admin.py:1461
+#: ../roundup/admin.py:1480
 msgid " ... at a minimum, you must set following options:"
 msgstr ""
 
-#: ../roundup/admin.py:1466
+#: ../roundup/admin.py:1485
 #, python-format
 msgid ""
 "\n"
@@ -669,7 +669,7 @@ msgid ""
 "---------------------------------------------------------------------------\n"
 msgstr ""
 
-#: ../roundup/admin.py:1482
+#: ../roundup/admin.py:1501
 msgid ""
 "Usage: list classname [property]\n"
 "        List the instances of a class.\n"
@@ -685,17 +685,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1495
+#: ../roundup/admin.py:1514
 msgid "Too many arguments supplied"
 msgstr ""
 
-#: ../roundup/admin.py:1528
+#: ../roundup/admin.py:1547
 #, python-format
 msgid "%(nodeid)4s: %(value)s"
 msgstr ""
 
 #. noqa: ARG002  - args unused
-#: ../roundup/admin.py:1535
+#: ../roundup/admin.py:1554
 msgid ""
 "Usage: migrate\n"
 "        Update a tracker's database to be compatible with the Roundup\n"
@@ -718,17 +718,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1555
+#: ../roundup/admin.py:1574
 #, python-format
 msgid "Tracker updated to schema version %s."
 msgstr ""
 
-#: ../roundup/admin.py:1559
+#: ../roundup/admin.py:1578
 #, python-format
 msgid "No migration action required. At schema version %s."
 msgstr ""
 
-#: ../roundup/admin.py:1564
+#: ../roundup/admin.py:1583
 msgid ""
 "Usage: pack period | date\n"
 "        Remove journal entries older than the date/period.\n"
@@ -748,11 +748,11 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1590
+#: ../roundup/admin.py:1609
 msgid "Invalid format"
 msgstr ""
 
-#: ../roundup/admin.py:1601
+#: ../roundup/admin.py:1620
 msgid ""
 "Usage: perftest [mode] [arguments]*\n"
 "        Time operations in Roundup.\n"
@@ -770,25 +770,25 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1635
+#: ../roundup/admin.py:1657
 msgid "Invalid 'rounds'. Must be larger than 999."
 msgstr ""
 
-#: ../roundup/admin.py:1639
+#: ../roundup/admin.py:1661
 #, python-format
 msgid "Invalid 'rounds'. It must be an integer not: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1666
+#: ../roundup/admin.py:1688
 msgid "scheme does not support rounds."
 msgstr ""
 
-#: ../roundup/admin.py:1669
+#: ../roundup/admin.py:1691
 #, python-format
 msgid "Hash time: %(time)0.9f seconds, scheme: %(scheme)s, rounds: %(rounds)s"
 msgstr ""
 
-#: ../roundup/admin.py:1675
+#: ../roundup/admin.py:1697
 msgid ""
 "Usage: pragma setting=value | 'list'\n"
 "        Set internal admin settings to a value.\n"
@@ -817,49 +817,49 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1710
+#: ../roundup/admin.py:1732
 #, python-format
 msgid "Argument must be setting=value, was given: %s."
 msgstr ""
 
-#: ../roundup/admin.py:1713
+#: ../roundup/admin.py:1735
 msgid "Current settings and values (NYI - not yet implemented):"
 msgstr ""
 
-#: ../roundup/admin.py:1724
+#: ../roundup/admin.py:1746
 msgid ""
 "      Help for this pragma is missing. Please report it to the Roundup "
 "project.\n"
 msgstr ""
 
-#: ../roundup/admin.py:1730
+#: ../roundup/admin.py:1752
 #, fuzzy, python-format
 msgid "Unknown setting %s. Try \"pragma list\"."
 msgstr "ç™»éŒ²ã•ã‚Œã¦ã„ãªã„ãƒ¦ãƒ¼ã‚¶ãƒ¼åã§ã™"
 
-#: ../roundup/admin.py:1740
+#: ../roundup/admin.py:1762
 #, python-format
 msgid "Incorrect value for boolean setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1747
+#: ../roundup/admin.py:1769
 #, python-format
 msgid "Incorrect value for integer setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1754
+#: ../roundup/admin.py:1776
 #, python-format
 msgid ""
 "Incorrect value for setting %(setting)s: %(value)s. Should be no, both, or "
 "only."
 msgstr ""
 
-#: ../roundup/admin.py:1764
+#: ../roundup/admin.py:1786
 #, python-format
 msgid "Internal error: pragma can not handle values of type: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1773
+#: ../roundup/admin.py:1795
 msgid ""
 "Usage: reindex [classname|classname:#-#|designator]*\n"
 "        Re-generate a tracker's search indexes.\n"
@@ -876,17 +876,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1795
+#: ../roundup/admin.py:1817
 #, python-format
 msgid "no such item \"%(designator)s\""
 msgstr ""
 
-#: ../roundup/admin.py:1805
+#: ../roundup/admin.py:1827
 #, fuzzy, python-format
 msgid "no such item \"%(class)s%(id)s\""
 msgstr "%(class)s %(id)s ã®ã‚³ãƒ”ãƒ¼"
 
-#: ../roundup/admin.py:1817
+#: ../roundup/admin.py:1839
 msgid ""
 "Usage: restore designator[,designator]*\n"
 "        Restore the retired node specified by designator.\n"
@@ -898,7 +898,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1848
+#: ../roundup/admin.py:1870
 msgid ""
 "Usage: retire designator[,designator]*\n"
 "        Retire the node specified by designator.\n"
@@ -912,7 +912,7 @@ msgid ""
 msgstr ""
 
 #. noqa: ARG002 - args unused
-#: ../roundup/admin.py:1876
+#: ../roundup/admin.py:1898
 msgid ""
 "Usage: rollback\n"
 "        Undo all changes that are pending commit to the database.\n"
@@ -924,7 +924,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1889
+#: ../roundup/admin.py:1911
 msgid ""
 "Usage: security [Role name]\n"
 "        Display the Permissions available to one or all Roles.\n"
@@ -937,46 +937,46 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1904
+#: ../roundup/admin.py:1926
 #, python-format
 msgid "No such Role \"%(role)s\"\n"
 msgstr ""
 
-#: ../roundup/admin.py:1910
+#: ../roundup/admin.py:1932
 #, python-format
 msgid "New Web users get the Roles \"%(role)s\"\n"
 msgstr ""
 
-#: ../roundup/admin.py:1913
+#: ../roundup/admin.py:1935
 #, python-format
 msgid "New Web users get the Role \"%(role)s\"\n"
 msgstr ""
 
-#: ../roundup/admin.py:1917
+#: ../roundup/admin.py:1939
 #, python-format
 msgid "New Email users get the Roles \"%(role)s\"\n"
 msgstr ""
 
-#: ../roundup/admin.py:1919
+#: ../roundup/admin.py:1941
 #, python-format
 msgid "New Email users get the Role \"%(role)s\"\n"
 msgstr ""
 
-#: ../roundup/admin.py:1922
+#: ../roundup/admin.py:1944
 #, python-format
 msgid "Role \"%(name)s\":\n"
 msgstr ""
 
-#: ../roundup/admin.py:1928
+#: ../roundup/admin.py:1950
 msgid " %(description)s (%(name)s for \"%(klass)s\""
 msgstr ""
 
-#: ../roundup/admin.py:1928
+#: ../roundup/admin.py:1950
 #, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\": %(properties)s only)\n"
 msgstr ""
 
-#: ../roundup/admin.py:1941
+#: ../roundup/admin.py:1963
 #, python-format
 msgid ""
 "\n"
@@ -984,17 +984,17 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/admin.py:1947
+#: ../roundup/admin.py:1969
 #, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\" only)\n"
 msgstr ""
 
-#: ../roundup/admin.py:1950
+#: ../roundup/admin.py:1972
 #, python-format
 msgid " %(description)s (%(name)s)\n"
 msgstr ""
 
-#: ../roundup/admin.py:1954
+#: ../roundup/admin.py:1976
 msgid ""
 "Usage: set items property=value [property=value ...]\n"
 "        Set the given properties of one or more items(s).\n"
@@ -1015,7 +1015,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2022
+#: ../roundup/admin.py:2044
 msgid ""
 "Usage: specification classname\n"
 "        Show the properties for a classname.\n"
@@ -1024,17 +1024,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2041
+#: ../roundup/admin.py:2063
 #, python-format
 msgid "%(key)s: %(value)s (key property)\n"
 msgstr ""
 
-#: ../roundup/admin.py:2044
+#: ../roundup/admin.py:2066
 #, python-format
 msgid "%(key)s: %(value)s\n"
 msgstr ""
 
-#: ../roundup/admin.py:2047
+#: ../roundup/admin.py:2069
 msgid ""
 "Usage: table classname [property[,property]*]\n"
 "        List the instances of a class in tabular form.\n"
@@ -1066,17 +1066,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2093
+#: ../roundup/admin.py:2115
 #, python-format
 msgid "\"%(spec)s\" not name:width"
 msgstr ""
 
-#: ../roundup/admin.py:2115
+#: ../roundup/admin.py:2137
 #, python-format
 msgid "\"%(spec)s\" does not have an integer width: \"%(width)s\""
 msgstr ""
 
-#: ../roundup/admin.py:2151
+#: ../roundup/admin.py:2173
 msgid ""
 "Usage: templates [trace_search]\n"
 "        List templates and their installed directories.\n"
@@ -1086,7 +1086,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2179
+#: ../roundup/admin.py:2201
 msgid ""
 "Usage: updateconfig <filename>\n"
 "        Merge existing tracker config with new settings.\n"
@@ -1096,49 +1096,49 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2188 ../roundup/cgi/actions.py:886
+#: ../roundup/admin.py:2210 ../roundup/cgi/actions.py:886
 #: ../roundup/cgi/actions.py:897 ../roundup/cgi/actions.py:1099
 #: ../roundup/cgi/actions.py:1113 ../roundup/cgi/actions.py:886:897 :1099:1113
 #, python-format
 msgid "Error: %s"
 msgstr "ã‚¨ãƒ©ãƒ¼: %s"
 
-#: ../roundup/admin.py:2220
+#: ../roundup/admin.py:2242
 #, python-format
 msgid "Unknown command \"%(command)s\" (\"help commands\" for a list)"
 msgstr ""
 
-#: ../roundup/admin.py:2226
+#: ../roundup/admin.py:2248
 #, python-format
 msgid "Multiple commands match \"%(command)s\": %(list)s"
 msgstr ""
 
-#: ../roundup/admin.py:2241
+#: ../roundup/admin.py:2263
 msgid "Enter tracker home: "
 msgstr ""
 
-#: ../roundup/admin.py:2270 ../roundup/admin.py:2274
-#: ../roundup/admin.py:2270:2274
+#: ../roundup/admin.py:2292 ../roundup/admin.py:2296
+#: ../roundup/admin.py:2292:2296
 #, python-format
 msgid "Error: Couldn't open tracker: %(message)s"
 msgstr ""
 
-#: ../roundup/admin.py:2322
+#: ../roundup/admin.py:2344
 #, python-format
 msgid ""
 "Roundup %s ready for input.\n"
 "Type \"help\" for help."
 msgstr ""
 
-#: ../roundup/admin.py:2355
+#: ../roundup/admin.py:2377
 msgid "Note: command history and editing not available"
 msgstr ""
 
-#: ../roundup/admin.py:2361
+#: ../roundup/admin.py:2383
 msgid "exit..."
 msgstr ""
 
-#: ../roundup/admin.py:2374
+#: ../roundup/admin.py:2396
 msgid "There are unsaved changes. Commit them (y/N)? "
 msgstr ""
 
@@ -1165,23 +1165,23 @@ msgstr ""
 msgid "Couldn't open database - the required module '%s' is not available"
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:871
-#: ../roundup/backends/back_anydbm.py:884
-#: ../roundup/backends/back_anydbm.py:1158
-#: ../roundup/backends/back_anydbm.py:1193
-#: ../roundup/backends/back_anydbm.py:1422
-#: ../roundup/backends/back_anydbm.py:1440
-#: ../roundup/backends/back_anydbm.py:1487
-#: ../roundup/backends/back_anydbm.py:2123
-#: ../roundup/backends/back_anydbm.py:871:884
+#: ../roundup/backends/back_anydbm.py:873
+#: ../roundup/backends/back_anydbm.py:886
+#: ../roundup/backends/back_anydbm.py:1160
+#: ../roundup/backends/back_anydbm.py:1195
+#: ../roundup/backends/back_anydbm.py:1424
+#: ../roundup/backends/back_anydbm.py:1442
+#: ../roundup/backends/back_anydbm.py:1489
+#: ../roundup/backends/back_anydbm.py:2135
+#: ../roundup/backends/back_anydbm.py:873:886
 #: ../roundup/backends/rdbms_common.py:1720
 #: ../roundup/backends/rdbms_common.py:1967
 #: ../roundup/backends/rdbms_common.py:2206
 #: ../roundup/backends/rdbms_common.py:2226
 #: ../roundup/backends/rdbms_common.py:2279
-#: ../roundup/backends/rdbms_common.py:3246
-#: ../roundup/backends/rdbms_common.py:1720:1967 :1158:1193 :1422:1440:1487
-#: :2123 :2206:2226 :2279:3246
+#: ../roundup/backends/rdbms_common.py:3254
+#: ../roundup/backends/rdbms_common.py:1720:1967 :1160:1195 :1424:1442:1489
+#: :2135 :2206:2226 :2279:3254
 msgid "Database open read-only"
 msgstr ""
 
@@ -1569,13 +1569,13 @@ msgstr ""
 msgid "You do not have permission to login"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1577 ../roundup/cgi/actions.py:1761
-#: ../roundup/cgi/actions.py:1577:1761
+#: ../roundup/cgi/actions.py:1577 ../roundup/cgi/actions.py:1757
+#: ../roundup/cgi/actions.py:1577:1757
 #, python-format
 msgid "Column \"%(column)s\" not found in %(class)s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1832
+#: ../roundup/cgi/actions.py:1822
 #, python-format
 msgid "You do not have permission to view %(class)s"
 msgstr "%(class)s ã‚’è¡¨ç¤ºã™ã‚‹æ¨©é™ãŒã‚ã‚Šã¾ã›ã‚“"
@@ -1653,7 +1653,7 @@ msgstr ""
 msgid "<em>undefined</em>"
 msgstr "<em>æœªå®šç¾©</em>"
 
-#: ../roundup/cgi/client.py:105
+#: ../roundup/cgi/client.py:111
 msgid ""
 "<html><head><title>An error has occurred</title></head>\n"
 "<body><h1>An error has occurred</h1>\n"
@@ -1662,155 +1662,161 @@ msgid ""
 "</body></html>"
 msgstr ""
 
-#: ../roundup/cgi/client.py:717 ../roundup/cgi/client.py:1635
-#: ../roundup/cgi/client.py:717:1635
+#: ../roundup/cgi/client.py:666
+msgid ""
+"XMLRPC endpoint is not using defusedxml. Improve security by installing "
+"defusedxml."
+msgstr ""
+
+#: ../roundup/cgi/client.py:728 ../roundup/cgi/client.py:1646
+#: ../roundup/cgi/client.py:728:1646
 msgid "Required Header Missing"
 msgstr ""
 
-#: ../roundup/cgi/client.py:719
+#: ../roundup/cgi/client.py:731
 #, fuzzy
 msgid "Client is not allowed to use Rest Interface."
 msgstr "ã‚¯ã‚¨ãƒªãƒ¼ç·¨é›†ã®æ¨©é™ãŒã‚ã‚Šã¾ã›ã‚“ã€‚"
 
-#: ../roundup/cgi/client.py:971
+#: ../roundup/cgi/client.py:985
 msgid "Form Error: "
 msgstr ""
 
-#: ../roundup/cgi/client.py:1064
+#: ../roundup/cgi/client.py:1078
 #, python-format
 msgid "Unrecognized charset: %r"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1331 ../roundup/cgi/client.py:2294
-#: ../roundup/cgi/client.py:1331:2294
+#: ../roundup/cgi/client.py:1345 ../roundup/cgi/client.py:2357
+#: ../roundup/cgi/client.py:1345:2357
 msgid "broken form: multiple @action values submitted"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1348
+#: ../roundup/cgi/client.py:1362
 msgid "Anonymous users are not allowed to use the web interface"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1496
+#: ../roundup/cgi/client.py:1507
 msgid "Referer header not available."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1500
+#: ../roundup/cgi/client.py:1511
 #, python-format
 msgid "csrf key used with wrong method from: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1529
+#: ../roundup/cgi/client.py:1540
 #, python-format
 msgid "csrf header %(header)s required but missing for user%(userid)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1533
+#: ../roundup/cgi/client.py:1544
 #, python-format
 msgid "Missing header: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1541
+#: ../roundup/cgi/client.py:1552
 #, python-format
 msgid "csrf Referer header check failed for user%(userid)s. Value=%(referer)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1546
+#: ../roundup/cgi/client.py:1557
 #, fuzzy, python-format
 msgid "Invalid Referer: %s"
 msgstr "ä¸æ­£ãªãƒªã‚¯ã‚¨ã‚¹ãƒˆ"
 
-#: ../roundup/cgi/client.py:1561
+#: ../roundup/cgi/client.py:1572
 #, python-format
 msgid "csrf Origin header check failed for user%(userid)s. Value=%(origin)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1566
+#: ../roundup/cgi/client.py:1577
 #, fuzzy, python-format
 msgid "Invalid Origin %s"
 msgstr "ä¸æ­£ãªãƒªã‚¯ã‚¨ã‚¹ãƒˆ"
 
-#: ../roundup/cgi/client.py:1580
+#: ../roundup/cgi/client.py:1591
 #, python-format
 msgid ""
 "csrf X-FORWARDED-HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1586
+#: ../roundup/cgi/client.py:1597
 #, python-format
 msgid "Invalid X-FORWARDED-HOST %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1605
+#: ../roundup/cgi/client.py:1616
 #, python-format
 msgid "csrf HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1610
+#: ../roundup/cgi/client.py:1621
 #, fuzzy, python-format
 msgid "Invalid HOST %s"
 msgstr "ä¸æ­£ãªãƒªã‚¯ã‚¨ã‚¹ãƒˆ"
 
-#: ../roundup/cgi/client.py:1618
+#: ../roundup/cgi/client.py:1629
 msgid "Csrf: unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1619
+#: ../roundup/cgi/client.py:1630
 msgid "Unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1632
+#: ../roundup/cgi/client.py:1643
 #, python-format
 msgid "csrf X-REQUESTED-WITH xmlrpc required header check failed for user%s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1673
+#: ../roundup/cgi/client.py:1684
 #, python-format
 msgid "Required csrf field missing for user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1675 ../roundup/cgi/client.py:1702
-#: ../roundup/cgi/client.py:1719 ../roundup/cgi/client.py:1675:1702:1719
+#: ../roundup/cgi/client.py:1686 ../roundup/cgi/client.py:1713
+#: ../roundup/cgi/client.py:1730 ../roundup/cgi/client.py:1686:1713:1730
 msgid ""
 "We can't validate your session (csrf failure). Re-enter any unsaved data and "
 "try again."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1679
+#: ../roundup/cgi/client.py:1690
 #, python-format
 msgid "csrf field not supplied by user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1691
+#: ../roundup/cgi/client.py:1702
 #, python-format
 msgid ""
 "Csrf mismatch user: current user %(user)s != stored user %(stored)s, current "
 "session, stored session: %(cur_sess)s,%(stor_sess)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1709
+#: ../roundup/cgi/client.py:1720
 #, python-format
 msgid ""
 "Csrf mismatch user: current session %(curr_sess)s != stored session "
 "%(stor_sess)s, current user/stored user is: %(user)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1901
+#: ../roundup/cgi/client.py:1912
 msgid "You are not allowed to view this file."
 msgstr ""
 
-#: ../roundup/cgi/client.py:2172
+#: ../roundup/cgi/client.py:2235
 #, python-format
 msgid "%(starttag)sTime elapsed: %(seconds)fs%(endtag)s\n"
 msgstr ""
 
-#: ../roundup/cgi/client.py:2176
+#: ../roundup/cgi/client.py:2239
 #, python-format
 msgid ""
 "%(starttag)sCache hits: %(cache_hits)d, misses %(cache_misses)d. Loading "
 "items: %(get_items)f secs. Filtering: %(filtering)f secs.%(endtag)s\n"
 msgstr ""
 
-#: ../roundup/cgi/client.py:2716
+#: ../roundup/cgi/client.py:2778
 #, python-format
 msgid ""
 "Cache failure: compressed file %(compressed)s is older than its source file "
@@ -2211,17 +2217,17 @@ msgstr ""
 msgid "Not a property name: %s"
 msgstr ""
 
-#: ../roundup/hyperdb.py:1984
+#: ../roundup/hyperdb.py:2038
 #, fuzzy, python-format
 msgid "property %(property)s: %(value)r is not a %(classname)s."
 msgstr "ãƒ—ãƒ­ãƒ‘ãƒ†ã‚£ \"%(propname)s\": \"%(value)s\" ãŒãƒªã‚¹ãƒˆã®ä¸­ã«ã‚ã‚Šã¾ã›ã‚“"
 
-#: ../roundup/hyperdb.py:1990
+#: ../roundup/hyperdb.py:2044
 #, python-format
 msgid "you may only enter ID values for property %s"
 msgstr ""
 
-#: ../roundup/hyperdb.py:2025
+#: ../roundup/hyperdb.py:2079
 #, python-format
 msgid "%(property)r is not a property of %(classname)s"
 msgstr ""
@@ -2460,6 +2466,22 @@ msgstr ""
 msgid "not of form [arg=value,value,...;arg=value,value,...]"
 msgstr ""
 
+#: ../roundup/mlink_expr.py:161
+#, python-format
+msgid ""
+"There was an error searching %(class)s by %(attr)s using: %(opcodes)s. The "
+"operator %(opcode)s (%(opcodename)s) at position %(position)d has too few "
+"arguments."
+msgstr ""
+
+#: ../roundup/mlink_expr.py:174
+#, python-format
+msgid ""
+"There was an error searching %(class)s by %(attr)s using: %(opcodes)s. There "
+"are too many arguments for the existing operators. The values on the stack "
+"are: %(stack)s"
+msgstr ""
+
 #: ../roundup/pygettext.py:401
 #, python-format
 msgid "*** %(file)s:%(lineno)s: Seen unexpected token \"%(token)s\""
@@ -2517,42 +2539,63 @@ msgstr ""
 msgid "morethanonestring"
 msgstr ""
 
-#: ../roundup/rest.py:410
+#: ../roundup/rest.py:417
 #, python-format
 msgid "Method %(m)s not allowed. Allowed: %(a)s"
 msgstr ""
 
-#: ../roundup/rest.py:948
+#: ../roundup/rest.py:964
 #, python-format
 msgid ""
 "Page size %(page_size)s must be less than admin limit on query result size: "
 "%(max_size)s."
 msgstr ""
 
-#: ../roundup/rest.py:1193
+#: ../roundup/rest.py:1211
 #, fuzzy, python-format
 msgid "Invalid attribute %s"
 msgstr "ä¸æ­£ãªãƒªã‚¯ã‚¨ã‚¹ãƒˆ"
 
-#: ../roundup/rest.py:2182
+#: ../roundup/rest.py:2199
 #, python-format
 msgid "Api rate limits exceeded. Please wait: %s seconds."
 msgstr ""
 
-#: ../roundup/rest.py:2258
+#: ../roundup/rest.py:2283
 #, python-format
 msgid ""
-"Unable to parse Accept Header. %(error)s. Acceptable types: "
+"Content type '%s' requested in URL is not available.\n"
+"Acceptable types: %s\n"
+msgstr ""
+
+#: ../roundup/rest.py:2304
+#, python-format
+msgid ""
+"Unable to parse Accept Header. %(error)s. Acceptable types: */*, "
 "%(acceptable_types)s"
 msgstr ""
 
-#: ../roundup/rest.py:2441
+#: ../roundup/rest.py:2376 ../roundup/rest.py:2597 ../roundup/rest.py:2376:2597
 #, python-format
 msgid ""
 "Unrecognized api version: %s. See /rest without specifying api version for "
 "supported versions."
 msgstr ""
 
+#: ../roundup/rest.py:2411 ../roundup/rest.py:2420 ../roundup/rest.py:2411:2420
+#, python-format
+msgid ""
+"Requested content type(s) '%s' not available.\n"
+"Acceptable mime types are: */*, %s"
+msgstr ""
+
+#: ../roundup/rest.py:2696
+msgid ""
+"Internal error while formatting response.\n"
+"accept_mime_type is not defined. This should\n"
+"never happen\n"
+msgstr ""
+
 #: ../roundup/roundupdb.py:140
 #, python-format
 msgid "Username '%s' already exists."
@@ -2704,90 +2747,90 @@ msgid ""
 "\"imap\", \"imaps\",  \"imaps_cram\", or \"imaps_oauth\""
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:112
+#: ../roundup/scripts/roundup_server.py:113
 msgid "WARNING: generating temporary SSL certificate"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:143
+#: ../roundup/scripts/roundup_server.py:144
 #, python-format
 msgid "Unable to find/use key from file: %(pemfile)s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:144
+#: ../roundup/scripts/roundup_server.py:145
 msgid ""
 "Does it have a private key surrounded by '-----BEGIN PRIVATE KEY-----' and\n"
 "  '-----END PRIVATE KEY-----' markers?"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:149
+#: ../roundup/scripts/roundup_server.py:150
 #, python-format
 msgid "Unable to find/use certificate from file: %(pemfile)s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:150
+#: ../roundup/scripts/roundup_server.py:151
 msgid ""
 "Does it have a certificate surrounded by '-----BEGIN CERTIFICATE-----' and\n"
 "  '-----END CERTIFICATE-----' markers?"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:344
+#: ../roundup/scripts/roundup_server.py:345
 msgid ""
 "<html><head><title>Roundup trackers index</title></head>\n"
 "<body><h1>Roundup trackers index</h1><ol>\n"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:570
+#: ../roundup/scripts/roundup_server.py:587
 #, python-format
 msgid "Error: %(type)s: %(value)s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:582
+#: ../roundup/scripts/roundup_server.py:599
 msgid "WARNING: ignoring \"-g\" argument, not root"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:588
+#: ../roundup/scripts/roundup_server.py:605
 msgid "Can't change groups - no grp module"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:597
+#: ../roundup/scripts/roundup_server.py:614
 #, python-format
 msgid "Group %(group)s doesn't exist"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:609
+#: ../roundup/scripts/roundup_server.py:626
 msgid "Can't run as root!"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:612
+#: ../roundup/scripts/roundup_server.py:629
 msgid "WARNING: ignoring \"-u\" argument, not root"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:618
+#: ../roundup/scripts/roundup_server.py:635
 msgid "Can't change users - no pwd module"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:627
+#: ../roundup/scripts/roundup_server.py:644
 #, python-format
 msgid "User %(user)s doesn't exist"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:833
+#: ../roundup/scripts/roundup_server.py:856
 #, python-format
 msgid "Multiprocess mode \"%s\" is not available, switching to single-process"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:861
+#: ../roundup/scripts/roundup_server.py:884
 #, python-format
 msgid "Unable to bind to port %s, port already in use."
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:865
+#: ../roundup/scripts/roundup_server.py:888
 #, python-format
 msgid ""
 "Unable to bind to port %(port)s, access not allowed, errno: %(errno)s %(msg)s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:944
+#: ../roundup/scripts/roundup_server.py:967
 msgid ""
 " -c <Command>  Windows Service options.\n"
 "               If you want to run the server as a Windows Service, you\n"
@@ -2797,16 +2840,17 @@ msgid ""
 "               specifics."
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:951
+#: ../roundup/scripts/roundup_server.py:974
 msgid ""
 " -u <UID>      runs the Roundup web server as this UID\n"
 " -g <GID>      runs the Roundup web server as this GID\n"
 " -d <PIDfile>  run the server in the background and write the server's PID\n"
 "               to the file indicated by PIDfile. The -l option *must* be\n"
-"               specified if -d is used."
+"               specified if -d is used.\n"
+" -D            run the server in the foreground even when -d is used."
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:958
+#: ../roundup/scripts/roundup_server.py:982
 #, python-format
 msgid ""
 "\n"
@@ -2831,6 +2875,10 @@ msgid ""
 "mode\n"
 " -s            enable SSL\n"
 " -L            http request logging uses python logging (roundup.http)\n"
+" -P            log client address/name using reverse proxy X-Forwarded-For\n"
+"               header and not the connection IP (which is the reverse "
+"proxy).\n"
+"               Appends a '+' sign to the logged address/name.\n"
 " -e <fname>    PEM file containing SSL key and certificate\n"
 " -t <mode>     multiprocess mode (default: %(mp_def)s).\n"
 "               Allowed values: %(mp_types)s.\n"
@@ -2875,20 +2923,20 @@ msgid ""
 "   any url-unsafe characters like spaces, as these confuse IE.\n"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:1135
+#: ../roundup/scripts/roundup_server.py:1162
 msgid "Instances must be name=home"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:1149
+#: ../roundup/scripts/roundup_server.py:1176
 #, python-format
 msgid "Configuration saved to %s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:1167
+#: ../roundup/scripts/roundup_server.py:1194
 msgid "Sorry, you can't run the server as a daemon on this Operating System"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:1187
+#: ../roundup/scripts/roundup_server.py:1214
 #, python-format
 msgid "Roundup server started on %(HOST)s:%(PORT)s"
 msgstr ""
diff --git a/locale/lt.po b/locale/lt.po
index 67a725a44..fee99e9bf 100644
--- a/locale/lt.po
+++ b/locale/lt.po
@@ -5,9 +5,9 @@
 #
 msgid ""
 msgstr ""
-"Project-Id-Version: Roundup 2.4.0\n"
+"Project-Id-Version: Roundup 2.5.0\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
-"POT-Creation-Date: 2024-08-07 21:43-0400\n"
+"POT-Creation-Date: 2024-12-30 22:49-0500\n"
 "PO-Revision-Date: 2013-10-31 12:21+0100\n"
 "Last-Translator: Nerijus Baliunas <nerijus@users.sourceforge.net>\n"
 "Language-Team: \n"
@@ -84,8 +84,8 @@ msgid "Enable verbose output: tracing, descriptions...\n"
 msgstr ""
 
 # ../roundup/admin.py:85 :962 :1011 :1033
-#: ../roundup/admin.py:175 ../roundup/admin.py:1188 ../roundup/admin.py:1836
-#: ../roundup/admin.py:1868 ../roundup/admin.py:175:1188 :1836:1868
+#: ../roundup/admin.py:175 ../roundup/admin.py:1188 ../roundup/admin.py:1858
+#: ../roundup/admin.py:1890 ../roundup/admin.py:175:1188 :1858:1890
 #, python-format
 msgid "no such class \"%(classname)s\""
 msgstr "nÄ—ra klasÄ—s \"%(classname)s\""
@@ -312,14 +312,14 @@ msgid "%s:"
 msgstr "%s:"
 
 # ../roundup/admin.py:338 :387
-#: ../roundup/admin.py:439 ../roundup/admin.py:1396
-#: ../roundup/admin.py:439:1396
+#: ../roundup/admin.py:439 ../roundup/admin.py:1415
+#: ../roundup/admin.py:439:1415
 msgid "Templates:"
 msgstr "Å ablonai:"
 
 # ../roundup/admin.py:341 :398
-#: ../roundup/admin.py:442 ../roundup/admin.py:1406
-#: ../roundup/admin.py:442:1406
+#: ../roundup/admin.py:442 ../roundup/admin.py:1425
+#: ../roundup/admin.py:442:1425
 msgid "Back ends:"
 msgstr "DuomenÅ³ saugyklos:"
 
@@ -373,11 +373,11 @@ msgstr ""
 #: ../roundup/admin.py:482 ../roundup/admin.py:555 ../roundup/admin.py:606
 #: ../roundup/admin.py:733 ../roundup/admin.py:806 ../roundup/admin.py:851
 #: ../roundup/admin.py:902 ../roundup/admin.py:999 ../roundup/admin.py:1216
-#: ../roundup/admin.py:1369 ../roundup/admin.py:1497 ../roundup/admin.py:1580
-#: ../roundup/admin.py:1703 ../roundup/admin.py:1826 ../roundup/admin.py:1858
-#: ../roundup/admin.py:1974 ../roundup/admin.py:2028 ../roundup/admin.py:2076
-#: ../roundup/admin.py:482:555 :1216:1369:1497 :1580:1703 :1826:1858 :1974:2028
-#: :2076 :606:733 :806:851 :902:999
+#: ../roundup/admin.py:1388 ../roundup/admin.py:1516 ../roundup/admin.py:1599
+#: ../roundup/admin.py:1725 ../roundup/admin.py:1848 ../roundup/admin.py:1880
+#: ../roundup/admin.py:1996 ../roundup/admin.py:2050 ../roundup/admin.py:2098
+#: ../roundup/admin.py:482:555 :1216:1388:1516 :1599:1725 :1848:1880 :1996:2050
+#: :2098 :606:733 :806:851 :902:999
 msgid "Not enough arguments supplied"
 msgstr "Paduota nepakankamai argumentÅ³"
 
@@ -525,9 +525,9 @@ msgid "Class %(curclassname)s has no property %(pn)s in %(propname)s."
 msgstr "%(classname)s neturi parinkties \"%(propname)s\""
 
 # ../roundup/admin.py:682 :835 :847 :901
-#: ../roundup/admin.py:791 ../roundup/admin.py:840 ../roundup/admin.py:1517
-#: ../roundup/admin.py:1530 ../roundup/admin.py:2098
-#: ../roundup/admin.py:791:840 :1517:1530:2098
+#: ../roundup/admin.py:791 ../roundup/admin.py:840 ../roundup/admin.py:1536
+#: ../roundup/admin.py:1549 ../roundup/admin.py:2120
+#: ../roundup/admin.py:791:840 :1536:1549:2120
 #, python-format
 msgid "%(classname)s has no property \"%(propname)s\""
 msgstr "%(classname)s neturi parinkties \"%(propname)s\""
@@ -612,8 +612,8 @@ msgstr ""
 "-d netinkamas."
 
 # ../roundup/admin.py:564 :964 :1013 :1035
-#: ../roundup/admin.py:942 ../roundup/admin.py:1190 ../roundup/admin.py:1842
-#: ../roundup/admin.py:1870 ../roundup/admin.py:942:1190 :1842:1870
+#: ../roundup/admin.py:942 ../roundup/admin.py:1190 ../roundup/admin.py:1864
+#: ../roundup/admin.py:1892 ../roundup/admin.py:942:1190 :1864:1892
 #, python-format
 msgid "no such %(classname)s node \"%(nodeid)s\""
 msgstr "nÄ—ra tokio %(classname)s elemento \"%(nodeid)s\""
@@ -768,7 +768,7 @@ msgstr ""
 "            veiksmas).\n"
 "        "
 
-#: ../roundup/admin.py:1287
+#: ../roundup/admin.py:1306
 msgid ""
 "Usage: importtables export_dir\n"
 "        This imports the database tables exported using exporttables.\n"
@@ -778,7 +778,7 @@ msgid ""
 msgstr ""
 
 #. password
-#: ../roundup/admin.py:1295
+#: ../roundup/admin.py:1314
 msgid ""
 "Usage: initialise [adminpw]\n"
 "        Initialise a new Roundup tracker.\n"
@@ -796,23 +796,23 @@ msgstr ""
 "            Vykdyti tracker'io inicializacijos funkcijÄ… dbinit.init()\n"
 "        "
 
-#: ../roundup/admin.py:1309
+#: ../roundup/admin.py:1328
 msgid "Admin Password: "
 msgstr "Administratoriaus slaptaÅ¾odis: "
 
-#: ../roundup/admin.py:1310
+#: ../roundup/admin.py:1329
 msgid "       Confirm: "
 msgstr "       Patvirtinkite: "
 
-#: ../roundup/admin.py:1314
+#: ../roundup/admin.py:1333
 msgid "Instance home does not exist"
 msgstr "NamÅ³ direktorija neegzistuoja"
 
-#: ../roundup/admin.py:1318
+#: ../roundup/admin.py:1337
 msgid "Instance has not been installed"
 msgstr "Egzempliorius nebuvo Ä¯diegtas"
 
-#: ../roundup/admin.py:1326
+#: ../roundup/admin.py:1345
 msgid ""
 "WARNING: The database is already initialised!\n"
 "If you re-initialise it, you will lose all the data!\n"
@@ -822,7 +822,7 @@ msgstr ""
 "Jei jÅ«s jÄ… inicializuosite dar kartÄ…, prarasite visus duomenis!\n"
 "IÅ¡trinti duomenÅ³ bazÄ™? Y/N: "
 
-#: ../roundup/admin.py:1346
+#: ../roundup/admin.py:1365
 msgid ""
 "Usage: install [template [backend [key=val[,key=val]]]]\n"
 "        Install a new Roundup tracker.\n"
@@ -870,12 +870,12 @@ msgstr ""
 "        Taip pat paÅ¾iÅ«rÄ—kite initopts pagalbÄ….\n"
 "        "
 
-#: ../roundup/admin.py:1375
+#: ../roundup/admin.py:1394
 #, python-format
 msgid "Instance home parent directory \"%(parent)s\" does not exist"
 msgstr "NamÅ³ direktorijos tÄ—vinÄ— direktorija \"%(parent)s\" neegzistuoja"
 
-#: ../roundup/admin.py:1384
+#: ../roundup/admin.py:1403
 #, python-format
 msgid ""
 "WARNING: There appears to be a tracker in \"%(tracker_home)s\"!\n"
@@ -886,22 +886,22 @@ msgstr ""
 "Jei jÅ«s jÄ¯ perdiegsite, prarasite visus duomenis!\n"
 "IÅ¡trinti jÄ¯? Y/N: "
 
-#: ../roundup/admin.py:1397
+#: ../roundup/admin.py:1416
 #, fuzzy
 msgid "Select template"
 msgstr "Pasirinkite Å¡ablonÄ… [klasikinis]: "
 
-#: ../roundup/admin.py:1407
+#: ../roundup/admin.py:1426
 #, fuzzy
 msgid "Select backend"
 msgstr "Pasirinkite duomenÅ³ saugyklÄ… [anydbm]: "
 
-#: ../roundup/admin.py:1418
+#: ../roundup/admin.py:1437
 #, python-format
 msgid "Error in configuration settings: \"%s\""
 msgstr "Klaida konfigÅ«racijos nustatymuose: \"%s\""
 
-#: ../roundup/admin.py:1451
+#: ../roundup/admin.py:1470
 #, python-format
 msgid ""
 "\n"
@@ -914,11 +914,11 @@ msgstr ""
 " Dabar jÅ«s turÄ—tumÄ—te pakeisti tracker'io konfigÅ«racijos failÄ…:\n"
 "   %(config_file)s"
 
-#: ../roundup/admin.py:1461
+#: ../roundup/admin.py:1480
 msgid " ... at a minimum, you must set following options:"
 msgstr " ... maÅ¾iausiai turÄ—tumÄ—te nustalyti Å¡ias parinktis:"
 
-#: ../roundup/admin.py:1466
+#: ../roundup/admin.py:1485
 #, python-format
 msgid ""
 "\n"
@@ -947,7 +947,7 @@ msgstr ""
 " aukÅ¡Äiau minÄ—tus Å¾ingsnius.\n"
 "---------------------------------------------------------------------------\n"
 
-#: ../roundup/admin.py:1482
+#: ../roundup/admin.py:1501
 msgid ""
 "Usage: list classname [property]\n"
 "        List the instances of a class.\n"
@@ -975,17 +975,17 @@ msgstr ""
 "            parinkties sÄ…raÅ¡as kiekvienam klasÄ—s egzemplioriui.\n"
 "        "
 
-#: ../roundup/admin.py:1495
+#: ../roundup/admin.py:1514
 msgid "Too many arguments supplied"
 msgstr "Pateikta per daug argumentÅ³"
 
-#: ../roundup/admin.py:1528
+#: ../roundup/admin.py:1547
 #, python-format
 msgid "%(nodeid)4s: %(value)s"
 msgstr "%(nodeid)4s: %(value)s"
 
 #. noqa: ARG002  - args unused
-#: ../roundup/admin.py:1535
+#: ../roundup/admin.py:1554
 msgid ""
 "Usage: migrate\n"
 "        Update a tracker's database to be compatible with the Roundup\n"
@@ -1008,17 +1008,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1555
+#: ../roundup/admin.py:1574
 #, python-format
 msgid "Tracker updated to schema version %s."
 msgstr ""
 
-#: ../roundup/admin.py:1559
+#: ../roundup/admin.py:1578
 #, python-format
 msgid "No migration action required. At schema version %s."
 msgstr ""
 
-#: ../roundup/admin.py:1564
+#: ../roundup/admin.py:1583
 #, fuzzy
 msgid ""
 "Usage: pack period | date\n"
@@ -1056,11 +1056,11 @@ msgstr ""
 "\n"
 "        "
 
-#: ../roundup/admin.py:1590
+#: ../roundup/admin.py:1609
 msgid "Invalid format"
 msgstr "Netinkamas formatas"
 
-#: ../roundup/admin.py:1601
+#: ../roundup/admin.py:1620
 msgid ""
 "Usage: perftest [mode] [arguments]*\n"
 "        Time operations in Roundup.\n"
@@ -1078,25 +1078,25 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1635
+#: ../roundup/admin.py:1657
 msgid "Invalid 'rounds'. Must be larger than 999."
 msgstr ""
 
-#: ../roundup/admin.py:1639
+#: ../roundup/admin.py:1661
 #, python-format
 msgid "Invalid 'rounds'. It must be an integer not: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1666
+#: ../roundup/admin.py:1688
 msgid "scheme does not support rounds."
 msgstr ""
 
-#: ../roundup/admin.py:1669
+#: ../roundup/admin.py:1691
 #, python-format
 msgid "Hash time: %(time)0.9f seconds, scheme: %(scheme)s, rounds: %(rounds)s"
 msgstr ""
 
-#: ../roundup/admin.py:1675
+#: ../roundup/admin.py:1697
 msgid ""
 "Usage: pragma setting=value | 'list'\n"
 "        Set internal admin settings to a value.\n"
@@ -1125,49 +1125,49 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1710
+#: ../roundup/admin.py:1732
 #, python-format
 msgid "Argument must be setting=value, was given: %s."
 msgstr ""
 
-#: ../roundup/admin.py:1713
+#: ../roundup/admin.py:1735
 msgid "Current settings and values (NYI - not yet implemented):"
 msgstr ""
 
-#: ../roundup/admin.py:1724
+#: ../roundup/admin.py:1746
 msgid ""
 "      Help for this pragma is missing. Please report it to the Roundup "
 "project.\n"
 msgstr ""
 
-#: ../roundup/admin.py:1730
+#: ../roundup/admin.py:1752
 #, fuzzy, python-format
 msgid "Unknown setting %s. Try \"pragma list\"."
 msgstr "NeÅ¾inomas vartotojo vardas"
 
-#: ../roundup/admin.py:1740
+#: ../roundup/admin.py:1762
 #, python-format
 msgid "Incorrect value for boolean setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1747
+#: ../roundup/admin.py:1769
 #, python-format
 msgid "Incorrect value for integer setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1754
+#: ../roundup/admin.py:1776
 #, python-format
 msgid ""
 "Incorrect value for setting %(setting)s: %(value)s. Should be no, both, or "
 "only."
 msgstr ""
 
-#: ../roundup/admin.py:1764
+#: ../roundup/admin.py:1786
 #, python-format
 msgid "Internal error: pragma can not handle values of type: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1773
+#: ../roundup/admin.py:1795
 #, fuzzy
 msgid ""
 "Usage: reindex [classname|classname:#-#|designator]*\n"
@@ -1191,17 +1191,17 @@ msgstr ""
 "            Paprastai tai Ä¯vyksta automatiÅ¡kai.\n"
 "        "
 
-#: ../roundup/admin.py:1795
+#: ../roundup/admin.py:1817
 #, python-format
 msgid "no such item \"%(designator)s\""
 msgstr "nÄ—ra elemento \"%(designator)s\""
 
-#: ../roundup/admin.py:1805
+#: ../roundup/admin.py:1827
 #, fuzzy, python-format
 msgid "no such item \"%(class)s%(id)s\""
 msgstr "nÄ—ra elemento \"%(designator)s\""
 
-#: ../roundup/admin.py:1817
+#: ../roundup/admin.py:1839
 #, fuzzy
 msgid ""
 "Usage: restore designator[,designator]*\n"
@@ -1219,7 +1219,7 @@ msgstr ""
 "            Duotas elementas vÄ—l taps prieinamas vartotojams.\n"
 "        "
 
-#: ../roundup/admin.py:1848
+#: ../roundup/admin.py:1870
 #, fuzzy
 msgid ""
 "Usage: retire designator[,designator]*\n"
@@ -1241,7 +1241,7 @@ msgstr ""
 "        "
 
 #. noqa: ARG002 - args unused
-#: ../roundup/admin.py:1876
+#: ../roundup/admin.py:1898
 msgid ""
 "Usage: rollback\n"
 "        Undo all changes that are pending commit to the database.\n"
@@ -1263,7 +1263,7 @@ msgstr ""
 "             nepadarys jokiÅ³ pakeitimÅ³ duomenÅ³ bazÄ—je.\n"
 "        "
 
-#: ../roundup/admin.py:1889
+#: ../roundup/admin.py:1911
 msgid ""
 "Usage: security [Role name]\n"
 "        Display the Permissions available to one or all Roles.\n"
@@ -1276,47 +1276,47 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1904
+#: ../roundup/admin.py:1926
 #, fuzzy, python-format
 msgid "No such Role \"%(role)s\"\n"
 msgstr "NÄ—ra tokios rolÄ—s \"%(role)s\""
 
-#: ../roundup/admin.py:1910
+#: ../roundup/admin.py:1932
 #, fuzzy, python-format
 msgid "New Web users get the Roles \"%(role)s\"\n"
 msgstr "Naujiems web vartotojams suteikiamos rolÄ—s \"%(role)s\""
 
-#: ../roundup/admin.py:1913
+#: ../roundup/admin.py:1935
 #, fuzzy, python-format
 msgid "New Web users get the Role \"%(role)s\"\n"
 msgstr "Naujiems web vartotojams suteikiama rolÄ— \"%(role)s\""
 
-#: ../roundup/admin.py:1917
+#: ../roundup/admin.py:1939
 #, fuzzy, python-format
 msgid "New Email users get the Roles \"%(role)s\"\n"
 msgstr "Naujiems vartotojams per el. paÅ¡tÄ… suteikiamos rolÄ—s \"%(role)s\""
 
-#: ../roundup/admin.py:1919
+#: ../roundup/admin.py:1941
 #, fuzzy, python-format
 msgid "New Email users get the Role \"%(role)s\"\n"
 msgstr "Naujiems vartotojams per el. paÅ¡tÄ… suteikiama rolÄ— \"%(role)s\""
 
-#: ../roundup/admin.py:1922
+#: ../roundup/admin.py:1944
 #, fuzzy, python-format
 msgid "Role \"%(name)s\":\n"
 msgstr "RolÄ— \"%(name)s\":"
 
-#: ../roundup/admin.py:1928
+#: ../roundup/admin.py:1950
 #, fuzzy
 msgid " %(description)s (%(name)s for \"%(klass)s\""
 msgstr " %(description)s (%(name)s skirta tik \"%(klass)s\")"
 
-#: ../roundup/admin.py:1928
+#: ../roundup/admin.py:1950
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\": %(properties)s only)\n"
 msgstr " %(description)s (%(name)s skirta tik \"%(klass)s\": %(properties)s)"
 
-#: ../roundup/admin.py:1941
+#: ../roundup/admin.py:1963
 #, python-format
 msgid ""
 "\n"
@@ -1324,17 +1324,17 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/admin.py:1947
+#: ../roundup/admin.py:1969
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\" only)\n"
 msgstr " %(description)s (%(name)s skirta tik \"%(klass)s\")"
 
-#: ../roundup/admin.py:1950
+#: ../roundup/admin.py:1972
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s)\n"
 msgstr " %(description)s (%(name)s)"
 
-#: ../roundup/admin.py:1954
+#: ../roundup/admin.py:1976
 #, fuzzy
 msgid ""
 "Usage: set items property=value [property=value ...]\n"
@@ -1369,7 +1369,7 @@ msgstr ""
 "            reikÅ¡mÄ—s (t.y. \"1,2,3\").\n"
 "        "
 
-#: ../roundup/admin.py:2022
+#: ../roundup/admin.py:2044
 msgid ""
 "Usage: specification classname\n"
 "        Show the properties for a classname.\n"
@@ -1383,17 +1383,17 @@ msgstr ""
 "            Å i komanda iÅ¡vardina duotos klasÄ—s parinktis.\n"
 "        "
 
-#: ../roundup/admin.py:2041
+#: ../roundup/admin.py:2063
 #, fuzzy, python-format
 msgid "%(key)s: %(value)s (key property)\n"
 msgstr "%(key)s: %(value)s (key property)"
 
-#: ../roundup/admin.py:2044
+#: ../roundup/admin.py:2066
 #, fuzzy, python-format
 msgid "%(key)s: %(value)s\n"
 msgstr "%(key)s: %(value)s"
 
-#: ../roundup/admin.py:2047
+#: ../roundup/admin.py:2069
 msgid ""
 "Usage: table classname [property[,property]*]\n"
 "        List the instances of a class in tabular form.\n"
@@ -1455,17 +1455,17 @@ msgstr ""
 "            pateiks 4 simboliÅ³ ilgio \"Name\" stulpelÄ¯.\n"
 "        "
 
-#: ../roundup/admin.py:2093
+#: ../roundup/admin.py:2115
 #, python-format
 msgid "\"%(spec)s\" not name:width"
 msgstr "\"%(spec)s\" ne vardas:plotis"
 
-#: ../roundup/admin.py:2115
+#: ../roundup/admin.py:2137
 #, python-format
 msgid "\"%(spec)s\" does not have an integer width: \"%(width)s\""
 msgstr ""
 
-#: ../roundup/admin.py:2151
+#: ../roundup/admin.py:2173
 msgid ""
 "Usage: templates [trace_search]\n"
 "        List templates and their installed directories.\n"
@@ -1475,7 +1475,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2179
+#: ../roundup/admin.py:2201
 #, fuzzy
 msgid ""
 "Usage: updateconfig <filename>\n"
@@ -1491,36 +1491,36 @@ msgstr ""
 "        "
 
 # ../roundup/cgi/actions.py:579 :590 :761 :780
-#: ../roundup/admin.py:2188 ../roundup/cgi/actions.py:886
+#: ../roundup/admin.py:2210 ../roundup/cgi/actions.py:886
 #: ../roundup/cgi/actions.py:897 ../roundup/cgi/actions.py:1099
 #: ../roundup/cgi/actions.py:1113 ../roundup/cgi/actions.py:886:897 :1099:1113
 #, python-format
 msgid "Error: %s"
 msgstr "Klaida: %s"
 
-#: ../roundup/admin.py:2220
+#: ../roundup/admin.py:2242
 #, python-format
 msgid "Unknown command \"%(command)s\" (\"help commands\" for a list)"
 msgstr ""
 "NeÅ¾inoma komanda \"%(command)s\" (Ä¯veskite \"help commands\" komandÅ³\n"
 "sÄ…raÅ¡ui gauti)"
 
-#: ../roundup/admin.py:2226
+#: ../roundup/admin.py:2248
 #, python-format
 msgid "Multiple commands match \"%(command)s\": %(list)s"
 msgstr "Kelios komandos atitinka \"%(command)s\": %(list)s"
 
-#: ../roundup/admin.py:2241
+#: ../roundup/admin.py:2263
 msgid "Enter tracker home: "
 msgstr "Ä®veskite tracker'io namÅ³ direktorijÄ…: "
 
-#: ../roundup/admin.py:2270 ../roundup/admin.py:2274
-#: ../roundup/admin.py:2270:2274
+#: ../roundup/admin.py:2292 ../roundup/admin.py:2296
+#: ../roundup/admin.py:2292:2296
 #, python-format
 msgid "Error: Couldn't open tracker: %(message)s"
 msgstr "Klaida: Negaliu atidaryti tracker'io: %(message)s"
 
-#: ../roundup/admin.py:2322
+#: ../roundup/admin.py:2344
 #, python-format
 msgid ""
 "Roundup %s ready for input.\n"
@@ -1529,15 +1529,15 @@ msgstr ""
 "Roundup %s pasiruoÅ¡Ä™s priimti duomenis.\n"
 "NorÄ—dami iÅ¡kviesti pagalbÄ… Ä¯veskite \"help\"."
 
-#: ../roundup/admin.py:2355
+#: ../roundup/admin.py:2377
 msgid "Note: command history and editing not available"
 msgstr "Pastaba: komandÅ³ archyvas ir redagavimas neprieinami"
 
-#: ../roundup/admin.py:2361
+#: ../roundup/admin.py:2383
 msgid "exit..."
 msgstr "iÅ¡eiti..."
 
-#: ../roundup/admin.py:2374
+#: ../roundup/admin.py:2396
 msgid "There are unsaved changes. Commit them (y/N)? "
 msgstr "Yra neiÅ¡saugotÅ³ pakeitimÅ³. IÅ¡saugoti juos (y/N)? "
 
@@ -1564,23 +1564,23 @@ msgstr ""
 msgid "Couldn't open database - the required module '%s' is not available"
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:871
-#: ../roundup/backends/back_anydbm.py:884
-#: ../roundup/backends/back_anydbm.py:1158
-#: ../roundup/backends/back_anydbm.py:1193
-#: ../roundup/backends/back_anydbm.py:1422
-#: ../roundup/backends/back_anydbm.py:1440
-#: ../roundup/backends/back_anydbm.py:1487
-#: ../roundup/backends/back_anydbm.py:2123
-#: ../roundup/backends/back_anydbm.py:871:884
+#: ../roundup/backends/back_anydbm.py:873
+#: ../roundup/backends/back_anydbm.py:886
+#: ../roundup/backends/back_anydbm.py:1160
+#: ../roundup/backends/back_anydbm.py:1195
+#: ../roundup/backends/back_anydbm.py:1424
+#: ../roundup/backends/back_anydbm.py:1442
+#: ../roundup/backends/back_anydbm.py:1489
+#: ../roundup/backends/back_anydbm.py:2135
+#: ../roundup/backends/back_anydbm.py:873:886
 #: ../roundup/backends/rdbms_common.py:1720
 #: ../roundup/backends/rdbms_common.py:1967
 #: ../roundup/backends/rdbms_common.py:2206
 #: ../roundup/backends/rdbms_common.py:2226
 #: ../roundup/backends/rdbms_common.py:2279
-#: ../roundup/backends/rdbms_common.py:3246
-#: ../roundup/backends/rdbms_common.py:1720:1967 :1158:1193 :1422:1440:1487
-#: :2123 :2206:2226 :2279:3246
+#: ../roundup/backends/rdbms_common.py:3254
+#: ../roundup/backends/rdbms_common.py:1720:1967 :1160:1195 :1424:1442:1489
+#: :2135 :2206:2226 :2279:3254
 msgid "Database open read-only"
 msgstr ""
 
@@ -1977,13 +1977,13 @@ msgstr "Neteisingas vartotojo vardas ar slaptaÅ¾odis"
 msgid "You do not have permission to login"
 msgstr "Neturite prisijungimo teisiÅ³"
 
-#: ../roundup/cgi/actions.py:1577 ../roundup/cgi/actions.py:1761
-#: ../roundup/cgi/actions.py:1577:1761
+#: ../roundup/cgi/actions.py:1577 ../roundup/cgi/actions.py:1757
+#: ../roundup/cgi/actions.py:1577:1757
 #, python-format
 msgid "Column \"%(column)s\" not found in %(class)s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1832
+#: ../roundup/cgi/actions.py:1822
 #, fuzzy, python-format
 msgid "You do not have permission to view %(class)s"
 msgstr "Neturite leidimo redaguoti %(class)s"
@@ -2074,7 +2074,7 @@ msgstr "<strong>%s</strong> viduje"
 msgid "<em>undefined</em>"
 msgstr "<em>neapibrÄ—Å¾ta</em>"
 
-#: ../roundup/cgi/client.py:105
+#: ../roundup/cgi/client.py:111
 msgid ""
 "<html><head><title>An error has occurred</title></head>\n"
 "<body><h1>An error has occurred</h1>\n"
@@ -2088,150 +2088,156 @@ msgstr ""
 "Apie klaidÄ… praneÅ¡Ä—me tracker'io administratoriui.</p>\n"
 "</body></html>"
 
-#: ../roundup/cgi/client.py:717 ../roundup/cgi/client.py:1635
-#: ../roundup/cgi/client.py:717:1635
+#: ../roundup/cgi/client.py:666
+msgid ""
+"XMLRPC endpoint is not using defusedxml. Improve security by installing "
+"defusedxml."
+msgstr ""
+
+#: ../roundup/cgi/client.py:728 ../roundup/cgi/client.py:1646
+#: ../roundup/cgi/client.py:728:1646
 msgid "Required Header Missing"
 msgstr ""
 
-#: ../roundup/cgi/client.py:719
+#: ../roundup/cgi/client.py:731
 #, fuzzy
 msgid "Client is not allowed to use Rest Interface."
 msgstr "Anoniminiai vartotojai neturi teisiÅ³ naudoti web interfeisÄ…"
 
-#: ../roundup/cgi/client.py:971
+#: ../roundup/cgi/client.py:985
 msgid "Form Error: "
 msgstr "Formos klaida: "
 
-#: ../roundup/cgi/client.py:1064
+#: ../roundup/cgi/client.py:1078
 #, python-format
 msgid "Unrecognized charset: %r"
 msgstr "NeatpaÅ¾inta koduotÄ—: %r"
 
-#: ../roundup/cgi/client.py:1331 ../roundup/cgi/client.py:2294
-#: ../roundup/cgi/client.py:1331:2294
+#: ../roundup/cgi/client.py:1345 ../roundup/cgi/client.py:2357
+#: ../roundup/cgi/client.py:1345:2357
 msgid "broken form: multiple @action values submitted"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1348
+#: ../roundup/cgi/client.py:1362
 msgid "Anonymous users are not allowed to use the web interface"
 msgstr "Anoniminiai vartotojai neturi teisiÅ³ naudoti web interfeisÄ…"
 
-#: ../roundup/cgi/client.py:1496
+#: ../roundup/cgi/client.py:1507
 msgid "Referer header not available."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1500
+#: ../roundup/cgi/client.py:1511
 #, python-format
 msgid "csrf key used with wrong method from: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1529
+#: ../roundup/cgi/client.py:1540
 #, python-format
 msgid "csrf header %(header)s required but missing for user%(userid)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1533
+#: ../roundup/cgi/client.py:1544
 #, python-format
 msgid "Missing header: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1541
+#: ../roundup/cgi/client.py:1552
 #, python-format
 msgid "csrf Referer header check failed for user%(userid)s. Value=%(referer)s"
 msgstr ""
 
 # ../roundup/cgi/actions.py:897 :901
-#: ../roundup/cgi/client.py:1546
+#: ../roundup/cgi/client.py:1557
 #, fuzzy, python-format
 msgid "Invalid Referer: %s"
 msgstr "Neteisingas vartotojo vardas ar slaptaÅ¾odis"
 
-#: ../roundup/cgi/client.py:1561
+#: ../roundup/cgi/client.py:1572
 #, python-format
 msgid "csrf Origin header check failed for user%(userid)s. Value=%(origin)s"
 msgstr ""
 
 # ../roundup/cgi/actions.py:897 :901
-#: ../roundup/cgi/client.py:1566
+#: ../roundup/cgi/client.py:1577
 #, fuzzy, python-format
 msgid "Invalid Origin %s"
 msgstr "Neteisingas vartotojo vardas ar slaptaÅ¾odis"
 
-#: ../roundup/cgi/client.py:1580
+#: ../roundup/cgi/client.py:1591
 #, python-format
 msgid ""
 "csrf X-FORWARDED-HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1586
+#: ../roundup/cgi/client.py:1597
 #, python-format
 msgid "Invalid X-FORWARDED-HOST %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1605
+#: ../roundup/cgi/client.py:1616
 #, python-format
 msgid "csrf HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1610
+#: ../roundup/cgi/client.py:1621
 #, python-format
 msgid "Invalid HOST %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1618
+#: ../roundup/cgi/client.py:1629
 msgid "Csrf: unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1619
+#: ../roundup/cgi/client.py:1630
 msgid "Unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1632
+#: ../roundup/cgi/client.py:1643
 #, python-format
 msgid "csrf X-REQUESTED-WITH xmlrpc required header check failed for user%s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1673
+#: ../roundup/cgi/client.py:1684
 #, python-format
 msgid "Required csrf field missing for user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1675 ../roundup/cgi/client.py:1702
-#: ../roundup/cgi/client.py:1719 ../roundup/cgi/client.py:1675:1702:1719
+#: ../roundup/cgi/client.py:1686 ../roundup/cgi/client.py:1713
+#: ../roundup/cgi/client.py:1730 ../roundup/cgi/client.py:1686:1713:1730
 msgid ""
 "We can't validate your session (csrf failure). Re-enter any unsaved data and "
 "try again."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1679
+#: ../roundup/cgi/client.py:1690
 #, python-format
 msgid "csrf field not supplied by user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1691
+#: ../roundup/cgi/client.py:1702
 #, python-format
 msgid ""
 "Csrf mismatch user: current user %(user)s != stored user %(stored)s, current "
 "session, stored session: %(cur_sess)s,%(stor_sess)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1709
+#: ../roundup/cgi/client.py:1720
 #, python-format
 msgid ""
 "Csrf mismatch user: current session %(curr_sess)s != stored session "
 "%(stor_sess)s, current user/stored user is: %(user)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1901
+#: ../roundup/cgi/client.py:1912
 msgid "You are not allowed to view this file."
 msgstr "JÅ«s neturite teisiÅ³ Å¾iÅ«rÄ—ti Å¡Ä¯ failÄ…."
 
-#: ../roundup/cgi/client.py:2172
+#: ../roundup/cgi/client.py:2235
 #, python-format
 msgid "%(starttag)sTime elapsed: %(seconds)fs%(endtag)s\n"
 msgstr "%(starttag)sPraÄ—jÄ™s laikas: %(seconds)fs%(endtag)s\n"
 
-#: ../roundup/cgi/client.py:2176
+#: ../roundup/cgi/client.py:2239
 #, python-format
 msgid ""
 "%(starttag)sCache hits: %(cache_hits)d, misses %(cache_misses)d. Loading "
@@ -2241,7 +2247,7 @@ msgstr ""
 "%(cache_misses)d. Ä®keliami elementai: %(get_items)f sek. Filtruojama: "
 "%(filtering)f sek.%(endtag)s\n"
 
-#: ../roundup/cgi/client.py:2716
+#: ../roundup/cgi/client.py:2778
 #, python-format
 msgid ""
 "Cache failure: compressed file %(compressed)s is older than its source file "
@@ -2664,17 +2670,17 @@ msgstr ""
 msgid "Not a property name: %s"
 msgstr ""
 
-#: ../roundup/hyperdb.py:1984
+#: ../roundup/hyperdb.py:2038
 #, fuzzy, python-format
 msgid "property %(property)s: %(value)r is not a %(classname)s."
 msgstr "parinkties \"%(propname)s\": \"%(value)s\" nÄ—ra sÄ…raÅ¡e"
 
-#: ../roundup/hyperdb.py:1990
+#: ../roundup/hyperdb.py:2044
 #, python-format
 msgid "you may only enter ID values for property %s"
 msgstr ""
 
-#: ../roundup/hyperdb.py:2025
+#: ../roundup/hyperdb.py:2079
 #, python-format
 msgid "%(property)r is not a property of %(classname)s"
 msgstr ""
@@ -2979,6 +2985,22 @@ msgstr ""
 msgid "not of form [arg=value,value,...;arg=value,value,...]"
 msgstr "ne tokios formos: [arg=reikÅ¡mÄ—,reikÅ¡mÄ—,...;arg=reikÅ¡mÄ—,reikÅ¡mÄ—,...]"
 
+#: ../roundup/mlink_expr.py:161
+#, python-format
+msgid ""
+"There was an error searching %(class)s by %(attr)s using: %(opcodes)s. The "
+"operator %(opcode)s (%(opcodename)s) at position %(position)d has too few "
+"arguments."
+msgstr ""
+
+#: ../roundup/mlink_expr.py:174
+#, python-format
+msgid ""
+"There was an error searching %(class)s by %(attr)s using: %(opcodes)s. There "
+"are too many arguments for the existing operators. The values on the stack "
+"are: %(stack)s"
+msgstr ""
+
 #: ../roundup/pygettext.py:401
 #, python-format
 msgid "*** %(file)s:%(lineno)s: Seen unexpected token \"%(token)s\""
@@ -3037,12 +3059,12 @@ msgstr ""
 msgid "morethanonestring"
 msgstr ""
 
-#: ../roundup/rest.py:410
+#: ../roundup/rest.py:417
 #, python-format
 msgid "Method %(m)s not allowed. Allowed: %(a)s"
 msgstr ""
 
-#: ../roundup/rest.py:948
+#: ../roundup/rest.py:964
 #, python-format
 msgid ""
 "Page size %(page_size)s must be less than admin limit on query result size: "
@@ -3050,30 +3072,51 @@ msgid ""
 msgstr ""
 
 # ../roundup/cgi/actions.py:897 :901
-#: ../roundup/rest.py:1193
+#: ../roundup/rest.py:1211
 #, fuzzy, python-format
 msgid "Invalid attribute %s"
 msgstr "Neteisingas vartotojo vardas ar slaptaÅ¾odis"
 
-#: ../roundup/rest.py:2182
+#: ../roundup/rest.py:2199
 #, python-format
 msgid "Api rate limits exceeded. Please wait: %s seconds."
 msgstr ""
 
-#: ../roundup/rest.py:2258
+#: ../roundup/rest.py:2283
 #, python-format
 msgid ""
-"Unable to parse Accept Header. %(error)s. Acceptable types: "
+"Content type '%s' requested in URL is not available.\n"
+"Acceptable types: %s\n"
+msgstr ""
+
+#: ../roundup/rest.py:2304
+#, python-format
+msgid ""
+"Unable to parse Accept Header. %(error)s. Acceptable types: */*, "
 "%(acceptable_types)s"
 msgstr ""
 
-#: ../roundup/rest.py:2441
+#: ../roundup/rest.py:2376 ../roundup/rest.py:2597 ../roundup/rest.py:2376:2597
 #, python-format
 msgid ""
 "Unrecognized api version: %s. See /rest without specifying api version for "
 "supported versions."
 msgstr ""
 
+#: ../roundup/rest.py:2411 ../roundup/rest.py:2420 ../roundup/rest.py:2411:2420
+#, python-format
+msgid ""
+"Requested content type(s) '%s' not available.\n"
+"Acceptable mime types are: */*, %s"
+msgstr ""
+
+#: ../roundup/rest.py:2696
+msgid ""
+"Internal error while formatting response.\n"
+"accept_mime_type is not defined. This should\n"
+"never happen\n"
+msgstr ""
+
 #: ../roundup/roundupdb.py:140
 #, python-format
 msgid "Username '%s' already exists."
@@ -3233,33 +3276,33 @@ msgid ""
 "\"imap\", \"imaps\",  \"imaps_cram\", or \"imaps_oauth\""
 msgstr "Klaida: Å altinis turi bÅ«ti â€žmailboxâ€œ, â€žpopâ€œ, â€žapopâ€œ, â€žimapâ€œ ar â€žimapsâ€œ"
 
-#: ../roundup/scripts/roundup_server.py:112
+#: ../roundup/scripts/roundup_server.py:113
 msgid "WARNING: generating temporary SSL certificate"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:143
+#: ../roundup/scripts/roundup_server.py:144
 #, python-format
 msgid "Unable to find/use key from file: %(pemfile)s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:144
+#: ../roundup/scripts/roundup_server.py:145
 msgid ""
 "Does it have a private key surrounded by '-----BEGIN PRIVATE KEY-----' and\n"
 "  '-----END PRIVATE KEY-----' markers?"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:149
+#: ../roundup/scripts/roundup_server.py:150
 #, python-format
 msgid "Unable to find/use certificate from file: %(pemfile)s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:150
+#: ../roundup/scripts/roundup_server.py:151
 msgid ""
 "Does it have a certificate surrounded by '-----BEGIN CERTIFICATE-----' and\n"
 "  '-----END CERTIFICATE-----' markers?"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:344
+#: ../roundup/scripts/roundup_server.py:345
 msgid ""
 "<html><head><title>Roundup trackers index</title></head>\n"
 "<body><h1>Roundup trackers index</h1><ol>\n"
@@ -3267,58 +3310,58 @@ msgstr ""
 "<html><head><title>Roundup tracker'io indeksas</title></head>\n"
 "<body><h1>Roundup tracker'io indeksas</h1><ol>\n"
 
-#: ../roundup/scripts/roundup_server.py:570
+#: ../roundup/scripts/roundup_server.py:587
 #, fuzzy, python-format
 msgid "Error: %(type)s: %(value)s"
 msgstr "%(key)s: %(value)s"
 
-#: ../roundup/scripts/roundup_server.py:582
+#: ../roundup/scripts/roundup_server.py:599
 msgid "WARNING: ignoring \"-g\" argument, not root"
 msgstr "PERSPÄ–JIMAS: \"-g\" argumentas ignoruojamas, nÄ—ra root teisiÅ³"
 
-#: ../roundup/scripts/roundup_server.py:588
+#: ../roundup/scripts/roundup_server.py:605
 msgid "Can't change groups - no grp module"
 msgstr "Negaliu pakeisti grupiÅ³ -- nÄ—ra grp modulio"
 
-#: ../roundup/scripts/roundup_server.py:597
+#: ../roundup/scripts/roundup_server.py:614
 #, python-format
 msgid "Group %(group)s doesn't exist"
 msgstr "GrupÄ—s %(group)s nÄ—ra"
 
-#: ../roundup/scripts/roundup_server.py:609
+#: ../roundup/scripts/roundup_server.py:626
 msgid "Can't run as root!"
 msgstr "Negaliu paleisti root teisÄ—mis!"
 
-#: ../roundup/scripts/roundup_server.py:612
+#: ../roundup/scripts/roundup_server.py:629
 msgid "WARNING: ignoring \"-u\" argument, not root"
 msgstr "PERSPÄ–JIMAS: \"-u\" argumentas ignoruojamas, nÄ—ra root teisiÅ³"
 
-#: ../roundup/scripts/roundup_server.py:618
+#: ../roundup/scripts/roundup_server.py:635
 msgid "Can't change users - no pwd module"
 msgstr "Negaliu pakesiti vartotojÅ³ - nÄ—ra pwd modulio"
 
-#: ../roundup/scripts/roundup_server.py:627
+#: ../roundup/scripts/roundup_server.py:644
 #, python-format
 msgid "User %(user)s doesn't exist"
 msgstr "Vartotojo %(user)s nÄ—ra"
 
-#: ../roundup/scripts/roundup_server.py:833
+#: ../roundup/scripts/roundup_server.py:856
 #, python-format
 msgid "Multiprocess mode \"%s\" is not available, switching to single-process"
 msgstr "MultiprocesinÄ— aplinka \"%s\" neprieinama, perjungiu Ä¯ vienprocesinÄ™"
 
-#: ../roundup/scripts/roundup_server.py:861
+#: ../roundup/scripts/roundup_server.py:884
 #, python-format
 msgid "Unable to bind to port %s, port already in use."
 msgstr "Negaliu prijungti prie jungties %s, jungtis jau naudojama."
 
-#: ../roundup/scripts/roundup_server.py:865
+#: ../roundup/scripts/roundup_server.py:888
 #, fuzzy, python-format
 msgid ""
 "Unable to bind to port %(port)s, access not allowed, errno: %(errno)s %(msg)s"
 msgstr "Negaliu prijungti prie jungties %s, jungtis jau naudojama."
 
-#: ../roundup/scripts/roundup_server.py:944
+#: ../roundup/scripts/roundup_server.py:967
 msgid ""
 " -c <Command>  Windows Service options.\n"
 "               If you want to run the server as a Windows Service, you\n"
@@ -3335,13 +3378,15 @@ msgstr ""
 "               Ä®vedÄ™ \"roundup-server -c help\" pamatysite Windows Services\n"
 "               specifikÄ…."
 
-#: ../roundup/scripts/roundup_server.py:951
+#: ../roundup/scripts/roundup_server.py:974
+#, fuzzy
 msgid ""
 " -u <UID>      runs the Roundup web server as this UID\n"
 " -g <GID>      runs the Roundup web server as this GID\n"
 " -d <PIDfile>  run the server in the background and write the server's PID\n"
 "               to the file indicated by PIDfile. The -l option *must* be\n"
-"               specified if -d is used."
+"               specified if -d is used.\n"
+" -D            run the server in the foreground even when -d is used."
 msgstr ""
 " -u <UID>      paleidÅ¾ia Roundup Å¾iniatinklio serverÄ¯ kaip Å¡is UID\n"
 " -g <GID>      paleidÅ¾ia Roundup Å¾iniatinklio serverÄ¯ kaip Å¡is GID\n"
@@ -3349,7 +3394,7 @@ msgstr ""
 "               nurodytÄ… PIDfaile. Parinktis -l *privalo* bÅ«ti nurodyta\n"
 "               jei naudojama -d."
 
-#: ../roundup/scripts/roundup_server.py:958
+#: ../roundup/scripts/roundup_server.py:982
 #, fuzzy, python-format
 msgid ""
 "\n"
@@ -3374,6 +3419,10 @@ msgid ""
 "mode\n"
 " -s            enable SSL\n"
 " -L            http request logging uses python logging (roundup.http)\n"
+" -P            log client address/name using reverse proxy X-Forwarded-For\n"
+"               header and not the connection IP (which is the reverse "
+"proxy).\n"
+"               Appends a '+' sign to the logged address/name.\n"
 " -e <fname>    PEM file containing SSL key and certificate\n"
 " -t <mode>     multiprocess mode (default: %(mp_def)s).\n"
 "               Allowed values: %(mp_types)s.\n"
@@ -3471,21 +3520,21 @@ msgstr ""
 "   nesupras.\n"
 "\n"
 
-#: ../roundup/scripts/roundup_server.py:1135
+#: ../roundup/scripts/roundup_server.py:1162
 msgid "Instances must be name=home"
 msgstr "Egzempliorius turi bÅ«ti nurodomas taip: vardas=namÅ³_direktorija"
 
-#: ../roundup/scripts/roundup_server.py:1149
+#: ../roundup/scripts/roundup_server.py:1176
 #, python-format
 msgid "Configuration saved to %s"
 msgstr "KonfigÅ«racija iÅ¡saugota %s"
 
-#: ../roundup/scripts/roundup_server.py:1167
+#: ../roundup/scripts/roundup_server.py:1194
 msgid "Sorry, you can't run the server as a daemon on this Operating System"
 msgstr ""
 "JÅ«s negalite paleisti serverio kaip daemon'o Å¡ioje operacinÄ—je sistemoje"
 
-#: ../roundup/scripts/roundup_server.py:1187
+#: ../roundup/scripts/roundup_server.py:1214
 #, python-format
 msgid "Roundup server started on %(HOST)s:%(PORT)s"
 msgstr "Roundup serveris paleistas ant %(HOST)s:%(PORT)s"
diff --git a/locale/nb.po b/locale/nb.po
index 1b3cc5506..a51e8b4b0 100644
--- a/locale/nb.po
+++ b/locale/nb.po
@@ -5,9 +5,9 @@
 #
 msgid ""
 msgstr ""
-"Project-Id-Version: Roundup 2.4.0\n"
+"Project-Id-Version: Roundup 2.5.0\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
-"POT-Creation-Date: 2024-08-07 21:43-0400\n"
+"POT-Creation-Date: 2024-12-30 22:49-0500\n"
 "PO-Revision-Date: 2013-10-31 12:21+0100\n"
 "Last-Translator: Christian Aastorp <christian.aastorp@gmail.com>\n"
 "Language-Team: Norwegian Bokmal <LL@li.org>\n"
@@ -85,8 +85,8 @@ msgstr ""
 msgid "Enable verbose output: tracing, descriptions...\n"
 msgstr ""
 
-#: ../roundup/admin.py:175 ../roundup/admin.py:1188 ../roundup/admin.py:1836
-#: ../roundup/admin.py:1868 ../roundup/admin.py:175:1188 :1836:1868
+#: ../roundup/admin.py:175 ../roundup/admin.py:1188 ../roundup/admin.py:1858
+#: ../roundup/admin.py:1890 ../roundup/admin.py:175:1188 :1858:1890
 #, python-format
 msgid "no such class \"%(classname)s\""
 msgstr "ingen slik klasse \"%(classname)s\""
@@ -314,13 +314,13 @@ msgstr ""
 msgid "%s:"
 msgstr "%s:"
 
-#: ../roundup/admin.py:439 ../roundup/admin.py:1396
-#: ../roundup/admin.py:439:1396
+#: ../roundup/admin.py:439 ../roundup/admin.py:1415
+#: ../roundup/admin.py:439:1415
 msgid "Templates:"
 msgstr "Maler:"
 
-#: ../roundup/admin.py:442 ../roundup/admin.py:1406
-#: ../roundup/admin.py:442:1406
+#: ../roundup/admin.py:442 ../roundup/admin.py:1425
+#: ../roundup/admin.py:442:1425
 msgid "Back ends:"
 msgstr "Back ends:"
 
@@ -369,11 +369,11 @@ msgstr ""
 #: ../roundup/admin.py:482 ../roundup/admin.py:555 ../roundup/admin.py:606
 #: ../roundup/admin.py:733 ../roundup/admin.py:806 ../roundup/admin.py:851
 #: ../roundup/admin.py:902 ../roundup/admin.py:999 ../roundup/admin.py:1216
-#: ../roundup/admin.py:1369 ../roundup/admin.py:1497 ../roundup/admin.py:1580
-#: ../roundup/admin.py:1703 ../roundup/admin.py:1826 ../roundup/admin.py:1858
-#: ../roundup/admin.py:1974 ../roundup/admin.py:2028 ../roundup/admin.py:2076
-#: ../roundup/admin.py:482:555 :1216:1369:1497 :1580:1703 :1826:1858 :1974:2028
-#: :2076 :606:733 :806:851 :902:999
+#: ../roundup/admin.py:1388 ../roundup/admin.py:1516 ../roundup/admin.py:1599
+#: ../roundup/admin.py:1725 ../roundup/admin.py:1848 ../roundup/admin.py:1880
+#: ../roundup/admin.py:1996 ../roundup/admin.py:2050 ../roundup/admin.py:2098
+#: ../roundup/admin.py:482:555 :1216:1388:1516 :1599:1725 :1848:1880 :1996:2050
+#: :2098 :606:733 :806:851 :902:999
 msgid "Not enough arguments supplied"
 msgstr "For fÃ¥ parametre"
 
@@ -515,9 +515,9 @@ msgstr ""
 msgid "Class %(curclassname)s has no property %(pn)s in %(propname)s."
 msgstr "%(classname)s har ingen verdi \"%(propname)s\""
 
-#: ../roundup/admin.py:791 ../roundup/admin.py:840 ../roundup/admin.py:1517
-#: ../roundup/admin.py:1530 ../roundup/admin.py:2098
-#: ../roundup/admin.py:791:840 :1517:1530:2098
+#: ../roundup/admin.py:791 ../roundup/admin.py:840 ../roundup/admin.py:1536
+#: ../roundup/admin.py:1549 ../roundup/admin.py:2120
+#: ../roundup/admin.py:791:840 :1536:1549:2120
 #, python-format
 msgid "%(classname)s has no property \"%(propname)s\""
 msgstr "%(classname)s har ingen verdi \"%(propname)s\""
@@ -599,8 +599,8 @@ msgid "property %s is not of type Multilink or Link so -d flag does not apply."
 msgstr ""
 "egneskapen %s er ikke multilenke eller lenke so -d lfagget kan ikke anvendes."
 
-#: ../roundup/admin.py:942 ../roundup/admin.py:1190 ../roundup/admin.py:1842
-#: ../roundup/admin.py:1870 ../roundup/admin.py:942:1190 :1842:1870
+#: ../roundup/admin.py:942 ../roundup/admin.py:1190 ../roundup/admin.py:1864
+#: ../roundup/admin.py:1892 ../roundup/admin.py:942:1190 :1864:1892
 #, python-format
 msgid "no such %(classname)s node \"%(nodeid)s\""
 msgstr "finnes ikke %(classname)s node \"%(nodeid)s\""
@@ -751,7 +751,7 @@ msgstr ""
 "    (eller, mer omstendelig glem alle gamle data).\n"
 "        "
 
-#: ../roundup/admin.py:1287
+#: ../roundup/admin.py:1306
 msgid ""
 "Usage: importtables export_dir\n"
 "        This imports the database tables exported using exporttables.\n"
@@ -761,7 +761,7 @@ msgid ""
 msgstr ""
 
 #. password
-#: ../roundup/admin.py:1295
+#: ../roundup/admin.py:1314
 msgid ""
 "Usage: initialise [adminpw]\n"
 "        Initialise a new Roundup tracker.\n"
@@ -779,23 +779,23 @@ msgstr ""
 "        KjÃ¸r sporerens oppstartsfunksjon dbinit.init()\n"
 "        "
 
-#: ../roundup/admin.py:1309
+#: ../roundup/admin.py:1328
 msgid "Admin Password: "
 msgstr "Admin passord:"
 
-#: ../roundup/admin.py:1310
+#: ../roundup/admin.py:1329
 msgid "       Confirm: "
 msgstr "       Bekreft: "
 
-#: ../roundup/admin.py:1314
+#: ../roundup/admin.py:1333
 msgid "Instance home does not exist"
 msgstr "Hjemmekatalogen finnes ikke"
 
-#: ../roundup/admin.py:1318
+#: ../roundup/admin.py:1337
 msgid "Instance has not been installed"
 msgstr "Sporeren er ikke installert"
 
-#: ../roundup/admin.py:1326
+#: ../roundup/admin.py:1345
 msgid ""
 "WARNING: The database is already initialised!\n"
 "If you re-initialise it, you will lose all the data!\n"
@@ -805,7 +805,7 @@ msgstr ""
 "Hvis du reinitialiserer den vil alle data bli slettet.\n"
 "Slette den? Y/N: "
 
-#: ../roundup/admin.py:1346
+#: ../roundup/admin.py:1365
 msgid ""
 "Usage: install [template [backend [key=val[,key=val]]]]\n"
 "        Install a new Roundup tracker.\n"
@@ -852,12 +852,12 @@ msgstr ""
 "\t\tSe ogsÃ¥ hjelp for initops.\n"
 "        "
 
-#: ../roundup/admin.py:1375
+#: ../roundup/admin.py:1394
 #, python-format
 msgid "Instance home parent directory \"%(parent)s\" does not exist"
 msgstr "Overordnet katalog \"%(parent)s\" finnes ikke"
 
-#: ../roundup/admin.py:1384
+#: ../roundup/admin.py:1403
 #, python-format
 msgid ""
 "WARNING: There appears to be a tracker in \"%(tracker_home)s\"!\n"
@@ -868,22 +868,22 @@ msgstr ""
 "Du vil miste alle data hvis du reinstallerer!\n"
 "Slette den? Y/N: "
 
-#: ../roundup/admin.py:1397
+#: ../roundup/admin.py:1416
 #, fuzzy
 msgid "Select template"
 msgstr "Velg mal [classic]: "
 
-#: ../roundup/admin.py:1407
+#: ../roundup/admin.py:1426
 #, fuzzy
 msgid "Select backend"
 msgstr "Velg database backend [anydbm]: "
 
-#: ../roundup/admin.py:1418
+#: ../roundup/admin.py:1437
 #, python-format
 msgid "Error in configuration settings: \"%s\""
 msgstr "Feil i konfigurasjon \"%s\""
 
-#: ../roundup/admin.py:1451
+#: ../roundup/admin.py:1470
 #, python-format
 msgid ""
 "\n"
@@ -896,11 +896,11 @@ msgstr ""
 " Du bÃ¸r redigere konfigurasjonsfilen for sporeren nÃ¥:\n"
 "   %(config_file)s"
 
-#: ../roundup/admin.py:1461
+#: ../roundup/admin.py:1480
 msgid " ... at a minimum, you must set following options:"
 msgstr "... du mÃ¥ spesifisere fÃ¸lgende opsjoner som et minimum:"
 
-#: ../roundup/admin.py:1466
+#: ../roundup/admin.py:1485
 #, python-format
 msgid ""
 "\n"
@@ -928,7 +928,7 @@ msgstr ""
 " disse endringene.\n"
 "---------------------------------------------------------------------------\n"
 
-#: ../roundup/admin.py:1482
+#: ../roundup/admin.py:1501
 msgid ""
 "Usage: list classname [property]\n"
 "        List the instances of a class.\n"
@@ -957,17 +957,17 @@ msgstr ""
 "        for alle klasseinstanser.\n"
 "        "
 
-#: ../roundup/admin.py:1495
+#: ../roundup/admin.py:1514
 msgid "Too many arguments supplied"
 msgstr "For mange argumenter"
 
-#: ../roundup/admin.py:1528
+#: ../roundup/admin.py:1547
 #, python-format
 msgid "%(nodeid)4s: %(value)s"
 msgstr "%(nodeid)4s: %(value)s"
 
 #. noqa: ARG002  - args unused
-#: ../roundup/admin.py:1535
+#: ../roundup/admin.py:1554
 #, fuzzy
 msgid ""
 "Usage: migrate\n"
@@ -1014,17 +1014,17 @@ msgstr ""
 "    la det bli en vane.\n"
 "        "
 
-#: ../roundup/admin.py:1555
+#: ../roundup/admin.py:1574
 #, python-format
 msgid "Tracker updated to schema version %s."
 msgstr ""
 
-#: ../roundup/admin.py:1559
+#: ../roundup/admin.py:1578
 #, fuzzy, python-format
 msgid "No migration action required. At schema version %s."
 msgstr "Ingen migrasjon krevet"
 
-#: ../roundup/admin.py:1564
+#: ../roundup/admin.py:1583
 #, fuzzy
 msgid ""
 "Usage: pack period | date\n"
@@ -1062,11 +1062,11 @@ msgstr ""
 "\n"
 "        "
 
-#: ../roundup/admin.py:1590
+#: ../roundup/admin.py:1609
 msgid "Invalid format"
 msgstr "Ugyldig format"
 
-#: ../roundup/admin.py:1601
+#: ../roundup/admin.py:1620
 msgid ""
 "Usage: perftest [mode] [arguments]*\n"
 "        Time operations in Roundup.\n"
@@ -1084,25 +1084,25 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1635
+#: ../roundup/admin.py:1657
 msgid "Invalid 'rounds'. Must be larger than 999."
 msgstr ""
 
-#: ../roundup/admin.py:1639
+#: ../roundup/admin.py:1661
 #, python-format
 msgid "Invalid 'rounds'. It must be an integer not: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1666
+#: ../roundup/admin.py:1688
 msgid "scheme does not support rounds."
 msgstr ""
 
-#: ../roundup/admin.py:1669
+#: ../roundup/admin.py:1691
 #, python-format
 msgid "Hash time: %(time)0.9f seconds, scheme: %(scheme)s, rounds: %(rounds)s"
 msgstr ""
 
-#: ../roundup/admin.py:1675
+#: ../roundup/admin.py:1697
 msgid ""
 "Usage: pragma setting=value | 'list'\n"
 "        Set internal admin settings to a value.\n"
@@ -1131,49 +1131,49 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1710
+#: ../roundup/admin.py:1732
 #, python-format
 msgid "Argument must be setting=value, was given: %s."
 msgstr ""
 
-#: ../roundup/admin.py:1713
+#: ../roundup/admin.py:1735
 msgid "Current settings and values (NYI - not yet implemented):"
 msgstr ""
 
-#: ../roundup/admin.py:1724
+#: ../roundup/admin.py:1746
 msgid ""
 "      Help for this pragma is missing. Please report it to the Roundup "
 "project.\n"
 msgstr ""
 
-#: ../roundup/admin.py:1730
+#: ../roundup/admin.py:1752
 #, fuzzy, python-format
 msgid "Unknown setting %s. Try \"pragma list\"."
 msgstr "Ukjent brukernavn:"
 
-#: ../roundup/admin.py:1740
+#: ../roundup/admin.py:1762
 #, python-format
 msgid "Incorrect value for boolean setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1747
+#: ../roundup/admin.py:1769
 #, python-format
 msgid "Incorrect value for integer setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1754
+#: ../roundup/admin.py:1776
 #, python-format
 msgid ""
 "Incorrect value for setting %(setting)s: %(value)s. Should be no, both, or "
 "only."
 msgstr ""
 
-#: ../roundup/admin.py:1764
+#: ../roundup/admin.py:1786
 #, python-format
 msgid "Internal error: pragma can not handle values of type: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1773
+#: ../roundup/admin.py:1795
 #, fuzzy
 msgid ""
 "Usage: reindex [classname|classname:#-#|designator]*\n"
@@ -1197,17 +1197,17 @@ msgstr ""
 "    automatisk.\n"
 "        "
 
-#: ../roundup/admin.py:1795
+#: ../roundup/admin.py:1817
 #, python-format
 msgid "no such item \"%(designator)s\""
 msgstr "ingen slik enhet  \"%(designator)s\""
 
-#: ../roundup/admin.py:1805
+#: ../roundup/admin.py:1827
 #, fuzzy, python-format
 msgid "no such item \"%(class)s%(id)s\""
 msgstr "ingen slik enhet  \"%(designator)s\""
 
-#: ../roundup/admin.py:1817
+#: ../roundup/admin.py:1839
 #, fuzzy
 msgid ""
 "Usage: restore designator[,designator]*\n"
@@ -1225,7 +1225,7 @@ msgstr ""
 "\t   Oppgitte noder blir tilgjengelige for brukerne igjen.\n"
 "        "
 
-#: ../roundup/admin.py:1848
+#: ../roundup/admin.py:1870
 #, fuzzy
 msgid ""
 "Usage: retire designator[,designator]*\n"
@@ -1246,7 +1246,7 @@ msgstr ""
 "        "
 
 #. noqa: ARG002 - args unused
-#: ../roundup/admin.py:1876
+#: ../roundup/admin.py:1898
 msgid ""
 "Usage: rollback\n"
 "        Undo all changes that are pending commit to the database.\n"
@@ -1265,7 +1265,7 @@ msgstr ""
 "          commited. \n"
 "        "
 
-#: ../roundup/admin.py:1889
+#: ../roundup/admin.py:1911
 msgid ""
 "Usage: security [Role name]\n"
 "        Display the Permissions available to one or all Roles.\n"
@@ -1278,47 +1278,47 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1904
+#: ../roundup/admin.py:1926
 #, fuzzy, python-format
 msgid "No such Role \"%(role)s\"\n"
 msgstr "Ingen slik rolle \"%(role)s\""
 
-#: ../roundup/admin.py:1910
+#: ../roundup/admin.py:1932
 #, fuzzy, python-format
 msgid "New Web users get the Roles \"%(role)s\"\n"
 msgstr "Nye web-brukere for rollene \"%(role)s\""
 
-#: ../roundup/admin.py:1913
+#: ../roundup/admin.py:1935
 #, fuzzy, python-format
 msgid "New Web users get the Role \"%(role)s\"\n"
 msgstr "Nye web-brukere for rollen \"%(role)s\""
 
-#: ../roundup/admin.py:1917
+#: ../roundup/admin.py:1939
 #, fuzzy, python-format
 msgid "New Email users get the Roles \"%(role)s\"\n"
 msgstr "Nye epostbrukere for rollene \"%(role)s\""
 
-#: ../roundup/admin.py:1919
+#: ../roundup/admin.py:1941
 #, fuzzy, python-format
 msgid "New Email users get the Role \"%(role)s\"\n"
 msgstr "Nye epostbrukere for rollen \"%(role)s\""
 
-#: ../roundup/admin.py:1922
+#: ../roundup/admin.py:1944
 #, fuzzy, python-format
 msgid "Role \"%(name)s\":\n"
 msgstr "Rolle \"%(name)s\":"
 
-#: ../roundup/admin.py:1928
+#: ../roundup/admin.py:1950
 #, fuzzy
 msgid " %(description)s (%(name)s for \"%(klass)s\""
 msgstr " %(description)s (%(name)s bare for \"%(klass)s\")"
 
-#: ../roundup/admin.py:1928
+#: ../roundup/admin.py:1950
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\": %(properties)s only)\n"
 msgstr " %(description)s (%(name)s bare for \"%(klass)s\": %(properties)s )"
 
-#: ../roundup/admin.py:1941
+#: ../roundup/admin.py:1963
 #, python-format
 msgid ""
 "\n"
@@ -1326,17 +1326,17 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/admin.py:1947
+#: ../roundup/admin.py:1969
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\" only)\n"
 msgstr " %(description)s (%(name)s bare for \"%(klass)s\")"
 
-#: ../roundup/admin.py:1950
+#: ../roundup/admin.py:1972
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s)\n"
 msgstr " %(description)s (%(name)s)"
 
-#: ../roundup/admin.py:1954
+#: ../roundup/admin.py:1976
 #, fuzzy
 msgid ""
 "Usage: set items property=value [property=value ...]\n"
@@ -1371,7 +1371,7 @@ msgstr ""
 "som\n"
 "        en kommaseparert liste (feks \"1,2,3\")."
 
-#: ../roundup/admin.py:2022
+#: ../roundup/admin.py:2044
 msgid ""
 "Usage: specification classname\n"
 "        Show the properties for a classname.\n"
@@ -1385,17 +1385,17 @@ msgstr ""
 "        Lister egenskapene til gitt klasse.\n"
 "        "
 
-#: ../roundup/admin.py:2041
+#: ../roundup/admin.py:2063
 #, fuzzy, python-format
 msgid "%(key)s: %(value)s (key property)\n"
 msgstr "%(key)s: %(value)s (key property)"
 
-#: ../roundup/admin.py:2044
+#: ../roundup/admin.py:2066
 #, fuzzy, python-format
 msgid "%(key)s: %(value)s\n"
 msgstr "%(key)s: %(value)s"
 
-#: ../roundup/admin.py:2047
+#: ../roundup/admin.py:2069
 msgid ""
 "Usage: table classname [property[,property]*]\n"
 "        List the instances of a class in tabular form.\n"
@@ -1455,17 +1455,17 @@ msgstr ""
 "        resulterer i en fire bokstavaer bred \"Name\" kolonne.\n"
 "        "
 
-#: ../roundup/admin.py:2093
+#: ../roundup/admin.py:2115
 #, python-format
 msgid "\"%(spec)s\" not name:width"
 msgstr "\"%(spec)s\" ikke navn:bredde"
 
-#: ../roundup/admin.py:2115
+#: ../roundup/admin.py:2137
 #, python-format
 msgid "\"%(spec)s\" does not have an integer width: \"%(width)s\""
 msgstr ""
 
-#: ../roundup/admin.py:2151
+#: ../roundup/admin.py:2173
 msgid ""
 "Usage: templates [trace_search]\n"
 "        List templates and their installed directories.\n"
@@ -1475,7 +1475,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2179
+#: ../roundup/admin.py:2201
 #, fuzzy
 msgid ""
 "Usage: updateconfig <filename>\n"
@@ -1490,34 +1490,34 @@ msgstr ""
 "        i <filename>.\n"
 "        "
 
-#: ../roundup/admin.py:2188 ../roundup/cgi/actions.py:886
+#: ../roundup/admin.py:2210 ../roundup/cgi/actions.py:886
 #: ../roundup/cgi/actions.py:897 ../roundup/cgi/actions.py:1099
 #: ../roundup/cgi/actions.py:1113 ../roundup/cgi/actions.py:886:897 :1099:1113
 #, python-format
 msgid "Error: %s"
 msgstr "Feil: %s"
 
-#: ../roundup/admin.py:2220
+#: ../roundup/admin.py:2242
 #, python-format
 msgid "Unknown command \"%(command)s\" (\"help commands\" for a list)"
 msgstr "Ukjent kommando \"%(command)s\" (\"help commands\" for liste)"
 
-#: ../roundup/admin.py:2226
+#: ../roundup/admin.py:2248
 #, python-format
 msgid "Multiple commands match \"%(command)s\": %(list)s"
 msgstr "Multiple kommandoer  matcher \"%(command)s\": %(list)s"
 
-#: ../roundup/admin.py:2241
+#: ../roundup/admin.py:2263
 msgid "Enter tracker home: "
 msgstr "Oppgi sporers plassering:"
 
-#: ../roundup/admin.py:2270 ../roundup/admin.py:2274
-#: ../roundup/admin.py:2270:2274
+#: ../roundup/admin.py:2292 ../roundup/admin.py:2296
+#: ../roundup/admin.py:2292:2296
 #, python-format
 msgid "Error: Couldn't open tracker: %(message)s"
 msgstr "Feil: Kan ikke Ã¥pne sporer: %(message)s"
 
-#: ../roundup/admin.py:2322
+#: ../roundup/admin.py:2344
 #, python-format
 msgid ""
 "Roundup %s ready for input.\n"
@@ -1526,15 +1526,15 @@ msgstr ""
 "Roundup %s er klar til bruk.\n"
 "Skriv  \"help\" for hjelp."
 
-#: ../roundup/admin.py:2355
+#: ../roundup/admin.py:2377
 msgid "Note: command history and editing not available"
 msgstr "Merk: kommandohistorikk og redigering utilgjengelig"
 
-#: ../roundup/admin.py:2361
+#: ../roundup/admin.py:2383
 msgid "exit..."
 msgstr "exit..."
 
-#: ../roundup/admin.py:2374
+#: ../roundup/admin.py:2396
 msgid "There are unsaved changes. Commit them (y/N)? "
 msgstr "Det er ikkelagrede endringer. Lagre dem (y/N)? "
 
@@ -1563,23 +1563,23 @@ msgid "Couldn't open database - the required module '%s' is not available"
 msgstr ""
 "Kunne ikke Ã¥pne databasen - den pÃ¥krevde modulen '%s' er ikke tilgjengelig"
 
-#: ../roundup/backends/back_anydbm.py:871
-#: ../roundup/backends/back_anydbm.py:884
-#: ../roundup/backends/back_anydbm.py:1158
-#: ../roundup/backends/back_anydbm.py:1193
-#: ../roundup/backends/back_anydbm.py:1422
-#: ../roundup/backends/back_anydbm.py:1440
-#: ../roundup/backends/back_anydbm.py:1487
-#: ../roundup/backends/back_anydbm.py:2123
-#: ../roundup/backends/back_anydbm.py:871:884
+#: ../roundup/backends/back_anydbm.py:873
+#: ../roundup/backends/back_anydbm.py:886
+#: ../roundup/backends/back_anydbm.py:1160
+#: ../roundup/backends/back_anydbm.py:1195
+#: ../roundup/backends/back_anydbm.py:1424
+#: ../roundup/backends/back_anydbm.py:1442
+#: ../roundup/backends/back_anydbm.py:1489
+#: ../roundup/backends/back_anydbm.py:2135
+#: ../roundup/backends/back_anydbm.py:873:886
 #: ../roundup/backends/rdbms_common.py:1720
 #: ../roundup/backends/rdbms_common.py:1967
 #: ../roundup/backends/rdbms_common.py:2206
 #: ../roundup/backends/rdbms_common.py:2226
 #: ../roundup/backends/rdbms_common.py:2279
-#: ../roundup/backends/rdbms_common.py:3246
-#: ../roundup/backends/rdbms_common.py:1720:1967 :1158:1193 :1422:1440:1487
-#: :2123 :2206:2226 :2279:3246
+#: ../roundup/backends/rdbms_common.py:3254
+#: ../roundup/backends/rdbms_common.py:1720:1967 :1160:1195 :1424:1442:1489
+#: :2135 :2206:2226 :2279:3254
 msgid "Database open read-only"
 msgstr "Databsen Ã¥pnet bare for lesing"
 
@@ -1971,13 +1971,13 @@ msgstr "Ugylig login"
 msgid "You do not have permission to login"
 msgstr "Du har ikke tillatelse til Ã¥ logge inn"
 
-#: ../roundup/cgi/actions.py:1577 ../roundup/cgi/actions.py:1761
-#: ../roundup/cgi/actions.py:1577:1761
+#: ../roundup/cgi/actions.py:1577 ../roundup/cgi/actions.py:1757
+#: ../roundup/cgi/actions.py:1577:1757
 #, python-format
 msgid "Column \"%(column)s\" not found in %(class)s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1832
+#: ../roundup/cgi/actions.py:1822
 #, python-format
 msgid "You do not have permission to view %(class)s"
 msgstr "Du har ikke tillatelse til  Ã¥ se pÃ¥ %(class)s"
@@ -2067,7 +2067,7 @@ msgstr "i <strong>%s</strong>"
 msgid "<em>undefined</em>"
 msgstr "<em>udefinert</em>"
 
-#: ../roundup/cgi/client.py:105
+#: ../roundup/cgi/client.py:111
 msgid ""
 "<html><head><title>An error has occurred</title></head>\n"
 "<body><h1>An error has occurred</h1>\n"
@@ -2076,148 +2076,154 @@ msgid ""
 "</body></html>"
 msgstr ""
 
-#: ../roundup/cgi/client.py:717 ../roundup/cgi/client.py:1635
-#: ../roundup/cgi/client.py:717:1635
+#: ../roundup/cgi/client.py:666
+msgid ""
+"XMLRPC endpoint is not using defusedxml. Improve security by installing "
+"defusedxml."
+msgstr ""
+
+#: ../roundup/cgi/client.py:728 ../roundup/cgi/client.py:1646
+#: ../roundup/cgi/client.py:728:1646
 msgid "Required Header Missing"
 msgstr ""
 
-#: ../roundup/cgi/client.py:719
+#: ../roundup/cgi/client.py:731
 #, fuzzy
 msgid "Client is not allowed to use Rest Interface."
 msgstr "Anonyme brukere fÃ¥r ikke benytte web-grensesnittet"
 
-#: ../roundup/cgi/client.py:971
+#: ../roundup/cgi/client.py:985
 msgid "Form Error: "
 msgstr "Skjema feil:"
 
-#: ../roundup/cgi/client.py:1064
+#: ../roundup/cgi/client.py:1078
 #, python-format
 msgid "Unrecognized charset: %r"
 msgstr "Ukjent tegnsett: %r"
 
-#: ../roundup/cgi/client.py:1331 ../roundup/cgi/client.py:2294
-#: ../roundup/cgi/client.py:1331:2294
+#: ../roundup/cgi/client.py:1345 ../roundup/cgi/client.py:2357
+#: ../roundup/cgi/client.py:1345:2357
 msgid "broken form: multiple @action values submitted"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1348
+#: ../roundup/cgi/client.py:1362
 msgid "Anonymous users are not allowed to use the web interface"
 msgstr "Anonyme brukere fÃ¥r ikke benytte web-grensesnittet"
 
-#: ../roundup/cgi/client.py:1496
+#: ../roundup/cgi/client.py:1507
 msgid "Referer header not available."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1500
+#: ../roundup/cgi/client.py:1511
 #, python-format
 msgid "csrf key used with wrong method from: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1529
+#: ../roundup/cgi/client.py:1540
 #, python-format
 msgid "csrf header %(header)s required but missing for user%(userid)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1533
+#: ../roundup/cgi/client.py:1544
 #, python-format
 msgid "Missing header: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1541
+#: ../roundup/cgi/client.py:1552
 #, python-format
 msgid "csrf Referer header check failed for user%(userid)s. Value=%(referer)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1546
+#: ../roundup/cgi/client.py:1557
 #, fuzzy, python-format
 msgid "Invalid Referer: %s"
 msgstr "Ugylig login"
 
-#: ../roundup/cgi/client.py:1561
+#: ../roundup/cgi/client.py:1572
 #, python-format
 msgid "csrf Origin header check failed for user%(userid)s. Value=%(origin)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1566
+#: ../roundup/cgi/client.py:1577
 #, fuzzy, python-format
 msgid "Invalid Origin %s"
 msgstr "Ugylig login"
 
-#: ../roundup/cgi/client.py:1580
+#: ../roundup/cgi/client.py:1591
 #, python-format
 msgid ""
 "csrf X-FORWARDED-HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1586
+#: ../roundup/cgi/client.py:1597
 #, python-format
 msgid "Invalid X-FORWARDED-HOST %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1605
+#: ../roundup/cgi/client.py:1616
 #, python-format
 msgid "csrf HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1610
+#: ../roundup/cgi/client.py:1621
 #, fuzzy, python-format
 msgid "Invalid HOST %s"
 msgstr "Ugyldig forespÃ¸rsel"
 
-#: ../roundup/cgi/client.py:1618
+#: ../roundup/cgi/client.py:1629
 msgid "Csrf: unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1619
+#: ../roundup/cgi/client.py:1630
 msgid "Unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1632
+#: ../roundup/cgi/client.py:1643
 #, python-format
 msgid "csrf X-REQUESTED-WITH xmlrpc required header check failed for user%s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1673
+#: ../roundup/cgi/client.py:1684
 #, python-format
 msgid "Required csrf field missing for user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1675 ../roundup/cgi/client.py:1702
-#: ../roundup/cgi/client.py:1719 ../roundup/cgi/client.py:1675:1702:1719
+#: ../roundup/cgi/client.py:1686 ../roundup/cgi/client.py:1713
+#: ../roundup/cgi/client.py:1730 ../roundup/cgi/client.py:1686:1713:1730
 msgid ""
 "We can't validate your session (csrf failure). Re-enter any unsaved data and "
 "try again."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1679
+#: ../roundup/cgi/client.py:1690
 #, python-format
 msgid "csrf field not supplied by user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1691
+#: ../roundup/cgi/client.py:1702
 #, python-format
 msgid ""
 "Csrf mismatch user: current user %(user)s != stored user %(stored)s, current "
 "session, stored session: %(cur_sess)s,%(stor_sess)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1709
+#: ../roundup/cgi/client.py:1720
 #, python-format
 msgid ""
 "Csrf mismatch user: current session %(curr_sess)s != stored session "
 "%(stor_sess)s, current user/stored user is: %(user)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1901
+#: ../roundup/cgi/client.py:1912
 msgid "You are not allowed to view this file."
 msgstr "Du har ikke lov Ã¥ se denne filen."
 
-#: ../roundup/cgi/client.py:2172
+#: ../roundup/cgi/client.py:2235
 #, python-format
 msgid "%(starttag)sTime elapsed: %(seconds)fs%(endtag)s\n"
 msgstr "%(starttag)sMedgÃ¥tt tid: %(seconds)fs%(endtag)s\n"
 
-#: ../roundup/cgi/client.py:2176
+#: ../roundup/cgi/client.py:2239
 #, python-format
 msgid ""
 "%(starttag)sCache hits: %(cache_hits)d, misses %(cache_misses)d. Loading "
@@ -2226,7 +2232,7 @@ msgstr ""
 "%(starttag)sCache treff: %(cache_hits)d, ikke-treff %(cache_misses)d. Laster "
 "saker: %(get_items)f secs. Filtrerer: %(filtering)f secs.%(endtag)s\n"
 
-#: ../roundup/cgi/client.py:2716
+#: ../roundup/cgi/client.py:2778
 #, python-format
 msgid ""
 "Cache failure: compressed file %(compressed)s is older than its source file "
@@ -2633,17 +2639,17 @@ msgstr "\"%s\" ikke en node-benevnelse"
 msgid "Not a property name: %s"
 msgstr "Ikke et navn pÃ¥ egenskap: %s"
 
-#: ../roundup/hyperdb.py:1984
+#: ../roundup/hyperdb.py:2038
 #, fuzzy, python-format
 msgid "property %(property)s: %(value)r is not a %(classname)s."
 msgstr "egenskapen \"%(propname)s\": \"%(value)s\" er ikke i listen nÃ¥"
 
-#: ../roundup/hyperdb.py:1990
+#: ../roundup/hyperdb.py:2044
 #, python-format
 msgid "you may only enter ID values for property %s"
 msgstr "du kan bare oppgi ID-verdier for egenskap %s"
 
-#: ../roundup/hyperdb.py:2025
+#: ../roundup/hyperdb.py:2079
 #, fuzzy, python-format
 msgid "%(property)r is not a property of %(classname)s"
 msgstr "%r er ikke en egenskap ved %s"
@@ -2967,6 +2973,22 @@ msgstr ""
 msgid "not of form [arg=value,value,...;arg=value,value,...]"
 msgstr "ikke pÃ¥ formen [arg=value,value,...;arg=value,value,...]"
 
+#: ../roundup/mlink_expr.py:161
+#, python-format
+msgid ""
+"There was an error searching %(class)s by %(attr)s using: %(opcodes)s. The "
+"operator %(opcode)s (%(opcodename)s) at position %(position)d has too few "
+"arguments."
+msgstr ""
+
+#: ../roundup/mlink_expr.py:174
+#, python-format
+msgid ""
+"There was an error searching %(class)s by %(attr)s using: %(opcodes)s. There "
+"are too many arguments for the existing operators. The values on the stack "
+"are: %(stack)s"
+msgstr ""
+
 #: ../roundup/pygettext.py:401
 #, python-format
 msgid "*** %(file)s:%(lineno)s: Seen unexpected token \"%(token)s\""
@@ -3024,42 +3046,63 @@ msgstr ""
 msgid "morethanonestring"
 msgstr ""
 
-#: ../roundup/rest.py:410
+#: ../roundup/rest.py:417
 #, python-format
 msgid "Method %(m)s not allowed. Allowed: %(a)s"
 msgstr ""
 
-#: ../roundup/rest.py:948
+#: ../roundup/rest.py:964
 #, python-format
 msgid ""
 "Page size %(page_size)s must be less than admin limit on query result size: "
 "%(max_size)s."
 msgstr ""
 
-#: ../roundup/rest.py:1193
+#: ../roundup/rest.py:1211
 #, fuzzy, python-format
 msgid "Invalid attribute %s"
 msgstr "Ugylig login"
 
-#: ../roundup/rest.py:2182
+#: ../roundup/rest.py:2199
 #, python-format
 msgid "Api rate limits exceeded. Please wait: %s seconds."
 msgstr ""
 
-#: ../roundup/rest.py:2258
+#: ../roundup/rest.py:2283
 #, python-format
 msgid ""
-"Unable to parse Accept Header. %(error)s. Acceptable types: "
+"Content type '%s' requested in URL is not available.\n"
+"Acceptable types: %s\n"
+msgstr ""
+
+#: ../roundup/rest.py:2304
+#, python-format
+msgid ""
+"Unable to parse Accept Header. %(error)s. Acceptable types: */*, "
 "%(acceptable_types)s"
 msgstr ""
 
-#: ../roundup/rest.py:2441
+#: ../roundup/rest.py:2376 ../roundup/rest.py:2597 ../roundup/rest.py:2376:2597
 #, python-format
 msgid ""
 "Unrecognized api version: %s. See /rest without specifying api version for "
 "supported versions."
 msgstr ""
 
+#: ../roundup/rest.py:2411 ../roundup/rest.py:2420 ../roundup/rest.py:2411:2420
+#, python-format
+msgid ""
+"Requested content type(s) '%s' not available.\n"
+"Acceptable mime types are: */*, %s"
+msgstr ""
+
+#: ../roundup/rest.py:2696
+msgid ""
+"Internal error while formatting response.\n"
+"accept_mime_type is not defined. This should\n"
+"never happen\n"
+msgstr ""
+
 #: ../roundup/roundupdb.py:140
 #, python-format
 msgid "Username '%s' already exists."
@@ -3221,33 +3264,33 @@ msgstr ""
 "Feil: Kilden mÃ¥ vÃ¦re enten \"mailbox\", \"pop\", \"pops\", \"apop\", \"imap"
 "\" eller \"imaps\""
 
-#: ../roundup/scripts/roundup_server.py:112
+#: ../roundup/scripts/roundup_server.py:113
 msgid "WARNING: generating temporary SSL certificate"
 msgstr "ADVARSEL: genererer midlertidig SSL sertifikat"
 
-#: ../roundup/scripts/roundup_server.py:143
+#: ../roundup/scripts/roundup_server.py:144
 #, python-format
 msgid "Unable to find/use key from file: %(pemfile)s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:144
+#: ../roundup/scripts/roundup_server.py:145
 msgid ""
 "Does it have a private key surrounded by '-----BEGIN PRIVATE KEY-----' and\n"
 "  '-----END PRIVATE KEY-----' markers?"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:149
+#: ../roundup/scripts/roundup_server.py:150
 #, python-format
 msgid "Unable to find/use certificate from file: %(pemfile)s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:150
+#: ../roundup/scripts/roundup_server.py:151
 msgid ""
 "Does it have a certificate surrounded by '-----BEGIN CERTIFICATE-----' and\n"
 "  '-----END CERTIFICATE-----' markers?"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:344
+#: ../roundup/scripts/roundup_server.py:345
 msgid ""
 "<html><head><title>Roundup trackers index</title></head>\n"
 "<body><h1>Roundup trackers index</h1><ol>\n"
@@ -3255,59 +3298,59 @@ msgstr ""
 "<html><head><title>Roundup saksliste</title></head>\n"
 "<body><h1>Roundup saksliste</h1><ol>\n"
 
-#: ../roundup/scripts/roundup_server.py:570
+#: ../roundup/scripts/roundup_server.py:587
 #, fuzzy, python-format
 msgid "Error: %(type)s: %(value)s"
 msgstr "%(key)s: %(value)s"
 
-#: ../roundup/scripts/roundup_server.py:582
+#: ../roundup/scripts/roundup_server.py:599
 msgid "WARNING: ignoring \"-g\" argument, not root"
 msgstr "ADVARSEL: ignorerer \"-g\" argument, ikke root"
 
-#: ../roundup/scripts/roundup_server.py:588
+#: ../roundup/scripts/roundup_server.py:605
 msgid "Can't change groups - no grp module"
 msgstr "Kan ikke skifte gruppe, ingen grp modul"
 
-#: ../roundup/scripts/roundup_server.py:597
+#: ../roundup/scripts/roundup_server.py:614
 #, python-format
 msgid "Group %(group)s doesn't exist"
 msgstr "Gruppe %(group)s finnes ikke"
 
-#: ../roundup/scripts/roundup_server.py:609
+#: ../roundup/scripts/roundup_server.py:626
 msgid "Can't run as root!"
 msgstr "Kan ikke kjÃ¸re som root"
 
-#: ../roundup/scripts/roundup_server.py:612
+#: ../roundup/scripts/roundup_server.py:629
 msgid "WARNING: ignoring \"-u\" argument, not root"
 msgstr "ADVARSEL: ignorerer \"-u\" argument, ikke root"
 
-#: ../roundup/scripts/roundup_server.py:618
+#: ../roundup/scripts/roundup_server.py:635
 msgid "Can't change users - no pwd module"
 msgstr "Kan ikke skifte bruker , ingen pwd modul"
 
-#: ../roundup/scripts/roundup_server.py:627
+#: ../roundup/scripts/roundup_server.py:644
 #, python-format
 msgid "User %(user)s doesn't exist"
 msgstr "Bruker %(user)s finnes ikke"
 
-#: ../roundup/scripts/roundup_server.py:833
+#: ../roundup/scripts/roundup_server.py:856
 #, python-format
 msgid "Multiprocess mode \"%s\" is not available, switching to single-process"
 msgstr ""
 "Multiprosess modus  \"%s\" ikke tilgjengelig, fortsetter som enkeltprosess"
 
-#: ../roundup/scripts/roundup_server.py:861
+#: ../roundup/scripts/roundup_server.py:884
 #, python-format
 msgid "Unable to bind to port %s, port already in use."
 msgstr "Ikke mulig Ã¥ binde til port %s, porten er allerede i bruk."
 
-#: ../roundup/scripts/roundup_server.py:865
+#: ../roundup/scripts/roundup_server.py:888
 #, fuzzy, python-format
 msgid ""
 "Unable to bind to port %(port)s, access not allowed, errno: %(errno)s %(msg)s"
 msgstr "Ikke mulig Ã¥ binde til port %s, porten er allerede i bruk."
 
-#: ../roundup/scripts/roundup_server.py:944
+#: ../roundup/scripts/roundup_server.py:967
 msgid ""
 " -c <Command>  Windows Service options.\n"
 "               If you want to run the server as a Windows Service, you\n"
@@ -3324,13 +3367,15 @@ msgstr ""
 "               Skriv \"roundup-server -c help\" for Ã¥ vise Windows Services\n"
 "               informasjon."
 
-#: ../roundup/scripts/roundup_server.py:951
+#: ../roundup/scripts/roundup_server.py:974
+#, fuzzy
 msgid ""
 " -u <UID>      runs the Roundup web server as this UID\n"
 " -g <GID>      runs the Roundup web server as this GID\n"
 " -d <PIDfile>  run the server in the background and write the server's PID\n"
 "               to the file indicated by PIDfile. The -l option *must* be\n"
-"               specified if -d is used."
+"               specified if -d is used.\n"
+" -D            run the server in the foreground even when -d is used."
 msgstr ""
 " -u <UID>      kjÃ¸rer Roundup web server som denne UID\n"
 " -g <GID>      kjÃ¸rer Roundup web server som denne GID\n"
@@ -3338,7 +3383,7 @@ msgstr ""
 "               serverens PID til filen indikert av PIDfile.\n"
 "               -l optsjonen *mÃ¥* brukes hvis -d brukes."
 
-#: ../roundup/scripts/roundup_server.py:958
+#: ../roundup/scripts/roundup_server.py:982
 #, fuzzy, python-format
 msgid ""
 "\n"
@@ -3363,6 +3408,10 @@ msgid ""
 "mode\n"
 " -s            enable SSL\n"
 " -L            http request logging uses python logging (roundup.http)\n"
+" -P            log client address/name using reverse proxy X-Forwarded-For\n"
+"               header and not the connection IP (which is the reverse "
+"proxy).\n"
+"               Appends a '+' sign to the logged address/name.\n"
 " -e <fname>    PEM file containing SSL key and certificate\n"
 " -t <mode>     multiprocess mode (default: %(mp_def)s).\n"
 "               Allowed values: %(mp_types)s.\n"
@@ -3462,21 +3511,21 @@ msgstr ""
 "   Pass pÃ¥ at de ikke inneholder url-utrygge tegn som mellomrom, for de kan "
 "forvirre IE.\n"
 
-#: ../roundup/scripts/roundup_server.py:1135
+#: ../roundup/scripts/roundup_server.py:1162
 msgid "Instances must be name=home"
 msgstr "Instanser mÃ¥ vÃ¦re navn=home"
 
-#: ../roundup/scripts/roundup_server.py:1149
+#: ../roundup/scripts/roundup_server.py:1176
 #, python-format
 msgid "Configuration saved to %s"
 msgstr "Konfigurasjon lagret til %s"
 
-#: ../roundup/scripts/roundup_server.py:1167
+#: ../roundup/scripts/roundup_server.py:1194
 msgid "Sorry, you can't run the server as a daemon on this Operating System"
 msgstr ""
 "Beklager, du kan ikke kjÃ¸re servern som daemon under dette operativsystemet"
 
-#: ../roundup/scripts/roundup_server.py:1187
+#: ../roundup/scripts/roundup_server.py:1214
 #, python-format
 msgid "Roundup server started on %(HOST)s:%(PORT)s"
 msgstr "Roundup server startet pÃ¥ %(HOST)s:%(PORT)s"
diff --git a/locale/roundup.pot b/locale/roundup.pot
index d7e573b27..fc8cfcab3 100644
--- a/locale/roundup.pot
+++ b/locale/roundup.pot
@@ -6,9 +6,9 @@
 #, fuzzy
 msgid ""
 msgstr ""
-"Project-Id-Version: Roundup 2.4.0\n"
+"Project-Id-Version: Roundup 2.5.0\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
-"POT-Creation-Date: 2024-08-07 21:43-0400\n"
+"POT-Creation-Date: 2024-12-30 22:49-0500\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -82,8 +82,8 @@ msgstr ""
 msgid "Enable verbose output: tracing, descriptions...\n"
 msgstr ""
 
-#: ../roundup/admin.py:175 ../roundup/admin.py:1188 ../roundup/admin.py:1836
-#: ../roundup/admin.py:1868 ../roundup/admin.py:175:1188 :1836:1868
+#: ../roundup/admin.py:175 ../roundup/admin.py:1188 ../roundup/admin.py:1858
+#: ../roundup/admin.py:1890 ../roundup/admin.py:175:1188 :1858:1890
 #, python-format
 msgid "no such class \"%(classname)s\""
 msgstr ""
@@ -212,11 +212,11 @@ msgstr ""
 msgid "%s:"
 msgstr ""
 
-#: ../roundup/admin.py:439 ../roundup/admin.py:1396 ../roundup/admin.py:439:1396
+#: ../roundup/admin.py:439 ../roundup/admin.py:1415 ../roundup/admin.py:439:1415
 msgid "Templates:"
 msgstr ""
 
-#: ../roundup/admin.py:442 ../roundup/admin.py:1406 ../roundup/admin.py:442:1406
+#: ../roundup/admin.py:442 ../roundup/admin.py:1425 ../roundup/admin.py:442:1425
 msgid "Back ends:"
 msgstr ""
 
@@ -250,11 +250,11 @@ msgstr ""
 #: ../roundup/admin.py:482 ../roundup/admin.py:555 ../roundup/admin.py:606
 #: ../roundup/admin.py:733 ../roundup/admin.py:806 ../roundup/admin.py:851
 #: ../roundup/admin.py:902 ../roundup/admin.py:999 ../roundup/admin.py:1216
-#: ../roundup/admin.py:1369 ../roundup/admin.py:1497 ../roundup/admin.py:1580
-#: ../roundup/admin.py:1703 ../roundup/admin.py:1826 ../roundup/admin.py:1858
-#: ../roundup/admin.py:1974 ../roundup/admin.py:2028 ../roundup/admin.py:2076
-#: ../roundup/admin.py:482:555 :1216:1369 :1497 :1580:1703 :1826:1858 :1974:2028
-#: :2076 :606:733 :806:851 :902:999
+#: ../roundup/admin.py:1388 ../roundup/admin.py:1516 ../roundup/admin.py:1599
+#: ../roundup/admin.py:1725 ../roundup/admin.py:1848 ../roundup/admin.py:1880
+#: ../roundup/admin.py:1996 ../roundup/admin.py:2050 ../roundup/admin.py:2098
+#: ../roundup/admin.py:482:555 :1216:1388 :1516 :1599:1725 :1848:1880 :1996:2050
+#: :2098 :606:733 :806:851 :902:999
 msgid "Not enough arguments supplied"
 msgstr ""
 
@@ -358,9 +358,9 @@ msgstr ""
 msgid "Class %(curclassname)s has no property %(pn)s in %(propname)s."
 msgstr ""
 
-#: ../roundup/admin.py:791 ../roundup/admin.py:840 ../roundup/admin.py:1517
-#: ../roundup/admin.py:1530 ../roundup/admin.py:2098 ../roundup/admin.py:791:840
-#: :1517:1530 :2098
+#: ../roundup/admin.py:791 ../roundup/admin.py:840 ../roundup/admin.py:1536
+#: ../roundup/admin.py:1549 ../roundup/admin.py:2120 ../roundup/admin.py:791:840
+#: :1536:1549 :2120
 #, python-format
 msgid "%(classname)s has no property \"%(propname)s\""
 msgstr ""
@@ -422,8 +422,8 @@ msgstr ""
 msgid "property %s is not of type Multilink or Link so -d flag does not apply."
 msgstr ""
 
-#: ../roundup/admin.py:942 ../roundup/admin.py:1190 ../roundup/admin.py:1842
-#: ../roundup/admin.py:1870 ../roundup/admin.py:942:1190 :1842:1870
+#: ../roundup/admin.py:942 ../roundup/admin.py:1190 ../roundup/admin.py:1864
+#: ../roundup/admin.py:1892 ../roundup/admin.py:942:1190 :1864:1892
 #, python-format
 msgid "no such %(classname)s node \"%(nodeid)s\""
 msgstr ""
@@ -538,7 +538,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1287
+#: ../roundup/admin.py:1306
 msgid ""
 "Usage: importtables export_dir\n"
 "        This imports the database tables exported using exporttables.\n"
@@ -548,7 +548,7 @@ msgid ""
 msgstr ""
 
 #. password
-#: ../roundup/admin.py:1295
+#: ../roundup/admin.py:1314
 msgid ""
 "Usage: initialise [adminpw]\n"
 "        Initialise a new Roundup tracker.\n"
@@ -559,30 +559,30 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1309
+#: ../roundup/admin.py:1328
 msgid "Admin Password: "
 msgstr ""
 
-#: ../roundup/admin.py:1310
+#: ../roundup/admin.py:1329
 msgid "       Confirm: "
 msgstr ""
 
-#: ../roundup/admin.py:1314
+#: ../roundup/admin.py:1333
 msgid "Instance home does not exist"
 msgstr ""
 
-#: ../roundup/admin.py:1318
+#: ../roundup/admin.py:1337
 msgid "Instance has not been installed"
 msgstr ""
 
-#: ../roundup/admin.py:1326
+#: ../roundup/admin.py:1345
 msgid ""
 "WARNING: The database is already initialised!\n"
 "If you re-initialise it, you will lose all the data!\n"
 "Erase it? Y/N: "
 msgstr ""
 
-#: ../roundup/admin.py:1346
+#: ../roundup/admin.py:1365
 msgid ""
 "Usage: install [template [backend [key=val[,key=val]]]]\n"
 "        Install a new Roundup tracker.\n"
@@ -608,12 +608,12 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1375
+#: ../roundup/admin.py:1394
 #, python-format
 msgid "Instance home parent directory \"%(parent)s\" does not exist"
 msgstr ""
 
-#: ../roundup/admin.py:1384
+#: ../roundup/admin.py:1403
 #, python-format
 msgid ""
 "WARNING: There appears to be a tracker in \"%(tracker_home)s\"!\n"
@@ -621,20 +621,20 @@ msgid ""
 "Erase it? Y/N: "
 msgstr ""
 
-#: ../roundup/admin.py:1397
+#: ../roundup/admin.py:1416
 msgid "Select template"
 msgstr ""
 
-#: ../roundup/admin.py:1407
+#: ../roundup/admin.py:1426
 msgid "Select backend"
 msgstr ""
 
-#: ../roundup/admin.py:1418
+#: ../roundup/admin.py:1437
 #, python-format
 msgid "Error in configuration settings: \"%s\""
 msgstr ""
 
-#: ../roundup/admin.py:1451
+#: ../roundup/admin.py:1470
 #, python-format
 msgid ""
 "\n"
@@ -643,11 +643,11 @@ msgid ""
 "   %(config_file)s"
 msgstr ""
 
-#: ../roundup/admin.py:1461
+#: ../roundup/admin.py:1480
 msgid " ... at a minimum, you must set following options:"
 msgstr ""
 
-#: ../roundup/admin.py:1466
+#: ../roundup/admin.py:1485
 #, python-format
 msgid ""
 "\n"
@@ -663,7 +663,7 @@ msgid ""
 "---------------------------------------------------------------------------\n"
 msgstr ""
 
-#: ../roundup/admin.py:1482
+#: ../roundup/admin.py:1501
 msgid ""
 "Usage: list classname [property]\n"
 "        List the instances of a class.\n"
@@ -679,17 +679,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1495
+#: ../roundup/admin.py:1514
 msgid "Too many arguments supplied"
 msgstr ""
 
-#: ../roundup/admin.py:1528
+#: ../roundup/admin.py:1547
 #, python-format
 msgid "%(nodeid)4s: %(value)s"
 msgstr ""
 
 #. noqa: ARG002  - args unused
-#: ../roundup/admin.py:1535
+#: ../roundup/admin.py:1554
 msgid ""
 "Usage: migrate\n"
 "        Update a tracker's database to be compatible with the Roundup\n"
@@ -712,17 +712,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1555
+#: ../roundup/admin.py:1574
 #, python-format
 msgid "Tracker updated to schema version %s."
 msgstr ""
 
-#: ../roundup/admin.py:1559
+#: ../roundup/admin.py:1578
 #, python-format
 msgid "No migration action required. At schema version %s."
 msgstr ""
 
-#: ../roundup/admin.py:1564
+#: ../roundup/admin.py:1583
 msgid ""
 "Usage: pack period | date\n"
 "        Remove journal entries older than the date/period.\n"
@@ -742,11 +742,11 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1590
+#: ../roundup/admin.py:1609
 msgid "Invalid format"
 msgstr ""
 
-#: ../roundup/admin.py:1601
+#: ../roundup/admin.py:1620
 msgid ""
 "Usage: perftest [mode] [arguments]*\n"
 "        Time operations in Roundup.\n"
@@ -764,25 +764,25 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1635
+#: ../roundup/admin.py:1657
 msgid "Invalid 'rounds'. Must be larger than 999."
 msgstr ""
 
-#: ../roundup/admin.py:1639
+#: ../roundup/admin.py:1661
 #, python-format
 msgid "Invalid 'rounds'. It must be an integer not: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1666
+#: ../roundup/admin.py:1688
 msgid "scheme does not support rounds."
 msgstr ""
 
-#: ../roundup/admin.py:1669
+#: ../roundup/admin.py:1691
 #, python-format
 msgid "Hash time: %(time)0.9f seconds, scheme: %(scheme)s, rounds: %(rounds)s"
 msgstr ""
 
-#: ../roundup/admin.py:1675
+#: ../roundup/admin.py:1697
 msgid ""
 "Usage: pragma setting=value | 'list'\n"
 "        Set internal admin settings to a value.\n"
@@ -811,49 +811,49 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1710
+#: ../roundup/admin.py:1732
 #, python-format
 msgid "Argument must be setting=value, was given: %s."
 msgstr ""
 
-#: ../roundup/admin.py:1713
+#: ../roundup/admin.py:1735
 msgid "Current settings and values (NYI - not yet implemented):"
 msgstr ""
 
-#: ../roundup/admin.py:1724
+#: ../roundup/admin.py:1746
 msgid ""
 "      Help for this pragma is missing. Please report it to the Roundup "
 "project.\n"
 msgstr ""
 
-#: ../roundup/admin.py:1730
+#: ../roundup/admin.py:1752
 #, python-format
 msgid "Unknown setting %s. Try \"pragma list\"."
 msgstr ""
 
-#: ../roundup/admin.py:1740
+#: ../roundup/admin.py:1762
 #, python-format
 msgid "Incorrect value for boolean setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1747
+#: ../roundup/admin.py:1769
 #, python-format
 msgid "Incorrect value for integer setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1754
+#: ../roundup/admin.py:1776
 #, python-format
 msgid ""
 "Incorrect value for setting %(setting)s: %(value)s. Should be no, both, or "
 "only."
 msgstr ""
 
-#: ../roundup/admin.py:1764
+#: ../roundup/admin.py:1786
 #, python-format
 msgid "Internal error: pragma can not handle values of type: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1773
+#: ../roundup/admin.py:1795
 msgid ""
 "Usage: reindex [classname|classname:#-#|designator]*\n"
 "        Re-generate a tracker's search indexes.\n"
@@ -870,17 +870,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1795
+#: ../roundup/admin.py:1817
 #, python-format
 msgid "no such item \"%(designator)s\""
 msgstr ""
 
-#: ../roundup/admin.py:1805
+#: ../roundup/admin.py:1827
 #, python-format
 msgid "no such item \"%(class)s%(id)s\""
 msgstr ""
 
-#: ../roundup/admin.py:1817
+#: ../roundup/admin.py:1839
 msgid ""
 "Usage: restore designator[,designator]*\n"
 "        Restore the retired node specified by designator.\n"
@@ -892,7 +892,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1848
+#: ../roundup/admin.py:1870
 msgid ""
 "Usage: retire designator[,designator]*\n"
 "        Retire the node specified by designator.\n"
@@ -906,7 +906,7 @@ msgid ""
 msgstr ""
 
 #. noqa: ARG002 - args unused
-#: ../roundup/admin.py:1876
+#: ../roundup/admin.py:1898
 msgid ""
 "Usage: rollback\n"
 "        Undo all changes that are pending commit to the database.\n"
@@ -918,7 +918,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1889
+#: ../roundup/admin.py:1911
 msgid ""
 "Usage: security [Role name]\n"
 "        Display the Permissions available to one or all Roles.\n"
@@ -931,46 +931,46 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1904
+#: ../roundup/admin.py:1926
 #, python-format
 msgid "No such Role \"%(role)s\"\n"
 msgstr ""
 
-#: ../roundup/admin.py:1910
+#: ../roundup/admin.py:1932
 #, python-format
 msgid "New Web users get the Roles \"%(role)s\"\n"
 msgstr ""
 
-#: ../roundup/admin.py:1913
+#: ../roundup/admin.py:1935
 #, python-format
 msgid "New Web users get the Role \"%(role)s\"\n"
 msgstr ""
 
-#: ../roundup/admin.py:1917
+#: ../roundup/admin.py:1939
 #, python-format
 msgid "New Email users get the Roles \"%(role)s\"\n"
 msgstr ""
 
-#: ../roundup/admin.py:1919
+#: ../roundup/admin.py:1941
 #, python-format
 msgid "New Email users get the Role \"%(role)s\"\n"
 msgstr ""
 
-#: ../roundup/admin.py:1922
+#: ../roundup/admin.py:1944
 #, python-format
 msgid "Role \"%(name)s\":\n"
 msgstr ""
 
-#: ../roundup/admin.py:1928
+#: ../roundup/admin.py:1950
 msgid " %(description)s (%(name)s for \"%(klass)s\""
 msgstr ""
 
-#: ../roundup/admin.py:1928
+#: ../roundup/admin.py:1950
 #, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\": %(properties)s only)\n"
 msgstr ""
 
-#: ../roundup/admin.py:1941
+#: ../roundup/admin.py:1963
 #, python-format
 msgid ""
 "\n"
@@ -978,17 +978,17 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/admin.py:1947
+#: ../roundup/admin.py:1969
 #, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\" only)\n"
 msgstr ""
 
-#: ../roundup/admin.py:1950
+#: ../roundup/admin.py:1972
 #, python-format
 msgid " %(description)s (%(name)s)\n"
 msgstr ""
 
-#: ../roundup/admin.py:1954
+#: ../roundup/admin.py:1976
 msgid ""
 "Usage: set items property=value [property=value ...]\n"
 "        Set the given properties of one or more items(s).\n"
@@ -1009,7 +1009,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2022
+#: ../roundup/admin.py:2044
 msgid ""
 "Usage: specification classname\n"
 "        Show the properties for a classname.\n"
@@ -1018,17 +1018,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2041
+#: ../roundup/admin.py:2063
 #, python-format
 msgid "%(key)s: %(value)s (key property)\n"
 msgstr ""
 
-#: ../roundup/admin.py:2044
+#: ../roundup/admin.py:2066
 #, python-format
 msgid "%(key)s: %(value)s\n"
 msgstr ""
 
-#: ../roundup/admin.py:2047
+#: ../roundup/admin.py:2069
 msgid ""
 "Usage: table classname [property[,property]*]\n"
 "        List the instances of a class in tabular form.\n"
@@ -1060,17 +1060,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2093
+#: ../roundup/admin.py:2115
 #, python-format
 msgid "\"%(spec)s\" not name:width"
 msgstr ""
 
-#: ../roundup/admin.py:2115
+#: ../roundup/admin.py:2137
 #, python-format
 msgid "\"%(spec)s\" does not have an integer width: \"%(width)s\""
 msgstr ""
 
-#: ../roundup/admin.py:2151
+#: ../roundup/admin.py:2173
 msgid ""
 "Usage: templates [trace_search]\n"
 "        List templates and their installed directories.\n"
@@ -1080,7 +1080,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2179
+#: ../roundup/admin.py:2201
 msgid ""
 "Usage: updateconfig <filename>\n"
 "        Merge existing tracker config with new settings.\n"
@@ -1090,49 +1090,49 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2188 ../roundup/cgi/actions.py:886
+#: ../roundup/admin.py:2210 ../roundup/cgi/actions.py:886
 #: ../roundup/cgi/actions.py:897 ../roundup/cgi/actions.py:1099
 #: ../roundup/cgi/actions.py:1113 ../roundup/cgi/actions.py:886:897 :1099:1113
 #, python-format
 msgid "Error: %s"
 msgstr ""
 
-#: ../roundup/admin.py:2220
+#: ../roundup/admin.py:2242
 #, python-format
 msgid "Unknown command \"%(command)s\" (\"help commands\" for a list)"
 msgstr ""
 
-#: ../roundup/admin.py:2226
+#: ../roundup/admin.py:2248
 #, python-format
 msgid "Multiple commands match \"%(command)s\": %(list)s"
 msgstr ""
 
-#: ../roundup/admin.py:2241
+#: ../roundup/admin.py:2263
 msgid "Enter tracker home: "
 msgstr ""
 
-#: ../roundup/admin.py:2270 ../roundup/admin.py:2274
-#: ../roundup/admin.py:2270:2274
+#: ../roundup/admin.py:2292 ../roundup/admin.py:2296
+#: ../roundup/admin.py:2292:2296
 #, python-format
 msgid "Error: Couldn't open tracker: %(message)s"
 msgstr ""
 
-#: ../roundup/admin.py:2322
+#: ../roundup/admin.py:2344
 #, python-format
 msgid ""
 "Roundup %s ready for input.\n"
 "Type \"help\" for help."
 msgstr ""
 
-#: ../roundup/admin.py:2355
+#: ../roundup/admin.py:2377
 msgid "Note: command history and editing not available"
 msgstr ""
 
-#: ../roundup/admin.py:2361
+#: ../roundup/admin.py:2383
 msgid "exit..."
 msgstr ""
 
-#: ../roundup/admin.py:2374
+#: ../roundup/admin.py:2396
 msgid "There are unsaved changes. Commit them (y/N)? "
 msgstr ""
 
@@ -1158,22 +1158,22 @@ msgstr ""
 msgid "Couldn't open database - the required module '%s' is not available"
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:871 ../roundup/backends/back_anydbm.py:884
-#: ../roundup/backends/back_anydbm.py:1158
-#: ../roundup/backends/back_anydbm.py:1193
-#: ../roundup/backends/back_anydbm.py:1422
-#: ../roundup/backends/back_anydbm.py:1440
-#: ../roundup/backends/back_anydbm.py:1487
-#: ../roundup/backends/back_anydbm.py:2123
-#: ../roundup/backends/back_anydbm.py:871:884
+#: ../roundup/backends/back_anydbm.py:873 ../roundup/backends/back_anydbm.py:886
+#: ../roundup/backends/back_anydbm.py:1160
+#: ../roundup/backends/back_anydbm.py:1195
+#: ../roundup/backends/back_anydbm.py:1424
+#: ../roundup/backends/back_anydbm.py:1442
+#: ../roundup/backends/back_anydbm.py:1489
+#: ../roundup/backends/back_anydbm.py:2135
+#: ../roundup/backends/back_anydbm.py:873:886
 #: ../roundup/backends/rdbms_common.py:1720
 #: ../roundup/backends/rdbms_common.py:1967
 #: ../roundup/backends/rdbms_common.py:2206
 #: ../roundup/backends/rdbms_common.py:2226
 #: ../roundup/backends/rdbms_common.py:2279
-#: ../roundup/backends/rdbms_common.py:3246
-#: ../roundup/backends/rdbms_common.py:1720:1967 :1158:1193 :1422:1440 :1487
-#: :2123 :2206:2226 :2279:3246
+#: ../roundup/backends/rdbms_common.py:3254
+#: ../roundup/backends/rdbms_common.py:1720:1967 :1160:1195 :1424:1442 :1489
+#: :2135 :2206:2226 :2279:3254
 msgid "Database open read-only"
 msgstr ""
 
@@ -1555,13 +1555,13 @@ msgstr ""
 msgid "You do not have permission to login"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1577 ../roundup/cgi/actions.py:1761
-#: ../roundup/cgi/actions.py:1577:1761
+#: ../roundup/cgi/actions.py:1577 ../roundup/cgi/actions.py:1757
+#: ../roundup/cgi/actions.py:1577:1757
 #, python-format
 msgid "Column \"%(column)s\" not found in %(class)s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1832
+#: ../roundup/cgi/actions.py:1822
 #, python-format
 msgid "You do not have permission to view %(class)s"
 msgstr ""
@@ -1637,7 +1637,7 @@ msgstr ""
 msgid "<em>undefined</em>"
 msgstr ""
 
-#: ../roundup/cgi/client.py:105
+#: ../roundup/cgi/client.py:111
 msgid ""
 "<html><head><title>An error has occurred</title></head>\n"
 "<body><h1>An error has occurred</h1>\n"
@@ -1646,154 +1646,160 @@ msgid ""
 "</body></html>"
 msgstr ""
 
-#: ../roundup/cgi/client.py:717 ../roundup/cgi/client.py:1635
-#: ../roundup/cgi/client.py:717:1635
+#: ../roundup/cgi/client.py:666
+msgid ""
+"XMLRPC endpoint is not using defusedxml. Improve security by installing "
+"defusedxml."
+msgstr ""
+
+#: ../roundup/cgi/client.py:728 ../roundup/cgi/client.py:1646
+#: ../roundup/cgi/client.py:728:1646
 msgid "Required Header Missing"
 msgstr ""
 
-#: ../roundup/cgi/client.py:719
+#: ../roundup/cgi/client.py:731
 msgid "Client is not allowed to use Rest Interface."
 msgstr ""
 
-#: ../roundup/cgi/client.py:971
+#: ../roundup/cgi/client.py:985
 msgid "Form Error: "
 msgstr ""
 
-#: ../roundup/cgi/client.py:1064
+#: ../roundup/cgi/client.py:1078
 #, python-format
 msgid "Unrecognized charset: %r"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1331 ../roundup/cgi/client.py:2294
-#: ../roundup/cgi/client.py:1331:2294
+#: ../roundup/cgi/client.py:1345 ../roundup/cgi/client.py:2357
+#: ../roundup/cgi/client.py:1345:2357
 msgid "broken form: multiple @action values submitted"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1348
+#: ../roundup/cgi/client.py:1362
 msgid "Anonymous users are not allowed to use the web interface"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1496
+#: ../roundup/cgi/client.py:1507
 msgid "Referer header not available."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1500
+#: ../roundup/cgi/client.py:1511
 #, python-format
 msgid "csrf key used with wrong method from: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1529
+#: ../roundup/cgi/client.py:1540
 #, python-format
 msgid "csrf header %(header)s required but missing for user%(userid)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1533
+#: ../roundup/cgi/client.py:1544
 #, python-format
 msgid "Missing header: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1541
+#: ../roundup/cgi/client.py:1552
 #, python-format
 msgid "csrf Referer header check failed for user%(userid)s. Value=%(referer)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1546
+#: ../roundup/cgi/client.py:1557
 #, python-format
 msgid "Invalid Referer: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1561
+#: ../roundup/cgi/client.py:1572
 #, python-format
 msgid "csrf Origin header check failed for user%(userid)s. Value=%(origin)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1566
+#: ../roundup/cgi/client.py:1577
 #, python-format
 msgid "Invalid Origin %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1580
+#: ../roundup/cgi/client.py:1591
 #, python-format
 msgid ""
 "csrf X-FORWARDED-HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1586
+#: ../roundup/cgi/client.py:1597
 #, python-format
 msgid "Invalid X-FORWARDED-HOST %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1605
+#: ../roundup/cgi/client.py:1616
 #, python-format
 msgid "csrf HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1610
+#: ../roundup/cgi/client.py:1621
 #, python-format
 msgid "Invalid HOST %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1618
+#: ../roundup/cgi/client.py:1629
 msgid "Csrf: unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1619
+#: ../roundup/cgi/client.py:1630
 msgid "Unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1632
+#: ../roundup/cgi/client.py:1643
 #, python-format
 msgid "csrf X-REQUESTED-WITH xmlrpc required header check failed for user%s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1673
+#: ../roundup/cgi/client.py:1684
 #, python-format
 msgid "Required csrf field missing for user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1675 ../roundup/cgi/client.py:1702
-#: ../roundup/cgi/client.py:1719 ../roundup/cgi/client.py:1675:1702 :1719
+#: ../roundup/cgi/client.py:1686 ../roundup/cgi/client.py:1713
+#: ../roundup/cgi/client.py:1730 ../roundup/cgi/client.py:1686:1713 :1730
 msgid ""
 "We can't validate your session (csrf failure). Re-enter any unsaved data and "
 "try again."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1679
+#: ../roundup/cgi/client.py:1690
 #, python-format
 msgid "csrf field not supplied by user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1691
+#: ../roundup/cgi/client.py:1702
 #, python-format
 msgid ""
 "Csrf mismatch user: current user %(user)s != stored user %(stored)s, current "
 "session, stored session: %(cur_sess)s,%(stor_sess)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1709
+#: ../roundup/cgi/client.py:1720
 #, python-format
 msgid ""
 "Csrf mismatch user: current session %(curr_sess)s != stored session "
 "%(stor_sess)s, current user/stored user is: %(user)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1901
+#: ../roundup/cgi/client.py:1912
 msgid "You are not allowed to view this file."
 msgstr ""
 
-#: ../roundup/cgi/client.py:2172
+#: ../roundup/cgi/client.py:2235
 #, python-format
 msgid "%(starttag)sTime elapsed: %(seconds)fs%(endtag)s\n"
 msgstr ""
 
-#: ../roundup/cgi/client.py:2176
+#: ../roundup/cgi/client.py:2239
 #, python-format
 msgid ""
 "%(starttag)sCache hits: %(cache_hits)d, misses %(cache_misses)d. Loading "
 "items: %(get_items)f secs. Filtering: %(filtering)f secs.%(endtag)s\n"
 msgstr ""
 
-#: ../roundup/cgi/client.py:2716
+#: ../roundup/cgi/client.py:2778
 #, python-format
 msgid ""
 "Cache failure: compressed file %(compressed)s is older than its source file "
@@ -2185,17 +2191,17 @@ msgstr ""
 msgid "Not a property name: %s"
 msgstr ""
 
-#: ../roundup/hyperdb.py:1984
+#: ../roundup/hyperdb.py:2038
 #, python-format
 msgid "property %(property)s: %(value)r is not a %(classname)s."
 msgstr ""
 
-#: ../roundup/hyperdb.py:1990
+#: ../roundup/hyperdb.py:2044
 #, python-format
 msgid "you may only enter ID values for property %s"
 msgstr ""
 
-#: ../roundup/hyperdb.py:2025
+#: ../roundup/hyperdb.py:2079
 #, python-format
 msgid "%(property)r is not a property of %(classname)s"
 msgstr ""
@@ -2433,6 +2439,22 @@ msgstr ""
 msgid "not of form [arg=value,value,...;arg=value,value,...]"
 msgstr ""
 
+#: ../roundup/mlink_expr.py:161
+#, python-format
+msgid ""
+"There was an error searching %(class)s by %(attr)s using: %(opcodes)s. The "
+"operator %(opcode)s (%(opcodename)s) at position %(position)d has too few "
+"arguments."
+msgstr ""
+
+#: ../roundup/mlink_expr.py:174
+#, python-format
+msgid ""
+"There was an error searching %(class)s by %(attr)s using: %(opcodes)s. There "
+"are too many arguments for the existing operators. The values on the stack "
+"are: %(stack)s"
+msgstr ""
+
 #: ../roundup/pygettext.py:401
 #, python-format
 msgid "*** %(file)s:%(lineno)s: Seen unexpected token \"%(token)s\""
@@ -2490,42 +2512,63 @@ msgstr ""
 msgid "morethanonestring"
 msgstr ""
 
-#: ../roundup/rest.py:410
+#: ../roundup/rest.py:417
 #, python-format
 msgid "Method %(m)s not allowed. Allowed: %(a)s"
 msgstr ""
 
-#: ../roundup/rest.py:948
+#: ../roundup/rest.py:964
 #, python-format
 msgid ""
 "Page size %(page_size)s must be less than admin limit on query result size: "
 "%(max_size)s."
 msgstr ""
 
-#: ../roundup/rest.py:1193
+#: ../roundup/rest.py:1211
 #, python-format
 msgid "Invalid attribute %s"
 msgstr ""
 
-#: ../roundup/rest.py:2182
+#: ../roundup/rest.py:2199
 #, python-format
 msgid "Api rate limits exceeded. Please wait: %s seconds."
 msgstr ""
 
-#: ../roundup/rest.py:2258
+#: ../roundup/rest.py:2283
 #, python-format
 msgid ""
-"Unable to parse Accept Header. %(error)s. Acceptable types: "
+"Content type '%s' requested in URL is not available.\n"
+"Acceptable types: %s\n"
+msgstr ""
+
+#: ../roundup/rest.py:2304
+#, python-format
+msgid ""
+"Unable to parse Accept Header. %(error)s. Acceptable types: */*, "
 "%(acceptable_types)s"
 msgstr ""
 
-#: ../roundup/rest.py:2441
+#: ../roundup/rest.py:2376 ../roundup/rest.py:2597 ../roundup/rest.py:2376:2597
 #, python-format
 msgid ""
 "Unrecognized api version: %s. See /rest without specifying api version for "
 "supported versions."
 msgstr ""
 
+#: ../roundup/rest.py:2411 ../roundup/rest.py:2420 ../roundup/rest.py:2411:2420
+#, python-format
+msgid ""
+"Requested content type(s) '%s' not available.\n"
+"Acceptable mime types are: */*, %s"
+msgstr ""
+
+#: ../roundup/rest.py:2696
+msgid ""
+"Internal error while formatting response.\n"
+"accept_mime_type is not defined. This should\n"
+"never happen\n"
+msgstr ""
+
 #: ../roundup/roundupdb.py:140
 #, python-format
 msgid "Username '%s' already exists."
@@ -2677,90 +2720,90 @@ msgid ""
 "\"imap\", \"imaps\",  \"imaps_cram\", or \"imaps_oauth\""
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:112
+#: ../roundup/scripts/roundup_server.py:113
 msgid "WARNING: generating temporary SSL certificate"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:143
+#: ../roundup/scripts/roundup_server.py:144
 #, python-format
 msgid "Unable to find/use key from file: %(pemfile)s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:144
+#: ../roundup/scripts/roundup_server.py:145
 msgid ""
 "Does it have a private key surrounded by '-----BEGIN PRIVATE KEY-----' and\n"
 "  '-----END PRIVATE KEY-----' markers?"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:149
+#: ../roundup/scripts/roundup_server.py:150
 #, python-format
 msgid "Unable to find/use certificate from file: %(pemfile)s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:150
+#: ../roundup/scripts/roundup_server.py:151
 msgid ""
 "Does it have a certificate surrounded by '-----BEGIN CERTIFICATE-----' and\n"
 "  '-----END CERTIFICATE-----' markers?"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:344
+#: ../roundup/scripts/roundup_server.py:345
 msgid ""
 "<html><head><title>Roundup trackers index</title></head>\n"
 "<body><h1>Roundup trackers index</h1><ol>\n"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:570
+#: ../roundup/scripts/roundup_server.py:587
 #, python-format
 msgid "Error: %(type)s: %(value)s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:582
+#: ../roundup/scripts/roundup_server.py:599
 msgid "WARNING: ignoring \"-g\" argument, not root"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:588
+#: ../roundup/scripts/roundup_server.py:605
 msgid "Can't change groups - no grp module"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:597
+#: ../roundup/scripts/roundup_server.py:614
 #, python-format
 msgid "Group %(group)s doesn't exist"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:609
+#: ../roundup/scripts/roundup_server.py:626
 msgid "Can't run as root!"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:612
+#: ../roundup/scripts/roundup_server.py:629
 msgid "WARNING: ignoring \"-u\" argument, not root"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:618
+#: ../roundup/scripts/roundup_server.py:635
 msgid "Can't change users - no pwd module"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:627
+#: ../roundup/scripts/roundup_server.py:644
 #, python-format
 msgid "User %(user)s doesn't exist"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:833
+#: ../roundup/scripts/roundup_server.py:856
 #, python-format
 msgid "Multiprocess mode \"%s\" is not available, switching to single-process"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:861
+#: ../roundup/scripts/roundup_server.py:884
 #, python-format
 msgid "Unable to bind to port %s, port already in use."
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:865
+#: ../roundup/scripts/roundup_server.py:888
 #, python-format
 msgid ""
 "Unable to bind to port %(port)s, access not allowed, errno: %(errno)s %(msg)s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:944
+#: ../roundup/scripts/roundup_server.py:967
 msgid ""
 " -c <Command>  Windows Service options.\n"
 "               If you want to run the server as a Windows Service, you\n"
@@ -2770,16 +2813,17 @@ msgid ""
 "               specifics."
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:951
+#: ../roundup/scripts/roundup_server.py:974
 msgid ""
 " -u <UID>      runs the Roundup web server as this UID\n"
 " -g <GID>      runs the Roundup web server as this GID\n"
 " -d <PIDfile>  run the server in the background and write the server's PID\n"
 "               to the file indicated by PIDfile. The -l option *must* be\n"
-"               specified if -d is used."
+"               specified if -d is used.\n"
+" -D            run the server in the foreground even when -d is used."
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:958
+#: ../roundup/scripts/roundup_server.py:982
 #, python-format
 msgid ""
 "\n"
@@ -2803,6 +2847,10 @@ msgid ""
 " -m <children> maximum number of children to spawn in fork multiprocess mode\n"
 " -s            enable SSL\n"
 " -L            http request logging uses python logging (roundup.http)\n"
+" -P            log client address/name using reverse proxy X-Forwarded-For\n"
+"               header and not the connection IP (which is the reverse "
+"proxy).\n"
+"               Appends a '+' sign to the logged address/name.\n"
 " -e <fname>    PEM file containing SSL key and certificate\n"
 " -t <mode>     multiprocess mode (default: %(mp_def)s).\n"
 "               Allowed values: %(mp_types)s.\n"
@@ -2847,20 +2895,20 @@ msgid ""
 "   any url-unsafe characters like spaces, as these confuse IE.\n"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:1135
+#: ../roundup/scripts/roundup_server.py:1162
 msgid "Instances must be name=home"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:1149
+#: ../roundup/scripts/roundup_server.py:1176
 #, python-format
 msgid "Configuration saved to %s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:1167
+#: ../roundup/scripts/roundup_server.py:1194
 msgid "Sorry, you can't run the server as a daemon on this Operating System"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:1187
+#: ../roundup/scripts/roundup_server.py:1214
 #, python-format
 msgid "Roundup server started on %(HOST)s:%(PORT)s"
 msgstr ""
diff --git a/locale/ru.po b/locale/ru.po
index 78751472f..81e578274 100644
--- a/locale/ru.po
+++ b/locale/ru.po
@@ -5,9 +5,9 @@
 #
 msgid ""
 msgstr ""
-"Project-Id-Version: Roundup 2.4.0\n"
+"Project-Id-Version: Roundup 2.5.0\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
-"POT-Creation-Date: 2024-08-07 21:43-0400\n"
+"POT-Creation-Date: 2024-12-30 22:49-0500\n"
 "PO-Revision-Date: 2013-10-31 12:21+0100\n"
 "Last-Translator: alexander smishlajev <alex@tycobka.lv>\n"
 "Language-Team: Russian\n"
@@ -84,8 +84,8 @@ msgstr ""
 msgid "Enable verbose output: tracing, descriptions...\n"
 msgstr ""
 
-#: ../roundup/admin.py:175 ../roundup/admin.py:1188 ../roundup/admin.py:1836
-#: ../roundup/admin.py:1868 ../roundup/admin.py:175:1188 :1836:1868
+#: ../roundup/admin.py:175 ../roundup/admin.py:1188 ../roundup/admin.py:1858
+#: ../roundup/admin.py:1890 ../roundup/admin.py:175:1188 :1858:1890
 #, python-format
 msgid "no such class \"%(classname)s\""
 msgstr "ëÌÁÓÓ \"%(classname)s\" ÎÅ ÓÕÝÅÓÔ×ÕÅÔ"
@@ -313,13 +313,13 @@ msgstr ""
 msgid "%s:"
 msgstr ""
 
-#: ../roundup/admin.py:439 ../roundup/admin.py:1396
-#: ../roundup/admin.py:439:1396
+#: ../roundup/admin.py:439 ../roundup/admin.py:1415
+#: ../roundup/admin.py:439:1415
 msgid "Templates:"
 msgstr "ûÁÂÌÏÎÙ:"
 
-#: ../roundup/admin.py:442 ../roundup/admin.py:1406
-#: ../roundup/admin.py:442:1406
+#: ../roundup/admin.py:442 ../roundup/admin.py:1425
+#: ../roundup/admin.py:442:1425
 msgid "Back ends:"
 msgstr "óÅÒ×ÅÒÙ:"
 
@@ -369,11 +369,11 @@ msgstr ""
 #: ../roundup/admin.py:482 ../roundup/admin.py:555 ../roundup/admin.py:606
 #: ../roundup/admin.py:733 ../roundup/admin.py:806 ../roundup/admin.py:851
 #: ../roundup/admin.py:902 ../roundup/admin.py:999 ../roundup/admin.py:1216
-#: ../roundup/admin.py:1369 ../roundup/admin.py:1497 ../roundup/admin.py:1580
-#: ../roundup/admin.py:1703 ../roundup/admin.py:1826 ../roundup/admin.py:1858
-#: ../roundup/admin.py:1974 ../roundup/admin.py:2028 ../roundup/admin.py:2076
-#: ../roundup/admin.py:482:555 :1216:1369:1497 :1580:1703 :1826:1858 :1974:2028
-#: :2076 :606:733 :806:851 :902:999
+#: ../roundup/admin.py:1388 ../roundup/admin.py:1516 ../roundup/admin.py:1599
+#: ../roundup/admin.py:1725 ../roundup/admin.py:1848 ../roundup/admin.py:1880
+#: ../roundup/admin.py:1996 ../roundup/admin.py:2050 ../roundup/admin.py:2098
+#: ../roundup/admin.py:482:555 :1216:1388:1516 :1599:1725 :1848:1880 :1996:2050
+#: :2098 :606:733 :806:851 :902:999
 msgid "Not enough arguments supplied"
 msgstr "îÅÄÏÓÔÁÔÏÞÎÏ ÁÒÇÕÍÅÎÔÏ×"
 
@@ -536,9 +536,9 @@ msgstr ""
 msgid "Class %(curclassname)s has no property %(pn)s in %(propname)s."
 msgstr "ëÌÁÓÓ %(classname)s ÎÅ ÉÍÅÅÔ ÁÔÒÉÂÕÔÁ \"%(propname)s\""
 
-#: ../roundup/admin.py:791 ../roundup/admin.py:840 ../roundup/admin.py:1517
-#: ../roundup/admin.py:1530 ../roundup/admin.py:2098
-#: ../roundup/admin.py:791:840 :1517:1530:2098
+#: ../roundup/admin.py:791 ../roundup/admin.py:840 ../roundup/admin.py:1536
+#: ../roundup/admin.py:1549 ../roundup/admin.py:2120
+#: ../roundup/admin.py:791:840 :1536:1549:2120
 #, python-format
 msgid "%(classname)s has no property \"%(propname)s\""
 msgstr "ëÌÁÓÓ %(classname)s ÎÅ ÉÍÅÅÔ ÁÔÒÉÂÕÔÁ \"%(propname)s\""
@@ -621,8 +621,8 @@ msgid "property %s is not of type Multilink or Link so -d flag does not apply."
 msgstr ""
 "ëÌÀÞ '-d' ÎÅÐÒÉÍÅÎÉÍ, ÐÏÔÏÍÕ ÞÔÏ ÔÉÐ ÁÔÒÉÂÕÔÁ %s - ÎÅ Link É ÎÅ Multilink"
 
-#: ../roundup/admin.py:942 ../roundup/admin.py:1190 ../roundup/admin.py:1842
-#: ../roundup/admin.py:1870 ../roundup/admin.py:942:1190 :1842:1870
+#: ../roundup/admin.py:942 ../roundup/admin.py:1190 ../roundup/admin.py:1864
+#: ../roundup/admin.py:1892 ../roundup/admin.py:942:1190 :1864:1892
 #, python-format
 msgid "no such %(classname)s node \"%(nodeid)s\""
 msgstr "÷ ËÌÁÓÓÅ %(classname)s ÎÅÔ ÏÂßÅËÔÁ \"%(nodeid)s\""
@@ -777,7 +777,7 @@ msgstr ""
 "        ÉÚ ÓÕÝÅÓÔ×ÕÀÝÅÊ ÂÁÚÙ ×ÓÅ ÏÂßÅËÔÙ).\n"
 "        "
 
-#: ../roundup/admin.py:1287
+#: ../roundup/admin.py:1306
 msgid ""
 "Usage: importtables export_dir\n"
 "        This imports the database tables exported using exporttables.\n"
@@ -788,7 +788,7 @@ msgstr ""
 
 #  password
 #. password
-#: ../roundup/admin.py:1295
+#: ../roundup/admin.py:1314
 msgid ""
 "Usage: initialise [adminpw]\n"
 "        Initialise a new Roundup tracker.\n"
@@ -806,23 +806,23 @@ msgstr ""
 "        éÎÉÃÉÁÌÉÚÁÃÉÑ ÔÒÅËÅÒÁ ÄÅÌÁÅÔÓÑ ÆÕÎËÃÉÅÊ dbinit.init()\n"
 "        "
 
-#: ../roundup/admin.py:1309
+#: ../roundup/admin.py:1328
 msgid "Admin Password: "
 msgstr "ðÁÒÏÌØ ÁÄÍÉÎÉÓÔÒÁÔÏÒÁ: "
 
-#: ../roundup/admin.py:1310
+#: ../roundup/admin.py:1329
 msgid "       Confirm: "
 msgstr "              åÝÅ ÒÁÚ: "
 
-#: ../roundup/admin.py:1314
+#: ../roundup/admin.py:1333
 msgid "Instance home does not exist"
 msgstr "äÏÍÁÛÎÉÊ ËÁÔÁÌÏÇ ÔÒÅËÅÒÁ ÎÅ ÓÕÝÅÓÔ×ÕÅÔ"
 
-#: ../roundup/admin.py:1318
+#: ../roundup/admin.py:1337
 msgid "Instance has not been installed"
 msgstr "ôÒÅËÅÒ ÎÅ ÕÓÔÁÎÏ×ÌÅÎ"
 
-#: ../roundup/admin.py:1326
+#: ../roundup/admin.py:1345
 msgid ""
 "WARNING: The database is already initialised!\n"
 "If you re-initialise it, you will lose all the data!\n"
@@ -832,7 +832,7 @@ msgstr ""
 "ðÏ×ÔÏÒÎÁÑ ÉÎÉÃÉÁÌÉÚÁÃÉÑ ÕÎÉÞÔÏÖÉÔ ×ÓÅ ×ÁÛÉ ÄÁÎÎÙÅ!\n"
 "õÄÁÌÉÔØ ÓÕÝÅÓÔ×ÕÀÝÕÀ ÂÁÚÕ? Y/N: "
 
-#: ../roundup/admin.py:1346
+#: ../roundup/admin.py:1365
 msgid ""
 "Usage: install [template [backend [key=val[,key=val]]]]\n"
 "        Install a new Roundup tracker.\n"
@@ -884,12 +884,12 @@ msgstr ""
 "        óÍ.ÔÁËÖÅ \"help initopts\".\n"
 "        "
 
-#: ../roundup/admin.py:1375
+#: ../roundup/admin.py:1394
 #, python-format
 msgid "Instance home parent directory \"%(parent)s\" does not exist"
 msgstr "ëÁÔÁÌÏÇ \"%(parent)s\" ÎÅ ÓÕÝÅÓÔ×ÕÅÔ"
 
-#: ../roundup/admin.py:1384
+#: ../roundup/admin.py:1403
 #, python-format
 msgid ""
 "WARNING: There appears to be a tracker in \"%(tracker_home)s\"!\n"
@@ -900,22 +900,22 @@ msgstr ""
 "ðÏ×ÔÏÒÎÁÑ ÕÓÔÁÎÏ×ËÁ ÕÎÉÞÔÏÖÉÔ ×ÓÅ ×ÁÛÉ ÄÁÎÎÙÅ!\n"
 "õÄÁÌÉÔØ ÓÕÝÅÓÔ×ÕÀÝÉÊ ÔÒÅËÅÒ? Y/N: "
 
-#: ../roundup/admin.py:1397
+#: ../roundup/admin.py:1416
 #, fuzzy
 msgid "Select template"
 msgstr "÷ÙÂÅÒÉÔÅ ÛÁÂÌÏÎ [classic]: "
 
-#: ../roundup/admin.py:1407
+#: ../roundup/admin.py:1426
 #, fuzzy
 msgid "Select backend"
 msgstr "÷ÙÂÅÒÉÔÅ ÓÅÒ×ÅÒ [anydbm]: "
 
-#: ../roundup/admin.py:1418
+#: ../roundup/admin.py:1437
 #, python-format
 msgid "Error in configuration settings: \"%s\""
 msgstr "ïÛÉÂËÁ × ÐÁÒÁÍÅÔÒÁÈ ËÏÎÆÉÇÕÒÁÃÉÉ: \"%s\""
 
-#: ../roundup/admin.py:1451
+#: ../roundup/admin.py:1470
 #, python-format
 msgid ""
 "\n"
@@ -928,12 +928,12 @@ msgstr ""
 " ôÅÐÅÒØ ×ÁÍ ÎÕÖÎÏ ÉÓÐÒÁ×ÉÔØ ËÏÎÆÉÇÕÒÁÃÉÏÎÎÙÊ ÆÁÊÌ ÔÒÅËÅÒÁ:\n"
 "   %(config_file)s"
 
-#: ../roundup/admin.py:1461
+#: ../roundup/admin.py:1480
 msgid " ... at a minimum, you must set following options:"
 msgstr " ... ËÁË ÍÉÎÉÍÕÍ, ×Ù ÄÏÌÖÎÙ ÕÓÔÁÎÏ×ÉÔØ ÎÁÓÔÒÏÊËÉ:"
 
 # õËÁÚÁÎÏ ÁÎÇÌÉÊÓËÏÅ ÎÁÚ×ÁÎÉÅ ÄÏËÕÍÅÎÔÁ
-#: ../roundup/admin.py:1466
+#: ../roundup/admin.py:1485
 #, python-format
 msgid ""
 "\n"
@@ -960,7 +960,7 @@ msgstr ""
 " ðÏÓÌÅ ÜÔÏÇÏ ×Ù ÄÏÌÖÎÙ ×ÙÐÏÌÎÉÔØ ËÏÍÁÎÄÕ \"roundup-admin initialise\".\n"
 "---------------------------------------------------------------------------\n"
 
-#: ../roundup/admin.py:1482
+#: ../roundup/admin.py:1501
 msgid ""
 "Usage: list classname [property]\n"
 "        List the instances of a class.\n"
@@ -989,17 +989,17 @@ msgstr ""
 "        ×ÙÄÁÅÔ ÓÐÉÓÏË ÚÎÁÞÅÎÉÊ ÜÔÏÇÏ ÁÔÒÉÂÕÔÁ.\n"
 "        "
 
-#: ../roundup/admin.py:1495
+#: ../roundup/admin.py:1514
 msgid "Too many arguments supplied"
 msgstr "ðÏÄÁÎÏ ÓÌÉÛËÏÍ ÍÎÏÇÏ ÐÁÒÁÍÅÔÒÏ×"
 
-#: ../roundup/admin.py:1528
+#: ../roundup/admin.py:1547
 #, python-format
 msgid "%(nodeid)4s: %(value)s"
 msgstr ""
 
 #. noqa: ARG002  - args unused
-#: ../roundup/admin.py:1535
+#: ../roundup/admin.py:1554
 msgid ""
 "Usage: migrate\n"
 "        Update a tracker's database to be compatible with the Roundup\n"
@@ -1022,17 +1022,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1555
+#: ../roundup/admin.py:1574
 #, python-format
 msgid "Tracker updated to schema version %s."
 msgstr ""
 
-#: ../roundup/admin.py:1559
+#: ../roundup/admin.py:1578
 #, python-format
 msgid "No migration action required. At schema version %s."
 msgstr ""
 
-#: ../roundup/admin.py:1564
+#: ../roundup/admin.py:1583
 #, fuzzy
 msgid ""
 "Usage: pack period | date\n"
@@ -1071,11 +1071,11 @@ msgstr ""
 "\n"
 "        "
 
-#: ../roundup/admin.py:1590
+#: ../roundup/admin.py:1609
 msgid "Invalid format"
 msgstr "îÅÐÒÁ×ÉÌØÎÙÊ ÆÏÒÍÁÔ"
 
-#: ../roundup/admin.py:1601
+#: ../roundup/admin.py:1620
 msgid ""
 "Usage: perftest [mode] [arguments]*\n"
 "        Time operations in Roundup.\n"
@@ -1093,25 +1093,25 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1635
+#: ../roundup/admin.py:1657
 msgid "Invalid 'rounds'. Must be larger than 999."
 msgstr ""
 
-#: ../roundup/admin.py:1639
+#: ../roundup/admin.py:1661
 #, python-format
 msgid "Invalid 'rounds'. It must be an integer not: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1666
+#: ../roundup/admin.py:1688
 msgid "scheme does not support rounds."
 msgstr ""
 
-#: ../roundup/admin.py:1669
+#: ../roundup/admin.py:1691
 #, python-format
 msgid "Hash time: %(time)0.9f seconds, scheme: %(scheme)s, rounds: %(rounds)s"
 msgstr ""
 
-#: ../roundup/admin.py:1675
+#: ../roundup/admin.py:1697
 msgid ""
 "Usage: pragma setting=value | 'list'\n"
 "        Set internal admin settings to a value.\n"
@@ -1140,49 +1140,49 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1710
+#: ../roundup/admin.py:1732
 #, python-format
 msgid "Argument must be setting=value, was given: %s."
 msgstr ""
 
-#: ../roundup/admin.py:1713
+#: ../roundup/admin.py:1735
 msgid "Current settings and values (NYI - not yet implemented):"
 msgstr ""
 
-#: ../roundup/admin.py:1724
+#: ../roundup/admin.py:1746
 msgid ""
 "      Help for this pragma is missing. Please report it to the Roundup "
 "project.\n"
 msgstr ""
 
-#: ../roundup/admin.py:1730
+#: ../roundup/admin.py:1752
 #, fuzzy, python-format
 msgid "Unknown setting %s. Try \"pragma list\"."
 msgstr "îÅÉÚ×ÅÓÔÎÏÅ ÉÍÑ ÐÏÌØÚÏ×ÁÔÅÌÑ"
 
-#: ../roundup/admin.py:1740
+#: ../roundup/admin.py:1762
 #, python-format
 msgid "Incorrect value for boolean setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1747
+#: ../roundup/admin.py:1769
 #, python-format
 msgid "Incorrect value for integer setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1754
+#: ../roundup/admin.py:1776
 #, python-format
 msgid ""
 "Incorrect value for setting %(setting)s: %(value)s. Should be no, both, or "
 "only."
 msgstr ""
 
-#: ../roundup/admin.py:1764
+#: ../roundup/admin.py:1786
 #, python-format
 msgid "Internal error: pragma can not handle values of type: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1773
+#: ../roundup/admin.py:1795
 #, fuzzy
 msgid ""
 "Usage: reindex [classname|classname:#-#|designator]*\n"
@@ -1206,17 +1206,17 @@ msgstr ""
 "        ÄÁÎÎÙÈ.  ïÂÙÞÎÏ ÐÏÓÔÒÏÅÎÉÅ ÉÎÄÅËÓÏ× ÐÒÏÉÓÈÏÄÉÔ Á×ÔÏÍÁÔÉÞÅÓËÉ.\n"
 "        "
 
-#: ../roundup/admin.py:1795
+#: ../roundup/admin.py:1817
 #, python-format
 msgid "no such item \"%(designator)s\""
 msgstr "ÏÂßÅËÔ \"%(designator)s\" ÎÅ ÓÕÝÅÓÔ×ÕÅÔ"
 
-#: ../roundup/admin.py:1805
+#: ../roundup/admin.py:1827
 #, fuzzy, python-format
 msgid "no such item \"%(class)s%(id)s\""
 msgstr "ÏÂßÅËÔ \"%(designator)s\" ÎÅ ÓÕÝÅÓÔ×ÕÅÔ"
 
-#: ../roundup/admin.py:1817
+#: ../roundup/admin.py:1839
 #, fuzzy
 msgid ""
 "Usage: restore designator[,designator]*\n"
@@ -1235,7 +1235,7 @@ msgstr ""
 "        ÍÏÖÎÏ ÐÏÌØÚÏ×ÁÔØÓÑ ÓÎÏ×Á.\n"
 "        "
 
-#: ../roundup/admin.py:1848
+#: ../roundup/admin.py:1870
 #, fuzzy
 msgid ""
 "Usage: retire designator[,designator]*\n"
@@ -1258,7 +1258,7 @@ msgstr ""
 "        "
 
 #. noqa: ARG002 - args unused
-#: ../roundup/admin.py:1876
+#: ../roundup/admin.py:1898
 msgid ""
 "Usage: rollback\n"
 "        Undo all changes that are pending commit to the database.\n"
@@ -1279,7 +1279,7 @@ msgstr ""
 "        ÂÙÌÏ × ÍÏÍÅÎÔ ÐÏÓÌÅÄÎÅÊ ÚÁÐÉÓÉ.\n"
 "        "
 
-#: ../roundup/admin.py:1889
+#: ../roundup/admin.py:1911
 msgid ""
 "Usage: security [Role name]\n"
 "        Display the Permissions available to one or all Roles.\n"
@@ -1292,49 +1292,49 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1904
+#: ../roundup/admin.py:1926
 #, fuzzy, python-format
 msgid "No such Role \"%(role)s\"\n"
 msgstr "òÏÌØ \"%(role)s\" ÎÅ ÓÕÝÅÓÔ×ÕÅÔ"
 
-#: ../roundup/admin.py:1910
+#: ../roundup/admin.py:1932
 #, fuzzy, python-format
 msgid "New Web users get the Roles \"%(role)s\"\n"
 msgstr "îÏ×ÙÅ ÐÏÌØÚÏ×ÁÔÅÌÉ web ÐÏÌÕÞÁÀÔ ÒÏÌÉ \"%(role)s\""
 
-#: ../roundup/admin.py:1913
+#: ../roundup/admin.py:1935
 #, fuzzy, python-format
 msgid "New Web users get the Role \"%(role)s\"\n"
 msgstr "îÏ×ÙÅ ÐÏÌØÚÏ×ÁÔÅÌÉ web ÐÏÌÕÞÁÀÔ ÒÏÌØ \"%(role)s\""
 
-#: ../roundup/admin.py:1917
+#: ../roundup/admin.py:1939
 #, fuzzy, python-format
 msgid "New Email users get the Roles \"%(role)s\"\n"
 msgstr "îÏ×ÙÅ ÐÏÌØÚÏ×ÁÔÅÌÉ email ÐÏÌÕÞÁÀÔ ÒÏÌÉ \"%(role)s\""
 
-#: ../roundup/admin.py:1919
+#: ../roundup/admin.py:1941
 #, fuzzy, python-format
 msgid "New Email users get the Role \"%(role)s\"\n"
 msgstr "îÏ×ÙÅ ÐÏÌØÚÏ×ÁÔÅÌÉ email ÐÏÌÕÞÁÀÔ ÒÏÌØ \"%(role)s\""
 
-#: ../roundup/admin.py:1922
+#: ../roundup/admin.py:1944
 #, fuzzy, python-format
 msgid "Role \"%(name)s\":\n"
 msgstr "òÏÌØ \"%(name)s\":"
 
-#: ../roundup/admin.py:1928
+#: ../roundup/admin.py:1950
 #, fuzzy
 msgid " %(description)s (%(name)s for \"%(klass)s\""
 msgstr " %(description)s (%(name)s ÔÏÌØËÏ ÄÌÑ ËÌÁÓÓÁ \"%(klass)s\")"
 
-#: ../roundup/admin.py:1928
+#: ../roundup/admin.py:1950
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\": %(properties)s only)\n"
 msgstr ""
 " %(description)s (%(name)s ÄÌÑ ËÌÁÓÓÁ \"%(klass)s\": ÔÏÌØËÏ Ó×ÏÊÓÔ×Á "
 "%(properties)s)"
 
-#: ../roundup/admin.py:1941
+#: ../roundup/admin.py:1963
 #, python-format
 msgid ""
 "\n"
@@ -1342,17 +1342,17 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/admin.py:1947
+#: ../roundup/admin.py:1969
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\" only)\n"
 msgstr " %(description)s (%(name)s ÔÏÌØËÏ ÄÌÑ ËÌÁÓÓÁ \"%(klass)s\")"
 
-#: ../roundup/admin.py:1950
+#: ../roundup/admin.py:1972
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s)\n"
 msgstr " %(description)s (%(name)s ÔÏÌØËÏ ÄÌÑ ËÌÁÓÓÁ \"%(klass)s\")"
 
-#: ../roundup/admin.py:1954
+#: ../roundup/admin.py:1976
 #, fuzzy
 msgid ""
 "Usage: set items property=value [property=value ...]\n"
@@ -1387,7 +1387,7 @@ msgstr ""
 "        ÁÔÒÉÂÕÔ.  (îÁÐÒÉÍÅÒ, \"1,2,3\".)\n"
 "        "
 
-#: ../roundup/admin.py:2022
+#: ../roundup/admin.py:2044
 msgid ""
 "Usage: specification classname\n"
 "        Show the properties for a classname.\n"
@@ -1401,17 +1401,17 @@ msgstr ""
 "        ÷ÙÄÁÅÔ ÓÐÉÓÏË ÁÔÒÉÂÕÔÏ× ÕËÁÚÁÎÎÏÇÏ ËÌÁÓÓÁ.\n"
 "        "
 
-#: ../roundup/admin.py:2041
+#: ../roundup/admin.py:2063
 #, fuzzy, python-format
 msgid "%(key)s: %(value)s (key property)\n"
 msgstr "%(key)s: %(value)s (ËÌÀÞÅ×ÏÊ ÁÔÒÉÂÕÔ)"
 
-#: ../roundup/admin.py:2044
+#: ../roundup/admin.py:2066
 #, fuzzy, python-format
 msgid "%(key)s: %(value)s\n"
 msgstr "%(key)s: %(value)s (ËÌÀÞÅ×ÏÊ ÁÔÒÉÂÕÔ)"
 
-#: ../roundup/admin.py:2047
+#: ../roundup/admin.py:2069
 msgid ""
 "Usage: table classname [property[,property]*]\n"
 "        List the instances of a class in tabular form.\n"
@@ -1471,17 +1471,17 @@ msgstr ""
 "        ÏÂÒÅÚÁÅÔ ÚÎÁÞÅÎÉÑ ÓÔÏÌÂÃÁ \"Name\" ÄÏ ÞÅÔÙÒÅÈ ÓÉÍ×ÏÌÏ×.\n"
 "        "
 
-#: ../roundup/admin.py:2093
+#: ../roundup/admin.py:2115
 #, python-format
 msgid "\"%(spec)s\" not name:width"
 msgstr "úÎÁÞÅÎÉÅ \"%(spec)s\" ÄÏÌÖÎÏ ÂÙÔØ ÚÁÄÁÎÏ ËÁË ÉÍÑ:ÛÉÒÉÎÁ"
 
-#: ../roundup/admin.py:2115
+#: ../roundup/admin.py:2137
 #, python-format
 msgid "\"%(spec)s\" does not have an integer width: \"%(width)s\""
 msgstr ""
 
-#: ../roundup/admin.py:2151
+#: ../roundup/admin.py:2173
 msgid ""
 "Usage: templates [trace_search]\n"
 "        List templates and their installed directories.\n"
@@ -1491,7 +1491,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2179
+#: ../roundup/admin.py:2201
 #, fuzzy
 msgid ""
 "Usage: updateconfig <filename>\n"
@@ -1506,35 +1506,35 @@ msgstr ""
 "        ÉÓÐÏÌØÚÕÑ ÎÁÓÔÒÏÊËÉ ÐÏ ÕÍÏÌÞÁÎÉÀ.\n"
 "        "
 
-#: ../roundup/admin.py:2188 ../roundup/cgi/actions.py:886
+#: ../roundup/admin.py:2210 ../roundup/cgi/actions.py:886
 #: ../roundup/cgi/actions.py:897 ../roundup/cgi/actions.py:1099
 #: ../roundup/cgi/actions.py:1113 ../roundup/cgi/actions.py:886:897 :1099:1113
 #, python-format
 msgid "Error: %s"
 msgstr "ïÛÉÂËÁ: %s"
 
-#: ../roundup/admin.py:2220
+#: ../roundup/admin.py:2242
 #, python-format
 msgid "Unknown command \"%(command)s\" (\"help commands\" for a list)"
 msgstr ""
 "ëÏÍÁÎÄÁ \"%(command)s\" ÎÅÉÚ×ÅÓÔÎÁ. (\"help commands\" ×ÙÄÁÅÔ ÓÐÉÓÏË ËÏÍÁÎÄ)"
 
-#: ../roundup/admin.py:2226
+#: ../roundup/admin.py:2248
 #, python-format
 msgid "Multiple commands match \"%(command)s\": %(list)s"
 msgstr "\"%(command)s\" ÓÏÏÔ×ÅÔÓÔ×ÕÅÔ ÎÅÓËÏÌØËÉÍ ËÏÍÁÎÄÁÍ: %(list)s"
 
-#: ../roundup/admin.py:2241
+#: ../roundup/admin.py:2263
 msgid "Enter tracker home: "
 msgstr "äÏÍÁÛÎÉÊ ËÁÔÁÌÏÇ ÔÒÅËÅÒÁ: "
 
-#: ../roundup/admin.py:2270 ../roundup/admin.py:2274
-#: ../roundup/admin.py:2270:2274
+#: ../roundup/admin.py:2292 ../roundup/admin.py:2296
+#: ../roundup/admin.py:2292:2296
 #, python-format
 msgid "Error: Couldn't open tracker: %(message)s"
 msgstr "ïÛÉÂËÁ: ôÒÅËÅÒ ÎÅ ÏÔËÒÙ×ÁÅÔÓÑ: %(message)s"
 
-#: ../roundup/admin.py:2322
+#: ../roundup/admin.py:2344
 #, python-format
 msgid ""
 "Roundup %s ready for input.\n"
@@ -1543,15 +1543,15 @@ msgstr ""
 "Roundup %s Ë ×ÁÛÉÍ ÕÓÌÕÇÁÍ.\n"
 "÷×ÅÄÉÔÅ \"help\" ÄÌÑ ÓÐÒÁ×ËÉ."
 
-#: ../roundup/admin.py:2355
+#: ../roundup/admin.py:2377
 msgid "Note: command history and editing not available"
 msgstr "ðÒÉÍÅÞÁÎÉÅ: ÒÁÂÏÔÁÅÔ ÒÅÄÁËÔÏÒ É ÉÓÔÏÒÉÑ ËÏÍÁÎÄ"
 
-#: ../roundup/admin.py:2361
+#: ../roundup/admin.py:2383
 msgid "exit..."
 msgstr "ÐÒÉÈÏÄÉÔÅ Ë ÎÁÍ ÅÝÅ..."
 
-#: ../roundup/admin.py:2374
+#: ../roundup/admin.py:2396
 msgid "There are unsaved changes. Commit them (y/N)? "
 msgstr "ïÊ, ÔÕÔ ÎÅÓÏÈÒÁÎÅÎÎÙÅ ÉÚÍÅÎÅÎÉÑ. úÁÐÉÓÁÔØ × ÂÁÚÕ ÄÁÎÎÙÈ (y/N)? "
 
@@ -1578,23 +1578,23 @@ msgstr ""
 msgid "Couldn't open database - the required module '%s' is not available"
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:871
-#: ../roundup/backends/back_anydbm.py:884
-#: ../roundup/backends/back_anydbm.py:1158
-#: ../roundup/backends/back_anydbm.py:1193
-#: ../roundup/backends/back_anydbm.py:1422
-#: ../roundup/backends/back_anydbm.py:1440
-#: ../roundup/backends/back_anydbm.py:1487
-#: ../roundup/backends/back_anydbm.py:2123
-#: ../roundup/backends/back_anydbm.py:871:884
+#: ../roundup/backends/back_anydbm.py:873
+#: ../roundup/backends/back_anydbm.py:886
+#: ../roundup/backends/back_anydbm.py:1160
+#: ../roundup/backends/back_anydbm.py:1195
+#: ../roundup/backends/back_anydbm.py:1424
+#: ../roundup/backends/back_anydbm.py:1442
+#: ../roundup/backends/back_anydbm.py:1489
+#: ../roundup/backends/back_anydbm.py:2135
+#: ../roundup/backends/back_anydbm.py:873:886
 #: ../roundup/backends/rdbms_common.py:1720
 #: ../roundup/backends/rdbms_common.py:1967
 #: ../roundup/backends/rdbms_common.py:2206
 #: ../roundup/backends/rdbms_common.py:2226
 #: ../roundup/backends/rdbms_common.py:2279
-#: ../roundup/backends/rdbms_common.py:3246
-#: ../roundup/backends/rdbms_common.py:1720:1967 :1158:1193 :1422:1440:1487
-#: :2123 :2206:2226 :2279:3246
+#: ../roundup/backends/rdbms_common.py:3254
+#: ../roundup/backends/rdbms_common.py:1720:1967 :1160:1195 :1424:1442:1489
+#: :2135 :2206:2226 :2279:3254
 msgid "Database open read-only"
 msgstr ""
 
@@ -1989,13 +1989,13 @@ msgstr "
 msgid "You do not have permission to login"
 msgstr "õ ×ÁÓ ÎÅÔ ÒÁÚÒÅÛÅÎÉÑ ÎÁ ÒÁÂÏÔÕ Ó ÓÉÓÔÅÍÏÊ"
 
-#: ../roundup/cgi/actions.py:1577 ../roundup/cgi/actions.py:1761
-#: ../roundup/cgi/actions.py:1577:1761
+#: ../roundup/cgi/actions.py:1577 ../roundup/cgi/actions.py:1757
+#: ../roundup/cgi/actions.py:1577:1757
 #, python-format
 msgid "Column \"%(column)s\" not found in %(class)s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1832
+#: ../roundup/cgi/actions.py:1822
 #, fuzzy, python-format
 msgid "You do not have permission to view %(class)s"
 msgstr "õ ×ÁÓ ÎÅÔ ÒÁÚÒÅÛÅÎÉÑ ÒÅÄÁËÔÉÒÏ×ÁÔØ %(class)s"
@@ -2088,7 +2088,7 @@ msgstr "
 msgid "<em>undefined</em>"
 msgstr "<em>ÎÅÏÐÒÅÄÅÌÅÎÏ</em>"
 
-#: ../roundup/cgi/client.py:105
+#: ../roundup/cgi/client.py:111
 msgid ""
 "<html><head><title>An error has occurred</title></head>\n"
 "<body><h1>An error has occurred</h1>\n"
@@ -2102,148 +2102,154 @@ msgstr ""
 "áÄÍÉÎÉÓÔÒÁÔÏÒÕ ÔÒÅËÅÒÁ ÏÔÏÓÌÁÎÏ ÓÏÏÂÝÅÎÉÅ ÏÂ ÏÛÉÂËÅ.</p>\n"
 "</body></html>"
 
-#: ../roundup/cgi/client.py:717 ../roundup/cgi/client.py:1635
-#: ../roundup/cgi/client.py:717:1635
+#: ../roundup/cgi/client.py:666
+msgid ""
+"XMLRPC endpoint is not using defusedxml. Improve security by installing "
+"defusedxml."
+msgstr ""
+
+#: ../roundup/cgi/client.py:728 ../roundup/cgi/client.py:1646
+#: ../roundup/cgi/client.py:728:1646
 msgid "Required Header Missing"
 msgstr ""
 
-#: ../roundup/cgi/client.py:719
+#: ../roundup/cgi/client.py:731
 #, fuzzy
 msgid "Client is not allowed to use Rest Interface."
 msgstr "áÎÏÎÉÍÎÙÍ ÐÏÌØÚÏ×ÁÔÅÌÑÍ ÎÅ ÒÁÚÒÅÛÅÎÏ ÐÏÌØÚÏ×ÁÔØÓÑ ×ÅÂ-ÉÎÔÅÒÆÅÊÓÏÍ."
 
-#: ../roundup/cgi/client.py:971
+#: ../roundup/cgi/client.py:985
 msgid "Form Error: "
 msgstr "ïÛÉÂËÁ ÆÏÒÍÙ: "
 
-#: ../roundup/cgi/client.py:1064
+#: ../roundup/cgi/client.py:1078
 #, python-format
 msgid "Unrecognized charset: %r"
 msgstr "ëÏÄÉÒÏ×ËÁ %r ÎÅ ÒÁÓÐÏÚÎÁÎÁ"
 
-#: ../roundup/cgi/client.py:1331 ../roundup/cgi/client.py:2294
-#: ../roundup/cgi/client.py:1331:2294
+#: ../roundup/cgi/client.py:1345 ../roundup/cgi/client.py:2357
+#: ../roundup/cgi/client.py:1345:2357
 msgid "broken form: multiple @action values submitted"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1348
+#: ../roundup/cgi/client.py:1362
 msgid "Anonymous users are not allowed to use the web interface"
 msgstr "áÎÏÎÉÍÎÙÍ ÐÏÌØÚÏ×ÁÔÅÌÑÍ ÎÅ ÒÁÚÒÅÛÅÎÏ ÐÏÌØÚÏ×ÁÔØÓÑ ×ÅÂ-ÉÎÔÅÒÆÅÊÓÏÍ."
 
-#: ../roundup/cgi/client.py:1496
+#: ../roundup/cgi/client.py:1507
 msgid "Referer header not available."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1500
+#: ../roundup/cgi/client.py:1511
 #, python-format
 msgid "csrf key used with wrong method from: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1529
+#: ../roundup/cgi/client.py:1540
 #, python-format
 msgid "csrf header %(header)s required but missing for user%(userid)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1533
+#: ../roundup/cgi/client.py:1544
 #, python-format
 msgid "Missing header: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1541
+#: ../roundup/cgi/client.py:1552
 #, python-format
 msgid "csrf Referer header check failed for user%(userid)s. Value=%(referer)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1546
+#: ../roundup/cgi/client.py:1557
 #, fuzzy, python-format
 msgid "Invalid Referer: %s"
 msgstr "îÅÐÒÁ×ÉÌØÎÙÊ ÐÁÒÏÌØ ÉÌÉ ÉÍÑ ÐÏÌØÚÏ×ÁÔÅÌÑ."
 
-#: ../roundup/cgi/client.py:1561
+#: ../roundup/cgi/client.py:1572
 #, python-format
 msgid "csrf Origin header check failed for user%(userid)s. Value=%(origin)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1566
+#: ../roundup/cgi/client.py:1577
 #, fuzzy, python-format
 msgid "Invalid Origin %s"
 msgstr "îÅÐÒÁ×ÉÌØÎÙÊ ÐÁÒÏÌØ ÉÌÉ ÉÍÑ ÐÏÌØÚÏ×ÁÔÅÌÑ."
 
-#: ../roundup/cgi/client.py:1580
+#: ../roundup/cgi/client.py:1591
 #, python-format
 msgid ""
 "csrf X-FORWARDED-HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1586
+#: ../roundup/cgi/client.py:1597
 #, python-format
 msgid "Invalid X-FORWARDED-HOST %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1605
+#: ../roundup/cgi/client.py:1616
 #, python-format
 msgid "csrf HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1610
+#: ../roundup/cgi/client.py:1621
 #, python-format
 msgid "Invalid HOST %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1618
+#: ../roundup/cgi/client.py:1629
 msgid "Csrf: unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1619
+#: ../roundup/cgi/client.py:1630
 msgid "Unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1632
+#: ../roundup/cgi/client.py:1643
 #, python-format
 msgid "csrf X-REQUESTED-WITH xmlrpc required header check failed for user%s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1673
+#: ../roundup/cgi/client.py:1684
 #, python-format
 msgid "Required csrf field missing for user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1675 ../roundup/cgi/client.py:1702
-#: ../roundup/cgi/client.py:1719 ../roundup/cgi/client.py:1675:1702:1719
+#: ../roundup/cgi/client.py:1686 ../roundup/cgi/client.py:1713
+#: ../roundup/cgi/client.py:1730 ../roundup/cgi/client.py:1686:1713:1730
 msgid ""
 "We can't validate your session (csrf failure). Re-enter any unsaved data and "
 "try again."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1679
+#: ../roundup/cgi/client.py:1690
 #, python-format
 msgid "csrf field not supplied by user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1691
+#: ../roundup/cgi/client.py:1702
 #, python-format
 msgid ""
 "Csrf mismatch user: current user %(user)s != stored user %(stored)s, current "
 "session, stored session: %(cur_sess)s,%(stor_sess)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1709
+#: ../roundup/cgi/client.py:1720
 #, python-format
 msgid ""
 "Csrf mismatch user: current session %(curr_sess)s != stored session "
 "%(stor_sess)s, current user/stored user is: %(user)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1901
+#: ../roundup/cgi/client.py:1912
 msgid "You are not allowed to view this file."
 msgstr "õ ×ÁÓ ÎÅÔ ÒÁÚÒÅÛÅÎÉÑ ÎÁ ÐÒÏÓÍÏÔÒ ÜÔÏÇÏ ÆÁÊÌÁ."
 
-#: ../roundup/cgi/client.py:2172
+#: ../roundup/cgi/client.py:2235
 #, python-format
 msgid "%(starttag)sTime elapsed: %(seconds)fs%(endtag)s\n"
 msgstr "%(starttag)súÁÔÒÁÞÅÎÎÏÅ ×ÒÅÍÑ: %(seconds)fs%(endtag)s\n"
 
-#: ../roundup/cgi/client.py:2176
+#: ../roundup/cgi/client.py:2239
 #, python-format
 msgid ""
 "%(starttag)sCache hits: %(cache_hits)d, misses %(cache_misses)d. Loading "
@@ -2253,7 +2259,7 @@ msgstr ""
 "%(cache_misses)d. úÁÇÒÕÚËÁ ÏÂßÅËÔÏ×: %(get_items)f ÓÅË. æÉÌØÔÒÁÃÉÑ: "
 "%(filtering)f ÓÅË.%(endtag)s\n"
 
-#: ../roundup/cgi/client.py:2716
+#: ../roundup/cgi/client.py:2778
 #, python-format
 msgid ""
 "Cache failure: compressed file %(compressed)s is older than its source file "
@@ -2675,17 +2681,17 @@ msgstr ""
 msgid "Not a property name: %s"
 msgstr ""
 
-#: ../roundup/hyperdb.py:1984
+#: ../roundup/hyperdb.py:2038
 #, fuzzy, python-format
 msgid "property %(property)s: %(value)r is not a %(classname)s."
 msgstr "ÁÔÒÉÂÕÔ \"%(propname)s\": ÚÎÁÞÅÎÉÅ \"%(value)s\" ÏÔÓÕÔÓÔ×ÕÅÔ × ÓÐÉÓËÅ"
 
-#: ../roundup/hyperdb.py:1990
+#: ../roundup/hyperdb.py:2044
 #, python-format
 msgid "you may only enter ID values for property %s"
 msgstr ""
 
-#: ../roundup/hyperdb.py:2025
+#: ../roundup/hyperdb.py:2079
 #, python-format
 msgid "%(property)r is not a property of %(classname)s"
 msgstr ""
@@ -3003,6 +3009,22 @@ msgstr ""
 "ÁÒÇÕÍÅÎÔÙ ÄÏÌÖÎÙ ÂÙÔØ × ÆÏÒÍÁÔÅ [ÉÍÑ=ÚÎÁÞÅÎÉÅ,ÚÎÁÞÅÎÉÅ,...;ÉÍÑ=ÚÎÁÞÅÎÉÅ,"
 "ÚÎÁÞÅÎÉÅ,...]"
 
+#: ../roundup/mlink_expr.py:161
+#, python-format
+msgid ""
+"There was an error searching %(class)s by %(attr)s using: %(opcodes)s. The "
+"operator %(opcode)s (%(opcodename)s) at position %(position)d has too few "
+"arguments."
+msgstr ""
+
+#: ../roundup/mlink_expr.py:174
+#, python-format
+msgid ""
+"There was an error searching %(class)s by %(attr)s using: %(opcodes)s. There "
+"are too many arguments for the existing operators. The values on the stack "
+"are: %(stack)s"
+msgstr ""
+
 #: ../roundup/pygettext.py:401
 #, python-format
 msgid "*** %(file)s:%(lineno)s: Seen unexpected token \"%(token)s\""
@@ -3060,42 +3082,63 @@ msgstr ""
 msgid "morethanonestring"
 msgstr ""
 
-#: ../roundup/rest.py:410
+#: ../roundup/rest.py:417
 #, python-format
 msgid "Method %(m)s not allowed. Allowed: %(a)s"
 msgstr ""
 
-#: ../roundup/rest.py:948
+#: ../roundup/rest.py:964
 #, python-format
 msgid ""
 "Page size %(page_size)s must be less than admin limit on query result size: "
 "%(max_size)s."
 msgstr ""
 
-#: ../roundup/rest.py:1193
+#: ../roundup/rest.py:1211
 #, fuzzy, python-format
 msgid "Invalid attribute %s"
 msgstr "îÅÐÒÁ×ÉÌØÎÙÊ ÐÁÒÏÌØ ÉÌÉ ÉÍÑ ÐÏÌØÚÏ×ÁÔÅÌÑ."
 
-#: ../roundup/rest.py:2182
+#: ../roundup/rest.py:2199
 #, python-format
 msgid "Api rate limits exceeded. Please wait: %s seconds."
 msgstr ""
 
-#: ../roundup/rest.py:2258
+#: ../roundup/rest.py:2283
 #, python-format
 msgid ""
-"Unable to parse Accept Header. %(error)s. Acceptable types: "
+"Content type '%s' requested in URL is not available.\n"
+"Acceptable types: %s\n"
+msgstr ""
+
+#: ../roundup/rest.py:2304
+#, python-format
+msgid ""
+"Unable to parse Accept Header. %(error)s. Acceptable types: */*, "
 "%(acceptable_types)s"
 msgstr ""
 
-#: ../roundup/rest.py:2441
+#: ../roundup/rest.py:2376 ../roundup/rest.py:2597 ../roundup/rest.py:2376:2597
 #, python-format
 msgid ""
 "Unrecognized api version: %s. See /rest without specifying api version for "
 "supported versions."
 msgstr ""
 
+#: ../roundup/rest.py:2411 ../roundup/rest.py:2420 ../roundup/rest.py:2411:2420
+#, python-format
+msgid ""
+"Requested content type(s) '%s' not available.\n"
+"Acceptable mime types are: */*, %s"
+msgstr ""
+
+#: ../roundup/rest.py:2696
+msgid ""
+"Internal error while formatting response.\n"
+"accept_mime_type is not defined. This should\n"
+"never happen\n"
+msgstr ""
+
 #: ../roundup/roundupdb.py:140
 #, python-format
 msgid "Username '%s' already exists."
@@ -3257,33 +3300,33 @@ msgstr ""
 "ïÛÉÂËÁ: ôÉÐ ÐÏÞÔÏ×ÏÇÏ ÑÝÉËÁ ÄÏÌÖÅÎ ÂÙÔØ \"mailbox\", \"pop\", \"apop\", "
 "\"imap\" ÉÌÉ \"imaps\""
 
-#: ../roundup/scripts/roundup_server.py:112
+#: ../roundup/scripts/roundup_server.py:113
 msgid "WARNING: generating temporary SSL certificate"
 msgstr "÷îéíáîéå: ÓÏÚÄÁÅÔÓÑ ×ÒÅÍÅÎÎÙÊ ÓÅÒÔÉÆÉËÁÔ ÄÌÑ SSL"
 
-#: ../roundup/scripts/roundup_server.py:143
+#: ../roundup/scripts/roundup_server.py:144
 #, python-format
 msgid "Unable to find/use key from file: %(pemfile)s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:144
+#: ../roundup/scripts/roundup_server.py:145
 msgid ""
 "Does it have a private key surrounded by '-----BEGIN PRIVATE KEY-----' and\n"
 "  '-----END PRIVATE KEY-----' markers?"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:149
+#: ../roundup/scripts/roundup_server.py:150
 #, python-format
 msgid "Unable to find/use certificate from file: %(pemfile)s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:150
+#: ../roundup/scripts/roundup_server.py:151
 msgid ""
 "Does it have a certificate surrounded by '-----BEGIN CERTIFICATE-----' and\n"
 "  '-----END CERTIFICATE-----' markers?"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:344
+#: ../roundup/scripts/roundup_server.py:345
 msgid ""
 "<html><head><title>Roundup trackers index</title></head>\n"
 "<body><h1>Roundup trackers index</h1><ol>\n"
@@ -3291,62 +3334,62 @@ msgstr ""
 "<html><head><title>óÐÉÓÏË ÔÒÅËÅÒÏ× Roundup</title></head>\n"
 "<body><h1>óÐÉÓÏË ÔÒÅËÅÒÏ× Roundup</h1><ol>\n"
 
-#: ../roundup/scripts/roundup_server.py:570
+#: ../roundup/scripts/roundup_server.py:587
 #, fuzzy, python-format
 msgid "Error: %(type)s: %(value)s"
 msgstr "%(key)s: %(value)s (ËÌÀÞÅ×ÏÊ ÁÔÒÉÂÕÔ)"
 
-#: ../roundup/scripts/roundup_server.py:582
+#: ../roundup/scripts/roundup_server.py:599
 msgid "WARNING: ignoring \"-g\" argument, not root"
 msgstr ""
 "÷îéíáîéå: ÐÁÒÁÍÅÔÒ \"-g\" ÎÅ ÉÓÐÏÌØÚÕÅÔÓÑ, ÏÎ ÒÁÚÒÅÛÅÎ ÔÏÌØËÏ ÄÌÑ "
 "ÐÏÌØÚÏ×ÁÔÅÌÑ root"
 
-#: ../roundup/scripts/roundup_server.py:588
+#: ../roundup/scripts/roundup_server.py:605
 msgid "Can't change groups - no grp module"
 msgstr "ðÏÄÍÅÎÁ ÇÒÕÐÐÙ ÎÅ×ÏÚÍÏÖÎÁ - ÎÕÖÅÎ ÍÏÄÕÌØ grp"
 
-#: ../roundup/scripts/roundup_server.py:597
+#: ../roundup/scripts/roundup_server.py:614
 #, python-format
 msgid "Group %(group)s doesn't exist"
 msgstr "çÒÕÐÐÁ %(group)s ÎÅ ÓÕÝÅÓÔ×ÕÅÔ"
 
-#: ../roundup/scripts/roundup_server.py:609
+#: ../roundup/scripts/roundup_server.py:626
 msgid "Can't run as root!"
 msgstr "úÁÐÕÓË ÓÅÒ×ÅÒÁ Ó ÐÏÌÎÏÍÏÞÉÑÍÉ ÐÏÌØÚÏ×ÁÔÅÌÑ root ÚÁÐÒÅÝÅÎ!"
 
-#: ../roundup/scripts/roundup_server.py:612
+#: ../roundup/scripts/roundup_server.py:629
 msgid "WARNING: ignoring \"-u\" argument, not root"
 msgstr ""
 "÷îéíáîéå: ÐÁÒÁÍÅÔÒ \"-u\" ÎÅ ÉÓÐÏÌØÚÕÅÔÓÑ, ÏÎ ÒÁÚÒÅÛÅÎ ÔÏÌØËÏ ÄÌÑ "
 "ÐÏÌØÚÏ×ÁÔÅÌÑ root"
 
-#: ../roundup/scripts/roundup_server.py:618
+#: ../roundup/scripts/roundup_server.py:635
 msgid "Can't change users - no pwd module"
 msgstr "ðÏÄÍÅÎÁ ÐÏÌØÚÏ×ÁÔÅÌÑ ÎÅ×ÏÚÍÏÖÎÁ - ÎÕÖÅÎ ÍÏÄÕÌØ pwd"
 
-#: ../roundup/scripts/roundup_server.py:627
+#: ../roundup/scripts/roundup_server.py:644
 #, python-format
 msgid "User %(user)s doesn't exist"
 msgstr "ðÏÌØÚÏ×ÁÔÅÌØ %(user)s ÎÅ ÓÕÝÅÓÔ×ÕÅÔ"
 
-#: ../roundup/scripts/roundup_server.py:833
+#: ../roundup/scripts/roundup_server.py:856
 #, python-format
 msgid "Multiprocess mode \"%s\" is not available, switching to single-process"
 msgstr "òÅÖÉÍ \"%s\" ÎÅÄÏÓÔÕÐÅÎ, ÐÅÒÅËÌÀÞÁÅÍÓÑ × ÏÄÎÏÚÁÄÁÞÎÙÊ ÒÅÖÉÍ"
 
-#: ../roundup/scripts/roundup_server.py:861
+#: ../roundup/scripts/roundup_server.py:884
 #, python-format
 msgid "Unable to bind to port %s, port already in use."
 msgstr "îÅ×ÏÚÍÏÖÎÏ ÕÓÔÁÎÏ×ÉÔØ ÓÅÒ×ÅÒ ÎÁ ÐÏÒÔÕ %s, ÐÏÒÔ ÕÖÅ ÚÁÎÑÔ."
 
-#: ../roundup/scripts/roundup_server.py:865
+#: ../roundup/scripts/roundup_server.py:888
 #, fuzzy, python-format
 msgid ""
 "Unable to bind to port %(port)s, access not allowed, errno: %(errno)s %(msg)s"
 msgstr "îÅ×ÏÚÍÏÖÎÏ ÕÓÔÁÎÏ×ÉÔØ ÓÅÒ×ÅÒ ÎÁ ÐÏÒÔÕ %s, ÐÏÒÔ ÕÖÅ ÚÁÎÑÔ."
 
-#: ../roundup/scripts/roundup_server.py:944
+#: ../roundup/scripts/roundup_server.py:967
 msgid ""
 " -c <Command>  Windows Service options.\n"
 "               If you want to run the server as a Windows Service, you\n"
@@ -3363,13 +3406,15 @@ msgstr ""
 "               ÆÁÊÌ ÐÒÏÔÏËÏÌÁ.  ëÏÍÁÎÄÁ 'roundup-server -c help'\n"
 "               ×ÙÄÁÅÔ ÓÐÒÁ×ËÕ Ï ËÏÍÁÎÄÎÏÊ ÓÔÒÏËÅ ÓÅÒ×ÉÓÁ Windows."
 
-#: ../roundup/scripts/roundup_server.py:951
+#: ../roundup/scripts/roundup_server.py:974
+#, fuzzy
 msgid ""
 " -u <UID>      runs the Roundup web server as this UID\n"
 " -g <GID>      runs the Roundup web server as this GID\n"
 " -d <PIDfile>  run the server in the background and write the server's PID\n"
 "               to the file indicated by PIDfile. The -l option *must* be\n"
-"               specified if -d is used."
+"               specified if -d is used.\n"
+" -D            run the server in the foreground even when -d is used."
 msgstr ""
 " -u <UID>      ÚÁÐÕÓÔÉÔØ cÅÒ×ÅÒ Roundup Ó ÐÒÁ×ÁÍÉ ÐÏÌØÚÏ×ÁÔÅÌÑ UID\n"
 " -g <GID>      ÚÁÐÕÓÔÉÔØ ÓÅÒ×ÅÒ Roundup × ÇÒÕÐÐÅ GID\n"
@@ -3377,7 +3422,7 @@ msgstr ""
 "               É ÚÁÐÕÓÔÉÔØ ÓÅÒ×ÅÒ × ÆÏÎÏ×ÏÍ ÒÅÖÉÍÅ.  åÓÌÉ ÕËÁÚÁÎÏ \"-d\",\n"
 "               ÆÁÊÌ ÐÒÏÔÏËÏÌÁ *ÏÂÑÚÁÔÅÌØÎÏ* ÄÏÌÖÅÎ ÂÙÔØ ÚÁÄÁÎ ËÌÀÞÏÍ \"-l\""
 
-#: ../roundup/scripts/roundup_server.py:958
+#: ../roundup/scripts/roundup_server.py:982
 #, fuzzy, python-format
 msgid ""
 "\n"
@@ -3402,6 +3447,10 @@ msgid ""
 "mode\n"
 " -s            enable SSL\n"
 " -L            http request logging uses python logging (roundup.http)\n"
+" -P            log client address/name using reverse proxy X-Forwarded-For\n"
+"               header and not the connection IP (which is the reverse "
+"proxy).\n"
+"               Appends a '+' sign to the logged address/name.\n"
 " -e <fname>    PEM file containing SSL key and certificate\n"
 " -t <mode>     multiprocess mode (default: %(mp_def)s).\n"
 "               Allowed values: %(mp_types)s.\n"
@@ -3502,21 +3551,21 @@ msgstr ""
 "   ÎÅ ÍÏÇÕÔ ÉÓÐÏÌØÚÏ×ÁÔØÓÑ × URL (ÐÒÏÂÅÌÙ, ÒÕÓÓËÉÅ ÂÕË×Ù É ÐÒÏÞ.),\n"
 "   ÐÏÔÏÍÕ ÞÔÏ ÔÁËÉÅ ÉÍÅÎÁ ÓÂÉ×ÁÀÔ Ó ÔÏÌËÕ ÎÅËÏÔÏÒÙÅ ÂÒÁÕÚÅÒÙ ÔÉÐÁ IE.\n"
 
-#: ../roundup/scripts/roundup_server.py:1135
+#: ../roundup/scripts/roundup_server.py:1162
 msgid "Instances must be name=home"
 msgstr "óÐÉÓÏË ÔÒÅËÅÒÏ× ÄÏÌÖÅÎ ÂÙÔØ × ÆÏÒÍÁÔÅ ÉÍÑ=ËÁÔÁÌÏÇ"
 
-#: ../roundup/scripts/roundup_server.py:1149
+#: ../roundup/scripts/roundup_server.py:1176
 #, python-format
 msgid "Configuration saved to %s"
 msgstr "ëÏÎÆÉÇÕÒÁÃÉÑ ÚÁÐÉÓÁÎÁ × %s"
 
-#: ../roundup/scripts/roundup_server.py:1167
+#: ../roundup/scripts/roundup_server.py:1194
 msgid "Sorry, you can't run the server as a daemon on this Operating System"
 msgstr ""
 "éÚ×ÉÎÉÔÅ, × ÜÔÏÊ ÏÐÅÒÁÃÉÏÎÎÏÊ ÓÉÓÔÅÍÅ ÒÁÂÏÔÁ × ÆÏÎÏ×ÏÍ ÒÅÖÉÍÅ ÎÅ×ÏÚÍÏÖÎÁ"
 
-#: ../roundup/scripts/roundup_server.py:1187
+#: ../roundup/scripts/roundup_server.py:1214
 #, python-format
 msgid "Roundup server started on %(HOST)s:%(PORT)s"
 msgstr "óÅÒ×ÅÒ Roundup ÇÏÔÏ× Ë ÒÁÂÏÔÅ ÐÏ ÁÄÒÅÓÕ %(HOST)s:%(PORT)s"
diff --git a/locale/zh_CN.po b/locale/zh_CN.po
index d40f0dd67..2718447c1 100644
--- a/locale/zh_CN.po
+++ b/locale/zh_CN.po
@@ -6,9 +6,9 @@
 #
 msgid ""
 msgstr ""
-"Project-Id-Version: Roundup 2.4.0\n"
+"Project-Id-Version: Roundup 2.5.0\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
-"POT-Creation-Date: 2024-08-07 21:43-0400\n"
+"POT-Creation-Date: 2024-12-30 22:49-0500\n"
 "PO-Revision-Date: 2013-10-31 12:22+0100\n"
 "Last-Translator: Cheer Xiao <xiaqqaix@gmail.com>\n"
 "Language-Team: Chinese Simplified <limodou@gmail.com>\n"
@@ -86,8 +86,8 @@ msgid "Enable verbose output: tracing, descriptions...\n"
 msgstr ""
 
 # ../roundup/admin.py:84 :943 :992 :1014
-#: ../roundup/admin.py:175 ../roundup/admin.py:1188 ../roundup/admin.py:1836
-#: ../roundup/admin.py:1868 ../roundup/admin.py:175:1188 :1836:1868
+#: ../roundup/admin.py:175 ../roundup/admin.py:1188 ../roundup/admin.py:1858
+#: ../roundup/admin.py:1890 ../roundup/admin.py:175:1188 :1858:1890
 #, python-format
 msgid "no such class \"%(classname)s\""
 msgstr "æ— æ­¤ç±»åˆ« \"%(classname)s\""
@@ -301,14 +301,14 @@ msgid "%s:"
 msgstr "%s:"
 
 # ../roundup/admin.py:337 :387
-#: ../roundup/admin.py:439 ../roundup/admin.py:1396
-#: ../roundup/admin.py:439:1396
+#: ../roundup/admin.py:439 ../roundup/admin.py:1415
+#: ../roundup/admin.py:439:1415
 msgid "Templates:"
 msgstr "æ¨¡æ¿:"
 
 # ../roundup/admin.py:340 :398
-#: ../roundup/admin.py:442 ../roundup/admin.py:1406
-#: ../roundup/admin.py:442:1406
+#: ../roundup/admin.py:442 ../roundup/admin.py:1425
+#: ../roundup/admin.py:442:1425
 msgid "Back ends:"
 msgstr "åŽç«¯:"
 
@@ -357,11 +357,11 @@ msgstr ""
 #: ../roundup/admin.py:482 ../roundup/admin.py:555 ../roundup/admin.py:606
 #: ../roundup/admin.py:733 ../roundup/admin.py:806 ../roundup/admin.py:851
 #: ../roundup/admin.py:902 ../roundup/admin.py:999 ../roundup/admin.py:1216
-#: ../roundup/admin.py:1369 ../roundup/admin.py:1497 ../roundup/admin.py:1580
-#: ../roundup/admin.py:1703 ../roundup/admin.py:1826 ../roundup/admin.py:1858
-#: ../roundup/admin.py:1974 ../roundup/admin.py:2028 ../roundup/admin.py:2076
-#: ../roundup/admin.py:482:555 :1216:1369:1497 :1580:1703 :1826:1858 :1974:2028
-#: :2076 :606:733 :806:851 :902:999
+#: ../roundup/admin.py:1388 ../roundup/admin.py:1516 ../roundup/admin.py:1599
+#: ../roundup/admin.py:1725 ../roundup/admin.py:1848 ../roundup/admin.py:1880
+#: ../roundup/admin.py:1996 ../roundup/admin.py:2050 ../roundup/admin.py:2098
+#: ../roundup/admin.py:482:555 :1216:1388:1516 :1599:1725 :1848:1880 :1996:2050
+#: :2098 :606:733 :806:851 :902:999
 msgid "Not enough arguments supplied"
 msgstr "æœªæä¾›è¶³å¤Ÿçš„å‚æ•°"
 
@@ -499,9 +499,9 @@ msgid "Class %(curclassname)s has no property %(pn)s in %(propname)s."
 msgstr "%(classname)s æ²¡æœ‰ \"%(propname)s\" å±žæ€§"
 
 # ../roundup/admin.py:663 :816 :828 :882
-#: ../roundup/admin.py:791 ../roundup/admin.py:840 ../roundup/admin.py:1517
-#: ../roundup/admin.py:1530 ../roundup/admin.py:2098
-#: ../roundup/admin.py:791:840 :1517:1530:2098
+#: ../roundup/admin.py:791 ../roundup/admin.py:840 ../roundup/admin.py:1536
+#: ../roundup/admin.py:1549 ../roundup/admin.py:2120
+#: ../roundup/admin.py:791:840 :1536:1549:2120
 #, python-format
 msgid "%(classname)s has no property \"%(propname)s\""
 msgstr "%(classname)s æ²¡æœ‰ \"%(propname)s\" å±žæ€§"
@@ -578,8 +578,8 @@ msgid "property %s is not of type Multilink or Link so -d flag does not apply."
 msgstr "å±žæ€§ %s ä¸æ˜¯ Multilink æˆ– Link ç±»åž‹ï¼Œæ‰€ä»¥ -d æ ‡å¿—ä¸èƒ½åº”ç”¨ã€‚"
 
 # ../roundup/admin.py:550 :945 :994 :1016
-#: ../roundup/admin.py:942 ../roundup/admin.py:1190 ../roundup/admin.py:1842
-#: ../roundup/admin.py:1870 ../roundup/admin.py:942:1190 :1842:1870
+#: ../roundup/admin.py:942 ../roundup/admin.py:1190 ../roundup/admin.py:1864
+#: ../roundup/admin.py:1892 ../roundup/admin.py:942:1190 :1864:1892
 #, python-format
 msgid "no such %(classname)s node \"%(nodeid)s\""
 msgstr "æ²¡æœ‰è¿™æ ·çš„ %(classname)s ç»“ç‚¹ \"%(nodeid)s\""
@@ -728,7 +728,7 @@ msgstr ""
 "        æ—§æ•°æ®ã€‚)\n"
 "        "
 
-#: ../roundup/admin.py:1287
+#: ../roundup/admin.py:1306
 msgid ""
 "Usage: importtables export_dir\n"
 "        This imports the database tables exported using exporttables.\n"
@@ -738,7 +738,7 @@ msgid ""
 msgstr ""
 
 #. password
-#: ../roundup/admin.py:1295
+#: ../roundup/admin.py:1314
 msgid ""
 "Usage: initialise [adminpw]\n"
 "        Initialise a new Roundup tracker.\n"
@@ -756,23 +756,23 @@ msgstr ""
 "        æ‰§è¡Œtrackerçš„åˆå§‹åŒ–å‡½æ•° dbinit.init()\n"
 "        "
 
-#: ../roundup/admin.py:1309
+#: ../roundup/admin.py:1328
 msgid "Admin Password: "
 msgstr "ç®¡ç†å‘˜å¯†ç :"
 
-#: ../roundup/admin.py:1310
+#: ../roundup/admin.py:1329
 msgid "       Confirm: "
 msgstr "       ç¡®è®¤:"
 
-#: ../roundup/admin.py:1314
+#: ../roundup/admin.py:1333
 msgid "Instance home does not exist"
 msgstr "å®žä¾‹ç›®å½•ä¸å­˜åœ¨"
 
-#: ../roundup/admin.py:1318
+#: ../roundup/admin.py:1337
 msgid "Instance has not been installed"
 msgstr "å®žä¾‹è¿˜æ²¡æœ‰å®‰è£…"
 
-#: ../roundup/admin.py:1326
+#: ../roundup/admin.py:1345
 msgid ""
 "WARNING: The database is already initialised!\n"
 "If you re-initialise it, you will lose all the data!\n"
@@ -782,7 +782,7 @@ msgstr ""
 "å¦‚æžœä½ é‡æ–°åˆå§‹åŒ–å®ƒï¼Œæ‰€æœ‰çš„æ•°æ®å°†ä¼šä¸¢å¤±ï¼\n"
 "åˆ é™¤å®ƒå—ï¼ŸY/N: "
 
-#: ../roundup/admin.py:1346
+#: ../roundup/admin.py:1365
 #, fuzzy
 msgid ""
 "Usage: install [template [backend [key=val[,key=val]]]]\n"
@@ -822,12 +822,12 @@ msgstr ""
 "        è¯·æŸ¥çœ‹åˆå§‹åŒ–å‚æ•°å¸®åŠ©ã€‚\n"
 "        "
 
-#: ../roundup/admin.py:1375
+#: ../roundup/admin.py:1394
 #, python-format
 msgid "Instance home parent directory \"%(parent)s\" does not exist"
 msgstr "å®žä¾‹ç›®å½•çš„çˆ¶ç›®å½• \"%(parent)s\" ä¸å­˜åœ¨"
 
-#: ../roundup/admin.py:1384
+#: ../roundup/admin.py:1403
 #, python-format
 msgid ""
 "WARNING: There appears to be a tracker in \"%(tracker_home)s\"!\n"
@@ -838,22 +838,22 @@ msgstr ""
 "å¦‚æžœä½ é‡æ–°å®‰è£…ï¼Œæ‰€æœ‰çš„æ•°æ®å°†ä¼šä¸¢å¤±ï¼\n"
 "åˆ é™¤å®ƒå—ï¼ŸY/N: "
 
-#: ../roundup/admin.py:1397
+#: ../roundup/admin.py:1416
 #, fuzzy
 msgid "Select template"
 msgstr "é€‰æ‹©æ¨¡æ¿ [classic]:"
 
-#: ../roundup/admin.py:1407
+#: ../roundup/admin.py:1426
 #, fuzzy
 msgid "Select backend"
 msgstr "é€‰æ‹©åŽç«¯ [anydbm]:"
 
-#: ../roundup/admin.py:1418
+#: ../roundup/admin.py:1437
 #, python-format
 msgid "Error in configuration settings: \"%s\""
 msgstr "é…ç½®è®¾å®šæœ‰é”™: â€œ%sâ€"
 
-#: ../roundup/admin.py:1451
+#: ../roundup/admin.py:1470
 #, fuzzy, python-format
 msgid ""
 "\n"
@@ -865,11 +865,11 @@ msgstr ""
 " çŽ°åœ¨ä½ åº”è¯¥ä¿®æ”¹trackerçš„é…ç½®æ–‡ä»¶ï¼š\n"
 "   %(config_file)s"
 
-#: ../roundup/admin.py:1461
+#: ../roundup/admin.py:1480
 msgid " ... at a minimum, you must set following options:"
 msgstr " ... è‡³å°‘ï¼Œä½ å¿…é¡»è®¾ç½®ä»¥ä¸‹é€‰é¡¹ï¼š"
 
-#: ../roundup/admin.py:1466
+#: ../roundup/admin.py:1485
 #, fuzzy, python-format
 msgid ""
 "\n"
@@ -893,7 +893,7 @@ msgstr ""
 "   %(database_init_file)s\n"
 " ... æŸ¥çœ‹å…³äºŽå®¢æˆ·åŒ–çš„æ–‡æ¡£æ¥äº†è§£æ›´å¤šçš„ä¿¡æ¯ã€‚\n"
 
-#: ../roundup/admin.py:1482
+#: ../roundup/admin.py:1501
 msgid ""
 "Usage: list classname [property]\n"
 "        List the instances of a class.\n"
@@ -919,17 +919,17 @@ msgstr ""
 "        å®šäº†å±žæ€§ï¼Œå¯¹æ¯ä¸ªç±»åž‹å®žä¾‹ä¼šæ‰“å°å‡ºè¿™ä¸ªå±žæ€§ã€‚\n"
 "        "
 
-#: ../roundup/admin.py:1495
+#: ../roundup/admin.py:1514
 msgid "Too many arguments supplied"
 msgstr "æä¾›äº†å¤ªå¤šçš„å‚æ•°äº†"
 
-#: ../roundup/admin.py:1528
+#: ../roundup/admin.py:1547
 #, python-format
 msgid "%(nodeid)4s: %(value)s"
 msgstr "%(nodeid)4s: %(value)s"
 
 #. noqa: ARG002  - args unused
-#: ../roundup/admin.py:1535
+#: ../roundup/admin.py:1554
 msgid ""
 "Usage: migrate\n"
 "        Update a tracker's database to be compatible with the Roundup\n"
@@ -952,17 +952,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1555
+#: ../roundup/admin.py:1574
 #, python-format
 msgid "Tracker updated to schema version %s."
 msgstr ""
 
-#: ../roundup/admin.py:1559
+#: ../roundup/admin.py:1578
 #, fuzzy, python-format
 msgid "No migration action required. At schema version %s."
 msgstr "ä¸å¿…æ‰§è¡Œè¿ç§»"
 
-#: ../roundup/admin.py:1564
+#: ../roundup/admin.py:1583
 #, fuzzy
 msgid ""
 "Usage: pack period | date\n"
@@ -999,11 +999,11 @@ msgstr ""
 "\n"
 "        "
 
-#: ../roundup/admin.py:1590
+#: ../roundup/admin.py:1609
 msgid "Invalid format"
 msgstr "æ— æ•ˆçš„æ ¼å¼"
 
-#: ../roundup/admin.py:1601
+#: ../roundup/admin.py:1620
 msgid ""
 "Usage: perftest [mode] [arguments]*\n"
 "        Time operations in Roundup.\n"
@@ -1021,25 +1021,25 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1635
+#: ../roundup/admin.py:1657
 msgid "Invalid 'rounds'. Must be larger than 999."
 msgstr ""
 
-#: ../roundup/admin.py:1639
+#: ../roundup/admin.py:1661
 #, python-format
 msgid "Invalid 'rounds'. It must be an integer not: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1666
+#: ../roundup/admin.py:1688
 msgid "scheme does not support rounds."
 msgstr ""
 
-#: ../roundup/admin.py:1669
+#: ../roundup/admin.py:1691
 #, python-format
 msgid "Hash time: %(time)0.9f seconds, scheme: %(scheme)s, rounds: %(rounds)s"
 msgstr ""
 
-#: ../roundup/admin.py:1675
+#: ../roundup/admin.py:1697
 msgid ""
 "Usage: pragma setting=value | 'list'\n"
 "        Set internal admin settings to a value.\n"
@@ -1068,49 +1068,49 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1710
+#: ../roundup/admin.py:1732
 #, python-format
 msgid "Argument must be setting=value, was given: %s."
 msgstr ""
 
-#: ../roundup/admin.py:1713
+#: ../roundup/admin.py:1735
 msgid "Current settings and values (NYI - not yet implemented):"
 msgstr ""
 
-#: ../roundup/admin.py:1724
+#: ../roundup/admin.py:1746
 msgid ""
 "      Help for this pragma is missing. Please report it to the Roundup "
 "project.\n"
 msgstr ""
 
-#: ../roundup/admin.py:1730
+#: ../roundup/admin.py:1752
 #, fuzzy, python-format
 msgid "Unknown setting %s. Try \"pragma list\"."
 msgstr "æœªçŸ¥ç”¨æˆ·å"
 
-#: ../roundup/admin.py:1740
+#: ../roundup/admin.py:1762
 #, python-format
 msgid "Incorrect value for boolean setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1747
+#: ../roundup/admin.py:1769
 #, python-format
 msgid "Incorrect value for integer setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1754
+#: ../roundup/admin.py:1776
 #, python-format
 msgid ""
 "Incorrect value for setting %(setting)s: %(value)s. Should be no, both, or "
 "only."
 msgstr ""
 
-#: ../roundup/admin.py:1764
+#: ../roundup/admin.py:1786
 #, python-format
 msgid "Internal error: pragma can not handle values of type: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1773
+#: ../roundup/admin.py:1795
 #, fuzzy
 msgid ""
 "Usage: reindex [classname|classname:#-#|designator]*\n"
@@ -1133,17 +1133,17 @@ msgstr ""
 "        é‡æ–°ç”Ÿæˆ tracker çš„æœç´¢ç´¢å¼•ï¼Œå®ƒå°†è‡ªåŠ¨è¿›è¡Œã€‚\n"
 "        "
 
-#: ../roundup/admin.py:1795
+#: ../roundup/admin.py:1817
 #, python-format
 msgid "no such item \"%(designator)s\""
 msgstr "æ²¡æœ‰è¿™æ ·çš„æ¡ç›® \"%(designator)s\""
 
-#: ../roundup/admin.py:1805
+#: ../roundup/admin.py:1827
 #, fuzzy, python-format
 msgid "no such item \"%(class)s%(id)s\""
 msgstr "æ²¡æœ‰è¿™æ ·çš„æ¡ç›® \"%(designator)s\""
 
-#: ../roundup/admin.py:1817
+#: ../roundup/admin.py:1839
 #, fuzzy
 msgid ""
 "Usage: restore designator[,designator]*\n"
@@ -1161,7 +1161,7 @@ msgstr ""
 "        ç»™å®šçš„ç»“ç‚¹å°†å¯¹ç”¨æˆ·æ¥è¯´å†æ¬¡ç”Ÿæ•ˆã€‚\n"
 "        "
 
-#: ../roundup/admin.py:1848
+#: ../roundup/admin.py:1870
 #, fuzzy
 msgid ""
 "Usage: retire designator[,designator]*\n"
@@ -1182,7 +1182,7 @@ msgstr ""
 "        "
 
 #. noqa: ARG002 - args unused
-#: ../roundup/admin.py:1876
+#: ../roundup/admin.py:1898
 msgid ""
 "Usage: rollback\n"
 "        Undo all changes that are pending commit to the database.\n"
@@ -1201,7 +1201,7 @@ msgstr ""
 "        äº§ç”Ÿå˜åŒ–ã€‚\n"
 "        "
 
-#: ../roundup/admin.py:1889
+#: ../roundup/admin.py:1911
 msgid ""
 "Usage: security [Role name]\n"
 "        Display the Permissions available to one or all Roles.\n"
@@ -1214,47 +1214,47 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1904
+#: ../roundup/admin.py:1926
 #, fuzzy, python-format
 msgid "No such Role \"%(role)s\"\n"
 msgstr "æ²¡æœ‰è¿™æ ·çš„è§’è‰² \"%(role)s\""
 
-#: ../roundup/admin.py:1910
+#: ../roundup/admin.py:1932
 #, fuzzy, python-format
 msgid "New Web users get the Roles \"%(role)s\"\n"
 msgstr "æ–°Webç”¨æˆ·å¾—åˆ°è§’è‰² \"%(role)s\""
 
-#: ../roundup/admin.py:1913
+#: ../roundup/admin.py:1935
 #, fuzzy, python-format
 msgid "New Web users get the Role \"%(role)s\"\n"
 msgstr "æ–°Webç”¨æˆ·å¾—åˆ°è§’è‰² \"%(role)s\""
 
-#: ../roundup/admin.py:1917
+#: ../roundup/admin.py:1939
 #, fuzzy, python-format
 msgid "New Email users get the Roles \"%(role)s\"\n"
 msgstr "æ–°é‚®ä»¶ç”¨æˆ·å¾—åˆ°è§’è‰² \"%(role)s\""
 
-#: ../roundup/admin.py:1919
+#: ../roundup/admin.py:1941
 #, fuzzy, python-format
 msgid "New Email users get the Role \"%(role)s\"\n"
 msgstr "æ–°é‚®ä»¶ç”¨æˆ·å¾—åˆ°è§’è‰² \"%(role)s\""
 
-#: ../roundup/admin.py:1922
+#: ../roundup/admin.py:1944
 #, fuzzy, python-format
 msgid "Role \"%(name)s\":\n"
 msgstr "è§’è‰² \"%(name)s\"ï¼š"
 
-#: ../roundup/admin.py:1928
+#: ../roundup/admin.py:1950
 #, fuzzy
 msgid " %(description)s (%(name)s for \"%(klass)s\""
 msgstr " %(description)s (%(name)s ä»…ç”¨äºŽ \"%(klass)s\")"
 
-#: ../roundup/admin.py:1928
+#: ../roundup/admin.py:1950
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\": %(properties)s only)\n"
 msgstr " %(description)s (%(name)s ä»…ç”¨äºŽ \"%(klass)s\")"
 
-#: ../roundup/admin.py:1941
+#: ../roundup/admin.py:1963
 #, python-format
 msgid ""
 "\n"
@@ -1262,17 +1262,17 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/admin.py:1947
+#: ../roundup/admin.py:1969
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\" only)\n"
 msgstr " %(description)s (%(name)s ä»…ç”¨äºŽ \"%(klass)s\")"
 
-#: ../roundup/admin.py:1950
+#: ../roundup/admin.py:1972
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s)\n"
 msgstr " %(description)s (%(name)s)"
 
-#: ../roundup/admin.py:1954
+#: ../roundup/admin.py:1976
 #, fuzzy
 msgid ""
 "Usage: set items property=value [property=value ...]\n"
@@ -1305,7 +1305,7 @@ msgstr ""
 "        ä½ éœ€è¦ä¸ºå¤šé“¾æŽ¥æä¾›ç”¨é€—å·åˆ†éš”çš„æ•°å­—(ä¾‹å¦‚ \"1,2,3\")ã€‚\n"
 "        "
 
-#: ../roundup/admin.py:2022
+#: ../roundup/admin.py:2044
 msgid ""
 "Usage: specification classname\n"
 "        Show the properties for a classname.\n"
@@ -1319,17 +1319,17 @@ msgstr ""
 "        ä¼šåˆ—å‡ºç»™å®šç±»åž‹çš„å±žæ€§ã€‚\n"
 "        "
 
-#: ../roundup/admin.py:2041
+#: ../roundup/admin.py:2063
 #, fuzzy, python-format
 msgid "%(key)s: %(value)s (key property)\n"
 msgstr "%(key)s: %(value)s (å…³é”®å±žæ€§)"
 
-#: ../roundup/admin.py:2044
+#: ../roundup/admin.py:2066
 #, fuzzy, python-format
 msgid "%(key)s: %(value)s\n"
 msgstr "%(key)s: %(value)s"
 
-#: ../roundup/admin.py:2047
+#: ../roundup/admin.py:2069
 msgid ""
 "Usage: table classname [property[,property]*]\n"
 "        List the instances of a class in tabular form.\n"
@@ -1387,17 +1387,17 @@ msgstr ""
 "        å°†ç”Ÿæˆ4ä¸ªå­—ç¬¦å®½çš„ \"Name\" åˆ—ã€‚\n"
 "        "
 
-#: ../roundup/admin.py:2093
+#: ../roundup/admin.py:2115
 #, python-format
 msgid "\"%(spec)s\" not name:width"
 msgstr "\"%(spec)s\" ä¸æ˜¯ åå­—:å®½åº¦"
 
-#: ../roundup/admin.py:2115
+#: ../roundup/admin.py:2137
 #, python-format
 msgid "\"%(spec)s\" does not have an integer width: \"%(width)s\""
 msgstr ""
 
-#: ../roundup/admin.py:2151
+#: ../roundup/admin.py:2173
 msgid ""
 "Usage: templates [trace_search]\n"
 "        List templates and their installed directories.\n"
@@ -1407,7 +1407,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2179
+#: ../roundup/admin.py:2201
 msgid ""
 "Usage: updateconfig <filename>\n"
 "        Merge existing tracker config with new settings.\n"
@@ -1418,34 +1418,34 @@ msgid ""
 msgstr ""
 
 # ../roundup/cgi/actions.py:549 :559 :730 :749
-#: ../roundup/admin.py:2188 ../roundup/cgi/actions.py:886
+#: ../roundup/admin.py:2210 ../roundup/cgi/actions.py:886
 #: ../roundup/cgi/actions.py:897 ../roundup/cgi/actions.py:1099
 #: ../roundup/cgi/actions.py:1113 ../roundup/cgi/actions.py:886:897 :1099:1113
 #, python-format
 msgid "Error: %s"
 msgstr "é”™è¯¯ï¼š%s"
 
-#: ../roundup/admin.py:2220
+#: ../roundup/admin.py:2242
 #, python-format
 msgid "Unknown command \"%(command)s\" (\"help commands\" for a list)"
 msgstr "æœªçŸ¥å‘½ä»¤ \"%(command)s\" (\"help commands\" æŸ¥çœ‹å‘½ä»¤åˆ—è¡¨)"
 
-#: ../roundup/admin.py:2226
+#: ../roundup/admin.py:2248
 #, python-format
 msgid "Multiple commands match \"%(command)s\": %(list)s"
 msgstr "å¤šå‘½ä»¤åŒ¹é… \"%(command)s\": %(list)s"
 
-#: ../roundup/admin.py:2241
+#: ../roundup/admin.py:2263
 msgid "Enter tracker home: "
 msgstr "è¾“å…¥trackerèµ·å§‹ç›®å½•ï¼š"
 
-#: ../roundup/admin.py:2270 ../roundup/admin.py:2274
-#: ../roundup/admin.py:2270:2274
+#: ../roundup/admin.py:2292 ../roundup/admin.py:2296
+#: ../roundup/admin.py:2292:2296
 #, python-format
 msgid "Error: Couldn't open tracker: %(message)s"
 msgstr "é”™è¯¯ï¼šä¸èƒ½æ‰“å¼€trackerï¼š%(message)s"
 
-#: ../roundup/admin.py:2322
+#: ../roundup/admin.py:2344
 #, python-format
 msgid ""
 "Roundup %s ready for input.\n"
@@ -1454,15 +1454,15 @@ msgstr ""
 "Roundup %s è¾“å…¥å°±ç»ªã€‚\n"
 "æ•²å…¥ \"help\" èŽ·å¾—å¸®åŠ©ã€‚"
 
-#: ../roundup/admin.py:2355
+#: ../roundup/admin.py:2377
 msgid "Note: command history and editing not available"
 msgstr "æ³¨æ„ï¼šå‘½ä»¤åŽ†å²å’Œç¼–è¾‘æ— æ•ˆ"
 
-#: ../roundup/admin.py:2361
+#: ../roundup/admin.py:2383
 msgid "exit..."
 msgstr "é€€å‡º..."
 
-#: ../roundup/admin.py:2374
+#: ../roundup/admin.py:2396
 msgid "There are unsaved changes. Commit them (y/N)? "
 msgstr "å­˜åœ¨æœªè¢«ä¿å­˜çš„æ”¹åŠ¨ã€‚æäº¤å—(y/N)ï¼Ÿ"
 
@@ -1489,23 +1489,23 @@ msgstr ""
 msgid "Couldn't open database - the required module '%s' is not available"
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:871
-#: ../roundup/backends/back_anydbm.py:884
-#: ../roundup/backends/back_anydbm.py:1158
-#: ../roundup/backends/back_anydbm.py:1193
-#: ../roundup/backends/back_anydbm.py:1422
-#: ../roundup/backends/back_anydbm.py:1440
-#: ../roundup/backends/back_anydbm.py:1487
-#: ../roundup/backends/back_anydbm.py:2123
-#: ../roundup/backends/back_anydbm.py:871:884
+#: ../roundup/backends/back_anydbm.py:873
+#: ../roundup/backends/back_anydbm.py:886
+#: ../roundup/backends/back_anydbm.py:1160
+#: ../roundup/backends/back_anydbm.py:1195
+#: ../roundup/backends/back_anydbm.py:1424
+#: ../roundup/backends/back_anydbm.py:1442
+#: ../roundup/backends/back_anydbm.py:1489
+#: ../roundup/backends/back_anydbm.py:2135
+#: ../roundup/backends/back_anydbm.py:873:886
 #: ../roundup/backends/rdbms_common.py:1720
 #: ../roundup/backends/rdbms_common.py:1967
 #: ../roundup/backends/rdbms_common.py:2206
 #: ../roundup/backends/rdbms_common.py:2226
 #: ../roundup/backends/rdbms_common.py:2279
-#: ../roundup/backends/rdbms_common.py:3246
-#: ../roundup/backends/rdbms_common.py:1720:1967 :1158:1193 :1422:1440:1487
-#: :2123 :2206:2226 :2279:3246
+#: ../roundup/backends/rdbms_common.py:3254
+#: ../roundup/backends/rdbms_common.py:1720:1967 :1160:1195 :1424:1442:1489
+#: :2135 :2206:2226 :2279:3254
 msgid "Database open read-only"
 msgstr ""
 
@@ -1893,13 +1893,13 @@ msgstr "æ— æ•ˆç™»å½•"
 msgid "You do not have permission to login"
 msgstr "ä½ æ²¡æœ‰ç™»å½•çš„æƒé™"
 
-#: ../roundup/cgi/actions.py:1577 ../roundup/cgi/actions.py:1761
-#: ../roundup/cgi/actions.py:1577:1761
+#: ../roundup/cgi/actions.py:1577 ../roundup/cgi/actions.py:1757
+#: ../roundup/cgi/actions.py:1577:1757
 #, python-format
 msgid "Column \"%(column)s\" not found in %(class)s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1832
+#: ../roundup/cgi/actions.py:1822
 #, python-format
 msgid "You do not have permission to view %(class)s"
 msgstr "ä½ æ²¡æœ‰æŸ¥çœ‹ %(class)s çš„æƒé™"
@@ -1988,7 +1988,7 @@ msgstr "åœ¨ <strong>%s</strong>"
 msgid "<em>undefined</em>"
 msgstr "<em>æœªå®šä¹‰</em>"
 
-#: ../roundup/cgi/client.py:105
+#: ../roundup/cgi/client.py:111
 msgid ""
 "<html><head><title>An error has occurred</title></head>\n"
 "<body><h1>An error has occurred</h1>\n"
@@ -1997,155 +1997,161 @@ msgid ""
 "</body></html>"
 msgstr ""
 
-#: ../roundup/cgi/client.py:717 ../roundup/cgi/client.py:1635
-#: ../roundup/cgi/client.py:717:1635
+#: ../roundup/cgi/client.py:666
+msgid ""
+"XMLRPC endpoint is not using defusedxml. Improve security by installing "
+"defusedxml."
+msgstr ""
+
+#: ../roundup/cgi/client.py:728 ../roundup/cgi/client.py:1646
+#: ../roundup/cgi/client.py:728:1646
 msgid "Required Header Missing"
 msgstr ""
 
-#: ../roundup/cgi/client.py:719
+#: ../roundup/cgi/client.py:731
 #, fuzzy
 msgid "Client is not allowed to use Rest Interface."
 msgstr "åŒ¿åç”¨æˆ·ä¸å…è®¸ä½¿ç”¨ web ç•Œé¢"
 
-#: ../roundup/cgi/client.py:971
+#: ../roundup/cgi/client.py:985
 msgid "Form Error: "
 msgstr "è¡¨æ ¼é”™è¯¯ï¼š"
 
-#: ../roundup/cgi/client.py:1064
+#: ../roundup/cgi/client.py:1078
 #, python-format
 msgid "Unrecognized charset: %r"
 msgstr "æ— æ³•è¯†åˆ«çš„å­—ç¬¦é›†ï¼š%r"
 
-#: ../roundup/cgi/client.py:1331 ../roundup/cgi/client.py:2294
-#: ../roundup/cgi/client.py:1331:2294
+#: ../roundup/cgi/client.py:1345 ../roundup/cgi/client.py:2357
+#: ../roundup/cgi/client.py:1345:2357
 msgid "broken form: multiple @action values submitted"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1348
+#: ../roundup/cgi/client.py:1362
 msgid "Anonymous users are not allowed to use the web interface"
 msgstr "åŒ¿åç”¨æˆ·ä¸å…è®¸ä½¿ç”¨ web ç•Œé¢"
 
-#: ../roundup/cgi/client.py:1496
+#: ../roundup/cgi/client.py:1507
 msgid "Referer header not available."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1500
+#: ../roundup/cgi/client.py:1511
 #, python-format
 msgid "csrf key used with wrong method from: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1529
+#: ../roundup/cgi/client.py:1540
 #, python-format
 msgid "csrf header %(header)s required but missing for user%(userid)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1533
+#: ../roundup/cgi/client.py:1544
 #, python-format
 msgid "Missing header: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1541
+#: ../roundup/cgi/client.py:1552
 #, python-format
 msgid "csrf Referer header check failed for user%(userid)s. Value=%(referer)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1546
+#: ../roundup/cgi/client.py:1557
 #, fuzzy, python-format
 msgid "Invalid Referer: %s"
 msgstr "æ— æ•ˆç™»å½•"
 
-#: ../roundup/cgi/client.py:1561
+#: ../roundup/cgi/client.py:1572
 #, python-format
 msgid "csrf Origin header check failed for user%(userid)s. Value=%(origin)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1566
+#: ../roundup/cgi/client.py:1577
 #, fuzzy, python-format
 msgid "Invalid Origin %s"
 msgstr "æ— æ•ˆç™»å½•"
 
-#: ../roundup/cgi/client.py:1580
+#: ../roundup/cgi/client.py:1591
 #, python-format
 msgid ""
 "csrf X-FORWARDED-HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1586
+#: ../roundup/cgi/client.py:1597
 #, python-format
 msgid "Invalid X-FORWARDED-HOST %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1605
+#: ../roundup/cgi/client.py:1616
 #, python-format
 msgid "csrf HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1610
+#: ../roundup/cgi/client.py:1621
 #, fuzzy, python-format
 msgid "Invalid HOST %s"
 msgstr "æ— æ•ˆè¯·æ±‚"
 
-#: ../roundup/cgi/client.py:1618
+#: ../roundup/cgi/client.py:1629
 msgid "Csrf: unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1619
+#: ../roundup/cgi/client.py:1630
 msgid "Unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1632
+#: ../roundup/cgi/client.py:1643
 #, python-format
 msgid "csrf X-REQUESTED-WITH xmlrpc required header check failed for user%s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1673
+#: ../roundup/cgi/client.py:1684
 #, python-format
 msgid "Required csrf field missing for user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1675 ../roundup/cgi/client.py:1702
-#: ../roundup/cgi/client.py:1719 ../roundup/cgi/client.py:1675:1702:1719
+#: ../roundup/cgi/client.py:1686 ../roundup/cgi/client.py:1713
+#: ../roundup/cgi/client.py:1730 ../roundup/cgi/client.py:1686:1713:1730
 msgid ""
 "We can't validate your session (csrf failure). Re-enter any unsaved data and "
 "try again."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1679
+#: ../roundup/cgi/client.py:1690
 #, python-format
 msgid "csrf field not supplied by user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1691
+#: ../roundup/cgi/client.py:1702
 #, python-format
 msgid ""
 "Csrf mismatch user: current user %(user)s != stored user %(stored)s, current "
 "session, stored session: %(cur_sess)s,%(stor_sess)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1709
+#: ../roundup/cgi/client.py:1720
 #, python-format
 msgid ""
 "Csrf mismatch user: current session %(curr_sess)s != stored session "
 "%(stor_sess)s, current user/stored user is: %(user)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1901
+#: ../roundup/cgi/client.py:1912
 msgid "You are not allowed to view this file."
 msgstr "ä½ æ²¡æœ‰æŸ¥çœ‹æ­¤æ–‡ä»¶çš„æƒé™"
 
-#: ../roundup/cgi/client.py:2172
+#: ../roundup/cgi/client.py:2235
 #, python-format
 msgid "%(starttag)sTime elapsed: %(seconds)fs%(endtag)s\n"
 msgstr ""
 
-#: ../roundup/cgi/client.py:2176
+#: ../roundup/cgi/client.py:2239
 #, python-format
 msgid ""
 "%(starttag)sCache hits: %(cache_hits)d, misses %(cache_misses)d. Loading "
 "items: %(get_items)f secs. Filtering: %(filtering)f secs.%(endtag)s\n"
 msgstr ""
 
-#: ../roundup/cgi/client.py:2716
+#: ../roundup/cgi/client.py:2778
 #, python-format
 msgid ""
 "Cache failure: compressed file %(compressed)s is older than its source file "
@@ -2534,17 +2540,17 @@ msgstr ""
 msgid "Not a property name: %s"
 msgstr "ä¸æ˜¯å±žæ€§å: %s"
 
-#: ../roundup/hyperdb.py:1984
+#: ../roundup/hyperdb.py:2038
 #, fuzzy, python-format
 msgid "property %(property)s: %(value)r is not a %(classname)s."
 msgstr "å±žæ€§ \"%(propname)s\": \"%(value)s\" å½“å‰ä¸åœ¨åˆ—è¡¨ä¸­"
 
-#: ../roundup/hyperdb.py:1990
+#: ../roundup/hyperdb.py:2044
 #, python-format
 msgid "you may only enter ID values for property %s"
 msgstr ""
 
-#: ../roundup/hyperdb.py:2025
+#: ../roundup/hyperdb.py:2079
 #, python-format
 msgid "%(property)r is not a property of %(classname)s"
 msgstr ""
@@ -2783,6 +2789,22 @@ msgstr ""
 msgid "not of form [arg=value,value,...;arg=value,value,...]"
 msgstr ""
 
+#: ../roundup/mlink_expr.py:161
+#, python-format
+msgid ""
+"There was an error searching %(class)s by %(attr)s using: %(opcodes)s. The "
+"operator %(opcode)s (%(opcodename)s) at position %(position)d has too few "
+"arguments."
+msgstr ""
+
+#: ../roundup/mlink_expr.py:174
+#, python-format
+msgid ""
+"There was an error searching %(class)s by %(attr)s using: %(opcodes)s. There "
+"are too many arguments for the existing operators. The values on the stack "
+"are: %(stack)s"
+msgstr ""
+
 #: ../roundup/pygettext.py:401
 #, python-format
 msgid "*** %(file)s:%(lineno)s: Seen unexpected token \"%(token)s\""
@@ -2840,42 +2862,63 @@ msgstr ""
 msgid "morethanonestring"
 msgstr ""
 
-#: ../roundup/rest.py:410
+#: ../roundup/rest.py:417
 #, python-format
 msgid "Method %(m)s not allowed. Allowed: %(a)s"
 msgstr ""
 
-#: ../roundup/rest.py:948
+#: ../roundup/rest.py:964
 #, python-format
 msgid ""
 "Page size %(page_size)s must be less than admin limit on query result size: "
 "%(max_size)s."
 msgstr ""
 
-#: ../roundup/rest.py:1193
+#: ../roundup/rest.py:1211
 #, fuzzy, python-format
 msgid "Invalid attribute %s"
 msgstr "æ— æ•ˆç™»å½•"
 
-#: ../roundup/rest.py:2182
+#: ../roundup/rest.py:2199
 #, python-format
 msgid "Api rate limits exceeded. Please wait: %s seconds."
 msgstr ""
 
-#: ../roundup/rest.py:2258
+#: ../roundup/rest.py:2283
 #, python-format
 msgid ""
-"Unable to parse Accept Header. %(error)s. Acceptable types: "
+"Content type '%s' requested in URL is not available.\n"
+"Acceptable types: %s\n"
+msgstr ""
+
+#: ../roundup/rest.py:2304
+#, python-format
+msgid ""
+"Unable to parse Accept Header. %(error)s. Acceptable types: */*, "
 "%(acceptable_types)s"
 msgstr ""
 
-#: ../roundup/rest.py:2441
+#: ../roundup/rest.py:2376 ../roundup/rest.py:2597 ../roundup/rest.py:2376:2597
 #, python-format
 msgid ""
 "Unrecognized api version: %s. See /rest without specifying api version for "
 "supported versions."
 msgstr ""
 
+#: ../roundup/rest.py:2411 ../roundup/rest.py:2420 ../roundup/rest.py:2411:2420
+#, python-format
+msgid ""
+"Requested content type(s) '%s' not available.\n"
+"Acceptable mime types are: */*, %s"
+msgstr ""
+
+#: ../roundup/rest.py:2696
+msgid ""
+"Internal error while formatting response.\n"
+"accept_mime_type is not defined. This should\n"
+"never happen\n"
+msgstr ""
+
 #: ../roundup/roundupdb.py:140
 #, python-format
 msgid "Username '%s' already exists."
@@ -3030,33 +3073,33 @@ msgid ""
 msgstr ""
 "é”™è¯¯ï¼šæºå¿…é¡»æ˜¯ \"mailbox\", \"pop\", \"apop\", \"imap\" æˆ–è€… \"imaps\" ä¹‹ä¸€"
 
-#: ../roundup/scripts/roundup_server.py:112
+#: ../roundup/scripts/roundup_server.py:113
 msgid "WARNING: generating temporary SSL certificate"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:143
+#: ../roundup/scripts/roundup_server.py:144
 #, python-format
 msgid "Unable to find/use key from file: %(pemfile)s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:144
+#: ../roundup/scripts/roundup_server.py:145
 msgid ""
 "Does it have a private key surrounded by '-----BEGIN PRIVATE KEY-----' and\n"
 "  '-----END PRIVATE KEY-----' markers?"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:149
+#: ../roundup/scripts/roundup_server.py:150
 #, python-format
 msgid "Unable to find/use certificate from file: %(pemfile)s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:150
+#: ../roundup/scripts/roundup_server.py:151
 msgid ""
 "Does it have a certificate surrounded by '-----BEGIN CERTIFICATE-----' and\n"
 "  '-----END CERTIFICATE-----' markers?"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:344
+#: ../roundup/scripts/roundup_server.py:345
 msgid ""
 "<html><head><title>Roundup trackers index</title></head>\n"
 "<body><h1>Roundup trackers index</h1><ol>\n"
@@ -3064,58 +3107,58 @@ msgstr ""
 "<html><head><title>Roundup tracker ç´¢å¼•</title></head>\n"
 "<body><h1>Roundup tracker ç´¢å¼•</h1><ol>\n"
 
-#: ../roundup/scripts/roundup_server.py:570
+#: ../roundup/scripts/roundup_server.py:587
 #, fuzzy, python-format
 msgid "Error: %(type)s: %(value)s"
 msgstr "%(key)s: %(value)s"
 
-#: ../roundup/scripts/roundup_server.py:582
+#: ../roundup/scripts/roundup_server.py:599
 msgid "WARNING: ignoring \"-g\" argument, not root"
 msgstr "è­¦å‘Šï¼šå¿½ç•¥ \"-g\" å‚æ•°ï¼Œä¸æ˜¯ root"
 
-#: ../roundup/scripts/roundup_server.py:588
+#: ../roundup/scripts/roundup_server.py:605
 msgid "Can't change groups - no grp module"
 msgstr "ä¸èƒ½ä¿®æ”¹ç»„ - æ—  grp æ¨¡å—"
 
-#: ../roundup/scripts/roundup_server.py:597
+#: ../roundup/scripts/roundup_server.py:614
 #, python-format
 msgid "Group %(group)s doesn't exist"
 msgstr "ç»„ %(group)s ä¸å­˜åœ¨"
 
-#: ../roundup/scripts/roundup_server.py:609
+#: ../roundup/scripts/roundup_server.py:626
 msgid "Can't run as root!"
 msgstr "ä¸èƒ½ä»¥ root è¿è¡Œï¼"
 
-#: ../roundup/scripts/roundup_server.py:612
+#: ../roundup/scripts/roundup_server.py:629
 msgid "WARNING: ignoring \"-u\" argument, not root"
 msgstr "è­¦å‘Šï¼šå¿½ç•¥ \"-u\" å‚æ•°ï¼Œä¸æ˜¯ root"
 
-#: ../roundup/scripts/roundup_server.py:618
+#: ../roundup/scripts/roundup_server.py:635
 msgid "Can't change users - no pwd module"
 msgstr "ä¸èƒ½ä¿®æ”¹ç”¨æˆ· - æ—  pwd æ¨¡å—"
 
-#: ../roundup/scripts/roundup_server.py:627
+#: ../roundup/scripts/roundup_server.py:644
 #, python-format
 msgid "User %(user)s doesn't exist"
 msgstr "ç”¨æˆ· %(user)s ä¸å­˜åœ¨"
 
-#: ../roundup/scripts/roundup_server.py:833
+#: ../roundup/scripts/roundup_server.py:856
 #, python-format
 msgid "Multiprocess mode \"%s\" is not available, switching to single-process"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:861
+#: ../roundup/scripts/roundup_server.py:884
 #, python-format
 msgid "Unable to bind to port %s, port already in use."
 msgstr "æ— æ³•ç»‘å®šåˆ°ç«¯å£ %s, ç«¯å£å·²ç»è¢«å ç”¨ã€‚"
 
-#: ../roundup/scripts/roundup_server.py:865
+#: ../roundup/scripts/roundup_server.py:888
 #, fuzzy, python-format
 msgid ""
 "Unable to bind to port %(port)s, access not allowed, errno: %(errno)s %(msg)s"
 msgstr "æ— æ³•ç»‘å®šåˆ°ç«¯å£ %s, ç«¯å£å·²ç»è¢«å ç”¨ã€‚"
 
-#: ../roundup/scripts/roundup_server.py:944
+#: ../roundup/scripts/roundup_server.py:967
 #, fuzzy
 msgid ""
 " -c <Command>  Windows Service options.\n"
@@ -3132,13 +3175,15 @@ msgstr ""
 "               å˜é‡ä¸Šé…ç½®ä¸€ä¸ªtrackerã€‚è¿™ä¸ªé€‰é¡¹ä¸Žå…¶ç»é€‰é¡¹æ˜¯äº’æ–¥çš„ã€‚æ‰“å…¥\n"
 "               \"roundup-server -c help\" æ¥äº†è§£WindowsæœåŠ¡çš„è§„èŒƒã€‚"
 
-#: ../roundup/scripts/roundup_server.py:951
+#: ../roundup/scripts/roundup_server.py:974
+#, fuzzy
 msgid ""
 " -u <UID>      runs the Roundup web server as this UID\n"
 " -g <GID>      runs the Roundup web server as this GID\n"
 " -d <PIDfile>  run the server in the background and write the server's PID\n"
 "               to the file indicated by PIDfile. The -l option *must* be\n"
-"               specified if -d is used."
+"               specified if -d is used.\n"
+" -D            run the server in the foreground even when -d is used."
 msgstr ""
 " -u <UID>      ä»¥è¿™ä¸ª UID æ¥è¿è¡Œ Roundup web æœåŠ¡å™¨\n"
 " -g <GID>      ä»¥è¿™ä¸ª GID æ¥è¿è¡Œ Roundup web æœåŠ¡å™¨\n"
@@ -3146,7 +3191,7 @@ msgstr ""
 "åŽ»ã€‚\n"
 "               å¦‚æžœä½¿ç”¨äº† -d é€‰é¡¹ï¼Œåˆ™ -l é€‰é¡¹ *å¿…é¡»* è¦æŒ‡å®šã€‚"
 
-#: ../roundup/scripts/roundup_server.py:958
+#: ../roundup/scripts/roundup_server.py:982
 #, fuzzy, python-format
 msgid ""
 "\n"
@@ -3171,6 +3216,10 @@ msgid ""
 "mode\n"
 " -s            enable SSL\n"
 " -L            http request logging uses python logging (roundup.http)\n"
+" -P            log client address/name using reverse proxy X-Forwarded-For\n"
+"               header and not the connection IP (which is the reverse "
+"proxy).\n"
+"               Appends a '+' sign to the logged address/name.\n"
 " -e <fname>    PEM file containing SSL key and certificate\n"
 " -t <mode>     multiprocess mode (default: %(mp_def)s).\n"
 "               Allowed values: %(mp_types)s.\n"
@@ -3244,20 +3293,20 @@ msgstr ""
 "   æ„æ•°é‡çš„ name=home å¯¹ã€‚è¦ç¡®ä¿ name éƒ¨åˆ†ä¸èƒ½åŒ…æ‹¬ä»»ä½•éžurlå®‰å…¨çš„\n"
 "   å­—ç¬¦ï¼Œè±¡ç©ºæ ¼ï¼Œå› ä¸ºå®ƒä»¬ä¼šæŠŠIEæžä¹±ã€‚\n"
 
-#: ../roundup/scripts/roundup_server.py:1135
+#: ../roundup/scripts/roundup_server.py:1162
 msgid "Instances must be name=home"
 msgstr "å®žä¾‹å¿…é¡»æ˜¯ å®žä¾‹å=å®žä¾‹è·¯å¾„"
 
-#: ../roundup/scripts/roundup_server.py:1149
+#: ../roundup/scripts/roundup_server.py:1176
 #, python-format
 msgid "Configuration saved to %s"
 msgstr "é…ç½®ä¿å­˜åˆ° %s"
 
-#: ../roundup/scripts/roundup_server.py:1167
+#: ../roundup/scripts/roundup_server.py:1194
 msgid "Sorry, you can't run the server as a daemon on this Operating System"
 msgstr "æŠ±æ­‰ï¼Œåœ¨è¿™ä¸ªæ“ä½œç³»ç»Ÿä¸Šä¸èƒ½ä»¥å®ˆæŠ¤è¿›ç¨‹çš„æ–¹å¼æ¥è¿è¡ŒæœåŠ¡"
 
-#: ../roundup/scripts/roundup_server.py:1187
+#: ../roundup/scripts/roundup_server.py:1214
 #, python-format
 msgid "Roundup server started on %(HOST)s:%(PORT)s"
 msgstr "Roundup server å¯åŠ¨äºŽ %(HOST)s:%(PORT)s"
diff --git a/locale/zh_TW.po b/locale/zh_TW.po
index b5434c3be..7244c367b 100644
--- a/locale/zh_TW.po
+++ b/locale/zh_TW.po
@@ -5,9 +5,9 @@
 #
 msgid ""
 msgstr ""
-"Project-Id-Version: Roundup 2.4.0\n"
+"Project-Id-Version: Roundup 2.5.0\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
-"POT-Creation-Date: 2024-08-07 21:43-0400\n"
+"POT-Creation-Date: 2024-12-30 22:49-0500\n"
 "PO-Revision-Date: 2013-10-31 12:23+0100\n"
 "Last-Translator: Fred Lin <gasolin@gmail>\n"
 "Language-Team: Chinese Traditional <gasolin@gmail.com>\n"
@@ -85,8 +85,8 @@ msgid "Enable verbose output: tracing, descriptions...\n"
 msgstr ""
 
 # ../roundup/admin.py:84 :943 :992 :1014
-#: ../roundup/admin.py:175 ../roundup/admin.py:1188 ../roundup/admin.py:1836
-#: ../roundup/admin.py:1868 ../roundup/admin.py:175:1188 :1836:1868
+#: ../roundup/admin.py:175 ../roundup/admin.py:1188 ../roundup/admin.py:1858
+#: ../roundup/admin.py:1890 ../roundup/admin.py:175:1188 :1858:1890
 #, python-format
 msgid "no such class \"%(classname)s\""
 msgstr "ç„¡æ­¤é¡žåˆ¥ \"%(classname)s\""
@@ -299,14 +299,14 @@ msgid "%s:"
 msgstr ""
 
 # ../roundup/admin.py:337 :387
-#: ../roundup/admin.py:439 ../roundup/admin.py:1396
-#: ../roundup/admin.py:439:1396
+#: ../roundup/admin.py:439 ../roundup/admin.py:1415
+#: ../roundup/admin.py:439:1415
 msgid "Templates:"
 msgstr "æ¨¡æ¿ï¼š"
 
 # ../roundup/admin.py:340 :398
-#: ../roundup/admin.py:442 ../roundup/admin.py:1406
-#: ../roundup/admin.py:442:1406
+#: ../roundup/admin.py:442 ../roundup/admin.py:1425
+#: ../roundup/admin.py:442:1425
 msgid "Back ends:"
 msgstr "å¾Œç«¯ï¼š"
 
@@ -355,11 +355,11 @@ msgstr ""
 #: ../roundup/admin.py:482 ../roundup/admin.py:555 ../roundup/admin.py:606
 #: ../roundup/admin.py:733 ../roundup/admin.py:806 ../roundup/admin.py:851
 #: ../roundup/admin.py:902 ../roundup/admin.py:999 ../roundup/admin.py:1216
-#: ../roundup/admin.py:1369 ../roundup/admin.py:1497 ../roundup/admin.py:1580
-#: ../roundup/admin.py:1703 ../roundup/admin.py:1826 ../roundup/admin.py:1858
-#: ../roundup/admin.py:1974 ../roundup/admin.py:2028 ../roundup/admin.py:2076
-#: ../roundup/admin.py:482:555 :1216:1369:1497 :1580:1703 :1826:1858 :1974:2028
-#: :2076 :606:733 :806:851 :902:999
+#: ../roundup/admin.py:1388 ../roundup/admin.py:1516 ../roundup/admin.py:1599
+#: ../roundup/admin.py:1725 ../roundup/admin.py:1848 ../roundup/admin.py:1880
+#: ../roundup/admin.py:1996 ../roundup/admin.py:2050 ../roundup/admin.py:2098
+#: ../roundup/admin.py:482:555 :1216:1388:1516 :1599:1725 :1848:1880 :1996:2050
+#: :2098 :606:733 :806:851 :902:999
 msgid "Not enough arguments supplied"
 msgstr "æœªæä¾›è¶³å¤ çš„åƒæ•¸"
 
@@ -497,9 +497,9 @@ msgid "Class %(curclassname)s has no property %(pn)s in %(propname)s."
 msgstr "%(classname)s æ²’æœ‰ \"%(propname)s\" å±¬æ€§"
 
 # ../roundup/admin.py:663 :816 :828 :882
-#: ../roundup/admin.py:791 ../roundup/admin.py:840 ../roundup/admin.py:1517
-#: ../roundup/admin.py:1530 ../roundup/admin.py:2098
-#: ../roundup/admin.py:791:840 :1517:1530:2098
+#: ../roundup/admin.py:791 ../roundup/admin.py:840 ../roundup/admin.py:1536
+#: ../roundup/admin.py:1549 ../roundup/admin.py:2120
+#: ../roundup/admin.py:791:840 :1536:1549:2120
 #, python-format
 msgid "%(classname)s has no property \"%(propname)s\""
 msgstr "%(classname)s æ²’æœ‰ \"%(propname)s\" å±¬æ€§"
@@ -576,8 +576,8 @@ msgid "property %s is not of type Multilink or Link so -d flag does not apply."
 msgstr "å±¬æ€§ %s ä¸æ˜¯ Multilink æˆ– Link é¡žåž‹ï¼Œæ‰€ä»¥ -d æ¨™èªŒä¸èƒ½æ‡‰ç”¨ã€‚"
 
 # ../roundup/admin.py:550 :945 :994 :1016
-#: ../roundup/admin.py:942 ../roundup/admin.py:1190 ../roundup/admin.py:1842
-#: ../roundup/admin.py:1870 ../roundup/admin.py:942:1190 :1842:1870
+#: ../roundup/admin.py:942 ../roundup/admin.py:1190 ../roundup/admin.py:1864
+#: ../roundup/admin.py:1892 ../roundup/admin.py:942:1190 :1864:1892
 #, python-format
 msgid "no such %(classname)s node \"%(nodeid)s\""
 msgstr "æ²’æœ‰é€™æ¨£çš„ %(classname)s çµé»ž \"%(nodeid)s\""
@@ -726,7 +726,7 @@ msgstr ""
 "        èˆŠæ•¸æ“šã€‚)\n"
 "        "
 
-#: ../roundup/admin.py:1287
+#: ../roundup/admin.py:1306
 msgid ""
 "Usage: importtables export_dir\n"
 "        This imports the database tables exported using exporttables.\n"
@@ -736,7 +736,7 @@ msgid ""
 msgstr ""
 
 #. password
-#: ../roundup/admin.py:1295
+#: ../roundup/admin.py:1314
 msgid ""
 "Usage: initialise [adminpw]\n"
 "        Initialise a new Roundup tracker.\n"
@@ -754,23 +754,23 @@ msgstr ""
 "        åŸ·è¡Œtrackerçš„åˆå§‹åŒ–å‡½æ•¸ dbinit.init()\n"
 "        "
 
-#: ../roundup/admin.py:1309
+#: ../roundup/admin.py:1328
 msgid "Admin Password: "
 msgstr "ç®¡ç†å“¡å£ä»¤ï¼š"
 
-#: ../roundup/admin.py:1310
+#: ../roundup/admin.py:1329
 msgid "       Confirm: "
 msgstr "       ç¢ºèªï¼š"
 
-#: ../roundup/admin.py:1314
+#: ../roundup/admin.py:1333
 msgid "Instance home does not exist"
 msgstr "å¯¦ä¾‹ç›®éŒ„ä¸å­˜åœ¨"
 
-#: ../roundup/admin.py:1318
+#: ../roundup/admin.py:1337
 msgid "Instance has not been installed"
 msgstr "å¯¦ä¾‹é‚„æ²’æœ‰å®‰è£"
 
-#: ../roundup/admin.py:1326
+#: ../roundup/admin.py:1345
 msgid ""
 "WARNING: The database is already initialised!\n"
 "If you re-initialise it, you will lose all the data!\n"
@@ -780,7 +780,7 @@ msgstr ""
 "å¦‚æžœä½ é‡æ–°åˆå§‹åŒ–å®ƒï¼Œæ‰€æœ‰çš„æ•¸æ“šå°‡æœƒä¸Ÿå¤±ï¼\n"
 "åˆªé™¤å®ƒå—Žï¼ŸY/N: "
 
-#: ../roundup/admin.py:1346
+#: ../roundup/admin.py:1365
 #, fuzzy
 msgid ""
 "Usage: install [template [backend [key=val[,key=val]]]]\n"
@@ -820,12 +820,12 @@ msgstr ""
 "        è«‹æŸ¥çœ‹åˆå§‹åŒ–åƒæ•¸èªªæ˜Žã€‚\n"
 "        "
 
-#: ../roundup/admin.py:1375
+#: ../roundup/admin.py:1394
 #, python-format
 msgid "Instance home parent directory \"%(parent)s\" does not exist"
 msgstr "å¯¦ä¾‹ç›®éŒ„çš„çˆ¶ç›®éŒ„ \"%(parent)s\" ä¸å­˜åœ¨"
 
-#: ../roundup/admin.py:1384
+#: ../roundup/admin.py:1403
 #, python-format
 msgid ""
 "WARNING: There appears to be a tracker in \"%(tracker_home)s\"!\n"
@@ -836,22 +836,22 @@ msgstr ""
 "å¦‚æžœä½ æ‰“ç®—é‡æ–°å®‰è£å®ƒï¼Œæ‰€æœ‰çš„æ•¸æ“šå°‡æœƒä¸Ÿå¤±ï¼\n"
 "åˆªé™¤å®ƒå—Žï¼ŸY/N: "
 
-#: ../roundup/admin.py:1397
+#: ../roundup/admin.py:1416
 #, fuzzy
 msgid "Select template"
 msgstr "é¸æ“‡æ¨¡æ¿ [classic]ï¼š"
 
-#: ../roundup/admin.py:1407
+#: ../roundup/admin.py:1426
 #, fuzzy
 msgid "Select backend"
 msgstr "é¸æ“‡å¾Œç«¯ [anydbm]ï¼š"
 
-#: ../roundup/admin.py:1418
+#: ../roundup/admin.py:1437
 #, fuzzy, python-format
 msgid "Error in configuration settings: \"%s\""
 msgstr "é…ç½®ä¿å­˜åˆ° %s"
 
-#: ../roundup/admin.py:1451
+#: ../roundup/admin.py:1470
 #, fuzzy, python-format
 msgid ""
 "\n"
@@ -863,11 +863,11 @@ msgstr ""
 " ç¾åœ¨ä½ æ‡‰è©²ä¿®æ”¹trackerçš„é…ç½®æ–‡ä»¶ï¼š\n"
 "   %(config_file)s"
 
-#: ../roundup/admin.py:1461
+#: ../roundup/admin.py:1480
 msgid " ... at a minimum, you must set following options:"
 msgstr " ... è‡³å°‘ï¼Œä½ å¿…é ˆè¨­ç½®ä»¥ä¸‹é¸é …ï¼š"
 
-#: ../roundup/admin.py:1466
+#: ../roundup/admin.py:1485
 #, fuzzy, python-format
 msgid ""
 "\n"
@@ -891,7 +891,7 @@ msgstr ""
 "   %(database_init_file)s\n"
 " ... æŸ¥çœ‹é—œæ–¼å®¢æˆ¶åŒ–çš„æ–‡æª”ä¾†çž­è§£æ›´å¤šçš„ä¿¡æ¯ã€‚\n"
 
-#: ../roundup/admin.py:1482
+#: ../roundup/admin.py:1501
 msgid ""
 "Usage: list classname [property]\n"
 "        List the instances of a class.\n"
@@ -917,17 +917,17 @@ msgstr ""
 "        å®šäº†å±¬æ€§ï¼Œå°æ¯å€‹é¡žåž‹å¯¦ä¾‹æœƒåˆ—å°å‡ºé€™å€‹å±¬æ€§ã€‚\n"
 "        "
 
-#: ../roundup/admin.py:1495
+#: ../roundup/admin.py:1514
 msgid "Too many arguments supplied"
 msgstr "æä¾›äº†å¤ªå¤šçš„åƒæ•¸äº†"
 
-#: ../roundup/admin.py:1528
+#: ../roundup/admin.py:1547
 #, python-format
 msgid "%(nodeid)4s: %(value)s"
 msgstr ""
 
 #. noqa: ARG002  - args unused
-#: ../roundup/admin.py:1535
+#: ../roundup/admin.py:1554
 msgid ""
 "Usage: migrate\n"
 "        Update a tracker's database to be compatible with the Roundup\n"
@@ -950,17 +950,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1555
+#: ../roundup/admin.py:1574
 #, python-format
 msgid "Tracker updated to schema version %s."
 msgstr ""
 
-#: ../roundup/admin.py:1559
+#: ../roundup/admin.py:1578
 #, python-format
 msgid "No migration action required. At schema version %s."
 msgstr ""
 
-#: ../roundup/admin.py:1564
+#: ../roundup/admin.py:1583
 #, fuzzy
 msgid ""
 "Usage: pack period | date\n"
@@ -997,11 +997,11 @@ msgstr ""
 "\n"
 "        "
 
-#: ../roundup/admin.py:1590
+#: ../roundup/admin.py:1609
 msgid "Invalid format"
 msgstr "ç„¡æ•ˆçš„æ ¼å¼"
 
-#: ../roundup/admin.py:1601
+#: ../roundup/admin.py:1620
 msgid ""
 "Usage: perftest [mode] [arguments]*\n"
 "        Time operations in Roundup.\n"
@@ -1019,25 +1019,25 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1635
+#: ../roundup/admin.py:1657
 msgid "Invalid 'rounds'. Must be larger than 999."
 msgstr ""
 
-#: ../roundup/admin.py:1639
+#: ../roundup/admin.py:1661
 #, python-format
 msgid "Invalid 'rounds'. It must be an integer not: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1666
+#: ../roundup/admin.py:1688
 msgid "scheme does not support rounds."
 msgstr ""
 
-#: ../roundup/admin.py:1669
+#: ../roundup/admin.py:1691
 #, python-format
 msgid "Hash time: %(time)0.9f seconds, scheme: %(scheme)s, rounds: %(rounds)s"
 msgstr ""
 
-#: ../roundup/admin.py:1675
+#: ../roundup/admin.py:1697
 msgid ""
 "Usage: pragma setting=value | 'list'\n"
 "        Set internal admin settings to a value.\n"
@@ -1066,49 +1066,49 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1710
+#: ../roundup/admin.py:1732
 #, python-format
 msgid "Argument must be setting=value, was given: %s."
 msgstr ""
 
-#: ../roundup/admin.py:1713
+#: ../roundup/admin.py:1735
 msgid "Current settings and values (NYI - not yet implemented):"
 msgstr ""
 
-#: ../roundup/admin.py:1724
+#: ../roundup/admin.py:1746
 msgid ""
 "      Help for this pragma is missing. Please report it to the Roundup "
 "project.\n"
 msgstr ""
 
-#: ../roundup/admin.py:1730
+#: ../roundup/admin.py:1752
 #, fuzzy, python-format
 msgid "Unknown setting %s. Try \"pragma list\"."
 msgstr "æœªçŸ¥ç”¨æˆ¶å"
 
-#: ../roundup/admin.py:1740
+#: ../roundup/admin.py:1762
 #, python-format
 msgid "Incorrect value for boolean setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1747
+#: ../roundup/admin.py:1769
 #, python-format
 msgid "Incorrect value for integer setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1754
+#: ../roundup/admin.py:1776
 #, python-format
 msgid ""
 "Incorrect value for setting %(setting)s: %(value)s. Should be no, both, or "
 "only."
 msgstr ""
 
-#: ../roundup/admin.py:1764
+#: ../roundup/admin.py:1786
 #, python-format
 msgid "Internal error: pragma can not handle values of type: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1773
+#: ../roundup/admin.py:1795
 #, fuzzy
 msgid ""
 "Usage: reindex [classname|classname:#-#|designator]*\n"
@@ -1131,17 +1131,17 @@ msgstr ""
 "        é‡æ–°ç”Ÿæˆ tracker çš„æœç´¢ç´¢å¼•ï¼Œå®ƒå°‡è‡ªå‹•é€²è¡Œã€‚\n"
 "        "
 
-#: ../roundup/admin.py:1795
+#: ../roundup/admin.py:1817
 #, python-format
 msgid "no such item \"%(designator)s\""
 msgstr "æ²’æœ‰é€™æ¨£çš„æ¢ç›® \"%(designator)s\""
 
-#: ../roundup/admin.py:1805
+#: ../roundup/admin.py:1827
 #, fuzzy, python-format
 msgid "no such item \"%(class)s%(id)s\""
 msgstr "æ²’æœ‰é€™æ¨£çš„æ¢ç›® \"%(designator)s\""
 
-#: ../roundup/admin.py:1817
+#: ../roundup/admin.py:1839
 #, fuzzy
 msgid ""
 "Usage: restore designator[,designator]*\n"
@@ -1159,7 +1159,7 @@ msgstr ""
 "        çµ¦å®šçš„çµé»žå°‡å°ç”¨æˆ¶ä¾†èªªå†æ¬¡ç”Ÿæ•ˆã€‚\n"
 "        "
 
-#: ../roundup/admin.py:1848
+#: ../roundup/admin.py:1870
 #, fuzzy
 msgid ""
 "Usage: retire designator[,designator]*\n"
@@ -1180,7 +1180,7 @@ msgstr ""
 "        "
 
 #. noqa: ARG002 - args unused
-#: ../roundup/admin.py:1876
+#: ../roundup/admin.py:1898
 msgid ""
 "Usage: rollback\n"
 "        Undo all changes that are pending commit to the database.\n"
@@ -1199,7 +1199,7 @@ msgstr ""
 "        ç”¢ç”Ÿè®ŠåŒ–ã€‚\n"
 "        "
 
-#: ../roundup/admin.py:1889
+#: ../roundup/admin.py:1911
 msgid ""
 "Usage: security [Role name]\n"
 "        Display the Permissions available to one or all Roles.\n"
@@ -1212,47 +1212,47 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1904
+#: ../roundup/admin.py:1926
 #, fuzzy, python-format
 msgid "No such Role \"%(role)s\"\n"
 msgstr "æ²’æœ‰é€™æ¨£çš„è§’è‰² \"%(role)s\""
 
-#: ../roundup/admin.py:1910
+#: ../roundup/admin.py:1932
 #, fuzzy, python-format
 msgid "New Web users get the Roles \"%(role)s\"\n"
 msgstr "æ–°Webç”¨æˆ¶å¾—åˆ°è§’è‰² \"%(role)s\""
 
-#: ../roundup/admin.py:1913
+#: ../roundup/admin.py:1935
 #, fuzzy, python-format
 msgid "New Web users get the Role \"%(role)s\"\n"
 msgstr "æ–°Webç”¨æˆ¶å¾—åˆ°è§’è‰² \"%(role)s\""
 
-#: ../roundup/admin.py:1917
+#: ../roundup/admin.py:1939
 #, fuzzy, python-format
 msgid "New Email users get the Roles \"%(role)s\"\n"
 msgstr "æ–°éƒµä»¶ç”¨æˆ¶å¾—åˆ°è§’è‰² \"%(role)s\""
 
-#: ../roundup/admin.py:1919
+#: ../roundup/admin.py:1941
 #, fuzzy, python-format
 msgid "New Email users get the Role \"%(role)s\"\n"
 msgstr "æ–°éƒµä»¶ç”¨æˆ¶å¾—åˆ°è§’è‰² \"%(role)s\""
 
-#: ../roundup/admin.py:1922
+#: ../roundup/admin.py:1944
 #, fuzzy, python-format
 msgid "Role \"%(name)s\":\n"
 msgstr "è§’è‰² \"%(name)s\"ï¼š"
 
-#: ../roundup/admin.py:1928
+#: ../roundup/admin.py:1950
 #, fuzzy
 msgid " %(description)s (%(name)s for \"%(klass)s\""
 msgstr " %(description)s (%(name)s åƒ…ç”¨æ–¼ \"%(klass)s\")"
 
-#: ../roundup/admin.py:1928
+#: ../roundup/admin.py:1950
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\": %(properties)s only)\n"
 msgstr " %(description)s (%(name)s åƒ…ç”¨æ–¼ \"%(klass)s\")"
 
-#: ../roundup/admin.py:1941
+#: ../roundup/admin.py:1963
 #, python-format
 msgid ""
 "\n"
@@ -1260,17 +1260,17 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/admin.py:1947
+#: ../roundup/admin.py:1969
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\" only)\n"
 msgstr " %(description)s (%(name)s åƒ…ç”¨æ–¼ \"%(klass)s\")"
 
-#: ../roundup/admin.py:1950
+#: ../roundup/admin.py:1972
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s)\n"
 msgstr " %(description)s (%(name)s åƒ…ç”¨æ–¼ \"%(klass)s\")"
 
-#: ../roundup/admin.py:1954
+#: ../roundup/admin.py:1976
 #, fuzzy
 msgid ""
 "Usage: set items property=value [property=value ...]\n"
@@ -1303,7 +1303,7 @@ msgstr ""
 "        ä½ éœ€è¦ç‚ºå¤šéˆæŽ¥æä¾›ç”¨é€—è™Ÿåˆ†éš”çš„æ•¸å­—(ä¾‹å¦‚ \"1,2,3\")ã€‚\n"
 "        "
 
-#: ../roundup/admin.py:2022
+#: ../roundup/admin.py:2044
 msgid ""
 "Usage: specification classname\n"
 "        Show the properties for a classname.\n"
@@ -1317,17 +1317,17 @@ msgstr ""
 "        æœƒåˆ—å‡ºçµ¦å®šé¡žåž‹çš„å±¬æ€§ã€‚\n"
 "        "
 
-#: ../roundup/admin.py:2041
+#: ../roundup/admin.py:2063
 #, fuzzy, python-format
 msgid "%(key)s: %(value)s (key property)\n"
 msgstr "%(key)s: %(value)s (é—œéµå±¬æ€§)"
 
-#: ../roundup/admin.py:2044
+#: ../roundup/admin.py:2066
 #, fuzzy, python-format
 msgid "%(key)s: %(value)s\n"
 msgstr "%(key)s: %(value)s (é—œéµå±¬æ€§)"
 
-#: ../roundup/admin.py:2047
+#: ../roundup/admin.py:2069
 msgid ""
 "Usage: table classname [property[,property]*]\n"
 "        List the instances of a class in tabular form.\n"
@@ -1385,17 +1385,17 @@ msgstr ""
 "        å°‡ç”Ÿæˆ4å€‹å­—ç¬¦å¯¬çš„ \"Name\" åˆ—ã€‚\n"
 "        "
 
-#: ../roundup/admin.py:2093
+#: ../roundup/admin.py:2115
 #, python-format
 msgid "\"%(spec)s\" not name:width"
 msgstr "\"%(spec)s\" ä¸æ˜¯ åå­—:å¯¬åº¦"
 
-#: ../roundup/admin.py:2115
+#: ../roundup/admin.py:2137
 #, python-format
 msgid "\"%(spec)s\" does not have an integer width: \"%(width)s\""
 msgstr ""
 
-#: ../roundup/admin.py:2151
+#: ../roundup/admin.py:2173
 msgid ""
 "Usage: templates [trace_search]\n"
 "        List templates and their installed directories.\n"
@@ -1405,7 +1405,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2179
+#: ../roundup/admin.py:2201
 msgid ""
 "Usage: updateconfig <filename>\n"
 "        Merge existing tracker config with new settings.\n"
@@ -1416,34 +1416,34 @@ msgid ""
 msgstr ""
 
 # ../roundup/cgi/actions.py:549 :559 :730 :749
-#: ../roundup/admin.py:2188 ../roundup/cgi/actions.py:886
+#: ../roundup/admin.py:2210 ../roundup/cgi/actions.py:886
 #: ../roundup/cgi/actions.py:897 ../roundup/cgi/actions.py:1099
 #: ../roundup/cgi/actions.py:1113 ../roundup/cgi/actions.py:886:897 :1099:1113
 #, python-format
 msgid "Error: %s"
 msgstr "éŒ¯èª¤ï¼š%s"
 
-#: ../roundup/admin.py:2220
+#: ../roundup/admin.py:2242
 #, python-format
 msgid "Unknown command \"%(command)s\" (\"help commands\" for a list)"
 msgstr "æœªçŸ¥å‘½ä»¤ \"%(command)s\" (\"help commands\" æŸ¥çœ‹å‘½ä»¤åˆ—è¡¨)"
 
-#: ../roundup/admin.py:2226
+#: ../roundup/admin.py:2248
 #, python-format
 msgid "Multiple commands match \"%(command)s\": %(list)s"
 msgstr "å¤šå‘½ä»¤åŒ¹é… \"%(command)s\": %(list)s"
 
-#: ../roundup/admin.py:2241
+#: ../roundup/admin.py:2263
 msgid "Enter tracker home: "
 msgstr "è¼¸å…¥trackerèµ·å§‹ç›®éŒ„ï¼š"
 
-#: ../roundup/admin.py:2270 ../roundup/admin.py:2274
-#: ../roundup/admin.py:2270:2274
+#: ../roundup/admin.py:2292 ../roundup/admin.py:2296
+#: ../roundup/admin.py:2292:2296
 #, python-format
 msgid "Error: Couldn't open tracker: %(message)s"
 msgstr "éŒ¯èª¤ï¼šä¸èƒ½æ‰“é–‹trackerï¼š%(message)s"
 
-#: ../roundup/admin.py:2322
+#: ../roundup/admin.py:2344
 #, python-format
 msgid ""
 "Roundup %s ready for input.\n"
@@ -1452,15 +1452,15 @@ msgstr ""
 "Roundup %s è¼¸å…¥å°±ç·’ã€‚\n"
 "æ•²å…¥ \"help\" ç²å¾—èªªæ˜Žã€‚"
 
-#: ../roundup/admin.py:2355
+#: ../roundup/admin.py:2377
 msgid "Note: command history and editing not available"
 msgstr "æ³¨æ„ï¼šå‘½ä»¤æ­·å²å’Œç·¨è¼¯ç„¡æ•ˆ"
 
-#: ../roundup/admin.py:2361
+#: ../roundup/admin.py:2383
 msgid "exit..."
 msgstr "é€€å‡º..."
 
-#: ../roundup/admin.py:2374
+#: ../roundup/admin.py:2396
 msgid "There are unsaved changes. Commit them (y/N)? "
 msgstr "å­˜åœ¨æœªè¢«ä¿å­˜çš„æ”¹å‹•ã€‚æäº¤å—Ž(y/N)ï¼Ÿ"
 
@@ -1487,23 +1487,23 @@ msgstr ""
 msgid "Couldn't open database - the required module '%s' is not available"
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:871
-#: ../roundup/backends/back_anydbm.py:884
-#: ../roundup/backends/back_anydbm.py:1158
-#: ../roundup/backends/back_anydbm.py:1193
-#: ../roundup/backends/back_anydbm.py:1422
-#: ../roundup/backends/back_anydbm.py:1440
-#: ../roundup/backends/back_anydbm.py:1487
-#: ../roundup/backends/back_anydbm.py:2123
-#: ../roundup/backends/back_anydbm.py:871:884
+#: ../roundup/backends/back_anydbm.py:873
+#: ../roundup/backends/back_anydbm.py:886
+#: ../roundup/backends/back_anydbm.py:1160
+#: ../roundup/backends/back_anydbm.py:1195
+#: ../roundup/backends/back_anydbm.py:1424
+#: ../roundup/backends/back_anydbm.py:1442
+#: ../roundup/backends/back_anydbm.py:1489
+#: ../roundup/backends/back_anydbm.py:2135
+#: ../roundup/backends/back_anydbm.py:873:886
 #: ../roundup/backends/rdbms_common.py:1720
 #: ../roundup/backends/rdbms_common.py:1967
 #: ../roundup/backends/rdbms_common.py:2206
 #: ../roundup/backends/rdbms_common.py:2226
 #: ../roundup/backends/rdbms_common.py:2279
-#: ../roundup/backends/rdbms_common.py:3246
-#: ../roundup/backends/rdbms_common.py:1720:1967 :1158:1193 :1422:1440:1487
-#: :2123 :2206:2226 :2279:3246
+#: ../roundup/backends/rdbms_common.py:3254
+#: ../roundup/backends/rdbms_common.py:1720:1967 :1160:1195 :1424:1442:1489
+#: :2135 :2206:2226 :2279:3254
 msgid "Database open read-only"
 msgstr ""
 
@@ -1894,13 +1894,13 @@ msgstr "ç„¡æ•ˆç™»éŒ„"
 msgid "You do not have permission to login"
 msgstr "ä½ æ²’æœ‰ç™»éŒ„çš„æ¬Šé™"
 
-#: ../roundup/cgi/actions.py:1577 ../roundup/cgi/actions.py:1761
-#: ../roundup/cgi/actions.py:1577:1761
+#: ../roundup/cgi/actions.py:1577 ../roundup/cgi/actions.py:1757
+#: ../roundup/cgi/actions.py:1577:1757
 #, python-format
 msgid "Column \"%(column)s\" not found in %(class)s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1832
+#: ../roundup/cgi/actions.py:1822
 #, fuzzy, python-format
 msgid "You do not have permission to view %(class)s"
 msgstr "ä½ æ²’æœ‰æ¬Šé™ä¾†ç·¨è¼¯ %(class)s"
@@ -1989,7 +1989,7 @@ msgstr "åœ¨ <strong>%s</strong>"
 msgid "<em>undefined</em>"
 msgstr "<em>æœªå®šç¾©</em>"
 
-#: ../roundup/cgi/client.py:105
+#: ../roundup/cgi/client.py:111
 msgid ""
 "<html><head><title>An error has occurred</title></head>\n"
 "<body><h1>An error has occurred</h1>\n"
@@ -1998,156 +1998,162 @@ msgid ""
 "</body></html>"
 msgstr ""
 
-#: ../roundup/cgi/client.py:717 ../roundup/cgi/client.py:1635
-#: ../roundup/cgi/client.py:717:1635
+#: ../roundup/cgi/client.py:666
+msgid ""
+"XMLRPC endpoint is not using defusedxml. Improve security by installing "
+"defusedxml."
+msgstr ""
+
+#: ../roundup/cgi/client.py:728 ../roundup/cgi/client.py:1646
+#: ../roundup/cgi/client.py:728:1646
 msgid "Required Header Missing"
 msgstr ""
 
-#: ../roundup/cgi/client.py:719
+#: ../roundup/cgi/client.py:731
 #, fuzzy
 msgid "Client is not allowed to use Rest Interface."
 msgstr "åŒ¿åç”¨æˆ¶ä¸å…è¨±ä½¿ç”¨webç•Œé¢"
 
-#: ../roundup/cgi/client.py:971
+#: ../roundup/cgi/client.py:985
 msgid "Form Error: "
 msgstr "è¡¨æ ¼éŒ¯èª¤ï¼š"
 
-#: ../roundup/cgi/client.py:1064
+#: ../roundup/cgi/client.py:1078
 #, python-format
 msgid "Unrecognized charset: %r"
 msgstr "ç„¡æ³•è­˜åˆ¥çš„å­—ç¬¦é›†ï¼š%r"
 
-#: ../roundup/cgi/client.py:1331 ../roundup/cgi/client.py:2294
-#: ../roundup/cgi/client.py:1331:2294
+#: ../roundup/cgi/client.py:1345 ../roundup/cgi/client.py:2357
+#: ../roundup/cgi/client.py:1345:2357
 msgid "broken form: multiple @action values submitted"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1348
+#: ../roundup/cgi/client.py:1362
 msgid "Anonymous users are not allowed to use the web interface"
 msgstr "åŒ¿åç”¨æˆ¶ä¸å…è¨±ä½¿ç”¨webç•Œé¢"
 
-#: ../roundup/cgi/client.py:1496
+#: ../roundup/cgi/client.py:1507
 msgid "Referer header not available."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1500
+#: ../roundup/cgi/client.py:1511
 #, python-format
 msgid "csrf key used with wrong method from: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1529
+#: ../roundup/cgi/client.py:1540
 #, python-format
 msgid "csrf header %(header)s required but missing for user%(userid)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1533
+#: ../roundup/cgi/client.py:1544
 #, python-format
 msgid "Missing header: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1541
+#: ../roundup/cgi/client.py:1552
 #, python-format
 msgid "csrf Referer header check failed for user%(userid)s. Value=%(referer)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1546
+#: ../roundup/cgi/client.py:1557
 #, fuzzy, python-format
 msgid "Invalid Referer: %s"
 msgstr "ç„¡æ•ˆç™»éŒ„"
 
-#: ../roundup/cgi/client.py:1561
+#: ../roundup/cgi/client.py:1572
 #, python-format
 msgid "csrf Origin header check failed for user%(userid)s. Value=%(origin)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1566
+#: ../roundup/cgi/client.py:1577
 #, fuzzy, python-format
 msgid "Invalid Origin %s"
 msgstr "ç„¡æ•ˆç™»éŒ„"
 
-#: ../roundup/cgi/client.py:1580
+#: ../roundup/cgi/client.py:1591
 #, python-format
 msgid ""
 "csrf X-FORWARDED-HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1586
+#: ../roundup/cgi/client.py:1597
 #, python-format
 msgid "Invalid X-FORWARDED-HOST %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1605
+#: ../roundup/cgi/client.py:1616
 #, python-format
 msgid "csrf HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1610
+#: ../roundup/cgi/client.py:1621
 #, python-format
 msgid "Invalid HOST %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1618
+#: ../roundup/cgi/client.py:1629
 msgid "Csrf: unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1619
+#: ../roundup/cgi/client.py:1630
 msgid "Unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1632
+#: ../roundup/cgi/client.py:1643
 #, python-format
 msgid "csrf X-REQUESTED-WITH xmlrpc required header check failed for user%s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1673
+#: ../roundup/cgi/client.py:1684
 #, python-format
 msgid "Required csrf field missing for user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1675 ../roundup/cgi/client.py:1702
-#: ../roundup/cgi/client.py:1719 ../roundup/cgi/client.py:1675:1702:1719
+#: ../roundup/cgi/client.py:1686 ../roundup/cgi/client.py:1713
+#: ../roundup/cgi/client.py:1730 ../roundup/cgi/client.py:1686:1713:1730
 msgid ""
 "We can't validate your session (csrf failure). Re-enter any unsaved data and "
 "try again."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1679
+#: ../roundup/cgi/client.py:1690
 #, python-format
 msgid "csrf field not supplied by user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1691
+#: ../roundup/cgi/client.py:1702
 #, python-format
 msgid ""
 "Csrf mismatch user: current user %(user)s != stored user %(stored)s, current "
 "session, stored session: %(cur_sess)s,%(stor_sess)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1709
+#: ../roundup/cgi/client.py:1720
 #, python-format
 msgid ""
 "Csrf mismatch user: current session %(curr_sess)s != stored session "
 "%(stor_sess)s, current user/stored user is: %(user)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1901
+#: ../roundup/cgi/client.py:1912
 #, fuzzy
 msgid "You are not allowed to view this file."
 msgstr "ä½ ä¸å…è¨±æŸ¥çœ‹æ­¤é "
 
-#: ../roundup/cgi/client.py:2172
+#: ../roundup/cgi/client.py:2235
 #, python-format
 msgid "%(starttag)sTime elapsed: %(seconds)fs%(endtag)s\n"
 msgstr ""
 
-#: ../roundup/cgi/client.py:2176
+#: ../roundup/cgi/client.py:2239
 #, python-format
 msgid ""
 "%(starttag)sCache hits: %(cache_hits)d, misses %(cache_misses)d. Loading "
 "items: %(get_items)f secs. Filtering: %(filtering)f secs.%(endtag)s\n"
 msgstr ""
 
-#: ../roundup/cgi/client.py:2716
+#: ../roundup/cgi/client.py:2778
 #, python-format
 msgid ""
 "Cache failure: compressed file %(compressed)s is older than its source file "
@@ -2536,17 +2542,17 @@ msgstr ""
 msgid "Not a property name: %s"
 msgstr "ä¸æ˜¯æ—¥æœŸæ ¼å¼ï¼š%s"
 
-#: ../roundup/hyperdb.py:1984
+#: ../roundup/hyperdb.py:2038
 #, fuzzy, python-format
 msgid "property %(property)s: %(value)r is not a %(classname)s."
 msgstr "å±¬æ€§ \"%(propname)s\": \"%(value)s\" ç•¶å‰ä¸åœ¨åˆ—è¡¨ä¸­"
 
-#: ../roundup/hyperdb.py:1990
+#: ../roundup/hyperdb.py:2044
 #, python-format
 msgid "you may only enter ID values for property %s"
 msgstr ""
 
-#: ../roundup/hyperdb.py:2025
+#: ../roundup/hyperdb.py:2079
 #, python-format
 msgid "%(property)r is not a property of %(classname)s"
 msgstr ""
@@ -2788,6 +2794,22 @@ msgstr ""
 msgid "not of form [arg=value,value,...;arg=value,value,...]"
 msgstr ""
 
+#: ../roundup/mlink_expr.py:161
+#, python-format
+msgid ""
+"There was an error searching %(class)s by %(attr)s using: %(opcodes)s. The "
+"operator %(opcode)s (%(opcodename)s) at position %(position)d has too few "
+"arguments."
+msgstr ""
+
+#: ../roundup/mlink_expr.py:174
+#, python-format
+msgid ""
+"There was an error searching %(class)s by %(attr)s using: %(opcodes)s. There "
+"are too many arguments for the existing operators. The values on the stack "
+"are: %(stack)s"
+msgstr ""
+
 #: ../roundup/pygettext.py:401
 #, python-format
 msgid "*** %(file)s:%(lineno)s: Seen unexpected token \"%(token)s\""
@@ -2845,42 +2867,63 @@ msgstr ""
 msgid "morethanonestring"
 msgstr ""
 
-#: ../roundup/rest.py:410
+#: ../roundup/rest.py:417
 #, python-format
 msgid "Method %(m)s not allowed. Allowed: %(a)s"
 msgstr ""
 
-#: ../roundup/rest.py:948
+#: ../roundup/rest.py:964
 #, python-format
 msgid ""
 "Page size %(page_size)s must be less than admin limit on query result size: "
 "%(max_size)s."
 msgstr ""
 
-#: ../roundup/rest.py:1193
+#: ../roundup/rest.py:1211
 #, fuzzy, python-format
 msgid "Invalid attribute %s"
 msgstr "ç„¡æ•ˆç™»éŒ„"
 
-#: ../roundup/rest.py:2182
+#: ../roundup/rest.py:2199
 #, python-format
 msgid "Api rate limits exceeded. Please wait: %s seconds."
 msgstr ""
 
-#: ../roundup/rest.py:2258
+#: ../roundup/rest.py:2283
 #, python-format
 msgid ""
-"Unable to parse Accept Header. %(error)s. Acceptable types: "
+"Content type '%s' requested in URL is not available.\n"
+"Acceptable types: %s\n"
+msgstr ""
+
+#: ../roundup/rest.py:2304
+#, python-format
+msgid ""
+"Unable to parse Accept Header. %(error)s. Acceptable types: */*, "
 "%(acceptable_types)s"
 msgstr ""
 
-#: ../roundup/rest.py:2441
+#: ../roundup/rest.py:2376 ../roundup/rest.py:2597 ../roundup/rest.py:2376:2597
 #, python-format
 msgid ""
 "Unrecognized api version: %s. See /rest without specifying api version for "
 "supported versions."
 msgstr ""
 
+#: ../roundup/rest.py:2411 ../roundup/rest.py:2420 ../roundup/rest.py:2411:2420
+#, python-format
+msgid ""
+"Requested content type(s) '%s' not available.\n"
+"Acceptable mime types are: */*, %s"
+msgstr ""
+
+#: ../roundup/rest.py:2696
+msgid ""
+"Internal error while formatting response.\n"
+"accept_mime_type is not defined. This should\n"
+"never happen\n"
+msgstr ""
+
 #: ../roundup/roundupdb.py:140
 #, python-format
 msgid "Username '%s' already exists."
@@ -3036,33 +3079,33 @@ msgid ""
 msgstr ""
 "éŒ¯èª¤ï¼šæºå¿…é ˆæ˜¯ \"mailbox\", \"pop\", \"apop\", \"imap\" æˆ–è€… \"imaps\" ä¹‹ä¸€"
 
-#: ../roundup/scripts/roundup_server.py:112
+#: ../roundup/scripts/roundup_server.py:113
 msgid "WARNING: generating temporary SSL certificate"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:143
+#: ../roundup/scripts/roundup_server.py:144
 #, python-format
 msgid "Unable to find/use key from file: %(pemfile)s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:144
+#: ../roundup/scripts/roundup_server.py:145
 msgid ""
 "Does it have a private key surrounded by '-----BEGIN PRIVATE KEY-----' and\n"
 "  '-----END PRIVATE KEY-----' markers?"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:149
+#: ../roundup/scripts/roundup_server.py:150
 #, python-format
 msgid "Unable to find/use certificate from file: %(pemfile)s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:150
+#: ../roundup/scripts/roundup_server.py:151
 msgid ""
 "Does it have a certificate surrounded by '-----BEGIN CERTIFICATE-----' and\n"
 "  '-----END CERTIFICATE-----' markers?"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:344
+#: ../roundup/scripts/roundup_server.py:345
 msgid ""
 "<html><head><title>Roundup trackers index</title></head>\n"
 "<body><h1>Roundup trackers index</h1><ol>\n"
@@ -3070,58 +3113,58 @@ msgstr ""
 "<html><head><title>Roundup tracker ç´¢å¼•</title></head>\n"
 "<body><h1>Roundup tracker ç´¢å¼•</h1><ol>\n"
 
-#: ../roundup/scripts/roundup_server.py:570
+#: ../roundup/scripts/roundup_server.py:587
 #, fuzzy, python-format
 msgid "Error: %(type)s: %(value)s"
 msgstr "%(key)s: %(value)s (é—œéµå±¬æ€§)"
 
-#: ../roundup/scripts/roundup_server.py:582
+#: ../roundup/scripts/roundup_server.py:599
 msgid "WARNING: ignoring \"-g\" argument, not root"
 msgstr "è­¦å‘Šï¼šå¿½ç•¥ \"-g\" åƒæ•¸ï¼Œä¸æ˜¯ root"
 
-#: ../roundup/scripts/roundup_server.py:588
+#: ../roundup/scripts/roundup_server.py:605
 msgid "Can't change groups - no grp module"
 msgstr "ä¸èƒ½ä¿®æ”¹çµ„ - ç„¡ grp æ¨¡å¡Š"
 
-#: ../roundup/scripts/roundup_server.py:597
+#: ../roundup/scripts/roundup_server.py:614
 #, python-format
 msgid "Group %(group)s doesn't exist"
 msgstr "çµ„ %(group)s ä¸å­˜åœ¨"
 
-#: ../roundup/scripts/roundup_server.py:609
+#: ../roundup/scripts/roundup_server.py:626
 msgid "Can't run as root!"
 msgstr "ä¸èƒ½ä»¥ root é‹è¡Œï¼"
 
-#: ../roundup/scripts/roundup_server.py:612
+#: ../roundup/scripts/roundup_server.py:629
 msgid "WARNING: ignoring \"-u\" argument, not root"
 msgstr "è­¦å‘Šï¼šå¿½ç•¥ \"-u\" åƒæ•¸ï¼Œä¸æ˜¯ root"
 
-#: ../roundup/scripts/roundup_server.py:618
+#: ../roundup/scripts/roundup_server.py:635
 msgid "Can't change users - no pwd module"
 msgstr "ä¸èƒ½ä¿®æ”¹ç”¨æˆ¶ - ç„¡ pwd æ¨¡å¡Š"
 
-#: ../roundup/scripts/roundup_server.py:627
+#: ../roundup/scripts/roundup_server.py:644
 #, python-format
 msgid "User %(user)s doesn't exist"
 msgstr "ç”¨æˆ¶ %(user)s ä¸å­˜åœ¨"
 
-#: ../roundup/scripts/roundup_server.py:833
+#: ../roundup/scripts/roundup_server.py:856
 #, python-format
 msgid "Multiprocess mode \"%s\" is not available, switching to single-process"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:861
+#: ../roundup/scripts/roundup_server.py:884
 #, python-format
 msgid "Unable to bind to port %s, port already in use."
 msgstr "ç„¡æ³•ç¶å®šåˆ°ç«¯å£ %s, ç«¯å£å·²ç¶“è¢«ä½”ç”¨ã€‚"
 
-#: ../roundup/scripts/roundup_server.py:865
+#: ../roundup/scripts/roundup_server.py:888
 #, fuzzy, python-format
 msgid ""
 "Unable to bind to port %(port)s, access not allowed, errno: %(errno)s %(msg)s"
 msgstr "ç„¡æ³•ç¶å®šåˆ°ç«¯å£ %s, ç«¯å£å·²ç¶“è¢«ä½”ç”¨ã€‚"
 
-#: ../roundup/scripts/roundup_server.py:944
+#: ../roundup/scripts/roundup_server.py:967
 #, fuzzy
 msgid ""
 " -c <Command>  Windows Service options.\n"
@@ -3138,13 +3181,15 @@ msgstr ""
 "               è®Šé‡ä¸Šé…ç½®ä¸€å€‹trackerã€‚é€™å€‹é¸é …èˆ‡å…¶ç¶“é¸é …æ˜¯äº’æ–¥çš„ã€‚æ‰“å…¥\n"
 "               \"roundup-server -c help\" ä¾†çž­è§£Windowsæœå‹™çš„è¦ç¯„ã€‚"
 
-#: ../roundup/scripts/roundup_server.py:951
+#: ../roundup/scripts/roundup_server.py:974
+#, fuzzy
 msgid ""
 " -u <UID>      runs the Roundup web server as this UID\n"
 " -g <GID>      runs the Roundup web server as this GID\n"
 " -d <PIDfile>  run the server in the background and write the server's PID\n"
 "               to the file indicated by PIDfile. The -l option *must* be\n"
-"               specified if -d is used."
+"               specified if -d is used.\n"
+" -D            run the server in the foreground even when -d is used."
 msgstr ""
 " -u <UID>      ä»¥é€™å€‹ UID ä¾†é‹è¡Œ Roundup web æœå‹™å™¨\n"
 " -g <GID>      ä»¥é€™å€‹ GID ä¾†é‹è¡Œ Roundup web æœå‹™å™¨\n"
@@ -3152,7 +3197,7 @@ msgstr ""
 "åŽ»ã€‚\n"
 "               å¦‚æžœä½¿ç”¨äº† -d é¸é …ï¼Œå‰‡ -l é¸é … *å¿…é ˆ* è¦æŒ‡å®šã€‚"
 
-#: ../roundup/scripts/roundup_server.py:958
+#: ../roundup/scripts/roundup_server.py:982
 #, fuzzy, python-format
 msgid ""
 "\n"
@@ -3177,6 +3222,10 @@ msgid ""
 "mode\n"
 " -s            enable SSL\n"
 " -L            http request logging uses python logging (roundup.http)\n"
+" -P            log client address/name using reverse proxy X-Forwarded-For\n"
+"               header and not the connection IP (which is the reverse "
+"proxy).\n"
+"               Appends a '+' sign to the logged address/name.\n"
 " -e <fname>    PEM file containing SSL key and certificate\n"
 " -t <mode>     multiprocess mode (default: %(mp_def)s).\n"
 "               Allowed values: %(mp_types)s.\n"
@@ -3250,20 +3299,20 @@ msgstr ""
 "   æ„æ•¸é‡çš„ name=home å°ã€‚è¦ç¢ºä¿ name éƒ¨åˆ†ä¸èƒ½åŒ…æ‹¬ä»»ä½•éžurlå®‰å…¨çš„\n"
 "   å­—ç¬¦ï¼Œåƒç©ºæ ¼ï¼Œå› ç‚ºå®ƒå€‘æœƒæŠŠIEæžäº‚ã€‚\n"
 
-#: ../roundup/scripts/roundup_server.py:1135
+#: ../roundup/scripts/roundup_server.py:1162
 msgid "Instances must be name=home"
 msgstr "å¯¦ä¾‹å¿…é ˆæ˜¯ å¯¦ä¾‹å=å¯¦ä¾‹è·¯å¾‘"
 
-#: ../roundup/scripts/roundup_server.py:1149
+#: ../roundup/scripts/roundup_server.py:1176
 #, python-format
 msgid "Configuration saved to %s"
 msgstr "é…ç½®ä¿å­˜åˆ° %s"
 
-#: ../roundup/scripts/roundup_server.py:1167
+#: ../roundup/scripts/roundup_server.py:1194
 msgid "Sorry, you can't run the server as a daemon on this Operating System"
 msgstr "æŠ±æ­‰ï¼Œåœ¨é€™å€‹æ“ä½œç³»çµ±ä¸Šä¸èƒ½ä»¥å®ˆè­·é€²ç¨‹çš„æ–¹å¼ä¾†é‹è¡Œæœå‹™"
 
-#: ../roundup/scripts/roundup_server.py:1187
+#: ../roundup/scripts/roundup_server.py:1214
 #, python-format
 msgid "Roundup server started on %(HOST)s:%(PORT)s"
 msgstr "Roundup server å•Ÿå‹•æ–¼ %(HOST)s:%(PORT)s"

From 7299214f8a54e10121e446e144d6f6179ed92a59 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Tue, 31 Dec 2024 17:11:17 -0500
Subject: [PATCH 108/398] feat: issue2551372 - REST-API CSRF protection should
 document mandatory Origin header

Logging is more useful I hope.

Logs the name of the user making the request.

Logs the value of the origin header if the value is not authorized
to use the rest interface.

Added a comment about difficulty include originating IP address
in log.
---
 roundup/cgi/client.py | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/roundup/cgi/client.py b/roundup/cgi/client.py
index 592113782..b35f4b2ef 100644
--- a/roundup/cgi/client.py
+++ b/roundup/cgi/client.py
@@ -726,10 +726,10 @@ def handle_rest(self):
         if not self.is_origin_header_ok(api=True):
             if 'HTTP_ORIGIN' not in self.env:
                 msg = self._("Required Header Missing")
-                err = 'Origin header missing'
+                err = "REST request missing 'Origin' header by user %(user)s."
             else:
                 msg = self._("Client is not allowed to use Rest Interface.")
-                err = 'Unauthorized for REST request'
+                err = "REST request 'Origin' (%(origin)s) unauthorized by user %(user)s."
 
             # Use code 400. Codes 401 and 403 imply that authentication
             # is needed or authenticated person is not authorized.
@@ -739,7 +739,18 @@ def handle_rest(self):
             self.reject_request(output,
                                 message_type="application/json",
                                 status=400)
-            logger.error(err)
+            # Would be nice to log the original source address here to
+            # allow firewalling in case of abuse/attack. Especially if
+            # anonymous is allowed REST access. However,
+            #    self.request.connection.getpeername()
+            # only gets us 127.0.0.1 when a proxy is used. I think the
+            # same is true of wsgi mode (but it might be a UNIX domain
+            # socket address). The upstream server needs to supply the
+            # real IP as it sees it and we need to consume it. There
+            # is no method for this that handles all the ways roundup
+            # can be run AFAIK. So no IP address, just user.
+            logger.error(err, {"user": self.user,
+                               "origin": self.env.get('HTTP_ORIGIN', None)})
             return
 
         # Handle CORS preflight request. We know rest is enabled

From 819669f8a63adc36aada0a3f2fcb57c0db25032a Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Tue, 31 Dec 2024 23:48:38 -0500
Subject: [PATCH 109/398] test: issue2551366. Probe for open port in
 test_liveserver.py

Add a method to probe for an open port to wsgi_liveserver.py. Start
the roundup server under wsgi on the open port.  If a port can't be
found, it skips all tests.

Also changed all hardcoded URL references to use the dynamicly
determined tracker url/port value.

I fed my patch to wsgi_liveserver.py upstream at:

  https://github.com/jerrykan/wsgi-liveserver/issues/3
---
 test/test_liveserver.py | 96 +++++++++++++++++++++++------------------
 test/wsgi_liveserver.py | 19 +++++++-
 2 files changed, 72 insertions(+), 43 deletions(-)

diff --git a/test/test_liveserver.py b/test/test_liveserver.py
index b97489351..4d5fabe51 100644
--- a/test/test_liveserver.py
+++ b/test/test_liveserver.py
@@ -79,8 +79,19 @@ class WsgiSetup(LiveServerTestCase):
     # have chicken and egg issue here. Need to encode the base_url
     # in the config file but we don't know it until after
     # the server is started and has read the config.ini.
-    # so only allow one port number
-    port_range = (9001, 9001)  # default is (8080, 8090)
+    # Probe for an unused port and set the port range to
+    # include only that port.
+    tracker_port = LiveServerTestCase.probe_ports(8080, 8100)
+    if tracker_port is None:
+        pytest.skip("Unable to find available port for server: 8080-8100",
+                    allow_module_level=True)
+    port_range = (tracker_port, tracker_port)
+
+    # set a couple of properties to use for URL generation in
+    # expected output or use to set TRACKER_WEB in config.ini.
+    tracker_web = "http://localhost:%d/" % tracker_port
+       # tracker_web_base should be the same as self.base_url()
+    tracker_web_base = "http://localhost:%d" % tracker_port
 
     dirname = '_test_instance'
     backend = 'anydbm'
@@ -106,7 +117,7 @@ def setup_class(cls):
             password=password.Password('sekrit'), address='fred@example.com')
 
         # set the url the test instance will run at.
-        cls.db.config['TRACKER_WEB'] = "http://localhost:9001/"
+        cls.db.config['TRACKER_WEB'] = cls.tracker_web
         # set up mailhost so errors get reported to debuging capture file
         cls.db.config.MAILHOST = "localhost"
         cls.db.config.MAIL_HOST = "localhost"
@@ -190,8 +201,9 @@ class ClientSetup():
     def create_login_session(self, username="admin", password="sekrit",
                              return_response=True, expect_login_ok=True):
         # Set up session to manage cookies <insert blue monster here>
+
         session = requests.Session()
-        session.headers.update({'Origin': 'http://localhost:9001'})
+        session.headers.update({'Origin': self.tracker_web_base})
 
         # login using form to get cookie
         login = {"__login_name": username, '__login_password': password,
@@ -747,13 +759,13 @@ def test_rest_endpoint_root_options(self):
         f = requests.options(self.url_base() + '/rest',
                              auth=('admin', 'sekrit'),
                              headers = {'content-type': "",
-                                        'Origin': "http://localhost:9001",
+                                        'Origin': self.tracker_web_base,
                              })
         print(f.status_code)
         print(f.headers)
 
         self.assertEqual(f.status_code, 204)
-        expected = { 'Access-Control-Allow-Origin': 'http://localhost:9001',
+        expected = { 'Access-Control-Allow-Origin': self.tracker_web_base,
                      'Access-Control-Allow-Headers': 'Content-Type, Authorization, X-Requested-With, X-HTTP-Method-Override',
                      'Allow': 'OPTIONS, GET',
                      'Access-Control-Allow-Credentials': 'true',
@@ -770,13 +782,13 @@ def test_rest_endpoint_data_options(self):
         f = requests.options(self.url_base() + '/rest/data',
                              auth=('admin', 'sekrit'),
                              headers = {'content-type': "",
-                                        'Origin': "http://localhost:9001",
+                                        'Origin': self.tracker_web_base,
                              })
         print(f.status_code)
         print(f.headers)
 
         self.assertEqual(f.status_code, 204)
-        expected = { 'Access-Control-Allow-Origin': 'http://localhost:9001',
+        expected = { 'Access-Control-Allow-Origin': self.tracker_web_base,
                      'Access-Control-Allow-Headers': 'Content-Type, Authorization, X-Requested-With, X-HTTP-Method-Override',
                      'Allow': 'OPTIONS, GET',
                      'Access-Control-Allow-Methods': 'OPTIONS, GET',
@@ -792,13 +804,13 @@ def test_rest_endpoint_collection_options(self):
         f = requests.options(self.url_base() + '/rest/data/user',
                              auth=('admin', 'sekrit'),
                              headers = {'content-type': "",
-                                        'Origin': "http://localhost:9001",
+                                        'Origin': self.tracker_web_base,
                              })
         print(f.status_code)
         print(f.headers)
 
         self.assertEqual(f.status_code, 204)
-        expected = { 'Access-Control-Allow-Origin': 'http://localhost:9001',
+        expected = { 'Access-Control-Allow-Origin': self.tracker_web_base,
                      'Access-Control-Allow-Headers': 'Content-Type, Authorization, X-Requested-With, X-HTTP-Method-Override',
                      'Allow': 'OPTIONS, GET, POST',
                      'Access-Control-Allow-Methods': 'OPTIONS, GET, POST',
@@ -815,13 +827,13 @@ def test_rest_endpoint_item_options(self):
         f = requests.options(self.url_base() + '/rest/data/user/1',
                              auth=('admin', 'sekrit'),
                              headers = {'content-type': "",
-                                        'Origin': "http://localhost:9001",
+                                        'Origin': self.tracker_web_base,
                              })
         print(f.status_code)
         print(f.headers)
 
         self.assertEqual(f.status_code, 204)
-        expected = { 'Access-Control-Allow-Origin': 'http://localhost:9001',
+        expected = { 'Access-Control-Allow-Origin': self.tracker_web_base,
                      'Access-Control-Allow-Headers': 'Content-Type, Authorization, X-Requested-With, X-HTTP-Method-Override',
                      'Allow': 'OPTIONS, GET, PUT, DELETE, PATCH',
                      'Access-Control-Allow-Methods': 'OPTIONS, GET, PUT, DELETE, PATCH',
@@ -837,13 +849,13 @@ def test_rest_endpoint_attribute_options(self):
         f = requests.options(self.url_base() + '/rest/data/user/1/username',
                              auth=('admin', 'sekrit'),
                              headers = {'content-type': "",
-                                        'Origin': "http://localhost:9001",
+                                        'Origin': self.tracker_web_base,
                              })
         print(f.status_code)
         print(f.headers)
 
         self.assertEqual(f.status_code, 204)
-        expected = { 'Access-Control-Allow-Origin': 'http://localhost:9001',
+        expected = { 'Access-Control-Allow-Origin': self.tracker_web_base,
                      'Access-Control-Allow-Headers': 'Content-Type, Authorization, X-Requested-With, X-HTTP-Method-Override',
                      'Allow': 'OPTIONS, GET, PUT, DELETE, PATCH',
                      'Access-Control-Allow-Methods': 'OPTIONS, GET, PUT, DELETE, PATCH',
@@ -859,7 +871,7 @@ def test_rest_endpoint_attribute_options(self):
         f = requests.options(self.url_base() + '/rest/data/user/1/creator',
                              auth=('admin', 'sekrit'),
                              headers = {'content-type': "",
-                                        'Origin': "http://localhost:9001",
+                                        'Origin': self.tracker_web_base,
                              })
         print(f.status_code)
         print(f.headers)
@@ -877,7 +889,7 @@ def test_rest_endpoint_attribute_options(self):
         f = requests.options(self.url_base() + '/rest/data/user/1/zot',
                              auth=('admin', 'sekrit'),
                              headers = {'content-type': "",
-                                        'Origin': "http://localhost:9001",})
+                                        'Origin': self.tracker_web_base,})
         print(f.status_code)
         print(f.headers)
 
@@ -888,7 +900,7 @@ def test_rest_endpoint_user_roles(self):
         f = requests.get(self.url_base() + '/rest/data/user/roles',
                          auth=('admin', 'sekrit'),
                          headers = {'content-type': "",
-                                    'Origin': "http://localhost:9001",
+                                    'Origin': self.tracker_web_base,
                          })
         print(f.status_code)
         print(f.headers)
@@ -1190,10 +1202,10 @@ def test_compression_none_etag(self):
 
         content_str = '''{ "data": {
                         "id": "1",
-                        "link": "http://localhost:9001/rest/data/user/1/username",
+                        "link": "%s/rest/data/user/1/username",
                         "data": "admin"
                     }
-        }'''
+        }''' % self.tracker_web_base
         content = json.loads(content_str)
 
 
@@ -1248,10 +1260,10 @@ def test_compression_gzip(self, method='gzip'):
 
         content_str = '''{ "data": {
                         "id": "1",
-                        "link": "http://localhost:9001/rest/data/user/1/username",
+                        "link": "%s/rest/data/user/1/username",
                         "data": "admin"
                     }
-        }'''
+        }''' % self.tracker_web_base
         content = json.loads(content_str)
 
         print(f.content)
@@ -1496,7 +1508,7 @@ def test_new_issue_with_file_upload(self):
         # Escape % signs in string by doubling them. This verifies the
         # search is working correctly.
         # use groupdict for python2.
-        self.assertEqual('http://localhost:9001/issue%(issue)s?@ok_message=file%%20%(file)s%%20created%%0Aissue%%20%(issue)s%%20created&@template=item'%m.groupdict(), f.url)
+        self.assertEqual( self.tracker_web_base + '/issue%(issue)s?@ok_message=file%%20%(file)s%%20created%%0Aissue%%20%(issue)s%%20created&@template=item'%m.groupdict(), f.url)
 
         # we have an issue display, verify filename is listed there
         # seach for unique filename given to it.
@@ -1520,13 +1532,13 @@ def test_new_file_via_rest(self):
         c = dict (content = r'xyzzy')
         r = session.post(url + 'file', files = c, data = d,
                           headers = {'x-requested-with': "rest",
-                                     'Origin': "http://localhost:9001"}
+                                     'Origin': self.tracker_web_base}
         )
 
         # was a 500 before fix for issue2551178
         self.assertEqual(r.status_code, 201)
         # just compare the path leave off the number
-        self.assertIn('http://localhost:9001/rest/data/file/',
+        self.assertIn(self.tracker_web_base + '/rest/data/file/',
                       r.headers["location"])
         json_dict = json.loads(r.text)
         self.assertEqual(json_dict["data"]["link"], r.headers["location"])
@@ -1534,7 +1546,7 @@ def test_new_file_via_rest(self):
         # download file and verify content
         r = session.get(r.headers["location"] +'/content',
                           headers = {'x-requested-with': "rest",
-                                     'Origin': "http://localhost:9001"}
+                                     'Origin': self.tracker_web_base}
 )
         json_dict = json.loads(r.text)
         self.assertEqual(json_dict['data']['data'], c["content"])
@@ -1544,7 +1556,7 @@ def test_new_file_via_rest(self):
         session.auth = None
         r = session.post(url + 'file', files = c, data = d,
                           headers = {'x-requested-with': "rest",
-                                     'Origin': "http://localhost:9001"}
+                                     'Origin': self.tracker_web_base}
         )
         self.assertEqual(r.status_code, 403)
 
@@ -1556,7 +1568,7 @@ def test_new_file_via_rest(self):
 
         r = session.post(url + 'file', files = c, data = d,
                           headers = {'x-requested-with': "rest",
-                                     'Origin': "http://localhost:9001"}
+                                     'Origin': self.tracker_web_base}
         )
         self.assertEqual(r.status_code, 201)
         print(r.status_code)
@@ -1611,7 +1623,7 @@ def setup_class(cls):
             password=password.Password('sekrit'), address='fred@example.com')
 
         # set the url the test instance will run at.
-        cls.db.config['TRACKER_WEB'] = "http://localhost:9001/"
+        cls.db.config['TRACKER_WEB'] = cls.tracker_web
         # set up mailhost so errors get reported to debuging capture file
         cls.db.config.MAILHOST = "localhost"
         cls.db.config.MAIL_HOST = "localhost"
@@ -1699,7 +1711,7 @@ def setup_class(cls):
             password=password.Password('sekrit'), address='fred@example.com')
 
         # set the url the test instance will run at.
-        cls.db.config['TRACKER_WEB'] = "http://localhost:9001/"
+        cls.db.config['TRACKER_WEB'] = cls.tracker_web
         # set up mailhost so errors get reported to debuging capture file
         cls.db.config.MAILHOST = "localhost"
         cls.db.config.MAIL_HOST = "localhost"
@@ -1761,7 +1773,7 @@ def test_rest_login_RateLimit(self):
             # use basic auth for rest endpoint
         
             request_headers = {'content-type': "",
-                               'Origin': "http://localhost:9001",}
+                               'Origin': self.tracker_web_base,}
             f = requests.options(url_base_numeric + '/rest/data',
                                  auth=('admin', 'sekrit'),
                                  headers=request_headers
@@ -1798,7 +1810,7 @@ def test_rest_login_RateLimit(self):
             f = requests.options(url_base_numeric + '/rest/data',
                                  auth=('admin', 'ekrit'),
                                  headers = {'content-type': "",
-                                            'Origin': "http://localhost:9001",}
+                                            'Origin': self.tracker_web_base,}
             )
 
             if (i < 4): # assuming limit is 4.
@@ -1835,7 +1847,7 @@ def test_rest_login_RateLimit(self):
         f = requests.options(url_base_numeric + '/rest/data',
                              auth=('admin', 'sekrit'),
                              headers = {'content-type': "",
-                                        'Origin': "http://localhost:9001",}
+                                        'Origin': self.tracker_web_base,}
         )
         self.assertEqual(f.status_code, 429)
 
@@ -1850,7 +1862,7 @@ def test_rest_login_RateLimit(self):
         f = requests.get(url_base_numeric + '/rest/data',
                              auth=('admin', 'sekrit'),
                              headers = {'content-type': "",
-                                        'Origin': "http://localhost:9001",}
+                                        'Origin': self.tracker_web_base,}
         )
         self.assertEqual(f.status_code, 200)
         print(i, f.status_code)
@@ -1868,7 +1880,7 @@ def test_rest_login_RateLimit(self):
               'Retry-After, '
               'Sunset, '
               'Allow'),
-            'Access-Control-Allow-Origin': 'http://localhost:9001',
+            'Access-Control-Allow-Origin': self.tracker_web_base,
             'Access-Control-Allow-Credentials': 'true',
             'Allow': 'OPTIONS, GET, POST, PUT, DELETE, PATCH'
         }
@@ -1879,28 +1891,28 @@ def test_rest_login_RateLimit(self):
 
         expected_data = {
             "status": {
-                "link": "http://localhost:9001/rest/data/status"
+                "link": self.tracker_web_base + "/rest/data/status"
             },
             "keyword": {
-                "link": "http://localhost:9001/rest/data/keyword"
+                "link": self.tracker_web_base + "/rest/data/keyword"
             },
             "priority": {
-                "link": "http://localhost:9001/rest/data/priority"
+                "link": self.tracker_web_base + "/rest/data/priority"
             },
             "user": {
-                "link": "http://localhost:9001/rest/data/user"
+                "link": self.tracker_web_base + "/rest/data/user"
             },
             "file": {
-                "link": "http://localhost:9001/rest/data/file"
+                "link": self.tracker_web_base + "/rest/data/file"
             },
             "msg": {
-                "link": "http://localhost:9001/rest/data/msg"
+                "link": self.tracker_web_base + "/rest/data/msg"
             },
             "query": {
-                "link": "http://localhost:9001/rest/data/query"
+                "link": self.tracker_web_base + "/rest/data/query"
             },
             "issue": {
-                "link": "http://localhost:9001/rest/data/issue"
+                "link": self.tracker_web_base + "/rest/data/issue"
             }
         }
 
diff --git a/test/wsgi_liveserver.py b/test/wsgi_liveserver.py
index f444ba351..93e9060af 100644
--- a/test/wsgi_liveserver.py
+++ b/test/wsgi_liveserver.py
@@ -9,8 +9,9 @@
 
 Copyright (c) 2013 John Kristensen (unless explicitly stated otherwise).
 """
-import threading
+import errno
 import socket
+import threading
 import unittest
 from wsgiref.simple_server import make_server, WSGIRequestHandler
 
@@ -82,3 +83,19 @@ def _post_teardown(self):
             self._server.server_close()
             self._thread.join()
             del self._server
+
+    def probe_ports(start=port_range[0], end=port_range[1]):
+        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+        s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+        port = start
+        try:
+            s.connect(('127.0.0.1', port))
+        except socket.error as e:
+            if not hasattr(e, 'args') or e.args[0] != errno.ECONNREFUSED:
+                raise
+            return port
+        else:
+            s.close()
+            port += 1
+            if port > end:
+                return None

From 457da4d897e4404ade489fdf15e50a1235807c94 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 1 Jan 2025 00:27:52 -0500
Subject: [PATCH 110/398] test: make probe_ports a class method under python2.

---
 test/wsgi_liveserver.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/test/wsgi_liveserver.py b/test/wsgi_liveserver.py
index 93e9060af..a84ba5a1d 100644
--- a/test/wsgi_liveserver.py
+++ b/test/wsgi_liveserver.py
@@ -84,7 +84,8 @@ def _post_teardown(self):
             self._thread.join()
             del self._server
 
-    def probe_ports(start=port_range[0], end=port_range[1]):
+    @classmethod
+    def probe_ports(cls, start=port_range[0], end=port_range[1]):
         s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
         s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
         port = start

From ee9ab4814b040aa0c70116bf432cc5de9f965ddf Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 1 Jan 2025 00:47:14 -0500
Subject: [PATCH 111/398] test: add comment that I modified  wsgi_liveserver.py

---
 test/wsgi_liveserver.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/test/wsgi_liveserver.py b/test/wsgi_liveserver.py
index a84ba5a1d..93f20f9a1 100644
--- a/test/wsgi_liveserver.py
+++ b/test/wsgi_liveserver.py
@@ -19,6 +19,9 @@
 __version__ = '0.3.1'
 __license__ = 'GPLv3'
 
+"""
+Classmethod probe_ports() added by John Rouillard 2024.
+"""
 
 class QuietHandler(WSGIRequestHandler):
     def log_request(*args, **kwargs):

From 0df0958d4347fc6590946e802a5a4d9d03e8d0b8 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 1 Jan 2025 00:54:58 -0500
Subject: [PATCH 112/398] test: try to handle loss of testmon data when
 cancelling test.

Not sure if this works, but I was having an issue where the testmon
database was not being saved properly. When I used ^C to cancel a run,
the next run with --testmon would select no tests even when I changed
files.

The only was to get working again was to delete the .testmon,
.testmon-wal and .testmon-shm files and rerun the whole test suite.
Once the full test suite was run, changing the file would select tests
again.
---
 test/conftest.py | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/test/conftest.py b/test/conftest.py
index d3aa5a538..9f1d17196 100644
--- a/test/conftest.py
+++ b/test/conftest.py
@@ -12,3 +12,9 @@ def pytest_configure(config):
     config.addinivalue_line(
         "markers", "pg_schema: tests using schema for postgres"
     )
+
+# try to work around loss of testmon data when ^Cing out of tests.
+def pytest_unconfigure(config):
+    if hasattr(config, "testmon_data"):
+        config.testmon_data.db.con.close()
+

From d3b1a25a6fa0906480c2a46ffc861431caaf9d25 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 1 Jan 2025 01:02:09 -0500
Subject: [PATCH 113/398] test: added pytest-testmon

Run test cases that execute changed code. Reduces the time spent to run
tests that cover the changed code.
---
 pyproject.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pyproject.toml b/pyproject.toml
index 4d0054754..087cc6029 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@
 # be adapted for pytest.ini if you are running under python2.
 
 # For use with packages:
-#     python -m pip install pytest-cov pytest-env pytest-randomly
+#     python -m pip install pytest-cov pytest-env pytest-randomly pytest-testmon
 
 minversion = "6.0"
 

From e61bd09838a2a10a194142ad2b8bf84b87a03a73 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 1 Jan 2025 02:06:00 -0500
Subject: [PATCH 114/398] fix: issue2551374 - Add error handling for filter
 expressions. Fix UI

Errors are now reported using the search template.

This should work in most situations. However if the query was
generated using an alternate search template, the user may not be able
to fix it. I'm not sure how to tell what template was used to submit
the search. By the time I handle the error, I don't think I have
access to an ok template or error template. Might need to add a new
field if this becomes a problem.

Also fixed a couple of tests changing the status code to 200 from 400
since we aren't on an error page anymore.

Updated user_guide including 3 sample error messages for search
expressions and how to understand them.
---
 CHANGES.txt             |  4 +---
 doc/user_guide.txt      | 45 +++++++++++++++++++++++++++++++++++------
 roundup/cgi/client.py   |  3 ++-
 test/test_liveserver.py |  4 ++--
 4 files changed, 44 insertions(+), 12 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index 334c86122..f30097726 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -59,9 +59,7 @@ Fixed:
 - fixed a crash with roundup-admin perftest password when rounds not set
   on command line. (John Rouillard)
 - issue2551374 - Add error handling for filter expressions. Filter
-  expression errors are now reported. The UI needs some work but
-  even the current code is helpful when debugging filter
-  expressions. (John Rouillard)
+  expression errors are now reported. (John Rouillard)
 
 Features:
 
diff --git a/doc/user_guide.txt b/doc/user_guide.txt
index 6e8d00644..1abc09dab 100644
--- a/doc/user_guide.txt
+++ b/doc/user_guide.txt
@@ -491,12 +491,45 @@ search page, there's an expression editor. You can access it by
 clicking on the ``(expr)`` link, which makes creating these
 expressions a bit easier.
 
-Note that errors in your expression (e.g. a missing operand) are
-silently ignored and a fallback search is conducted. This is
-`considered a bug <https://issues.roundup-tracker.org/issue2551374>`_
-and will hopefully be fixed in the future. But at least you can use
-this info to understand the search syntax in the URL if you see
-something strange.
+If your expression has an error, you will be returned to the search
+page and an error will be reported. For example using the expression
+``1, -3`` to search the nosy property of an issue generates the
+following error::
+
+   There was an error searching issue by nosy using: [1, -3]. The
+   operator -3 (and) at position 2 has too few arguments.
+
+The error message gives you the problem element (``-3``), it's meaning
+(``and``) and its position: the second element. The problem was caused
+because ``and`` requires two arguments, but only one argument (``1``)
+was given.
+
+Another error message::
+
+  There was an error searching issue by status using: [1, 2, -3,
+  -3]. The operator -3 (and) at position 4 has too few arguments.
+
+reports that the second ``-3`` in the 4th position is the problem
+operator. Note that this search expression will never return any
+values. This is because ``status`` is a single value (link) type
+property. It can't have the values ``1`` and ``2``, so the expression
+``1,2,-3`` will never return an issue.
+
+In the examples above, the error was caused by not having enough
+arguments. However you can also have too many arguments. An example of
+this type of message is::
+
+  There was an error searching issue by nosy using: [4, 5, 1, 2, -3,
+  -3]. There are too many arguments for the existing operators. The
+  values on the stack are: [Value 4, (Value 5 AND (Value 1 AND Value
+  2))]
+
+This message gives you the expression as far as it was able to compose
+it, but value 1 is not combined with the rest of the expression. So
+another binary operator is needed to complete the expression.
+
+If you have multiple incorrect expressions in your search, only one
+expression will be reported each time you submit the search.
 
 Using the Classhelper
 ---------------------
diff --git a/roundup/cgi/client.py b/roundup/cgi/client.py
index b35f4b2ef..8e37fae59 100644
--- a/roundup/cgi/client.py
+++ b/roundup/cgi/client.py
@@ -2232,7 +2232,8 @@ def renderContext(self):
                 result = self.renderError(e.args[0])
             except ExpressionError as e:
                 self.add_error_message(str(e))
-                result = self.renderError(str(e))
+                self.template = "search"
+                self.write_html(self.renderContext())
 
             if 'Content-Type' not in self.additional_headers:
                 self.additional_headers['Content-Type'] = pt.content_type
diff --git a/test/test_liveserver.py b/test/test_liveserver.py
index 4d5fabe51..82afaffc2 100644
--- a/test/test_liveserver.py
+++ b/test/test_liveserver.py
@@ -380,7 +380,7 @@ def test_broken_query(self):
                       '[-2]. The operator -2 (not) at position 1 has '
                       'too few arguments.',
                       f.text)
-        self.assertEqual(f.status_code, 400)
+        self.assertEqual(f.status_code, 200)
 
     def test_broken_multiink_query(self):
         # query multilink item
@@ -398,7 +398,7 @@ def test_broken_multiink_query(self):
                       '[-3]. The operator -3 (and) at position 1 has '
                       'too few arguments.',
                       f.text)
-        self.assertEqual(f.status_code, 400)
+        self.assertEqual(f.status_code, 200)
 
     def test_start_page(self):
         """ simple test that verifies that the server can serve a start page.

From 1d8c86fc00a6079394fa360850e6474e9d6e299a Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 1 Jan 2025 09:54:32 -0500
Subject: [PATCH 115/398] chore: it's 2025, update copyrights

---
 doc/conf.py         | 2 +-
 website/www/conf.py | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/conf.py b/doc/conf.py
index 70bb8b5c8..c46ccc021 100644
--- a/doc/conf.py
+++ b/doc/conf.py
@@ -72,7 +72,7 @@
 
 # General information about the project.
 project = u'Roundup'
-copyright = u'2009-2024, Richard Jones, Roundup-Team'
+copyright = u'2009-2025, Richard Jones, Roundup-Team'
 
 # The version info for the project you're documenting, acts as replacement for
 # |version| and |release|, also used in various other places throughout the
diff --git a/website/www/conf.py b/website/www/conf.py
index 777f705dd..9da7a3c40 100644
--- a/website/www/conf.py
+++ b/website/www/conf.py
@@ -73,7 +73,7 @@
 
 # General information about the project.
 project = u'Roundup'
-copyright = u'2009-2024, Richard Jones, Roundup-Team'
+copyright = u'2009-2025, Richard Jones, Roundup-Team'
 
 # The version info for the project you're documenting, acts as replacement for
 # |version| and |release|, also used in various other places throughout the

From 7f04d35948e005a370345b0952a7ca2435601a82 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 1 Jan 2025 15:48:01 -0500
Subject: [PATCH 116/398] docs: doc new types in user_guide; alphabetize types
 in reference.

user_guide.txt:

Removed Number from String and Number Properties.  Added new Integer
and Number Properties sections to the user guide. Number Proprty
formats defined: no thousand separators, '.' decimal separator,
supports scientific 2E4 style input. Ordered in rough order of use.

reference.txt:

Alphabetized the types in the reference manual for easy lookup.
Fixed sentence on quiet property.
---
 doc/reference.txt  | 30 +++++++++++++++---------------
 doc/user_guide.txt | 17 +++++++++++++++--
 2 files changed, 30 insertions(+), 17 deletions(-)

diff --git a/doc/reference.txt b/doc/reference.txt
index 43a0e7f95..e7f85ee7f 100644
--- a/doc/reference.txt
+++ b/doc/reference.txt
@@ -442,25 +442,16 @@ Properties
 
 A Class consists of one or more properties of the following types:
 
-String
-     properties store arbitrary-length strings.
-Password
-     properties store encoded arbitrary-length strings.
-     The default encoding is defined in the ``roundup.password.Password``
-     class.
+Boolean
+     properties store on/off, yes/no, true/false values.
 Date
      properties store date-and-time stamps. Their values are Timestamp
      objects.
+Integer
+     properties store integer values. (Number can store real/float values.)
 Interval
      properties store time periods rather than absolute dates. For
      example 2 hours.
-Integer
-     properties store integer values. (Number can store real/float values.)
-Number
-     properties store numeric values. There is an option to use
-     double-precision floating point numbers.
-Boolean
-     properties store on/off, yes/no, true/false values.
 Link
      properties refers to a single item selected from a
      specified class. The class is part of the property; the value is an
@@ -468,6 +459,15 @@ Link
 Multilink
      properties refer to one or more items in a specified
      class. The value is a list of integers.
+Number
+     properties store numeric values. There is an option to use
+     double-precision floating point numbers.
+Password
+     properties store encoded arbitrary-length strings.
+     The default encoding is defined in the ``roundup.password.Password``
+     class.
+String
+     properties store arbitrary-length strings.
 
 Properties have attributes to change the default behaviour:
 
@@ -481,8 +481,8 @@ Properties have attributes to change the default behaviour:
     the list returned by calling get_required_props for the class.
   - ``default_value``: see `design documentation`_ Sets the default
     value if the property is not set.
-  - ``quiet``: see `design documentation`_. Suppresses user visible
-    to changes to this property. The property change is not reported:
+  - ``quiet``: see `design documentation`_. Suppresses reporting user
+    visible changes to this property. The property change is not reported:
 
     - in the change feedback/confirmation message in the web
       interface
diff --git a/doc/user_guide.txt b/doc/user_guide.txt
index 1abc09dab..faade3492 100644
--- a/doc/user_guide.txt
+++ b/doc/user_guide.txt
@@ -114,11 +114,24 @@ This means the web interface for entering a new issue, the web interface
 for searching issues, the e-mail interface and even the command-line
 administration tool.
 
-String and Numeric properties
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+String Properties
+~~~~~~~~~~~~~~~~~
 
 These fields just take a plain text value, like ``It's broken``.
 
+Number Properties
+~~~~~~~~~~~~~~~~~
+
+These fields take a real number with decimal point like ``+12456.78``,
+``-12456.78`` ``12456.78``. It supports scientific/exponent notation
+like ``3.1415E-2``. Decimal commas (e.g. ``123456,78``) or thousand
+separators ``-12,456.78`` are not supported.
+
+Integer Properties
+~~~~~~~~~~~~~~~~~~
+
+These fields take a whole/integer number without decimal marker like
+``123``, ``+123``, ``-123``. Exponents are not supported.
 
 Boolean properties
 ~~~~~~~~~~~~~~~~~~

From 462311755e6bc062521a830de5127223136d6abe Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 1 Jan 2025 17:51:05 -0500
Subject: [PATCH 117/398] fix: crash when logging ip if roundup-server times
 out

Under some conditions (seen in production, no reproducer), if
connection timed out, there is no headers attribute
RoundupRequestHandler.

Check for headers attr before accessing self.headers.
---
 roundup/scripts/roundup_server.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/roundup/scripts/roundup_server.py b/roundup/scripts/roundup_server.py
index b0f595e56..e4630b61f 100644
--- a/roundup/scripts/roundup_server.py
+++ b/roundup/scripts/roundup_server.py
@@ -542,7 +542,9 @@ def address_string(self):
         """
         from_forwarded_header=""
         forwarded_for = None
-        if 'X-FORWARDED-FOR' in self.headers:
+
+        # if connection timed out, there is no headers property
+        if hasattr(self, 'headers') and ('X-FORWARDED-FOR' in self.headers):
             forwarded_for = re.split(r'[,\s]',
                                      self.headers['X-FORWARDED-FOR'],
                                      maxsplit=1)[0]

From c713dc72f6095dbd2d0b0159773f4226dc98f91e Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 1 Jan 2025 19:41:45 -0500
Subject: [PATCH 118/398] test: issue2551366. fix probe for open port in
 test_liveserver.py

Corrected the method. It was missing the outer loop.

Updated upstream.
---
 test/wsgi_liveserver.py | 33 +++++++++++++++++++--------------
 1 file changed, 19 insertions(+), 14 deletions(-)

diff --git a/test/wsgi_liveserver.py b/test/wsgi_liveserver.py
index 93f20f9a1..2adba3835 100644
--- a/test/wsgi_liveserver.py
+++ b/test/wsgi_liveserver.py
@@ -13,7 +13,7 @@
 import socket
 import threading
 import unittest
-from wsgiref.simple_server import make_server, WSGIRequestHandler
+from wsgiref.simple_server import WSGIRequestHandler, make_server
 
 __author__ = 'John Kristensen'
 __version__ = '0.3.1'
@@ -23,6 +23,7 @@
 Classmethod probe_ports() added by John Rouillard 2024.
 """
 
+
 class QuietHandler(WSGIRequestHandler):
     def log_request(*args, **kwargs):
         pass
@@ -89,17 +90,21 @@ def _post_teardown(self):
 
     @classmethod
     def probe_ports(cls, start=port_range[0], end=port_range[1]):
-        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-        s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+
         port = start
-        try:
-            s.connect(('127.0.0.1', port))
-        except socket.error as e:
-            if not hasattr(e, 'args') or e.args[0] != errno.ECONNREFUSED:
-                raise
-            return port
-        else:
-            s.close()
-            port += 1
-            if port > end:
-                return None
+
+        while port <= end:
+            s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+            s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+
+            try:
+                s.connect(('127.0.0.1', port))
+            except socket.error as e:
+                if not hasattr(e, 'args') or e.args[0] != errno.ECONNREFUSED:
+                    raise
+                return port
+            else:
+                s.close()
+                port += 1
+
+        return None

From 8e0c7e1f8cbc794cdb55032c34ffd0352427131d Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sat, 4 Jan 2025 18:48:35 -0500
Subject: [PATCH 119/398] chore(ruff): order imports.

---
 roundup/anypy/scandir_.py | 3 ++-
 roundup/anypy/urllib_.py  | 3 +--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/roundup/anypy/scandir_.py b/roundup/anypy/scandir_.py
index 724e82cf3..b2a56a715 100644
--- a/roundup/anypy/scandir_.py
+++ b/roundup/anypy/scandir_.py
@@ -4,5 +4,6 @@
 except ImportError:
     # python 2 fallback
     import os
-    import scandir # pip package
+
+    import scandir  # pip package
     os.scandir = scandir.scandir
diff --git a/roundup/anypy/urllib_.py b/roundup/anypy/urllib_.py
index d62c6167a..4d867b7c7 100644
--- a/roundup/anypy/urllib_.py
+++ b/roundup/anypy/urllib_.py
@@ -1,8 +1,7 @@
 
 try:
     # Python 3+
-    from urllib.parse import parse_qs, quote, unquote, urlencode, \
-        urlparse, urlunparse
+    from urllib.parse import parse_qs, quote, unquote, urlencode, urlparse, urlunparse
     from urllib.request import urlopen
 except ImportError:
     # Python 2.5-2.7

From db65d404a5fe9fc2075b5eed3f12dbde9f1841bd Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sat, 4 Jan 2025 20:50:59 -0500
Subject: [PATCH 120/398] chore(ruff): var name changes; unused import;
 formatting

Handle vars variable hiding builting vars().

Use more descripting variable name.

Remove unused sys import.

Add double lines where needed.
---
 roundup/backends/__init__.py | 21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/roundup/backends/__init__.py b/roundup/backends/__init__.py
index d29b28354..9d50d284d 100644
--- a/roundup/backends/__init__.py
+++ b/roundup/backends/__init__.py
@@ -19,8 +19,6 @@
 '''
 __docformat__ = 'restructuredtext'
 
-import sys
-
 # These names are used to suppress import errors.
 # If get_backend raises an ImportError with appropriate
 # module name, have_backend quietly returns False.
@@ -31,18 +29,20 @@
     'sqlite': ('sqlite3', '_sqlite3'),
 }
 
+
 def get_backend(name):
     '''Get a specific backend by name.'''
-    vars = globals()
+    global_vars = globals()
     # if requested backend has been imported yet, return current instance
-    if name in vars:
-        return vars[name]
+    if name in global_vars:
+        return global_vars[name]
     # import the backend module
     module_name = 'back_%s' % name
-    module = __import__(module_name, vars, level=1)
-    vars[name] = module
+    module = __import__(module_name, global_vars, level=1)
+    global_vars[name] = module
     return module
 
+
 def have_backend(name):
     '''Is backend "name" available?'''
     try:
@@ -62,6 +62,7 @@ def have_backend(name):
         raise
     return 0
 
+
 def list_backends():
     '''List all available backend names.
 
@@ -75,10 +76,10 @@ def list_backends():
     because we do not need to monkey-patch list_backends.
 
     '''
-    l = []
+    backend_list = []
     for name in 'anydbm', 'mysql', 'sqlite', 'postgresql', 'memorydb':
         if have_backend(name):
-            l.append(name)
-    return l
+            backend_list.append(name)
+    return backend_list
 
 # vim: set filetype=python sts=4 sw=4 et si :

From 283608f8a03f06fe2a442137ccb9bbcc89d078f4 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sat, 4 Jan 2025 22:34:47 -0500
Subject: [PATCH 121/398] chore(ruff): variable renames, formatting, sort
 imports, use with open

---
 roundup/test/memorydb.py | 71 +++++++++++++++++-----------------------
 roundup/test/mocknull.py | 14 ++++++--
 2 files changed, 42 insertions(+), 43 deletions(-)

diff --git a/roundup/test/memorydb.py b/roundup/test/memorydb.py
index d5f28a90f..61e2ac8fc 100644
--- a/roundup/test/memorydb.py
+++ b/roundup/test/memorydb.py
@@ -1,22 +1,14 @@
 '''Implement an in-memory hyperdb for testing purposes.
 '''
 
-import shutil
 import os
+import shutil
 import time
 
-from roundup import date
-from roundup import hyperdb
-from roundup import roundupdb
-from roundup import security
-from roundup import password
-from roundup import configuration
-from roundup.backends import back_anydbm
-from roundup.backends import indexer_dbm
-from roundup.backends import sessions_dbm
-from roundup.backends import indexer_common
-from roundup.support import ensureParentsExist
+from roundup import configuration, date, hyperdb, password, roundupdb, security
 from roundup.anypy.strings import s2b
+from roundup.backends import back_anydbm, indexer_common, indexer_dbm, sessions_dbm
+from roundup.support import ensureParentsExist
 from roundup.test.tx_Source_detector import init as tx_Source_init
 
 default_prefix = '../../share/roundup/templates/classic'
@@ -51,31 +43,30 @@ def create(journaltag, create=True, debug=False, prefix=default_prefix):
         prefix = os.path.join(os.path.dirname(__file__), prefix)
 
     schema = os.path.join(prefix, 'schema.py')
-    vars = hyperdb.__dict__
-    vars['Class'] = Class
-    vars['FileClass'] = FileClass
-    vars['IssueClass'] = IssueClass
-    vars['db'] = db
-    fd = open(schema)
-    exec(compile(fd.read(), schema, 'exec'), vars)
-    fd.close()
+    hyperdb_vars = hyperdb.__dict__
+    hyperdb_vars['Class'] = Class
+    hyperdb_vars['FileClass'] = FileClass
+    hyperdb_vars['IssueClass'] = IssueClass
+    hyperdb_vars['db'] = db
+
+    with open(schema) as fd:
+        exec(compile(fd.read(), schema, 'exec'), hyperdb_vars)
 
     initial_data = os.path.join(prefix, 'initial_data.py')
-    vars = dict(db=db, admin_email='admin@test.com',
-                adminpw=password.Password('sekrit', config=db.config))
-    fd = open(initial_data)
-    exec(compile(fd.read(), initial_data, 'exec'), vars)
-    fd.close()
+    admin_vars = {"db": db, "admin_email": "admin@test.com",
+                  "adminpw": password.Password('sekrit', config=db.config)}
+    with open(initial_data) as fd:
+        exec(compile(fd.read(), initial_data, 'exec'), admin_vars)
 
     # load standard detectors
     dirname = os.path.join(prefix, 'detectors')
     for fn in os.listdir(dirname):
         if not fn.endswith('.py'): continue                       # noqa: E701
-        vars = {}
+        exec_vars = {}
         with open(os.path.join(dirname, fn)) as fd:
             exec(compile(fd.read(),
-                         os.path.join(dirname, fn), 'exec'), vars)
-        vars['init'](db)
+                         os.path.join(dirname, fn), 'exec'), exec_vars)
+        exec_vars['init'](db)
 
     tx_Source_init(db)
 
@@ -200,7 +191,7 @@ def set(self, infoid, **newvalues):
                 float(newvalues['__timestamp'])
             except ValueError:
                 if infoid in self:
-                    del(newvalues['__timestamp'])
+                    del (newvalues['__timestamp'])
                 else:
                     newvalues['__timestamp'] = time.time()
         self[infoid].update(newvalues)
@@ -301,8 +292,8 @@ def __init__(self, config, journaltag=None):
         self.journals = self.__class__.memdb.get('journals', {})
 
     def filename(self, classname, nodeid, property=None, create=0):
-        shutil.copyfile(__file__, __file__+'.dummy')
-        return __file__+'.dummy'
+        shutil.copyfile(__file__, __file__ + '.dummy')
+        return __file__ + '.dummy'
 
     def filesize(self, classname, nodeid, property=None, create=0):
         return len(self.getfile(classname, nodeid, property))
@@ -423,8 +414,8 @@ def newid(self, classname):
         self.ids[classname] += 1
         return str(self.ids[classname])
 
-    def setid(self, classname, id):
-        self.ids[classname] = int(id)
+    def setid(self, classname, nodeid):
+        self.ids[classname] = int(nodeid)
 
     #
     # Journal
@@ -477,8 +468,8 @@ def pack(self, pack_before):
                 kept_journals = []
                 for entry in db[key]:
                     # unpack the entry
-                    (nodeid, date_stamp, self.journaltag, action,
-                     params) = entry
+                    (_nodeid, date_stamp, self.journaltag, action,
+                     _params) = entry
                     date_stamp = date_stamp.serialise()
                     # if the entry is after the pack date, _or_ the initial
                     # create entry, then it stays
@@ -502,15 +493,13 @@ def __init__(self, db, classname, **properties):
     def export_files(self, dirname, nodeid):
         dest = self.exportFilename(dirname, nodeid)
         ensureParentsExist(dest)
-        f = open(dest, 'wb')
-        f.write(self.db.files[self.classname, nodeid, None])
-        f.close()
+        with open(dest, 'wb') as f:
+            f.write(self.db.files[self.classname, nodeid, None])
 
     def import_files(self, dirname, nodeid):
         source = self.exportFilename(dirname, nodeid)
-        f = open(source, 'rb')
-        self.db.files[self.classname, nodeid, None] = f.read()
-        f.close()
+        with open(source, 'rb') as f:
+            self.db.files[self.classname, nodeid, None] = f.read()
         mime_type = None
         props = self.getprops()
         if 'type' in props:
diff --git a/roundup/test/mocknull.py b/roundup/test/mocknull.py
index 48a1cb267..38b5b2966 100644
--- a/roundup/test/mocknull.py
+++ b/roundup/test/mocknull.py
@@ -5,6 +5,7 @@ def __init__(self, **kwargs):
             self.__dict__[key] = value
 
     def __call__(self, *args, **kwargs): return MockNull()
+
     def __getattr__(self, name):
         # This allows assignments which assume all intermediate steps are Null
         # objects if they don't exist yet.
@@ -16,16 +17,25 @@ def __getattr__(self, name):
         return getattr(self, name)
 
     def __getitem__(self, key): return self
+
     def __bool__(self): return False
     # Python 2 compatibility:
     __nonzero__ = __bool__
+
     def __contains__(self, key): return False
+
     def __eq__(self, rhs): return False
+
     def __ne__(self, rhs): return False
+
     def __str__(self): return ''
-    def __repr__(self): return '<MockNull 0x%x>'%id(self)
-    def gettext(self, str): return str
+
+    def __repr__(self): return '<MockNull 0x%x>' % id(self)
+
+    def gettext(self, string): return string
+
     _ = gettext
+
     def get(self, name, default=None):
         try:
             return self.__dict__[name.lower()]

From a9c5fd9a40ba7848a4fd14b22a736633f99eeecd Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 5 Jan 2025 00:59:12 -0500
Subject: [PATCH 122/398] fix: cae1bbf2536b - expression errors not setting
 result properly

Rather than setting 'result' in renderContext, I was wrirting the
output directly, but was stil falling through to where result would be
used.

This caused email to be sent to the admin and when test_mailgw was
called the mail-test.log was somehow created and caused the test there
to fail.

Fixed renderContext to use result variable and output contents of
mail-test.log to make debugging easier.

This should fix CI failure.
---
 roundup/cgi/client.py | 2 +-
 test/test_mailgw.py   | 3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/roundup/cgi/client.py b/roundup/cgi/client.py
index 8e37fae59..397632364 100644
--- a/roundup/cgi/client.py
+++ b/roundup/cgi/client.py
@@ -2233,7 +2233,7 @@ def renderContext(self):
             except ExpressionError as e:
                 self.add_error_message(str(e))
                 self.template = "search"
-                self.write_html(self.renderContext())
+                result = self.renderContext()
 
             if 'Content-Type' not in self.additional_headers:
                 self.additional_headers['Content-Type'] = pt.content_type
diff --git a/test/test_mailgw.py b/test/test_mailgw.py
index bb0db627f..33590d247 100644
--- a/test/test_mailgw.py
+++ b/test/test_mailgw.py
@@ -539,6 +539,9 @@ def testAlternateAddress(self):
 This is a test submission of a new issue.
 ''')
         userlist = self.db.user.list()
+        if os.path.exists(SENDMAILDEBUG):
+            with open(SENDMAILDEBUG) as f:
+                print(f.read())
         assert not os.path.exists(SENDMAILDEBUG)
         self.assertEqual(userlist, self.db.user.list(),
             "user created when it shouldn't have been")

From fd1a1e962176b780eaf8cbcfe0de8f6eca624db0 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Tue, 7 Jan 2025 20:22:33 -0500
Subject: [PATCH 123/398] feat: add templating utils method dynamically; method
 to set http code

Added new utils.set_http_response(integer) to set the HTML response
code from a template. Useful for error handling inside template.

Also noted that a real TemplatingUtils (like set_http_response) method
gets the TemplatingUtils object instance, but there is no way to do
this with registerUtil() from an extension file.

Added new instance.registerUtilMethod() method to register a function
in an extension as a method passing the client instance in as the first
parameter (aka self).
---
 CHANGES.txt               |  8 +++++-
 doc/admin_guide.txt       | 58 +++++++++++++++++++++++++++++++++------
 doc/reference.txt         | 38 ++++++++++++++-----------
 doc/upgrading.txt         | 22 +++++++++++++++
 roundup/cgi/templating.py | 12 ++++++++
 roundup/instance.py       | 30 ++++++++++++++++++++
 6 files changed, 142 insertions(+), 26 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index f30097726..bffc401a3 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -95,7 +95,13 @@ Features:
 - issue2551116 - Replace xmlrpclib (xmlrpc.client) with defusedxml.
   Added support for defusedxml to better secure the xmlrpc
   endpoint. (John Rouillard)
-
+- Added new instance.registerUtilMethod() method to make using complex
+  templating easier as it provides a default Client instance to the
+  templating method. (John Rouillard)
+- Added new templating utils.set_http_response(integer) method to
+  allow reporting an error to the user from a template. (John
+  Rouillard)
+	
 2024-07-13 2.4.0
 
 Fixed:
diff --git a/doc/admin_guide.txt b/doc/admin_guide.txt
index 75d9fa06d..726b4bc8b 100644
--- a/doc/admin_guide.txt
+++ b/doc/admin_guide.txt
@@ -443,6 +443,8 @@ when invoked.
 More secure CSPs can also be created. However because of the ability
 to customise the web interface, it is difficult to provide guidance.
 
+.. _dynamic_csp:
+
 Dynamic CSP
 -----------
 
@@ -469,7 +471,7 @@ directory that generates the CSP on the fly. For example::
     }
 
 
-    def AddHtmlHeaders(client, header_dict=None):
+    def AddHtmlHeaders(self, header_dict=None):
 	''' Generate https headers from dict use default security headers
 
 	    Setting the header with a value of None will not inject the
@@ -479,34 +481,35 @@ directory that generates the CSP on the fly. For example::
 	    nonce. Use to set a nonce for inline scripts.
 	'''
 	try:
-	    if client.client_nonce is None:
+	    if self.client.client_nonce is None:
 		# logger.warning("client_nonce is None")
-		client.client_nonce = client.session_api._gen_sid()
+		self.client.client_nonce = self.client.session_api._gen_sid()
 	except AttributeError:
-	    # client.client_nonce doesn't exist, create it
+	    # self.client.client_nonce doesn't exist, create it
 	    # logger.warning("client_nonce does not exist, creating")
-	    client.client_nonce = client.session_api._gen_sid()
+	    self.client.client_nonce = client.session_api._gen_sid()
 
 	headers = default_security_headers.copy()
 	if isinstance(header_dict, dict):
             headers.update(header_dict)
 
-	client_headers = client.additional_headers
+	client_headers = self.client.additional_headers
 
 	for header, value in list(headers.items()):
 	    if value is None:
 		continue
 	    client_headers[header] = value.format(
-                nonce=client.client_nonce)
+                nonce=self.client.client_nonce)
 
     def init(instance):
-        instance.registerUtil('AddHtmlHeaders', AddHtmlHeaders)
+        # Note the use of the new (in version 2.5) registerUtilMethod
+        instance.registerUtilMethod('AddHtmlHeaders', AddHtmlHeaders)
 
 
 Adding the following to ``page.html`` right after the opening
 ``<html....`>`` tag::
 
-   <tal:code tal:content="python:utils.AddHtmlHeaders(request.client)" />
+   <tal:code tal:content="python:utils.AddHtmlHeaders()" />
 
 will invoke ``AddHtmlHeaders()`` to add the CSP header with the nonce.
 
@@ -523,6 +526,43 @@ to::
 
 for each script, object or style tag.
 
+If you are using a version of Roundup before version 2.5, you need to
+replace ``instance.registerUtilMethod`` with
+``instance.registerUtil``. For example::
+
+    def init(instance):
+        # Note the use of the new (in version 2.5) registerUtilMethod
+        instance.registerUtil('AddHtmlHeaders', AddHtmlHeaders)
+
+The AddHtmlHeaders function needs to be changed so that ``self.client``
+is replaced by ``client``::
+
+    # replace self parameter with client
+    def AddHtmlHeaders(client, header_dict=None):
+	''' Generate https headers from dict use default security headers
+
+	    Setting the header with a value of None will not inject the
+	    header and can override the default set.
+
+	    Header values will be formatted with a dictionary including a
+	    nonce. Use to set a nonce for inline scripts.
+	'''
+
+	### Then change all references to self.client to client
+
+	try:
+	    if client.client_nonce is None:  # note self.client -> client
+		# logger.warning("client_nonce is None")
+		client.client_nonce = self.client.session_api._gen_sid()
+
+	...
+
+Lastly the client must be passed explicitly when calling
+AddHtmlHeaders. The call looks like::
+
+   <tal:code tal:content="python:utils.AddHtmlHeaders(request.client)" />
+
+
 Remediating ``unsafe-inline``
 -----------------------------
 .. _remediating unsafe-inline:
diff --git a/doc/reference.txt b/doc/reference.txt
index e7f85ee7f..56a42770f 100644
--- a/doc/reference.txt
+++ b/doc/reference.txt
@@ -1148,6 +1148,11 @@ mechanism.
   (see `adding a time log to your issues
   <customizing.html#adding-a-time-log-to-your-issues-4>`_ for an example)
 
+* ``instance.registerUtilMethod`` is also used for adding `templating
+  utilities`_, and provides a client instance by default to the
+  function. This makes more complex templating actions easier to
+  use. (see :ref:`dynamic_csp` for an example)
+
 * ``instance.registerAction`` is used to add more actions to the
   instance and to web interface. See `Defining new web actions`_
   for details.  Generic action can be added by inheriting from
@@ -3465,22 +3470,23 @@ be added to the variable by using extensions_.
 .. table::
   :class: valign-top
 
-  =============== ========================================================
-  Method          Description
-  =============== ========================================================
-  Batch           return a batch object using the supplied list
-  anti_csrf_nonce returns the random nonce generated for this session
-  expandfile      load a file into a template and expand
-                  '%(tokenname)s' in the file using
-                  values from the supplied dictionary.
-  html_quote      quote some text as safe in HTML (ie. <, >, ...)
-  html_calendar   renders an HTML calendar used by the
-		  ``_generic.calendar.html`` template (itself invoked by
-		  the popupCalendar DateHTMLProperty method
-  readfile        read JavaScript or other content in an external
-                  file into the template.
-  url_quote       quote some text as safe for a URL (ie. space, %, ...)
-  =============== ========================================================
+  ================= ========================================================
+  Method            Description
+  ================= ========================================================
+  Batch             return a batch object using the supplied list
+  anti_csrf_nonce   returns the random nonce generated for this session
+  expandfile        load a file into a template and expand
+                    '%(tokenname)s' in the file using
+                    values from the supplied dictionary.
+  html_quote        quote some text as safe in HTML (ie. <, >, ...)
+  html_calendar     renders an HTML calendar used by the
+		    ``_generic.calendar.html`` template (itself invoked by
+		    the popupCalendar DateHTMLProperty method
+  readfile          read JavaScript or other content in an external
+                    file into the template.
+  set_http_response sets the HTTP response code for the request.
+  url_quote         quote some text as safe for a URL (ie. space, %, ...)
+  ================= ========================================================
 
 Additional info can be obtained by starting ``python`` with the
 ``roundup`` subdirectory on your PYTHONPATH and using the Python help
diff --git a/doc/upgrading.txt b/doc/upgrading.txt
index aad6e5870..3bd22b4c3 100644
--- a/doc/upgrading.txt
+++ b/doc/upgrading.txt
@@ -253,6 +253,28 @@ occurs before any database changes are made. Now, all errors related
 to the data format (mime type, API version) will return 406 errors,
 where some previously resulted in 400 errors.
 
+New method for registering templating utils (info)
+--------------------------------------------------
+
+If you are building a template utility function that needs access
+to:
+
+  * the database
+  * the client instance
+  * the form the user submitted
+
+you had to pass these objects from the template using the ``db``,
+``request.client`` or ``request.form``  arguments.
+
+A new method for registering a template utility has been
+added. If you use the ``instance`` object's
+``registerUtilMethod()`` to register a utility function, you do
+not need to pass these arguments. The function is called as a
+method and the first argument is a ``client`` instance from which
+the database (client.db), form (client.form).
+
+You can find an example in :ref:`dynamic_csp`.
+
 .. index:: Upgrading; 2.3.0 to 2.4.0
 
 Migrating from 2.3.0 to 2.4.0
diff --git a/roundup/cgi/templating.py b/roundup/cgi/templating.py
index 0bc70cfea..6a6fe8cea 100644
--- a/roundup/cgi/templating.py
+++ b/roundup/cgi/templating.py
@@ -3799,6 +3799,18 @@ def expandfile(self, name, values=None, optional=False):
                 {'fullpath': fullpath, 'issue': e.args[0]})
             return ""
 
+    def set_http_response(self, code):
+        '''Set the HTTP response code to the integer `code`.
+            Example::
+
+              <tal:x
+               tal:replace="python:utils.set_response(404);"
+              />
+
+
+            will make the template return code 404 (not found).
+            '''
+        self.client.response_code = code
 
 class MissingValue(object):
     def __init__(self, description, **kwargs):
diff --git a/roundup/instance.py b/roundup/instance.py
index 24cdbcf6b..651dae2db 100644
--- a/roundup/instance.py
+++ b/roundup/instance.py
@@ -247,8 +247,38 @@ def registerAction(self, name, action):
             self.cgi_actions[name] = action
 
     def registerUtil(self, name, function):
+        """Register a function that can be called using:
+           `utils.<name>(...)`.
+
+           The function is defined as:
+
+               def function(...):
+
+           If you need access to the client, database, form or other
+           item, you have to pass it explicitly::
+
+               utils.name(request.client, ...)
+
+           If you need client access, consider using registerUtilMethod()
+           instead.
+
+        """
         self.templating_utils[name] = function
 
+    def registerUtilMethod(self, name, function):
+        """Register a method that can be called using:
+           `utils.<name>(...)`.
+
+           Unlike registerUtil, the method is defined as:
+
+               def function(self, ...):
+
+           `self` is a TemplatingUtils object. You can use self.client
+           to access the client object for your request.
+        """
+        setattr(self.TemplatingUtils,
+                name, 
+                function)
 
 class TrackerError(RoundupException):
     pass

From 84fd9af9883d33fa52fb92ea01f9f2d84a2a1267 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Tue, 7 Jan 2025 23:00:35 -0500
Subject: [PATCH 124/398] docs: link to Client and TemplatingUtils class/method
 docstrings

pydoc.txt:
  new page. Has two example autodoc invocations: automethod and autoclass.

docs.txt
  Added pydoc.txt as a hidden page in a new toc in docs.txt. Added
  includehidden in toc directive.Not sure what it does, but was part
  of a recipie to hide the pydoc from the main TOC.

conf.py:
  added sphinx.ext.autodoc to get it pulling in the docs.

reference.txt:

  added references to the pydoc using :py:meth: for templating utils
  methods like set-http_response and :py:class: for Client as the
  existing docs referenced the docstrings.

  Changed table formatting for the TemplatingUtils methods from table
  to list-table. The length of the references to the methods was too
  large to exist in the first column of a drawn table.


For right now the pydoc stuff is only referenced via links from the
main docs. Currently it is ugly, but the additional info on tempating
utils  and their arguments can be helpful.

Added sphin
---
 doc/pydoc.txt        | 17 +++++++++++++
 doc/reference.txt    | 57 +++++++++++++++++++++++++++-----------------
 website/www/conf.py  |  7 +++---
 website/www/docs.txt |  6 +++++
 4 files changed, 62 insertions(+), 25 deletions(-)
 create mode 100644 doc/pydoc.txt

diff --git a/doc/pydoc.txt b/doc/pydoc.txt
new file mode 100644
index 000000000..49d076657
--- /dev/null
+++ b/doc/pydoc.txt
@@ -0,0 +1,17 @@
+================
+Pydocs from code
+================
+
+.. contents::
+   :local:
+
+Client class
+============
+
+.. autoclass:: roundup.cgi.client::Client
+
+Templating Utils class
+======================
+
+.. autoclass:: roundup.cgi.templating::TemplatingUtils
+   :members:
diff --git a/doc/reference.txt b/doc/reference.txt
index 56a42770f..471a5b86b 100644
--- a/doc/reference.txt
+++ b/doc/reference.txt
@@ -1745,7 +1745,7 @@ is used by ``roundup.cgi``, ``roundup-server`` and ``ZRoundup``
 (``ZRoundup``  is broken, until further notice). In all cases, Roundup
 determines which tracker is accessed (the first part of the URL
 path inside the scope of the CGI handler) and pass control on to the
-``roundup.cgi.client.Client`` class - which handles the rest of the
+:py:class:`roundup.cgi.client.Client` class - which handles the rest of the
 access through its ``main()`` method. This means that you can do pretty
 much anything you want as a web interface to your tracker.
 
@@ -3467,26 +3467,38 @@ This is implemented by the
 ``roundup.cgi.templating.TemplatingUtils`` class. New methods can
 be added to the variable by using extensions_.
 
-.. table::
-  :class: valign-top
-
-  ================= ========================================================
-  Method            Description
-  ================= ========================================================
-  Batch             return a batch object using the supplied list
-  anti_csrf_nonce   returns the random nonce generated for this session
-  expandfile        load a file into a template and expand
-                    '%(tokenname)s' in the file using
-                    values from the supplied dictionary.
-  html_quote        quote some text as safe in HTML (ie. <, >, ...)
-  html_calendar     renders an HTML calendar used by the
-		    ``_generic.calendar.html`` template (itself invoked by
-		    the popupCalendar DateHTMLProperty method
-  readfile          read JavaScript or other content in an external
-                    file into the template.
-  set_http_response sets the HTTP response code for the request.
-  url_quote         quote some text as safe for a URL (ie. space, %, ...)
-  ================= ========================================================
+-----
+
+.. list-table:: TemplatingUtils Methods
+   :align: left
+   :header-rows: 1
+   :class: valign-top captionbelow booktabs
+
+   * - Method
+     - Description
+   * - Batch
+     - return a batch object using the supplied list
+   * - anti_csrf_nonce
+     - returns the random nonce generated for this session
+   * - :meth:`expandfile <roundup.cgi.templating.TemplatingUtils.expandfile>`
+     - load a file into a template and expand
+       '%(tokenname)s' in the file using
+       values from the supplied dictionary.
+   * - :meth:`html_calendar <roundup.cgi.templating.TemplatingUtils.html_calendar>`
+     - renders an HTML calendar used by the ``_generic.calendar.html``
+       template (itself invoked by the popupCalendar DateHTMLProperty
+       method
+   * - :meth:`html_quote <roundup.cgi.templating.TemplatingUtils.html_quote>`
+     - quote some text as safe in HTML (ie. <, >, ...)
+   * - :meth:`readfile <roundup.cgi.templating.TemplatingUtils.readfile>`
+     - read JavaScript or other content in an external file
+       into the template.
+   * - :meth:`set_http_response <roundup.cgi.templating.TemplatingUtils.set_http_response>`
+     - set_http_response sets the HTTP response code for the request.
+   * - :meth:`url_quote <roundup.cgi.templating.TemplatingUtils.url_quote>`
+     - quote some text as safe for a URL (ie. space, %, ...)
+
+-----
 
 Additional info can be obtained by starting ``python`` with the
 ``roundup`` subdirectory on your PYTHONPATH and using the Python help
@@ -3960,7 +3972,8 @@ example ``myaction.py``::
          '''
 
 The *self.client* attribute is an instance of ``roundup.cgi.client.Client``.
-See the docstring of that class for details of what it can do.
+See the :class:`docstring of that class <roundup.cgi.client.Client>`
+for details of what it can do.
 
 The method will typically check the ``self.form`` variable's contents.
 It may then:
diff --git a/website/www/conf.py b/website/www/conf.py
index 9da7a3c40..a6afc70d6 100644
--- a/website/www/conf.py
+++ b/website/www/conf.py
@@ -45,9 +45,10 @@
 # General configuration
 # ---------------------
 
-# Add any Sphinx extension module names here, as strings. They can be extensions
-# coming with Sphinx (named 'sphinx.ext.*') or your custom ones.
-extensions = ["sphinxext.opengraph", 'sphinx_sitemap', 'sphinx_tabs.tabs',]
+# Add any Sphinx extension module names here, as strings. They can be
+#  extensions coming with Sphinx (named 'sphinx.ext.*') or your custom ones.
+extensions = ['sphinx.ext.autodoc', 'sphinxext.opengraph',
+              'sphinx_sitemap', 'sphinx_tabs.tabs']
 
 sphinx_tabs_valid_builders = ['linkcheck']
 sphinx_tabs_disable_tab_closing = True
diff --git a/website/www/docs.txt b/website/www/docs.txt
index 83c04c69c..0f6b8d39e 100644
--- a/website/www/docs.txt
+++ b/website/www/docs.txt
@@ -20,6 +20,7 @@ documentation.
 
 .. toctree::
    :maxdepth: 2
+   :includehidden:
 
    Features <docs/features>
    Installation <docs/installation>
@@ -37,3 +38,8 @@ documentation.
    docs/license
    docs/acknowledgements
    olderdocs
+
+.. toctree::
+   :hidden:
+
+   docs/pydoc

From f74deec643b81111205ba1afd8541df0653fa9d6 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 8 Jan 2025 11:39:54 -0500
Subject: [PATCH 125/398] docs: clarify wording, fix index, add superseder link

Make superseder, messages etc. properties index entries point to the
right place.

Link to description of using Superseder in the original overview.

fix bad wording on boolean properties.
---
 doc/reference.txt | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/doc/reference.txt b/doc/reference.txt
index 471a5b86b..91868047f 100644
--- a/doc/reference.txt
+++ b/doc/reference.txt
@@ -744,6 +744,11 @@ create(information)
 Create an item in the database. This is used to create items
 in the :term:`definitional class` like "priority" and "status".
 
+.. index:: triple: schema; class property; messages
+   triple: schema; class property; files
+   triple: schema; class property; nosy
+   triple: schema; class property; superseder
+
 IssueClass
 ~~~~~~~~~~
 
@@ -756,6 +761,8 @@ users to tell about changes to the issue. They get "CC'ed"
 e-mails when messages are sent to or generated by the issue. The nosy
 reactor (in the ``'detectors'`` directory) handles this action. The
 superseder link indicates an issue which has superseded this one.
+It is better described in the
+`original document <original_overview.html#roundupdb>`_.
 
 They also have the default "creation", "activity" and "creator"
 properties.
@@ -855,11 +862,6 @@ file class allows for other possibilities including:
   done on the filesystem outside of the Roundup mechanism.
 * keeping multiple revisions of the file.
 
-.. index:: triple: schema; class property; messages
-   triple: schema; class property; files
-   triple: schema; class property; nosy
-   triple: schema; class property; superseder
-
 .. index:: schema; item ordering
 
 A note about ordering
@@ -3084,7 +3086,7 @@ There are several methods available on these wrapper objects:
 	        Set the labels for the true/false/undefined
 		states. If u_label is defined, it produces a
 	        tri-state radio button selector. Otherwise, it
-		allows selection of true,yes/false,no only.
+		allows selection of true/yes or false/no only.
 
 	      labelfirst (Boolean properties only)
 	        place the labels before the radio buttons

From 36d0f61af69b22ccc4f1eccd2e2d4e77417439e8 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 9 Jan 2025 09:30:08 -0500
Subject: [PATCH 126/398] fix(api): issue2551384. Verify REST authorization
 earlier

To reduce the ability of bad actors to spam (DOS) the REST endpoint
with bad data and generate logs meant for debugging, modify the flow
in client.py's REST handler to verify authorization earlier.

If the anonymous user is allowed to use REST, this won't make a
difference for a DOS attempt. The templates don't enable REST for the
anonymous user by default. Most admins don't change this.

The validation order for REST requests has been changed.

  CORS identfied an handled
  User authorization to use REST (return 403 on failure)
  REST request validated (Origin header valid etc.) (return 400 for
                          bad request)

Incorrectly formatted CORS preflight requests (e.g. missing Origin
header) that are not recogized as a CORS request can now return HTTP
status 403 as well as status 400 (when anonymous is allowed
access). Note all CORS preflights are sent without authentication so
appear as anonymous requests.

The tests were updated to compensate, but it is not obvious to me from
specs what the proper evaulation order/return codes should be for this
case. Both 403/400 are failures and cause CORS to fail so there should
be no difference but...
---
 CHANGES.txt             |  7 +++++++
 doc/upgrading.txt       | 11 +++++++++++
 roundup/cgi/client.py   | 43 +++++++++++++++++++++++++++--------------
 test/test_cgi.py        |  2 +-
 test/test_liveserver.py |  5 ++---
 5 files changed, 49 insertions(+), 19 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index bffc401a3..68a1689eb 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -60,6 +60,13 @@ Fixed:
   on command line. (John Rouillard)
 - issue2551374 - Add error handling for filter expressions. Filter
   expression errors are now reported. (John Rouillard)
+- issue2551384: Modify flow in client.py's REST handler to verify
+  authorization earlier. The validation order for REST requests
+  has been changed. Checking user authorization to use the REST
+  interface is done before validating the Origin header. As a
+  result, incorrectly formatted CORS preflight requests
+  (e.g. missing Origin header) can now return HTTP status 403 as
+  well as status 400. (John Rouillard)
 
 Features:
 
diff --git a/doc/upgrading.txt b/doc/upgrading.txt
index 3bd22b4c3..52503a493 100644
--- a/doc/upgrading.txt
+++ b/doc/upgrading.txt
@@ -224,6 +224,17 @@ defusedxml.
 
 .. _defusedxml: https://pypi.org/project/defusedxml/
 
+Change in REST response for invalid CORS requests (info)
+--------------------------------------------------------
+
+CORS_ preflight requests that are missing required headers can
+now result in either a 403 or 400 error code. If you permit
+anonymous users to access the REST interface, a 400 error may
+still occur. Previously, only a 400 error was given. This change
+is not expected to create issues since the client will recognize
+both codes it as an error response, and the CORS request will
+still fail.
+
 More secure session cookie handling (info)
 ------------------------------------------
 
diff --git a/roundup/cgi/client.py b/roundup/cgi/client.py
index 397632364..ace724c76 100644
--- a/roundup/cgi/client.py
+++ b/roundup/cgi/client.py
@@ -677,8 +677,11 @@ def handle_xmlrpc(self):
     def is_cors_preflight(self):
         return (
             self.env['REQUEST_METHOD'] == "OPTIONS"
-            and self.request.headers.get("Access-Control-Request-Headers")
             and self.request.headers.get("Access-Control-Request-Method")
+               # technically Access-Control-Request-Headers (ACRH) is
+               # optional, but we require the header x-requested-with,
+               # so ACRH will be present.
+            and self.request.headers.get("Access-Control-Request-Headers")
             and self.request.headers.get("Origin"))
 
     def handle_preflight(self):
@@ -721,6 +724,30 @@ def handle_rest(self):
                                 status=http_.client.TOO_MANY_REQUESTS)
             return
 
+        # Handle CORS preflight request. We know rest is enabled
+        # because handle_rest is called. Preflight requests
+        # are unauthenticated, so no need to check permissions.
+        if (self.is_cors_preflight()):
+                # Origin header must be defined to get here
+            if self.is_origin_header_ok(api=True):
+                self.handle_preflight()
+            else:
+                # origin is not authorized for REST
+                msg = self._("Client is not allowed to use Rest Interface.")
+                output = s2b(
+                    '{ "error": { "status": 400, "msg": "%s" } }' % msg)
+                self.reject_request(output,
+                                message_type="application/json",
+                                status=400)
+            return
+
+        if not self.db.security.hasPermission('Rest Access', self.userid):
+            output = s2b('{ "error": { "status": 403, "msg": "Forbidden." } }')
+            self.reject_request(output,
+                                message_type="application/json",
+                                status=403)
+            return
+
         # verify Origin is allowed on all requests including GET.
         # If a GET, missing origin is allowed  (i.e. same site GET request)
         if not self.is_origin_header_ok(api=True):
@@ -753,20 +780,6 @@ def handle_rest(self):
                                "origin": self.env.get('HTTP_ORIGIN', None)})
             return
 
-        # Handle CORS preflight request. We know rest is enabled
-        # because handle_rest is called. Preflight requests
-        # are unauthenticated, so no need to check permissions.
-        if (self.is_cors_preflight()):
-            self.handle_preflight()
-            return
-
-        if not self.db.security.hasPermission('Rest Access', self.userid):
-            output = s2b('{ "error": { "status": 403, "msg": "Forbidden." } }')
-            self.reject_request(output,
-                                message_type="application/json",
-                                status=403)
-            return
-
         self.check_anonymous_access()
 
         try:
diff --git a/test/test_cgi.py b/test/test_cgi.py
index c9968d8e0..4990be733 100644
--- a/test/test_cgi.py
+++ b/test/test_cgi.py
@@ -1360,7 +1360,7 @@ def wh(s):
             cl.additional_headers
         )
 
-        self.assertEqual(cl.response_code, 400)
+        self.assertEqual(cl.response_code, 403)
         del(out[0])
 
         # origin not set to allowed value
diff --git a/test/test_liveserver.py b/test/test_liveserver.py
index 82afaffc2..6dab66e48 100644
--- a/test/test_liveserver.py
+++ b/test/test_liveserver.py
@@ -711,10 +711,9 @@ def test_rest_preflight_collection(self):
                                  "x-requested-with",
                              'Access-Control-Request-Method': "PUT",})
 
-        self.assertEqual(f.status_code, 400)
+        self.assertEqual(f.status_code, 403)
 
-        expected = ('{ "error": { "status": 400, "msg": "Required'
-                    ' Header Missing" } }')
+        expected = ('{ "error": { "status": 403, "msg": "Forbidden." } }')
         self.assertEqual(b2s(f.content), expected)
 
 

From cd1e62bdfe1d30f80e8c0fe71bab657da00b66c9 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 9 Jan 2025 09:32:10 -0500
Subject: [PATCH 127/398] doc: known issues with possible dependent tests

When reversing the testing order, two blocks of tests fail. Document
these.

I spent time trying to fix them, but got nowhere. Obviously I am
missing something. But this doc gives future me or somebody else a
starting point.
---
 test/conftest.py | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/test/conftest.py b/test/conftest.py
index 9f1d17196..ad872bf76 100644
--- a/test/conftest.py
+++ b/test/conftest.py
@@ -2,6 +2,20 @@
 # can use if pytest-random-order --random-order mode isn't
 # usable (e.g. python2).
 
+
+# known issues:
+#  python3 -m pytest -k Whoosh test/test_indexer.py fails starting with
+#      first reversed (so last) test in module
+#
+#  python3 -m pytest test/test_cgi.py 
+#    fails: FormTestCase::testCreatePermission
+#           FormTestCase::testClassPermission
+#           FormTestCase::testCheckAndPropertyPermission
+#
+#  this failure results in a failure in test_action again with
+#     bad permission application. Something run prior to these
+#     tests is breaking the permission checks.
+
 #def pytest_collection_modifyitems(items): 
 #    items.reverse()
 

From e150d351f271a42a3a22e293f144b9b0bf023846 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 9 Jan 2025 10:14:55 -0500
Subject: [PATCH 128/398] doc: remove uneeded comment. CORS preflight code path
 moved.

---
 roundup/cgi/client.py | 1 -
 1 file changed, 1 deletion(-)

diff --git a/roundup/cgi/client.py b/roundup/cgi/client.py
index ace724c76..580113408 100644
--- a/roundup/cgi/client.py
+++ b/roundup/cgi/client.py
@@ -760,7 +760,6 @@ def handle_rest(self):
 
             # Use code 400. Codes 401 and 403 imply that authentication
             # is needed or authenticated person is not authorized.
-            # Preflight doesn't do authentication.
             output = s2b(
                 '{ "error": { "status": 400, "msg": "%s" } }' % msg)
             self.reject_request(output,

From 6e35fc1a170917a94d211bc82c4d96fb96305b59 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 12 Jan 2025 12:34:52 -0500
Subject: [PATCH 129/398] fix: issue2551387 - TypeError: not indexable.

Fix crash due to uninitialized list element on a (Mini)FieldStorage
when unexpected input is posted via wsgi. This doesn't happen when
running roundup-server. It might happen under other front ends.

Moved the code that sets '.list = [] if .list == None' to the main
flow. Added an exception hander that logs the value of self.form if
self.form.list raises an AttributeError. This exception should never
happen if I understand the code correctly (but I probably don't).

Fixed a number of test cases that were broken because I was calling
Client and passing '[]' rather than a cgi.formStorage object.

Added test cases:

   create a FileStorage (self.form) with .list = None.

   check AttributeError exception and verify logging.

Problem reported and debugged by Christof Meerwald.
---
 CHANGES.txt             |  4 +++
 roundup/cgi/client.py   | 21 +++++++++++++---
 test/db_test_base.py    | 45 ++++++++++++++++++++++++++++++++-
 test/rest_common.py     | 56 +++++++++++++++++++++++++++++++----------
 test/test_cgi.py        |  7 ++++--
 test/test_liveserver.py | 12 +++++++++
 6 files changed, 125 insertions(+), 20 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index 68a1689eb..48a6933fb 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -67,6 +67,10 @@ Fixed:
   result, incorrectly formatted CORS preflight requests
   (e.g. missing Origin header) can now return HTTP status 403 as
   well as status 400. (John Rouillard)
+- issue2551387 - TypeError: not indexable. Fix crash due to
+  uninitialized list element on a (Mini)FieldStorage when unexpected
+  input is posted via wsgi. (Reported and debugged by Christof
+  Meerwald; fix John Rouillard)
 
 Features:
 
diff --git a/roundup/cgi/client.py b/roundup/cgi/client.py
index 580113408..c137ee150 100644
--- a/roundup/cgi/client.py
+++ b/roundup/cgi/client.py
@@ -504,13 +504,26 @@ def __init__(self, instance, request, env, form=None, translator=None):
             # It's a workaround for a bug in cgi.FieldStorage. See class
             # def for details.
             self.form = BinaryFieldStorage(fp=request.rfile, environ=env)
-            # In some case (e.g. content-type application/xml), cgi
-            # will not parse anything. Fake a list property in this case
-            if self.form.list is None:
-                self.form.list = []
         else:
             self.form = form
 
+        # When the CONTENT-TYPE is not 'application/x-www-form-urlencoded':
+        # or multipart/*, cgi.(Mini)FieldStorage sets the list property to
+        # None. Initialize an empty list property in this case so we can
+        # query the list in all cases.
+        try:
+            if (self.form.list is None):
+                self.form.list = []
+        except AttributeError:
+            # self.form should always be some type of
+            # FieldStorage. If we get an AttributeError,
+            # print what the form is.
+            # FIXME: plan on removing this in 2028 to improve
+            # performance if there are no reports of it being triggered.
+            logger.error(("Invalid self.form found (please report "
+                         "to the roundup-users mailing list): %s") % self.form)
+            raise
+
         # turn debugging on/off
         try:
             self.debug = int(env.get("ROUNDUP_DEBUG", 0))
diff --git a/test/db_test_base.py b/test/db_test_base.py
index 51c7b4e13..038383db8 100644
--- a/test/db_test_base.py
+++ b/test/db_test_base.py
@@ -30,6 +30,14 @@
 from email import message_from_string
 
 import pytest
+
+try:
+    from StringIO import cStringIO as IOBuff
+except ImportError:
+    # python 3
+    from io import BytesIO as IOBuff
+
+from roundup.cgi.client import BinaryFieldStorage
 from roundup.hyperdb import String, Password, Link, Multilink, Date, \
     Interval, DatabaseError, Boolean, Number, Node, Integer
 from roundup.mailer import Mailer
@@ -43,7 +51,7 @@
 from roundup.exceptions import UsageError, Reject
 from roundup.mlink_expr import ExpressionError
 
-from roundup.anypy.strings import b2s, s2b, u2s
+from roundup.anypy.strings import b2s, bs2b, s2b, u2s
 from roundup.anypy.cmp_ import NoneAndDictComparable
 from roundup.anypy.email_ import message_from_bytes
 
@@ -4340,6 +4348,14 @@ def testHTMLItemDerefFail(self):
         ae(bool(issue ['priority']['name']),False)
 
 def makeForm(args):
+    """ Takes a dict of form elements or a FieldStorage.
+
+         FieldStorage is just returned so you can pass the result from
+         makeFormFromString through it cleanly.
+    """
+    if isinstance(args, cgi.FieldStorage):
+        return args
+
     form = cgi.FieldStorage()
     for k,v in args.items():
         if type(v) is type([]):
@@ -4352,6 +4368,33 @@ def makeForm(args):
             form.list.append(cgi.MiniFieldStorage(k, v))
     return form
 
+def makeFormFromString(bstring, env=None):
+    """used for generating a form that looks like a rest or xmlrpc
+       payload. Takes a binary or regular string and stores
+       it in a FieldStorage object.
+
+       :param: bstring - binary or regular string
+       :param" env - dict of environment variables. Names/keys
+               must be uppercase.
+                  e.g. {"REQUEST_METHOD": "DELETE"}
+
+       Ideally this would be part of makeForm, but the env dict
+       is needed here to allow FieldStorage to properly define
+       the resulting object.
+    """
+    rfile=IOBuff(bs2b(bstring))
+
+    # base headers required for BinaryFieldStorage/FieldStorage
+    e = {'REQUEST_METHOD':'POST',
+         'CONTENT_TYPE': 'text/xml',
+         'CONTENT_LENGTH': str(len(bs2b(bstring)))
+         }
+    if env:
+        e.update(env)
+
+    form = BinaryFieldStorage(fp=rfile, environ=e)
+    return form
+
 class FileUpload:
     def __init__(self, content, filename):
         self.content = content
diff --git a/test/rest_common.py b/test/rest_common.py
index f6923af3f..58a639cd0 100644
--- a/test/rest_common.py
+++ b/test/rest_common.py
@@ -3,6 +3,7 @@
 import shutil
 import sys
 import errno
+import logging
 
 from time import sleep
 from datetime import datetime, timedelta
@@ -76,6 +77,10 @@ def dst(self, dt):
 
 class TestCase():
 
+    @pytest.fixture(autouse=True)
+    def inject_fixtures(self, caplog):
+        self._caplog = caplog
+
     backend = None
     url_pfx = 'http://tracker.example/cgi-bin/roundup.cgi/bugs/rest/data/'
 
@@ -291,7 +296,8 @@ def setUp(self):
             'HTTP_ORIGIN': 'http://tracker.example'
         }
         self.dummy_client = client.Client(self.instance, MockNull(),
-                                          self.client_env, [], None)
+                                          self.client_env,
+                                          cgi.FieldStorage(), None)
         self.dummy_client.request.headers.get = self.get_header
         self.dummy_client.db = self.db
 
@@ -2294,6 +2300,30 @@ def testdetermine_output_formatBadAccept(self):
                 self.assertNotIn("X-Content-Type-Options", 
                               self.server.client.additional_headers)
 
+    def testBadFormAttributeErrorException(self):
+        env = {
+            'PATH_INFO': 'rest/data/user',
+            'HTTP_HOST': 'localhost',
+            'TRACKER_NAME': 'rounduptest',
+            "REQUEST_METHOD": "GET"
+        }
+
+
+        with self._caplog.at_level(logging.ERROR, logger="roundup"):
+            with self.assertRaises(AttributeError) as exc:
+                self.dummy_client = client.Client(
+                    self.instance, MockNull(), env, [], None)
+
+        self.assertEqual(exc.exception.args[0],
+                         "'list' object has no attribute 'list'")
+
+        # log should look like (with string not broken into parts):
+        #    [('roundup', 40, 
+        #       'Invalid self.form found (please report to the '
+        #       'roundup-users mailing list): []')]
+        log = self._caplog.record_tuples[:]
+        self.assertIn("Invalid self.form found", log[0][2])
+
     def testDispatchBadAccept(self):
         # simulate: /rest/data/issue expect failure unknown accept settings
         body=b'{ "title": "Joe Doe has problems", \
@@ -4508,8 +4538,9 @@ def wh(s):
             'TRACKER_NAME': 'rounduptest',
             "REQUEST_METHOD": "GET"
         }
+
         self.dummy_client = client.Client(self.instance, MockNull(), env,
-                                          [], None)
+                                          cgi.FieldStorage(), None)
         self.dummy_client.db = self.db
         self.dummy_client.request.headers.get = self.get_header
         self.empty_form = cgi.FieldStorage()
@@ -4517,7 +4548,6 @@ def wh(s):
         self.terse_form.list = [
             cgi.MiniFieldStorage('@verbose', '0'),
         ]
-        self.dummy_client.form = cgi.FieldStorage()
         self.dummy_client.form.list = [
             cgi.MiniFieldStorage('@fields', 'username,address'),
         ]
@@ -4575,7 +4605,7 @@ def wh(s):
         )
 
         self.dummy_client = client.Client(self.instance, MockNull(), env,
-                                          [], None)
+                                          cgi.FieldStorage(), None)
         self.dummy_client.db = self.db
         self.dummy_client.request.headers.get = self.get_header
         self.empty_form = cgi.FieldStorage()
@@ -4645,7 +4675,7 @@ def wh(s):
         }
 
         self.dummy_client = client.Client(self.instance, MockNull(), env,
-                                          [], None)
+                                          cgi.FieldStorage(), None)
         self.dummy_client.db = self.db
         self.dummy_client.request.headers.get = self.get_header
         self.empty_form = cgi.FieldStorage()
@@ -4710,7 +4740,7 @@ def wh(s):
             "REQUEST_METHOD": "GET"
         }
         self.dummy_client = client.Client(self.instance, MockNull(), env,
-                                          [], None)
+                                          cgi.FieldStorage(), None)
         self.dummy_client.db = self.db
         self.dummy_client.request.headers.get = self.get_header
         self.empty_form = cgi.FieldStorage()
@@ -4781,7 +4811,7 @@ def wh(s):
             "REQUEST_METHOD": "GET"
         }
         self.dummy_client = client.Client(self.instance, MockNull(), env,
-                                          [], None)
+                                          cgi.FieldStorage(), None)
         self.dummy_client.db = self.db
         self.dummy_client.request.headers.get = self.get_header
         self.empty_form = cgi.FieldStorage()
@@ -4849,7 +4879,7 @@ def wh(s):
             "REQUEST_METHOD": "GET"
         }
         self.dummy_client = client.Client(self.instance, MockNull(), env,
-                                          [], None)
+                                          cgi.FieldStorage(), None)
         self.dummy_client.db = self.db
         self.dummy_client.request.headers.get = self.get_header
         self.empty_form = cgi.FieldStorage()
@@ -4891,7 +4921,7 @@ def wh(s):
             "REQUEST_METHOD": "GET"
         }
         self.dummy_client = client.Client(self.instance, MockNull(), env,
-                                          [], None)
+                                          cgi.FieldStorage(), None)
         self.dummy_client.db = self.db
         self.dummy_client.request.headers.get = self.get_header
         self.empty_form = cgi.FieldStorage()
@@ -4930,7 +4960,7 @@ def wh(s):
             "REQUEST_METHOD": "GET"
         }
         self.dummy_client = client.Client(self.instance, MockNull(), env,
-                                          [], None)
+                                          cgi.FieldStorage(), None)
         self.dummy_client.db = self.db
         self.dummy_client.request.headers.get = self.get_header
         self.empty_form = cgi.FieldStorage()
@@ -4966,7 +4996,7 @@ def wh(s):
             "REQUEST_METHOD": "GET"
         }
         self.dummy_client = client.Client(self.instance, MockNull(), env,
-                                          [], None)
+                                          cgi.FieldStorage(), None)
         self.dummy_client.db = self.db
         self.dummy_client.request.headers.get = self.get_header
         self.empty_form = cgi.FieldStorage()
@@ -5003,7 +5033,7 @@ def wh(s):
             "REQUEST_METHOD": "GET"
         }
         self.dummy_client = client.Client(self.instance, MockNull(), env,
-                                          [], None)
+                                          cgi.FieldStorage(), None)
         self.dummy_client.db = self.db
         self.dummy_client.request.headers.get = self.get_header
         self.empty_form = cgi.FieldStorage()
@@ -5039,7 +5069,7 @@ def wh(s):
             "REQUEST_METHOD": "GET"
         }
         self.dummy_client = client.Client(self.instance, MockNull(), env,
-                                          [], None)
+                                           cgi.FieldStorage(), None)
         self.dummy_client.db = self.db
         self.dummy_client.request.headers.get = self.get_header
         self.empty_form = cgi.FieldStorage()
diff --git a/test/test_cgi.py b/test/test_cgi.py
index 4990be733..022b83857 100644
--- a/test/test_cgi.py
+++ b/test/test_cgi.py
@@ -1870,8 +1870,11 @@ def testXmlrpcCsrfProtection(self):
         def wh(s):
             out.append(s)
 
-        # xmlrpc has no form content
-        form = {}
+        # create form for xmlrpc from string
+        form = db_test_base.makeFormFromString('xyzzy',
+                                               {"REQUEST_METHOD": "POST",
+                                               "CONTENT_TYPE": "text/json"})
+
         cl = client.Client(self.instance, None,
                            {'REQUEST_METHOD':'POST',
                             'PATH_INFO':'xmlrpc',
diff --git a/test/test_liveserver.py b/test/test_liveserver.py
index 6dab66e48..3f070762a 100644
--- a/test/test_liveserver.py
+++ b/test/test_liveserver.py
@@ -333,6 +333,18 @@ def test_cookie_attributes(self):
         self.assertEqual(cookie._rest['HttpOnly'], None)  # flag is present
         self.assertEqual(cookie._rest['SameSite'], 'Lax')
 
+    def test_bad_post_data(self):
+        """issue2551387 - bad post data causes TypeError: not indexable
+        """
+        session, _response = self.create_login_session()
+
+        h = {"Content-Type": "text/plain"}
+        response = session.post(self.url_base()+'/', headers=h, data="test")
+        print(response.status_code)
+        print(response.headers)
+        print(response.text)
+        self.assertEqual(response.status_code, 200)
+
     def test_query(self):
         current_user_query = (
             "@columns=title,id,activity,status,assignedto&"

From 8c2fe02110cd21a7f09f57a1461ac358d00618bc Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 12 Jan 2025 12:59:41 -0500
Subject: [PATCH 130/398] Handle timeout exception in roundup-server better.

A timeout in roundup-server used to generate another exception:

   OSError: cannot read from timed out object

when it tried to reuse the socket that timed out.

Now return status 408, a brief message and trigger closing of the
socket.

Manual testing, no CI.

To test used curl -X POST with no --data defined.
---
 CHANGES.txt                       | 3 +++
 roundup/scripts/roundup_server.py | 9 +++++++++
 2 files changed, 12 insertions(+)

diff --git a/CHANGES.txt b/CHANGES.txt
index 48a6933fb..29d0d05d8 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -71,6 +71,9 @@ Fixed:
   uninitialized list element on a (Mini)FieldStorage when unexpected
   input is posted via wsgi. (Reported and debugged by Christof
   Meerwald; fix John Rouillard)
+- close http socket and send a 408 status when a timeout exception
+  is handed in roundup-server. This prevents another exception
+  caused by using a timed out socket. (John Rouillard)
 
 Features:
 
diff --git a/roundup/scripts/roundup_server.py b/roundup/scripts/roundup_server.py
index e4630b61f..97ccbf91a 100644
--- a/roundup/scripts/roundup_server.py
+++ b/roundup/scripts/roundup_server.py
@@ -282,6 +282,15 @@ def run_cgi(self):
             exc, val, tb = sys.exc_info()
             if hasattr(socket, 'timeout') and isinstance(val, socket.timeout):
                 self.log_error('timeout')
+                self.send_response(408)
+                self.send_header('Content-Type', 'text/html')
+
+                output = s2b('''<body><p>Connection timed out</p></body>''')
+                # Close connection
+                self.send_header('Content-Length', len(output))
+                self.end_headers()
+                self.wfile.write(output)
+                self.close_connection = True
             else:
                 self.send_response(400)
                 self.send_header('Content-Type', 'text/html')

From 98dbe9fc49124d0dcbf60fe2fc358195f7ad60e4 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 12 Jan 2025 14:14:09 -0500
Subject: [PATCH 131/398] test: Override Fuzz timeout from env variable.

I have a local pytest.ini where I use:

  env =
    pytest_fuzz_timeout=30000

to set a 30 second timout while keeping the default 10 second for CI
because my machine is slow.

So the test now looks for that env variable and uses it if set.
---
 test/test_liveserver.py | 23 +++++++++++++++++++----
 1 file changed, 19 insertions(+), 4 deletions(-)

diff --git a/test/test_liveserver.py b/test/test_liveserver.py
index 3f070762a..19479712f 100644
--- a/test/test_liveserver.py
+++ b/test/test_liveserver.py
@@ -225,12 +225,17 @@ class FuzzGetUrls(WsgiSetup, ClientSetup):
 
     _max_examples = 100
 
+    # Timeout for each fuzz test in ms. Use env variable in local
+    # pytest.ini if your dev environment can't complete in the default
+    # 10 seconds.
+    fuzz_deadline = int(os.environ.get('pytest_fuzz_timeout', 0)) or 10000
+
     @given(sampled_from(['@verbose', '@page_size', '@page_index']),
            text(min_size=1))
     @example("@verbose", "1#")
     @example("@verbose", "#1stuff")
     @settings(max_examples=_max_examples,
-              deadline=10000) # in ms
+              deadline=fuzz_deadline) # in ms
     def test_class_url_param_accepting_integer_values(self, param, value):
         """Tests all integer args for rest url. @page_* is the
            same code for all *.
@@ -258,7 +263,7 @@ def test_class_url_param_accepting_integer_values(self, param, value):
     @example("@verbose", "10#")
     @example("@verbose", u'Ã˜\U000dd990')
     @settings(max_examples=_max_examples,
-              deadline=10000) # in ms
+              deadline=fuzz_deadline) # in ms
     def test_element_url_param_accepting_integer_values(self, param, value):
         """Tests args accepting int for rest url.
         """
@@ -281,10 +286,20 @@ def test_element_url_param_accepting_integer_values(self, param, value):
                 # invalid value for param
                 self.assertEqual(f.status_code, 400)
 
+@skip_hypothesis
+class FuzzTestSettingData(WsgiSetup, ClientSetup):
+
+    _max_examples = 100
+
+    # Timeout for each fuzz test in ms. Use env variable in local
+    # pytest.ini if your dev environment can't complete in the default
+    # 10 seconds.
+    fuzz_deadline = int(os.environ.get('pytest_fuzz_timeout', 0)) or 10000
+
     @given(emails())
     @settings(max_examples=_max_examples,
-              deadline=10000) # in ms
-    def test_email_param(self,email):
+              deadline=fuzz_deadline) # in ms
+    def test_setting_email_param(self,email):
         session, _response = self.create_login_session()
         url = '%s/rest/data/user/1/address' % (self.url_base())
         headers = {"Accept": "application/json",

From 47f7c4e91498983361382186b6a2a65b31c8bbff Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 12 Jan 2025 18:22:40 -0500
Subject: [PATCH 132/398] doc: add make help to all Makefiles and fix 2
 Makefiles

Use automatic help generator for help target that extracts help text
from makefile comments.

Reordered a number of targets to use grouping mechanism in help
generator.

A couple of multiple target rules had to be split because:

  target1 target2: ... ## help comment

doesn't work with the help generator.

In locale Makefile, the TEMPLATES variable was not set so changes to
the html files in the templates would not trigger regeneration of the
roundup.pot template.

In doc Makefile, made admin_help.html generate the file rather than
putting it into admin_help.py. Verified that the file shows up at end
of admin_guide.html.

In www makefile, fixed docs link generation.
---
 doc/Makefile         | 23 ++++++----
 locale/Makefile      | 99 +++++++++++++++++++++++---------------------
 website/www/Makefile | 59 ++++++++++++++------------
 3 files changed, 100 insertions(+), 81 deletions(-)

diff --git a/doc/Makefile b/doc/Makefile
index c4378bb3a..3c2345391 100644
--- a/doc/Makefile
+++ b/doc/Makefile
@@ -1,8 +1,10 @@
-all:  man_html tracker_config.txt admin_help.html
+##@ Default target
+all:  man_html tracker_config.txt admin_help.html ## make all docs under share
 	cd ..; ./setup.py build_doc
 
-tracker_config.txt: ../roundup/configuration.py
-	# generate a current config file
+##@ build doc parts
+tracker_config.txt: ../roundup/configuration.py ## generate a current config file
+
 	python3 ../roundup/scripts/roundup_admin.py \
                genconfig _temp_config.txt
 
@@ -15,7 +17,7 @@ tracker_config.txt: ../roundup/configuration.py
 MAN_ROFF=$(wildcard ../share/man/man1/*.1)
 MAN_HTML=$(patsubst ../share/man/man1/%.1,html_extra/man_pages/%.1.html,$(MAN_ROFF))
 
-man_html: $(MAN_HTML)
+man_html: $(MAN_HTML) ## generate html versions of man pages for docs
 
 html_extra/man_pages/%.1.html: ../share/man/man1/%.1
 	man --html=cat $< > $@
@@ -27,10 +29,17 @@ html_extra/man_pages/%.1.html: ../share/man/man1/%.1
 	sed -i '/<head>/,/<\/head>/s#^<style#<link rel="canonical" href="https://www.roundup-tracker.org/docs/man_pages/$(@F)">\n<style#' $@
 	#man2html $< > $@
 
-admin_help.html: ../roundup/admin.py
-	python3 ../roundup/scripts/roundup_admin.py htmlhelp > admin_help.py
+admin_help.html: ../roundup/admin.py ## generate html version of roundup-admin help (WIP)
+	python3 ../roundup/scripts/roundup_admin.py htmlhelp > admin_help.html
+
+##@ Utilties
 
-clean:
+clean: ## clean all generated docs
 	rm -f _temp_config.txt tracker_config.txt \
 	      html_extra/man_pages/*.1.html \
 	      admin_help.py
+
+# from https://www.thapaliya.com/en/writings/well-documented-makefiles/ via
+# https://til.jakelazaroff.com/make/list-all-commands-in-a-makefile/
+help:  ## this output
+	@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n  make \033[36m<target>\033[0m\n"} /^[.a-zA-Z_-]+:.*?##/ { printf "  \033[36m%-15s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST)
diff --git a/locale/Makefile b/locale/Makefile
index e6bde3895..09cc91f39 100644
--- a/locale/Makefile
+++ b/locale/Makefile
@@ -13,56 +13,69 @@ TEMPLATE=roundup.pot
 PACKAGES=$(shell find ../roundup ../share/roundup/templates -name '*.py' \
 	 | sed -e 's,/[^/]*$$,,' | sort | uniq)
 SOURCES=$(PACKAGES:=/*.py)
+TEMPLATES=$(wildcard ../share/roundup/templates/*/html/*.html)
 PO_FILES=$(wildcard *.po)
 MO_FILES=$(PO_FILES:.po=.mo)
 RUN_PYTHON=PYTHONPATH=.. $(PYTHON) -O
 
-all: dist
-
-help:
-	@echo "$(MAKE)           - build MO files.  Run this before sdist"
-	@echo "$(MAKE) dist      - same as above"
-	@echo "$(MAKE) template  - update message template from sources"
-	@echo "$(MAKE) merge     - merge template into *.po files"
-	@echo "$(MAKE) diff      - see template differences in vi"
-	@echo "$(MAKE) potest    - check .po files for errors"
-	@echo "$(MAKE) pytest    - create locale files to run pytest"
-	@echo "$(MAKE) locale.po - update message file from template"
-	@echo "$(MAKE) locale.mo - compile individual message file"
-	@echo "$(MAKE) help      - this text"
-	@echo ""
-	@echo "Running make dist is the same as: make template merge dist"
+##@ default target
+all: dist  ## build MO files.  Run this before sdist"
 
 # This will rebuild all MO files without updating their corresponding PO
 # files first.  Run before creating Roundup distribution (hence the name).
 # PO files should be updated by their translators only, automatic update
 # adds unwanted fuzzy labels.
-dist: $(MO_FILES)
+dist: $(MO_FILES) ## same as all target
 
-template: roundup.pot
+##@ Update files
+template: roundup.pot ## extract messages from source into template
 
-pytest local_install:
-	for file in $(PO_FILES); do \
-           ${MSGFMT} -o `basename $$file .po`.mo $$file; \
-	done
-	for file in $(MO_FILES); do \
-	   lang=`basename $$file .mo`; \
-	   mkdir -p locale/$$lang/LC_MESSAGES; \
-	   cp $$file locale/$$lang/LC_MESSAGES/roundup.mo; \
-	done
+merge: $(PO_FILES) ## merge template updates into *.po files
+
+# do the template file update
+roundup.pot: $(SOURCES) $(TEMPLATES)
+	${XPOT} -n -o $(TEMPLATE) $(SOURCES) 2>&1 | sed -e "/: Unexpected in Python source: #64 \`@'/d"
+
+	${RUN_PYTHON} ../roundup/cgi/TAL/talgettext.py -u $(TEMPLATE) \
+	  ../share/roundup/templates/classic/html/*.html \
+	  ../share/roundup/templates/devel/html/*.html \
+	  ../share/roundup/templates/minimal/html/*.html \
+	  ../share/roundup/templates/responsive/html/*.html
+	VERSION="`${RUN_PYTHON} -c 'from roundup import __version__; \
+	                            print(__version__)';`"; \
+	${XGETTEXT} -j -w 80 -F \
+	  --add-comments=".Hint " \
+	  --package-name=Roundup \
+	  --package-version=$$VERSION \
+	  --msgid-bugs-address=roundup-devel@lists.sourceforge.net \
+	  --copyright-holder="See Roundup README.txt" \
+	  -o $(TEMPLATE) $(SOURCES)
 
-# helps to check template file before check in
-diff:
+## QA commands
+diff: ## see template file (roundup.pot) differences
 	hg cat roundup.pot | diff -u -I '^\#: \.\./roundup.*$$' \
 	                             -I '^#:\s*:[0-9]*.*$$' \
                                      - roundup.pot || exit 0
-merge: $(PO_FILES)
 
-potest:
+potest:  ## check .po files for errors
 	 sh -c 'for file in $(PO_FILES); do \
 	   ${MSGFMT} -cv --statistics $$file; \
 	done' 2>&1 | sort -k 2,2n
 
+
+##@ Testing
+pytest: local_install  ## create locale files to run pytest
+local_install:
+	for file in $(PO_FILES); do \
+           ${MSGFMT} -o `basename $$file .po`.mo $$file; \
+	done
+	for file in $(MO_FILES); do \
+	   lang=`basename $$file .mo`; \
+	   mkdir -p locale/$$lang/LC_MESSAGES; \
+	   cp $$file locale/$$lang/LC_MESSAGES/roundup.mo; \
+	done
+
+### template rules
 %.po: $(TEMPLATE)
 	@echo "Rebuild $@"
 	@${MSGMERGE} -U --suffix=.bak $@ $<
@@ -75,21 +88,13 @@ potest:
 %.mo: %.po
 	${MSGFMT} -o $@ $<
 
-roundup.pot: $(SOURCES) $(TEMPLATES)
-	${XPOT} -n -o $(TEMPLATE) $(SOURCES) 2>&1 | sed -e "/: Unexpected in Python source: #64 \`@'/d"
-
-	${RUN_PYTHON} ../roundup/cgi/TAL/talgettext.py -u $(TEMPLATE) \
-	  ../share/roundup/templates/classic/html/*.html \
-	  ../share/roundup/templates/devel/html/*.html \
-	  ../share/roundup/templates/minimal/html/*.html \
-	  ../share/roundup/templates/responsive/html/*.html
-	VERSION="`${RUN_PYTHON} -c 'from roundup import __version__; \
-	                            print(__version__)';`"; \
-	${XGETTEXT} -j -w 80 -F \
-	  --add-comments=".Hint " \
-	  --package-name=Roundup \
-	  --package-version=$$VERSION \
-	  --msgid-bugs-address=roundup-devel@lists.sourceforge.net \
-	  --copyright-holder="See Roundup README.txt" \
-	  -o $(TEMPLATE) $(SOURCES)
+# from https://www.thapaliya.com/en/writings/well-documented-makefiles/ via
+# https://til.jakelazaroff.com/make/list-all-commands-in-a-makefile/
+help:   ## this text
+	@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n  make \033[36m<target>\033[0m\n"} /^[.a-zA-Z_-]+:.*?##/ { printf "  \033[36m%-15s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST)
 
+	@echo ""
+	@printf "  \033[36m%-15s\033[0m %s\n" "<locale>.po" "update message file from template"
+	@printf "  \033[36m%-15s\033[0m %s\n" "<locale>.mo" "compile individual message file"
+	@echo ""
+	@echo "Running 'make' is the same as: make template merge dist"
diff --git a/website/www/Makefile b/website/www/Makefile
index f52f0ad3e..5d7eb71fc 100644
--- a/website/www/Makefile
+++ b/website/www/Makefile
@@ -3,35 +3,23 @@ HTML := html
 
 .PHONY: help clean html linkcheck
 
+# from https://www.thapaliya.com/en/writings/well-documented-makefiles/ via
+# https://til.jakelazaroff.com/make/list-all-commands-in-a-makefile/
 help:
-	@echo "Please use \`make <target>' where <target> is one of"
-	@echo "  html      to make standalone HTML files"
-	@echo "  linkcheck to check all external links for integrity"
-	@echo "  sourceforge_prod_sync sync html directory to sourceforce"
-	@echo "      production website"
-	@echo "  sourceforge_dev_sync sync html directory to sourceforce"
-	@echo "      /dev_docs subdirectory"
-	@echo "  sourceforge_home_sync sync html directory to"
-        @echo "      sourceforge:~/roundup_docs"
-	@echo "  clean remove all produced files"
-clean:
-	-rm -rf $(TMP) $(HTML) docs COPYING.txt templates.zip
-
-docs:
-	ln -s ../../doc ./docs
-	ln -s ../../COPYING.txt
+	@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n  make \033[36m<target>\033[0m\n"} /^[.a-zA-Z_-]+:.*?##/ { printf "  \033[36m%-15s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST)
 
+##@ Main Command
 # after upgrade to sphinx 1.8.5, search.html is missing load of searchtools.
 # fix that in postprocess
 # also sed index.html to properly format meta og:... entries.
-html: docs
+html: doc_links  ## make standalone HTML files
 	rm -rf html
 	mkdir -p $(TMP)/doctrees $(HTML)
 	sphinx-build -n -W -b html -d $(TMP)/doctrees . $(HTML)
-	# install searchtools.js into search page.
+        # install searchtools.js into search page.
 	grep 'searchtools.js' html/search.html || sed -i -e '/language_data.js/s#</script>#</script>\n    <script type="text/javascript" src="_static/searchtools.js"></script>#' html/search.html
-	# sphinx inserts \: for : in meta tags. Get rid of the \ in
-	# opengraph tags
+        # sphinx inserts \: for : in meta tags. Get rid of the \ in
+        # opengraph tags
 	sed -i -e '/<meta/s/og\\:/og:/' \
              -e '/<meta/s/name="og:/property="og:/' html/index.html
 	cp robots.txt html/robots.txt
@@ -44,25 +32,32 @@ html: docs
 	if [ -e templates.zip ]; then cp templates.zip \
                                    html/CVE-2024-39124-templates.zip; fi
 
-linkcheck:
+##@ Utilities
+clean: ## remove all produced files
+	-rm -rf $(TMP) $(HTML) docs COPYING.txt templates.zip
+
+linkcheck: ## check external links for existence
 	mkdir -p $(TMP)/linkcheck $(TMP)/doctrees
 	sphinx-build -b linkcheck -d $(TMP)/doctrees . $(TMP)/linkcheck
 	@echo
 	@echo "Link check complete; look for any errors in the above output " \
 	      "or in .build/linkcheck/output.txt."
 
-templates.zip:
+# use to distribute template changes (e.g. for security issues)
+# separate from releases
+templates.zip:  ## package share/roundup/templates into zip file
 	rm -f templates.zip
 	(cd ../../share/roundup; hg status -A templates | \
            sed -ne '/^[AMC]/s/^..//p' | sort | zip -@ - ) > templates.zip
 
-sourceforge_dev_sync:
+##@ Sync/Distribution commands
+sourceforge_dev_sync:  ## sync html directory to sourceforce /dev_docs subdir
         # --no-times makes _images/* and other files sync over every time
         # so docs_backup-... is complete with all files and can be served
         # as the docs tree. Without --no-times _static, _images and other
         # directories are missing from the backup directory.
-	# Exclude docs_backup so it won't be deleted from sourceforge
-	# since:
+        # Exclude docs_backup so it won't be deleted from sourceforge
+        # since:
         #   --delete-exclude
         # IS NOT (and must not be) SET
 	read -p "sync to dev_docs y/N? " resp; echo "$$resp" | grep -i "^y"
@@ -71,16 +66,26 @@ sourceforge_dev_sync:
               html/. \
               web.sourceforge.net:/home/project-web/roundup/htdocs/dev_docs/.
 
-sourceforge_prod_sync:
+sourceforge_prod_sync: ## sync html directory to sourceforce production website
 	read -p "sync to production y/N? " resp; echo "$$resp" | grep -i "^y"
 	rsync -av --no-times --delete --exclude 'docs_backup*' \
               --backup --backup-dir docs_backup-`date --iso-8601=seconds` \
               html/. \
               web.sourceforge.net:/home/project-web/roundup/htdocs/.
 
-sourceforge_home_sync:
+sourceforge_home_sync:  ## sync html directory to sourceforge:~/roundup_docs
+
 	read -p "sync to home y/N? " resp; echo "$$resp" | grep -i "^y"
 	rsync -av --no-times --delete --exclude 'docs_backup*' \
               --backup --backup-dir docs_backup-`date --iso-8601=seconds` \
               html/. \
               web.sourceforge.net:roundup_docs/.
+
+##@ Setup
+doc_links: docs COPYING.txt ## recreate links to docs not in this tree
+
+docs:
+	ln -s ../../doc ./docs
+
+COPYING.txt:
+	ln -s ../../COPYING.txt COPYING.txt

From 5c1532b0ab4dfdead5eb060dee607ab085750bc5 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 12 Jan 2025 19:49:31 -0500
Subject: [PATCH 133/398] fix: correct strings with multiple %s that can't be
 translated

Changed to use %(name)s for each element. make in the locale directory
is no longer grousing.
---
 roundup/rest.py | 44 +++++++++++++++++++++++++-------------------
 1 file changed, 25 insertions(+), 19 deletions(-)

diff --git a/roundup/rest.py b/roundup/rest.py
index 39d324c1f..2fd493f3d 100644
--- a/roundup/rest.py
+++ b/roundup/rest.py
@@ -2277,15 +2277,17 @@ def determine_output_format(self, uri):
         if ext_type and (len(ext_type) < MAX_MIME_EXTENSION_LENGTH):
             if ext_type not in list(self.__accepted_content_type.values()):
                 self.client.response_code = 406
-                return (None, uri,
-                        self.error_obj(
-                            406,
-                            _("Content type '%s' requested in URL is "
-                             "not available.\nAcceptable types: %s\n") %
-                            (ext_type,
-                             ", ".join(sorted(
-                                 set(self.__accepted_content_type.values()))))))
-
+                return (
+                    None, uri,
+                    self.error_obj(
+                        406,
+                        _("Content type '%(requested)s' requested in URL is"
+                          "not available.\nAcceptable types: "
+                          "%(acceptable)s\n") %
+                        { "requested": ext_type,
+                          "acceptable": ", ".join(sorted(
+                              set(self.__accepted_content_type.values())))}))
+            
             # strip extension so uri makes sense.
             # E.G. .../issue.json -> .../issue
             uri = uri[:-(len(ext_type) + 1)]
@@ -2408,20 +2410,24 @@ def determine_output_format(self, uri):
             return (None, uri,
                     self.error_obj(
                         406,
-                        _("Requested content type(s) '%s' not available.\n"
-                          "Acceptable mime types are: */*, %s") %
-                        (self.client.request.headers.get('Accept'),
-                         ", ".join(sorted(
-                             valid_binary_content_types)))))
+                        _("Requested content type(s) '%(requested)s' not "
+                          "available.\nAcceptable mime types are: */*, "
+                          "%(acceptable)s") %
+                        {"requested":
+                         self.client.request.headers.get('Accept'),
+                         "acceptable": ", ".join(sorted(
+                             valid_binary_content_types))}))
 
         return (None, uri,
                 self.error_obj(
                     406,
-                    _("Requested content type(s) '%s' not available.\n"
-                      "Acceptable mime types are: */*, %s") %
-                    (self.client.request.headers.get('Accept'),
-                     ", ".join(sorted(
-                         self.__accepted_content_type.keys())))))
+                    _("Requested content type(s) '%(requested)s' not "
+                      "available.\nAcceptable mime types are: */*, "
+                      "%(acceptable)s") %
+                    {"requested":
+                     self.client.request.headers.get('Accept'),
+                     "acceptable": ", ".join(sorted(
+                         self.__accepted_content_type.keys()))}))
 
     def dispatch(self, method, uri, input_payload):
         """format and process the request"""

From 593606af03a3d78c96fbfbe1c4628137ecbaa6cd Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 12 Jan 2025 19:50:31 -0500
Subject: [PATCH 134/398] doc: update roundup-server.1.html

get newest changes.
---
 .../man_pages/roundup-server.1.html           | 39 ++++++++++++++++++-
 1 file changed, 38 insertions(+), 1 deletion(-)

diff --git a/doc/html_extra/man_pages/roundup-server.1.html b/doc/html_extra/man_pages/roundup-server.1.html
index 005db9a5a..f0468f2c1 100644
--- a/doc/html_extra/man_pages/roundup-server.1.html
+++ b/doc/html_extra/man_pages/roundup-server.1.html
@@ -1,5 +1,5 @@
 <!-- Creator     : groff version 1.22.4 -->
-<!-- CreationDate: Thu Oct 17 23:16:02 2024 -->
+<!-- CreationDate: Sun Jan 12 22:28:09 2025 -->
 <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
 "http://www.w3.org/TR/html4/loose.dtd">
 <html>
@@ -78,6 +78,21 @@ <h2>OPTIONS
 indicated by PIDfile. The -l (or -L) option <b>must</b> be
 specified if -d is used.</p>
 
+<table width="100%" border="0" rules="none" frame="void"
+       cellspacing="0" cellpadding="0">
+<tr valign="top" align="left">
+<td width="11%"></td>
+<td width="3%">
+
+
+<p><b>-D</b></p></td>
+<td width="8%"></td>
+<td width="78%">
+
+
+<p>Run the server in the foreground even if -d is used.</p></td></tr>
+</table>
+
 <p style="margin-left:11%;"><b>-t
 fork|thread|debug|none</b></p>
 
@@ -106,6 +121,28 @@ <h2>OPTIONS
 <td width="3%">
 
 
+<p><b>-P</b></p></td>
+<td width="8%"></td>
+<td width="78%">
+
+
+<p>If a reverse proxy is used in front of the
+roundup-server, the server will log the ip address of the
+proxy, not the client browser. Using -P logs the left most
+entry in the X-Forwarded-For http header as the IP address
+of the client. This address will be logged or resolved to a
+hostname (with <b>-N</b>) and a &rsquo;+&rsquo; character
+will be appended. <b>-P</b> should only be used when the
+roundup server is accessible only from trusted proxy hosts.
+See:
+https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For
+for details and warnings about using the X-Forwarded-For
+header.</p> </td></tr>
+<tr valign="top" align="left">
+<td width="11%"></td>
+<td width="3%">
+
+
 <p><b>-L</b></p></td>
 <td width="8%"></td>
 <td width="78%">

From 34597500ab836f4b06de1ff9d12dceada71ecc7a Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 12 Jan 2025 20:13:36 -0500
Subject: [PATCH 135/398] doc: update tracker_config.txt

Every generation of tracker_config.txt also changes the secret_key
value. To prevent this from showing up in diffs, modify
format_config.awk to use a static value for the secret_key and
substitute it into the config file.

Also update Makefile so tracker_config.txt depends on
format_config.awk.
---
 doc/Makefile           |  2 +-
 doc/format_config.awk  |  7 +++++++
 doc/tracker_config.txt | 35 +++++++++++++++++++++++++----------
 3 files changed, 33 insertions(+), 11 deletions(-)

diff --git a/doc/Makefile b/doc/Makefile
index 3c2345391..c9db7af88 100644
--- a/doc/Makefile
+++ b/doc/Makefile
@@ -3,7 +3,7 @@ all:  man_html tracker_config.txt admin_help.html ## make all docs under share
 	cd ..; ./setup.py build_doc
 
 ##@ build doc parts
-tracker_config.txt: ../roundup/configuration.py ## generate a current config file
+tracker_config.txt: ../roundup/configuration.py format_config.awk ## generate a current config file
 
 	python3 ../roundup/scripts/roundup_admin.py \
                genconfig _temp_config.txt
diff --git a/doc/format_config.awk b/doc/format_config.awk
index 932965c72..866ac2254 100644
--- a/doc/format_config.awk
+++ b/doc/format_config.awk
@@ -1,8 +1,14 @@
 #! /bin/awk
+BEGIN {SECRET_KEY = "DWmbKgVUy6fF5D2Y5TD5Az+dnHhMYKCCpJzIY3H8nsU="}
 
 # delete first 8 lines
 NR < 9 {next}
 
+# To prevent new file generation from causing the secret_key to
+# change, we replace the secret key with a fixed value.
+/^# Default: [0-9A-z+=]{44}/ {sub(/[0-9A-z+=]{44}/, SECRET_KEY)}
+/^secret_key = [0-9A-z+=]{44}/ {sub(/[0-9A-z+=]{44}/, SECRET_KEY)}
+
 # When we see a section [label]:
 #  emit section index marker,
 #  emit section anchor
@@ -43,3 +49,4 @@ NR < 9 {next}
 /^$/ { if (! prev_line_is_blank) {accumulate = accumulate $0};
        prev_line_is_blank = 1;
      }
+
diff --git a/doc/tracker_config.txt b/doc/tracker_config.txt
index f9b49a47b..994a91074 100644
--- a/doc/tracker_config.txt
+++ b/doc/tracker_config.txt
@@ -166,8 +166,9 @@
   csv_field_size = 131072
 
   # Sets the default number of rounds used when encoding passwords
-  # using the PBKDF2 scheme. Set this to a higher value on faster
-  # systems which want more security.
+  # using any PBKDF2 scheme. Set this to a higher value on faster
+  # systems which want more security. Use a minimum of 250000
+  # for PBKDF2-SHA512 which is the default hash in Roundup 2.5.
   # PBKDF2 (Password-Based Key Derivation Function) is a
   # password hashing mechanism that derives hash from the
   # password and a random salt. For authentication this process
@@ -180,8 +181,8 @@
   # become faster. The currently enforced minimum number of
   # rounds is 1000.
   # See: http://en.wikipedia.org/wiki/PBKDF2 and RFC2898
-  # Default: 2000000
-  password_pbkdf2_default_rounds = 2000000
+  # Default: 250000
+  password_pbkdf2_default_rounds = 250000
 
 .. index:: config.ini; sections tracker
 .. _`config-ini-section-tracker`:
@@ -460,7 +461,7 @@
   #     the user if the header is missing or invalid.
   # Set this to 'yes' to block the post and notify the user
   #     if the header is invalid, but accept the form if
-  #     the field is missing.
+  #     the header is missing.
   # Set this to 'logfailure' to log a notice to the roundup
   #     log if the header is invalid or missing, but accept
   #     the post.
@@ -475,7 +476,7 @@
   #     the user if the header is missing or invalid.
   # Set this to 'yes' to block the post and notify the user
   #     if the header is invalid, but accept the form if
-  #     the field is missing.
+  #     the header is missing.
   # Set this to 'logfailure' to log a notice to the roundup
   #     log if the header is invalid or missing, but accept
   #     the post.
@@ -513,7 +514,7 @@
   #     the user if the header is missing or invalid.
   # Set this to 'yes' to block the post and notify the user
   #     if the header is invalid, but accept the form if
-  #     the field is missing.
+  #     the header is missing.
   # Set this to 'logfailure' to log a notice to the roundup
   #     log if the header is invalid or missing, but accept
   #     the post.
@@ -529,7 +530,7 @@
   #     the user if the header is missing or invalid.
   # Set this to 'yes' to block the post and notify the user
   #     if the header is invalid, but accept the form if
-  #     the field is missing.
+  #     the header is missing.
   # Set this to 'logfailure' to log a notice to the roundup
   #     log if the header is invalid or missing, but accept
   #     the post.
@@ -628,8 +629,8 @@
 .. code:: ini
 
   
-  # Settings in this section (except for backend) are used
-  #  by RDBMS backends only.
+  # Most settings in this section (except for backend and debug_filter)
+  # are used by RDBMS backends only.
 
   [rdbms]
 
@@ -638,6 +639,20 @@
   # Default: NO DEFAULT
   #backend = NO DEFAULT
 
+  # Filter debugging: Permissions can define additional filter
+  # functions that are used when checking permissions on results
+  # returned by the database. This is done to improve
+  # performance since the filtering is done in the database
+  # backend, not in python (at least for the SQL backends). The
+  # user is responsible for making the filter return the same
+  # set of results as the check function for a permission. So it
+  # makes sense to aid in debugging (and performance
+  # measurements) to allow turning off the usage of filter
+  # functions using only the check functions.
+  # Allowed values: yes, no
+  # Default: no
+  debug_filter = no
+
   # Name of the database to use. For Postgresql, this can
   # be database.schema to use a specific schema within
   # a Postgres database.

From 173e536ef1a98275e39d83c0e33286111b7d357d Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 12 Jan 2025 20:17:39 -0500
Subject: [PATCH 136/398] fix: missing space in translated message.

---
 roundup/rest.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roundup/rest.py b/roundup/rest.py
index 2fd493f3d..36e8f3270 100644
--- a/roundup/rest.py
+++ b/roundup/rest.py
@@ -2281,7 +2281,7 @@ def determine_output_format(self, uri):
                     None, uri,
                     self.error_obj(
                         406,
-                        _("Content type '%(requested)s' requested in URL is"
+                        _("Content type '%(requested)s' requested in URL is "
                           "not available.\nAcceptable types: "
                           "%(acceptable)s\n") %
                         { "requested": ext_type,

From d92f76610da1b281a6dad8142bb3db3c8a858c6e Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 12 Jan 2025 20:21:57 -0500
Subject: [PATCH 137/398] fix(locale): update translation files

---
 locale/de.po       | 133 +++++++++++++++++++++++----------------------
 locale/en.po       | 131 ++++++++++++++++++++++----------------------
 locale/es.po       | 133 +++++++++++++++++++++++----------------------
 locale/fr.po       | 133 +++++++++++++++++++++++----------------------
 locale/hu.po       | 133 +++++++++++++++++++++++----------------------
 locale/it.po       | 133 +++++++++++++++++++++++----------------------
 locale/ja.po       | 133 +++++++++++++++++++++++----------------------
 locale/lt.po       | 133 +++++++++++++++++++++++----------------------
 locale/nb.po       | 133 +++++++++++++++++++++++----------------------
 locale/roundup.pot | 131 ++++++++++++++++++++++----------------------
 locale/ru.po       | 133 +++++++++++++++++++++++----------------------
 locale/zh_CN.po    | 133 +++++++++++++++++++++++----------------------
 locale/zh_TW.po    | 133 +++++++++++++++++++++++----------------------
 13 files changed, 869 insertions(+), 856 deletions(-)

diff --git a/locale/de.po b/locale/de.po
index f86e1023b..634d5ef13 100644
--- a/locale/de.po
+++ b/locale/de.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Roundup 2.5.0\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
-"POT-Creation-Date: 2024-12-30 22:49-0500\n"
+"POT-Creation-Date: 2025-01-12 20:17-0500\n"
 "PO-Revision-Date: 2016-04-11 09:13+0200\n"
 "Last-Translator: Tobias Herp <tobias.herp@gmx.de>\n"
 "Language-Team: German Translators <roundup-devel@lists.sourceforge.net>\n"
@@ -2117,154 +2117,155 @@ msgstr ""
 "Admistratoren wurden benachrichtigt.</p>\n"
 "</body></html>"
 
-#: ../roundup/cgi/client.py:666
+#: ../roundup/cgi/client.py:679
 msgid ""
 "XMLRPC endpoint is not using defusedxml. Improve security by installing "
 "defusedxml."
 msgstr ""
 
-#: ../roundup/cgi/client.py:728 ../roundup/cgi/client.py:1646
-#: ../roundup/cgi/client.py:728:1646
-msgid "Required Header Missing"
-msgstr ""
-
-#: ../roundup/cgi/client.py:731
+#: ../roundup/cgi/client.py:749 ../roundup/cgi/client.py:771
+#: ../roundup/cgi/client.py:749:771
 #, fuzzy
 msgid "Client is not allowed to use Rest Interface."
 msgstr "Gast-Benutzer sind nicht berechtigt, das Web-Interface zu benutzen."
 
-#: ../roundup/cgi/client.py:985
+#: ../roundup/cgi/client.py:768 ../roundup/cgi/client.py:1682
+#: ../roundup/cgi/client.py:768:1682
+msgid "Required Header Missing"
+msgstr ""
+
+#: ../roundup/cgi/client.py:1021
 msgid "Form Error: "
 msgstr "Formular-Fehler: "
 
-#: ../roundup/cgi/client.py:1078
+#: ../roundup/cgi/client.py:1114
 #, python-format
 msgid "Unrecognized charset: %r"
 msgstr "Zeichensatz nicht erkannt: %r"
 
-#: ../roundup/cgi/client.py:1345 ../roundup/cgi/client.py:2357
-#: ../roundup/cgi/client.py:1345:2357
+#: ../roundup/cgi/client.py:1381 ../roundup/cgi/client.py:2394
+#: ../roundup/cgi/client.py:1381:2394
 msgid "broken form: multiple @action values submitted"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1362
+#: ../roundup/cgi/client.py:1398
 msgid "Anonymous users are not allowed to use the web interface"
 msgstr "Gast-Benutzer sind nicht berechtigt, das Web-Interface zu benutzen."
 
-#: ../roundup/cgi/client.py:1507
+#: ../roundup/cgi/client.py:1543
 msgid "Referer header not available."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1511
+#: ../roundup/cgi/client.py:1547
 #, python-format
 msgid "csrf key used with wrong method from: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1540
+#: ../roundup/cgi/client.py:1576
 #, python-format
 msgid "csrf header %(header)s required but missing for user%(userid)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1544
+#: ../roundup/cgi/client.py:1580
 #, python-format
 msgid "Missing header: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1552
+#: ../roundup/cgi/client.py:1588
 #, python-format
 msgid "csrf Referer header check failed for user%(userid)s. Value=%(referer)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1557
+#: ../roundup/cgi/client.py:1593
 #, fuzzy, python-format
 msgid "Invalid Referer: %s"
 msgstr "UngÃ¼ltiger Benutzername %s"
 
-#: ../roundup/cgi/client.py:1572
+#: ../roundup/cgi/client.py:1608
 #, python-format
 msgid "csrf Origin header check failed for user%(userid)s. Value=%(origin)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1577
+#: ../roundup/cgi/client.py:1613
 #, fuzzy, python-format
 msgid "Invalid Origin %s"
 msgstr "UngÃ¼ltiger Benutzername %s"
 
-#: ../roundup/cgi/client.py:1591
+#: ../roundup/cgi/client.py:1627
 #, python-format
 msgid ""
 "csrf X-FORWARDED-HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1597
+#: ../roundup/cgi/client.py:1633
 #, python-format
 msgid "Invalid X-FORWARDED-HOST %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1616
+#: ../roundup/cgi/client.py:1652
 #, python-format
 msgid "csrf HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1621
+#: ../roundup/cgi/client.py:1657
 #, fuzzy, python-format
 msgid "Invalid HOST %s"
 msgstr "UngÃ¼ltige Anforderung %s"
 
-#: ../roundup/cgi/client.py:1629
+#: ../roundup/cgi/client.py:1665
 msgid "Csrf: unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1630
+#: ../roundup/cgi/client.py:1666
 msgid "Unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1643
+#: ../roundup/cgi/client.py:1679
 #, python-format
 msgid "csrf X-REQUESTED-WITH xmlrpc required header check failed for user%s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1684
+#: ../roundup/cgi/client.py:1720
 #, python-format
 msgid "Required csrf field missing for user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1686 ../roundup/cgi/client.py:1713
-#: ../roundup/cgi/client.py:1730 ../roundup/cgi/client.py:1686:1713:1730
+#: ../roundup/cgi/client.py:1722 ../roundup/cgi/client.py:1749
+#: ../roundup/cgi/client.py:1766 ../roundup/cgi/client.py:1722:1749:1766
 msgid ""
 "We can't validate your session (csrf failure). Re-enter any unsaved data and "
 "try again."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1690
+#: ../roundup/cgi/client.py:1726
 #, python-format
 msgid "csrf field not supplied by user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1702
+#: ../roundup/cgi/client.py:1738
 #, python-format
 msgid ""
 "Csrf mismatch user: current user %(user)s != stored user %(stored)s, current "
 "session, stored session: %(cur_sess)s,%(stor_sess)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1720
+#: ../roundup/cgi/client.py:1756
 #, python-format
 msgid ""
 "Csrf mismatch user: current session %(curr_sess)s != stored session "
 "%(stor_sess)s, current user/stored user is: %(user)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1912
+#: ../roundup/cgi/client.py:1948
 msgid "You are not allowed to view this file."
 msgstr "Sie sind nicht berechtigt, diese Seite anzuzeigen."
 
-#: ../roundup/cgi/client.py:2235
+#: ../roundup/cgi/client.py:2272
 #, python-format
 msgid "%(starttag)sTime elapsed: %(seconds)fs%(endtag)s\n"
 msgstr "%(starttag)sBenÃ¶tigte Zeit: %(seconds)fs%(endtag)s\n"
 
-#: ../roundup/cgi/client.py:2239
+#: ../roundup/cgi/client.py:2276
 #, python-format
 msgid ""
 "%(starttag)sCache hits: %(cache_hits)d, misses %(cache_misses)d. Loading "
@@ -2273,7 +2274,7 @@ msgstr ""
 "%(starttag)sCache benutzt: %(cache_hits)d, verfehlt: %(cache_misses)d. "
 "EintrÃ¤ge laden: %(get_items)fs; filtern: %(filtering)fs.%(endtag)s\n"
 
-#: ../roundup/cgi/client.py:2778
+#: ../roundup/cgi/client.py:2815
 #, python-format
 msgid ""
 "Cache failure: compressed file %(compressed)s is older than its source file "
@@ -3124,35 +3125,35 @@ msgstr "UngÃ¼ltiger Benutzername %s"
 msgid "Api rate limits exceeded. Please wait: %s seconds."
 msgstr ""
 
-#: ../roundup/rest.py:2283
+#: ../roundup/rest.py:2284
 #, python-format
 msgid ""
-"Content type '%s' requested in URL is not available.\n"
-"Acceptable types: %s\n"
+"Content type '%(requested)s' requested in URL is not available.\n"
+"Acceptable types: %(acceptable)s\n"
 msgstr ""
 
-#: ../roundup/rest.py:2304
+#: ../roundup/rest.py:2306
 #, python-format
 msgid ""
 "Unable to parse Accept Header. %(error)s. Acceptable types: */*, "
 "%(acceptable_types)s"
 msgstr ""
 
-#: ../roundup/rest.py:2376 ../roundup/rest.py:2597 ../roundup/rest.py:2376:2597
+#: ../roundup/rest.py:2378 ../roundup/rest.py:2603 ../roundup/rest.py:2378:2603
 #, python-format
 msgid ""
 "Unrecognized api version: %s. See /rest without specifying api version for "
 "supported versions."
 msgstr ""
 
-#: ../roundup/rest.py:2411 ../roundup/rest.py:2420 ../roundup/rest.py:2411:2420
+#: ../roundup/rest.py:2413 ../roundup/rest.py:2424 ../roundup/rest.py:2413:2424
 #, python-format
 msgid ""
-"Requested content type(s) '%s' not available.\n"
-"Acceptable mime types are: */*, %s"
+"Requested content type(s) '%(requested)s' not available.\n"
+"Acceptable mime types are: */*, %(acceptable)s"
 msgstr ""
 
-#: ../roundup/rest.py:2696
+#: ../roundup/rest.py:2702
 msgid ""
 "Internal error while formatting response.\n"
 "accept_mime_type is not defined. This should\n"
@@ -3347,7 +3348,7 @@ msgid ""
 "  '-----END CERTIFICATE-----' markers?"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:345
+#: ../roundup/scripts/roundup_server.py:354
 msgid ""
 "<html><head><title>Roundup trackers index</title></head>\n"
 "<body><h1>Roundup trackers index</h1><ol>\n"
@@ -3355,63 +3356,63 @@ msgstr ""
 "<html><head><title>Roundup Tracker-Liste</title></head>\n"
 "<body><h1>Roundup Tracker-Liste</h1><ol>\n"
 
-#: ../roundup/scripts/roundup_server.py:587
+#: ../roundup/scripts/roundup_server.py:598
 #, fuzzy, python-format
 msgid "Error: %(type)s: %(value)s"
 msgstr "%(type)s: %(value)s"
 
-#: ../roundup/scripts/roundup_server.py:599
+#: ../roundup/scripts/roundup_server.py:610
 msgid "WARNING: ignoring \"-g\" argument, not root"
 msgstr ""
 "WARNUNG: die Option \"-g\" wird ignoriert, da Sie nicht Administrator sind"
 
-#: ../roundup/scripts/roundup_server.py:605
+#: ../roundup/scripts/roundup_server.py:616
 msgid "Can't change groups - no grp module"
 msgstr "Die Gruppe kann nicht gewechselt werden - das Modul grp fehlt"
 
-#: ../roundup/scripts/roundup_server.py:614
+#: ../roundup/scripts/roundup_server.py:625
 #, python-format
 msgid "Group %(group)s doesn't exist"
 msgstr "Die Gruppe %(group)s existiert nicht"
 
-#: ../roundup/scripts/roundup_server.py:626
+#: ../roundup/scripts/roundup_server.py:637
 msgid "Can't run as root!"
 msgstr ""
 "Dieser Prozess kann nicht unter dem Administrator-Konto (\"root\") laufen!"
 
-#: ../roundup/scripts/roundup_server.py:629
+#: ../roundup/scripts/roundup_server.py:640
 msgid "WARNING: ignoring \"-u\" argument, not root"
 msgstr ""
 "WARNUNG: die Option \"-u\" wird ignoriert, da Sie nicht Administrator sind"
 
-#: ../roundup/scripts/roundup_server.py:635
+#: ../roundup/scripts/roundup_server.py:646
 msgid "Can't change users - no pwd module"
 msgstr "Der Benutzer kann nicht gewechselt werden - das Modul pwd fehlt"
 
-#: ../roundup/scripts/roundup_server.py:644
+#: ../roundup/scripts/roundup_server.py:655
 #, python-format
 msgid "User %(user)s doesn't exist"
 msgstr "Der Benutzer %(user)s existiert nicht"
 
-#: ../roundup/scripts/roundup_server.py:856
+#: ../roundup/scripts/roundup_server.py:867
 #, python-format
 msgid "Multiprocess mode \"%s\" is not available, switching to single-process"
 msgstr ""
 "Der Multiprozessmodus \"%s\" ist nicht verfÃ¼gbar, Einprozessmodus aktiviert"
 
-#: ../roundup/scripts/roundup_server.py:884
+#: ../roundup/scripts/roundup_server.py:895
 #, python-format
 msgid "Unable to bind to port %s, port already in use."
 msgstr "Start des Servers auf Port %s schlug fehl. Port bereits verwendet."
 
-#: ../roundup/scripts/roundup_server.py:888
+#: ../roundup/scripts/roundup_server.py:899
 #, fuzzy, python-format
 msgid ""
 "Unable to bind to port %(port)s, access not allowed, errno: %(errno)s %(msg)s"
 msgstr ""
 "Start des Servers auf Port %(port)s schlug fehl. Port bereits verwendet."
 
-#: ../roundup/scripts/roundup_server.py:967
+#: ../roundup/scripts/roundup_server.py:978
 msgid ""
 " -c <Command>  Windows Service options.\n"
 "               If you want to run the server as a Windows Service, you\n"
@@ -3427,7 +3428,7 @@ msgstr ""
 "               Zudem mÃ¼ssen Sie die Logfile-Option aktivieren.\n"
 "               \"roundup-server -c help\" zeigt eine weitere Hilfe zum Thema."
 
-#: ../roundup/scripts/roundup_server.py:974
+#: ../roundup/scripts/roundup_server.py:985
 #, fuzzy
 msgid ""
 " -u <UID>      runs the Roundup web server as this UID\n"
@@ -3443,7 +3444,7 @@ msgstr ""
 "               die Prozess-ID in die Datei PIDDatei.\n"
 "               Die Option -l muss dann auch angegeben werden."
 
-#: ../roundup/scripts/roundup_server.py:982
+#: ../roundup/scripts/roundup_server.py:993
 #, fuzzy, python-format
 msgid ""
 "\n"
@@ -3569,21 +3570,21 @@ msgstr ""
 "   URLs Probleme bereiten kÃ¶nnten. Am besten verwenden Sie nur Buchstaben, \n"
 "   Zahlen und \"-_\".\n"
 
-#: ../roundup/scripts/roundup_server.py:1162
+#: ../roundup/scripts/roundup_server.py:1173
 msgid "Instances must be name=home"
 msgstr "Instanzen mÃ¼ssen als Tracker-Name=Tracker-Verzeichnis angegeben werden"
 
-#: ../roundup/scripts/roundup_server.py:1176
+#: ../roundup/scripts/roundup_server.py:1187
 #, python-format
 msgid "Configuration saved to %s"
 msgstr "Konfiguration in der Datei %s gespeichert"
 
-#: ../roundup/scripts/roundup_server.py:1194
+#: ../roundup/scripts/roundup_server.py:1205
 msgid "Sorry, you can't run the server as a daemon on this Operating System"
 msgstr ""
 "Auf diesem Betriebssystem kann der Server nicht als Hintergrundprozess laufen"
 
-#: ../roundup/scripts/roundup_server.py:1214
+#: ../roundup/scripts/roundup_server.py:1225
 #, python-format
 msgid "Roundup server started on %(HOST)s:%(PORT)s"
 msgstr "Der Roundup-Server wurde unter %(HOST)s:%(PORT)s gestartet"
diff --git a/locale/en.po b/locale/en.po
index d8543b461..bcaa0c3ac 100644
--- a/locale/en.po
+++ b/locale/en.po
@@ -11,7 +11,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Roundup 2.5.0\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
-"POT-Creation-Date: 2024-12-30 22:49-0500\n"
+"POT-Creation-Date: 2025-01-12 20:17-0500\n"
 "PO-Revision-Date: 2004-11-20 13:47+0200\n"
 "Last-Translator: Not applicable\n"
 "Language-Team: English\n"
@@ -1658,160 +1658,161 @@ msgid ""
 "</body></html>"
 msgstr ""
 
-#: ../roundup/cgi/client.py:666
+#: ../roundup/cgi/client.py:679
 msgid ""
 "XMLRPC endpoint is not using defusedxml. Improve security by installing "
 "defusedxml."
 msgstr ""
 
-#: ../roundup/cgi/client.py:728 ../roundup/cgi/client.py:1646
-#: ../roundup/cgi/client.py:728:1646
-msgid "Required Header Missing"
+#: ../roundup/cgi/client.py:749 ../roundup/cgi/client.py:771
+#: ../roundup/cgi/client.py:749:771
+msgid "Client is not allowed to use Rest Interface."
 msgstr ""
 
-#: ../roundup/cgi/client.py:731
-msgid "Client is not allowed to use Rest Interface."
+#: ../roundup/cgi/client.py:768 ../roundup/cgi/client.py:1682
+#: ../roundup/cgi/client.py:768:1682
+msgid "Required Header Missing"
 msgstr ""
 
-#: ../roundup/cgi/client.py:985
+#: ../roundup/cgi/client.py:1021
 msgid "Form Error: "
 msgstr ""
 
-#: ../roundup/cgi/client.py:1078
+#: ../roundup/cgi/client.py:1114
 #, python-format
 msgid "Unrecognized charset: %r"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1345 ../roundup/cgi/client.py:2357
-#: ../roundup/cgi/client.py:1345:2357
+#: ../roundup/cgi/client.py:1381 ../roundup/cgi/client.py:2394
+#: ../roundup/cgi/client.py:1381:2394
 msgid "broken form: multiple @action values submitted"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1362
+#: ../roundup/cgi/client.py:1398
 msgid "Anonymous users are not allowed to use the web interface"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1507
+#: ../roundup/cgi/client.py:1543
 msgid "Referer header not available."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1511
+#: ../roundup/cgi/client.py:1547
 #, python-format
 msgid "csrf key used with wrong method from: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1540
+#: ../roundup/cgi/client.py:1576
 #, python-format
 msgid "csrf header %(header)s required but missing for user%(userid)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1544
+#: ../roundup/cgi/client.py:1580
 #, python-format
 msgid "Missing header: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1552
+#: ../roundup/cgi/client.py:1588
 #, python-format
 msgid "csrf Referer header check failed for user%(userid)s. Value=%(referer)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1557
+#: ../roundup/cgi/client.py:1593
 #, python-format
 msgid "Invalid Referer: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1572
+#: ../roundup/cgi/client.py:1608
 #, python-format
 msgid "csrf Origin header check failed for user%(userid)s. Value=%(origin)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1577
+#: ../roundup/cgi/client.py:1613
 #, python-format
 msgid "Invalid Origin %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1591
+#: ../roundup/cgi/client.py:1627
 #, python-format
 msgid ""
 "csrf X-FORWARDED-HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1597
+#: ../roundup/cgi/client.py:1633
 #, python-format
 msgid "Invalid X-FORWARDED-HOST %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1616
+#: ../roundup/cgi/client.py:1652
 #, python-format
 msgid "csrf HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1621
+#: ../roundup/cgi/client.py:1657
 #, python-format
 msgid "Invalid HOST %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1629
+#: ../roundup/cgi/client.py:1665
 msgid "Csrf: unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1630
+#: ../roundup/cgi/client.py:1666
 msgid "Unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1643
+#: ../roundup/cgi/client.py:1679
 #, python-format
 msgid "csrf X-REQUESTED-WITH xmlrpc required header check failed for user%s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1684
+#: ../roundup/cgi/client.py:1720
 #, python-format
 msgid "Required csrf field missing for user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1686 ../roundup/cgi/client.py:1713
-#: ../roundup/cgi/client.py:1730 ../roundup/cgi/client.py:1686:1713:1730
+#: ../roundup/cgi/client.py:1722 ../roundup/cgi/client.py:1749
+#: ../roundup/cgi/client.py:1766 ../roundup/cgi/client.py:1722:1749:1766
 msgid ""
 "We can't validate your session (csrf failure). Re-enter any unsaved data and "
 "try again."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1690
+#: ../roundup/cgi/client.py:1726
 #, python-format
 msgid "csrf field not supplied by user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1702
+#: ../roundup/cgi/client.py:1738
 #, python-format
 msgid ""
 "Csrf mismatch user: current user %(user)s != stored user %(stored)s, current "
 "session, stored session: %(cur_sess)s,%(stor_sess)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1720
+#: ../roundup/cgi/client.py:1756
 #, python-format
 msgid ""
 "Csrf mismatch user: current session %(curr_sess)s != stored session "
 "%(stor_sess)s, current user/stored user is: %(user)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1912
+#: ../roundup/cgi/client.py:1948
 msgid "You are not allowed to view this file."
 msgstr ""
 
-#: ../roundup/cgi/client.py:2235
+#: ../roundup/cgi/client.py:2272
 #, python-format
 msgid "%(starttag)sTime elapsed: %(seconds)fs%(endtag)s\n"
 msgstr ""
 
-#: ../roundup/cgi/client.py:2239
+#: ../roundup/cgi/client.py:2276
 #, python-format
 msgid ""
 "%(starttag)sCache hits: %(cache_hits)d, misses %(cache_misses)d. Loading "
 "items: %(get_items)f secs. Filtering: %(filtering)f secs.%(endtag)s\n"
 msgstr ""
 
-#: ../roundup/cgi/client.py:2778
+#: ../roundup/cgi/client.py:2815
 #, python-format
 msgid ""
 "Cache failure: compressed file %(compressed)s is older than its source file "
@@ -2547,35 +2548,35 @@ msgstr ""
 msgid "Api rate limits exceeded. Please wait: %s seconds."
 msgstr ""
 
-#: ../roundup/rest.py:2283
+#: ../roundup/rest.py:2284
 #, python-format
 msgid ""
-"Content type '%s' requested in URL is not available.\n"
-"Acceptable types: %s\n"
+"Content type '%(requested)s' requested in URL is not available.\n"
+"Acceptable types: %(acceptable)s\n"
 msgstr ""
 
-#: ../roundup/rest.py:2304
+#: ../roundup/rest.py:2306
 #, python-format
 msgid ""
 "Unable to parse Accept Header. %(error)s. Acceptable types: */*, "
 "%(acceptable_types)s"
 msgstr ""
 
-#: ../roundup/rest.py:2376 ../roundup/rest.py:2597 ../roundup/rest.py:2376:2597
+#: ../roundup/rest.py:2378 ../roundup/rest.py:2603 ../roundup/rest.py:2378:2603
 #, python-format
 msgid ""
 "Unrecognized api version: %s. See /rest without specifying api version for "
 "supported versions."
 msgstr ""
 
-#: ../roundup/rest.py:2411 ../roundup/rest.py:2420 ../roundup/rest.py:2411:2420
+#: ../roundup/rest.py:2413 ../roundup/rest.py:2424 ../roundup/rest.py:2413:2424
 #, python-format
 msgid ""
-"Requested content type(s) '%s' not available.\n"
-"Acceptable mime types are: */*, %s"
+"Requested content type(s) '%(requested)s' not available.\n"
+"Acceptable mime types are: */*, %(acceptable)s"
 msgstr ""
 
-#: ../roundup/rest.py:2696
+#: ../roundup/rest.py:2702
 msgid ""
 "Internal error while formatting response.\n"
 "accept_mime_type is not defined. This should\n"
@@ -2759,64 +2760,64 @@ msgid ""
 "  '-----END CERTIFICATE-----' markers?"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:345
+#: ../roundup/scripts/roundup_server.py:354
 msgid ""
 "<html><head><title>Roundup trackers index</title></head>\n"
 "<body><h1>Roundup trackers index</h1><ol>\n"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:587
+#: ../roundup/scripts/roundup_server.py:598
 #, python-format
 msgid "Error: %(type)s: %(value)s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:599
+#: ../roundup/scripts/roundup_server.py:610
 msgid "WARNING: ignoring \"-g\" argument, not root"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:605
+#: ../roundup/scripts/roundup_server.py:616
 msgid "Can't change groups - no grp module"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:614
+#: ../roundup/scripts/roundup_server.py:625
 #, python-format
 msgid "Group %(group)s doesn't exist"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:626
+#: ../roundup/scripts/roundup_server.py:637
 msgid "Can't run as root!"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:629
+#: ../roundup/scripts/roundup_server.py:640
 msgid "WARNING: ignoring \"-u\" argument, not root"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:635
+#: ../roundup/scripts/roundup_server.py:646
 msgid "Can't change users - no pwd module"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:644
+#: ../roundup/scripts/roundup_server.py:655
 #, python-format
 msgid "User %(user)s doesn't exist"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:856
+#: ../roundup/scripts/roundup_server.py:867
 #, python-format
 msgid "Multiprocess mode \"%s\" is not available, switching to single-process"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:884
+#: ../roundup/scripts/roundup_server.py:895
 #, python-format
 msgid "Unable to bind to port %s, port already in use."
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:888
+#: ../roundup/scripts/roundup_server.py:899
 #, python-format
 msgid ""
 "Unable to bind to port %(port)s, access not allowed, errno: %(errno)s %(msg)s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:967
+#: ../roundup/scripts/roundup_server.py:978
 msgid ""
 " -c <Command>  Windows Service options.\n"
 "               If you want to run the server as a Windows Service, you\n"
@@ -2826,7 +2827,7 @@ msgid ""
 "               specifics."
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:974
+#: ../roundup/scripts/roundup_server.py:985
 msgid ""
 " -u <UID>      runs the Roundup web server as this UID\n"
 " -g <GID>      runs the Roundup web server as this GID\n"
@@ -2836,7 +2837,7 @@ msgid ""
 " -D            run the server in the foreground even when -d is used."
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:982
+#: ../roundup/scripts/roundup_server.py:993
 #, python-format
 msgid ""
 "\n"
@@ -2909,20 +2910,20 @@ msgid ""
 "   any url-unsafe characters like spaces, as these confuse IE.\n"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:1162
+#: ../roundup/scripts/roundup_server.py:1173
 msgid "Instances must be name=home"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:1176
+#: ../roundup/scripts/roundup_server.py:1187
 #, python-format
 msgid "Configuration saved to %s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:1194
+#: ../roundup/scripts/roundup_server.py:1205
 msgid "Sorry, you can't run the server as a daemon on this Operating System"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:1214
+#: ../roundup/scripts/roundup_server.py:1225
 #, python-format
 msgid "Roundup server started on %(HOST)s:%(PORT)s"
 msgstr ""
diff --git a/locale/es.po b/locale/es.po
index f1d582e98..975b37f23 100644
--- a/locale/es.po
+++ b/locale/es.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Roundup 2.5.0\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
-"POT-Creation-Date: 2024-12-30 22:49-0500\n"
+"POT-Creation-Date: 2025-01-12 20:17-0500\n"
 "PO-Revision-Date: 2013-10-31 10:45+0100\n"
 "Last-Translator: Ramiro Morales <rm0@gmx.net>\n"
 "Language-Team: Spanish Translators <roundup-devel@lists.sourceforge.net>\n"
@@ -2132,156 +2132,157 @@ msgstr ""
 "p>\n"
 "</body></html>"
 
-#: ../roundup/cgi/client.py:666
+#: ../roundup/cgi/client.py:679
 msgid ""
 "XMLRPC endpoint is not using defusedxml. Improve security by installing "
 "defusedxml."
 msgstr ""
 
-#: ../roundup/cgi/client.py:728 ../roundup/cgi/client.py:1646
-#: ../roundup/cgi/client.py:728:1646
-msgid "Required Header Missing"
-msgstr ""
-
-#: ../roundup/cgi/client.py:731
+#: ../roundup/cgi/client.py:749 ../roundup/cgi/client.py:771
+#: ../roundup/cgi/client.py:749:771
 #, fuzzy
 msgid "Client is not allowed to use Rest Interface."
 msgstr "Los usuarios anonimos no tienen permitido usar esta interfaz Web"
 
-#: ../roundup/cgi/client.py:985
+#: ../roundup/cgi/client.py:768 ../roundup/cgi/client.py:1682
+#: ../roundup/cgi/client.py:768:1682
+msgid "Required Header Missing"
+msgstr ""
+
+#: ../roundup/cgi/client.py:1021
 msgid "Form Error: "
 msgstr "Error de formulario"
 
-#: ../roundup/cgi/client.py:1078
+#: ../roundup/cgi/client.py:1114
 #, python-format
 msgid "Unrecognized charset: %r"
 msgstr "Conjunto de caracteres desconocido: %r"
 
-#: ../roundup/cgi/client.py:1345 ../roundup/cgi/client.py:2357
-#: ../roundup/cgi/client.py:1345:2357
+#: ../roundup/cgi/client.py:1381 ../roundup/cgi/client.py:2394
+#: ../roundup/cgi/client.py:1381:2394
 msgid "broken form: multiple @action values submitted"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1362
+#: ../roundup/cgi/client.py:1398
 msgid "Anonymous users are not allowed to use the web interface"
 msgstr "Los usuarios anonimos no tienen permitido usar esta interfaz Web"
 
-#: ../roundup/cgi/client.py:1507
+#: ../roundup/cgi/client.py:1543
 msgid "Referer header not available."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1511
+#: ../roundup/cgi/client.py:1547
 #, python-format
 msgid "csrf key used with wrong method from: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1540
+#: ../roundup/cgi/client.py:1576
 #, python-format
 msgid "csrf header %(header)s required but missing for user%(userid)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1544
+#: ../roundup/cgi/client.py:1580
 #, python-format
 msgid "Missing header: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1552
+#: ../roundup/cgi/client.py:1588
 #, python-format
 msgid "csrf Referer header check failed for user%(userid)s. Value=%(referer)s"
 msgstr ""
 
 # ../roundup/cgi/actions.py:891 :895
-#: ../roundup/cgi/client.py:1557
+#: ../roundup/cgi/client.py:1593
 #, fuzzy, python-format
 msgid "Invalid Referer: %s"
 msgstr "nombre de usuario ó contraseña inválidos"
 
-#: ../roundup/cgi/client.py:1572
+#: ../roundup/cgi/client.py:1608
 #, python-format
 msgid "csrf Origin header check failed for user%(userid)s. Value=%(origin)s"
 msgstr ""
 
 # ../roundup/cgi/actions.py:891 :895
-#: ../roundup/cgi/client.py:1577
+#: ../roundup/cgi/client.py:1613
 #, fuzzy, python-format
 msgid "Invalid Origin %s"
 msgstr "nombre de usuario ó contraseña inválidos"
 
-#: ../roundup/cgi/client.py:1591
+#: ../roundup/cgi/client.py:1627
 #, python-format
 msgid ""
 "csrf X-FORWARDED-HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1597
+#: ../roundup/cgi/client.py:1633
 #, python-format
 msgid "Invalid X-FORWARDED-HOST %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1616
+#: ../roundup/cgi/client.py:1652
 #, python-format
 msgid "csrf HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1621
+#: ../roundup/cgi/client.py:1657
 #, python-format
 msgid "Invalid HOST %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1629
+#: ../roundup/cgi/client.py:1665
 msgid "Csrf: unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1630
+#: ../roundup/cgi/client.py:1666
 msgid "Unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1643
+#: ../roundup/cgi/client.py:1679
 #, python-format
 msgid "csrf X-REQUESTED-WITH xmlrpc required header check failed for user%s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1684
+#: ../roundup/cgi/client.py:1720
 #, python-format
 msgid "Required csrf field missing for user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1686 ../roundup/cgi/client.py:1713
-#: ../roundup/cgi/client.py:1730 ../roundup/cgi/client.py:1686:1713:1730
+#: ../roundup/cgi/client.py:1722 ../roundup/cgi/client.py:1749
+#: ../roundup/cgi/client.py:1766 ../roundup/cgi/client.py:1722:1749:1766
 msgid ""
 "We can't validate your session (csrf failure). Re-enter any unsaved data and "
 "try again."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1690
+#: ../roundup/cgi/client.py:1726
 #, python-format
 msgid "csrf field not supplied by user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1702
+#: ../roundup/cgi/client.py:1738
 #, python-format
 msgid ""
 "Csrf mismatch user: current user %(user)s != stored user %(stored)s, current "
 "session, stored session: %(cur_sess)s,%(stor_sess)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1720
+#: ../roundup/cgi/client.py:1756
 #, python-format
 msgid ""
 "Csrf mismatch user: current session %(curr_sess)s != stored session "
 "%(stor_sess)s, current user/stored user is: %(user)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1912
+#: ../roundup/cgi/client.py:1948
 msgid "You are not allowed to view this file."
 msgstr "Ud. no tiene permitido ver este fichero"
 
-#: ../roundup/cgi/client.py:2235
+#: ../roundup/cgi/client.py:2272
 #, python-format
 msgid "%(starttag)sTime elapsed: %(seconds)fs%(endtag)s\n"
 msgstr "%(starttag)sTiempo transcurrido: %(seconds)fs%(endtag)s\n"
 
-#: ../roundup/cgi/client.py:2239
+#: ../roundup/cgi/client.py:2276
 #, python-format
 msgid ""
 "%(starttag)sCache hits: %(cache_hits)d, misses %(cache_misses)d. Loading "
@@ -2290,7 +2291,7 @@ msgstr ""
 "%(starttag)sAciertos Cache: %(cache_hits)d, no aciertos %(cache_misses)d. "
 "Cargando items: %(get_items)f secs. Filtrado: %(filtering)f secs.%(endtag)s\n"
 
-#: ../roundup/cgi/client.py:2778
+#: ../roundup/cgi/client.py:2815
 #, python-format
 msgid ""
 "Cache failure: compressed file %(compressed)s is older than its source file "
@@ -3147,35 +3148,35 @@ msgstr "nombre de usuario 
 msgid "Api rate limits exceeded. Please wait: %s seconds."
 msgstr ""
 
-#: ../roundup/rest.py:2283
+#: ../roundup/rest.py:2284
 #, python-format
 msgid ""
-"Content type '%s' requested in URL is not available.\n"
-"Acceptable types: %s\n"
+"Content type '%(requested)s' requested in URL is not available.\n"
+"Acceptable types: %(acceptable)s\n"
 msgstr ""
 
-#: ../roundup/rest.py:2304
+#: ../roundup/rest.py:2306
 #, python-format
 msgid ""
 "Unable to parse Accept Header. %(error)s. Acceptable types: */*, "
 "%(acceptable_types)s"
 msgstr ""
 
-#: ../roundup/rest.py:2376 ../roundup/rest.py:2597 ../roundup/rest.py:2376:2597
+#: ../roundup/rest.py:2378 ../roundup/rest.py:2603 ../roundup/rest.py:2378:2603
 #, python-format
 msgid ""
 "Unrecognized api version: %s. See /rest without specifying api version for "
 "supported versions."
 msgstr ""
 
-#: ../roundup/rest.py:2411 ../roundup/rest.py:2420 ../roundup/rest.py:2411:2420
+#: ../roundup/rest.py:2413 ../roundup/rest.py:2424 ../roundup/rest.py:2413:2424
 #, python-format
 msgid ""
-"Requested content type(s) '%s' not available.\n"
-"Acceptable mime types are: */*, %s"
+"Requested content type(s) '%(requested)s' not available.\n"
+"Acceptable mime types are: */*, %(acceptable)s"
 msgstr ""
 
-#: ../roundup/rest.py:2696
+#: ../roundup/rest.py:2702
 msgid ""
 "Internal error while formatting response.\n"
 "accept_mime_type is not defined. This should\n"
@@ -3369,7 +3370,7 @@ msgid ""
 "  '-----END CERTIFICATE-----' markers?"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:345
+#: ../roundup/scripts/roundup_server.py:354
 msgid ""
 "<html><head><title>Roundup trackers index</title></head>\n"
 "<body><h1>Roundup trackers index</h1><ol>\n"
@@ -3377,59 +3378,59 @@ msgstr ""
 "<html><head><title>Índice de trackers Roundup</title></head>\n"
 "<body><h1>Índice de trackers Roundup</h1><ol>\n"
 
-#: ../roundup/scripts/roundup_server.py:587
+#: ../roundup/scripts/roundup_server.py:598
 #, fuzzy, python-format
 msgid "Error: %(type)s: %(value)s"
 msgstr "%(key)s: %(value)s"
 
-#: ../roundup/scripts/roundup_server.py:599
+#: ../roundup/scripts/roundup_server.py:610
 msgid "WARNING: ignoring \"-g\" argument, not root"
 msgstr "ATENCIÓN: ignorando argumento \"-g\" , Ud. no es root"
 
-#: ../roundup/scripts/roundup_server.py:605
+#: ../roundup/scripts/roundup_server.py:616
 msgid "Can't change groups - no grp module"
 msgstr "No puede cambiar grupos - el módulo grp no está presente"
 
-#: ../roundup/scripts/roundup_server.py:614
+#: ../roundup/scripts/roundup_server.py:625
 #, python-format
 msgid "Group %(group)s doesn't exist"
 msgstr "El grupo %(group)s no existe"
 
-#: ../roundup/scripts/roundup_server.py:626
+#: ../roundup/scripts/roundup_server.py:637
 msgid "Can't run as root!"
 msgstr "No puede ejecutarse como root!"
 
-#: ../roundup/scripts/roundup_server.py:629
+#: ../roundup/scripts/roundup_server.py:640
 msgid "WARNING: ignoring \"-u\" argument, not root"
 msgstr "ATENCIÓN: ignorando argumento \"-u\", Ud. no es root"
 
-#: ../roundup/scripts/roundup_server.py:635
+#: ../roundup/scripts/roundup_server.py:646
 msgid "Can't change users - no pwd module"
 msgstr "No puedo cambiar usuarios - no existe el módulo pwd"
 
-#: ../roundup/scripts/roundup_server.py:644
+#: ../roundup/scripts/roundup_server.py:655
 #, python-format
 msgid "User %(user)s doesn't exist"
 msgstr "El usuario %(user)s no existe"
 
-#: ../roundup/scripts/roundup_server.py:856
+#: ../roundup/scripts/roundup_server.py:867
 #, python-format
 msgid "Multiprocess mode \"%s\" is not available, switching to single-process"
 msgstr ""
 "El modo multiproceso \"%s\" no está disponible, conmutado a proceso simple"
 
-#: ../roundup/scripts/roundup_server.py:884
+#: ../roundup/scripts/roundup_server.py:895
 #, python-format
 msgid "Unable to bind to port %s, port already in use."
 msgstr "Imposible asociarse al puerto %s, el mismo ya está en uso."
 
-#: ../roundup/scripts/roundup_server.py:888
+#: ../roundup/scripts/roundup_server.py:899
 #, fuzzy, python-format
 msgid ""
 "Unable to bind to port %(port)s, access not allowed, errno: %(errno)s %(msg)s"
 msgstr "Imposible asociarse al puerto %s, el mismo ya está en uso."
 
-#: ../roundup/scripts/roundup_server.py:967
+#: ../roundup/scripts/roundup_server.py:978
 msgid ""
 " -c <Command>  Windows Service options.\n"
 "               If you want to run the server as a Windows Service, you\n"
@@ -3451,7 +3452,7 @@ msgstr ""
 "para\n"
 "               Servicios Web."
 
-#: ../roundup/scripts/roundup_server.py:974
+#: ../roundup/scripts/roundup_server.py:985
 #, fuzzy
 msgid ""
 " -u <UID>      runs the Roundup web server as this UID\n"
@@ -3468,7 +3469,7 @@ msgstr ""
 "               PID del servidor en el fichero especificado por PIDfile.\n"
 "               La opción -l *debe* ser especificada si se usa la opción -d."
 
-#: ../roundup/scripts/roundup_server.py:982
+#: ../roundup/scripts/roundup_server.py:993
 #, fuzzy, python-format
 msgid ""
 "\n"
@@ -3607,22 +3608,22 @@ msgstr ""
 "   caracteres tales como espacios, dado que los mismos confunden a Internet "
 "Explorer.\n"
 
-#: ../roundup/scripts/roundup_server.py:1162
+#: ../roundup/scripts/roundup_server.py:1173
 msgid "Instances must be name=home"
 msgstr "Las Instancias debe ser de la forma nombre=directorio base"
 
-#: ../roundup/scripts/roundup_server.py:1176
+#: ../roundup/scripts/roundup_server.py:1187
 #, python-format
 msgid "Configuration saved to %s"
 msgstr "Configuración guardada en %s"
 
-#: ../roundup/scripts/roundup_server.py:1194
+#: ../roundup/scripts/roundup_server.py:1205
 msgid "Sorry, you can't run the server as a daemon on this Operating System"
 msgstr ""
 "Lo siento, no puede ejecutar el servidor como un demonio en este Sistema "
 "Operativo"
 
-#: ../roundup/scripts/roundup_server.py:1214
+#: ../roundup/scripts/roundup_server.py:1225
 #, python-format
 msgid "Roundup server started on %(HOST)s:%(PORT)s"
 msgstr "servidor Roundup iniciado en %(HOST)s:%(PORT)s"
diff --git a/locale/fr.po b/locale/fr.po
index 92f7b0063..24af8e5a7 100644
--- a/locale/fr.po
+++ b/locale/fr.po
@@ -10,7 +10,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Roundup 2.5.0\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
-"POT-Creation-Date: 2024-12-30 22:49-0500\n"
+"POT-Creation-Date: 2025-01-12 20:17-0500\n"
 "PO-Revision-Date: 2013-10-31 12:19+0100\n"
 "Last-Translator: Stephane Raimbault <stephane.raimbault@gmail.com>\n"
 "Language-Team: GNOME French Team <gnomefr@traduc.org>\n"
@@ -2141,160 +2141,161 @@ msgstr ""
 "Les administrateurs du pisteur ont été notifiés du problème.</p>\n"
 "</body></html>"
 
-#: ../roundup/cgi/client.py:666
+#: ../roundup/cgi/client.py:679
 msgid ""
 "XMLRPC endpoint is not using defusedxml. Improve security by installing "
 "defusedxml."
 msgstr ""
 
-#: ../roundup/cgi/client.py:728 ../roundup/cgi/client.py:1646
-#: ../roundup/cgi/client.py:728:1646
-msgid "Required Header Missing"
-msgstr ""
-
-#: ../roundup/cgi/client.py:731
+#: ../roundup/cgi/client.py:749 ../roundup/cgi/client.py:771
+#: ../roundup/cgi/client.py:749:771
 #, fuzzy
 msgid "Client is not allowed to use Rest Interface."
 msgstr ""
 "Les utilisateurs anonymes ne sont pas autorisés à utiliser l'interface Web"
 
-#: ../roundup/cgi/client.py:985
+#: ../roundup/cgi/client.py:768 ../roundup/cgi/client.py:1682
+#: ../roundup/cgi/client.py:768:1682
+msgid "Required Header Missing"
+msgstr ""
+
+#: ../roundup/cgi/client.py:1021
 msgid "Form Error: "
 msgstr "Erreur de formulaire : "
 
-#: ../roundup/cgi/client.py:1078
+#: ../roundup/cgi/client.py:1114
 #, python-format
 msgid "Unrecognized charset: %r"
 msgstr "Jeu de caractères non reconnu : %r"
 
-#: ../roundup/cgi/client.py:1345 ../roundup/cgi/client.py:2357
-#: ../roundup/cgi/client.py:1345:2357
+#: ../roundup/cgi/client.py:1381 ../roundup/cgi/client.py:2394
+#: ../roundup/cgi/client.py:1381:2394
 msgid "broken form: multiple @action values submitted"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1362
+#: ../roundup/cgi/client.py:1398
 msgid "Anonymous users are not allowed to use the web interface"
 msgstr ""
 "Les utilisateurs anonymes ne sont pas autorisés à utiliser l'interface Web"
 
-#: ../roundup/cgi/client.py:1507
+#: ../roundup/cgi/client.py:1543
 msgid "Referer header not available."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1511
+#: ../roundup/cgi/client.py:1547
 #, python-format
 msgid "csrf key used with wrong method from: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1540
+#: ../roundup/cgi/client.py:1576
 #, python-format
 msgid "csrf header %(header)s required but missing for user%(userid)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1544
+#: ../roundup/cgi/client.py:1580
 #, python-format
 msgid "Missing header: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1552
+#: ../roundup/cgi/client.py:1588
 #, python-format
 msgid "csrf Referer header check failed for user%(userid)s. Value=%(referer)s"
 msgstr ""
 
 # ../roundup/cgi/actions.py:930 :934
 # ../roundup/cgi/actions.py:930:934
-#: ../roundup/cgi/client.py:1557
+#: ../roundup/cgi/client.py:1593
 #, fuzzy, python-format
 msgid "Invalid Referer: %s"
 msgstr "Tentative de connexion non valide"
 
-#: ../roundup/cgi/client.py:1572
+#: ../roundup/cgi/client.py:1608
 #, python-format
 msgid "csrf Origin header check failed for user%(userid)s. Value=%(origin)s"
 msgstr ""
 
 # ../roundup/cgi/actions.py:930 :934
 # ../roundup/cgi/actions.py:930:934
-#: ../roundup/cgi/client.py:1577
+#: ../roundup/cgi/client.py:1613
 #, fuzzy, python-format
 msgid "Invalid Origin %s"
 msgstr "Tentative de connexion non valide"
 
-#: ../roundup/cgi/client.py:1591
+#: ../roundup/cgi/client.py:1627
 #, python-format
 msgid ""
 "csrf X-FORWARDED-HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1597
+#: ../roundup/cgi/client.py:1633
 #, python-format
 msgid "Invalid X-FORWARDED-HOST %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1616
+#: ../roundup/cgi/client.py:1652
 #, python-format
 msgid "csrf HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1621
+#: ../roundup/cgi/client.py:1657
 #, python-format
 msgid "Invalid HOST %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1629
+#: ../roundup/cgi/client.py:1665
 msgid "Csrf: unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1630
+#: ../roundup/cgi/client.py:1666
 msgid "Unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1643
+#: ../roundup/cgi/client.py:1679
 #, python-format
 msgid "csrf X-REQUESTED-WITH xmlrpc required header check failed for user%s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1684
+#: ../roundup/cgi/client.py:1720
 #, python-format
 msgid "Required csrf field missing for user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1686 ../roundup/cgi/client.py:1713
-#: ../roundup/cgi/client.py:1730 ../roundup/cgi/client.py:1686:1713:1730
+#: ../roundup/cgi/client.py:1722 ../roundup/cgi/client.py:1749
+#: ../roundup/cgi/client.py:1766 ../roundup/cgi/client.py:1722:1749:1766
 msgid ""
 "We can't validate your session (csrf failure). Re-enter any unsaved data and "
 "try again."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1690
+#: ../roundup/cgi/client.py:1726
 #, python-format
 msgid "csrf field not supplied by user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1702
+#: ../roundup/cgi/client.py:1738
 #, python-format
 msgid ""
 "Csrf mismatch user: current user %(user)s != stored user %(stored)s, current "
 "session, stored session: %(cur_sess)s,%(stor_sess)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1720
+#: ../roundup/cgi/client.py:1756
 #, python-format
 msgid ""
 "Csrf mismatch user: current session %(curr_sess)s != stored session "
 "%(stor_sess)s, current user/stored user is: %(user)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1912
+#: ../roundup/cgi/client.py:1948
 msgid "You are not allowed to view this file."
 msgstr "Vous n'êtes pas autorisé à voir ce fichier"
 
-#: ../roundup/cgi/client.py:2235
+#: ../roundup/cgi/client.py:2272
 #, python-format
 msgid "%(starttag)sTime elapsed: %(seconds)fs%(endtag)s\n"
 msgstr "%(starttag)sTemps écoulé: %(seconds)fs%(endtag)s\n"
 
-#: ../roundup/cgi/client.py:2239
+#: ../roundup/cgi/client.py:2276
 #, python-format
 msgid ""
 "%(starttag)sCache hits: %(cache_hits)d, misses %(cache_misses)d. Loading "
@@ -2304,7 +2305,7 @@ msgstr ""
 "Chargement d'éléments : %(get_items)f secondes. Filtrage : %(filtering)f "
 "secondes.%(endtag)s\n"
 
-#: ../roundup/cgi/client.py:2778
+#: ../roundup/cgi/client.py:2815
 #, python-format
 msgid ""
 "Cache failure: compressed file %(compressed)s is older than its source file "
@@ -3173,35 +3174,35 @@ msgstr "Tentative de connexion non valide"
 msgid "Api rate limits exceeded. Please wait: %s seconds."
 msgstr ""
 
-#: ../roundup/rest.py:2283
+#: ../roundup/rest.py:2284
 #, python-format
 msgid ""
-"Content type '%s' requested in URL is not available.\n"
-"Acceptable types: %s\n"
+"Content type '%(requested)s' requested in URL is not available.\n"
+"Acceptable types: %(acceptable)s\n"
 msgstr ""
 
-#: ../roundup/rest.py:2304
+#: ../roundup/rest.py:2306
 #, python-format
 msgid ""
 "Unable to parse Accept Header. %(error)s. Acceptable types: */*, "
 "%(acceptable_types)s"
 msgstr ""
 
-#: ../roundup/rest.py:2376 ../roundup/rest.py:2597 ../roundup/rest.py:2376:2597
+#: ../roundup/rest.py:2378 ../roundup/rest.py:2603 ../roundup/rest.py:2378:2603
 #, python-format
 msgid ""
 "Unrecognized api version: %s. See /rest without specifying api version for "
 "supported versions."
 msgstr ""
 
-#: ../roundup/rest.py:2411 ../roundup/rest.py:2420 ../roundup/rest.py:2411:2420
+#: ../roundup/rest.py:2413 ../roundup/rest.py:2424 ../roundup/rest.py:2413:2424
 #, python-format
 msgid ""
-"Requested content type(s) '%s' not available.\n"
-"Acceptable mime types are: */*, %s"
+"Requested content type(s) '%(requested)s' not available.\n"
+"Acceptable mime types are: */*, %(acceptable)s"
 msgstr ""
 
-#: ../roundup/rest.py:2696
+#: ../roundup/rest.py:2702
 msgid ""
 "Internal error while formatting response.\n"
 "accept_mime_type is not defined. This should\n"
@@ -3393,7 +3394,7 @@ msgid ""
 "  '-----END CERTIFICATE-----' markers?"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:345
+#: ../roundup/scripts/roundup_server.py:354
 msgid ""
 "<html><head><title>Roundup trackers index</title></head>\n"
 "<body><h1>Roundup trackers index</h1><ol>\n"
@@ -3401,64 +3402,64 @@ msgstr ""
 "<html><head><title>Index des pisteurs Roundup</title></head>\n"
 "<body><h1>Index des pisteurs Roundup</h1><ol>\n"
 
-#: ../roundup/scripts/roundup_server.py:587
+#: ../roundup/scripts/roundup_server.py:598
 #, fuzzy, python-format
 msgid "Error: %(type)s: %(value)s"
 msgstr "%(key)s : %(value)s"
 
-#: ../roundup/scripts/roundup_server.py:599
+#: ../roundup/scripts/roundup_server.py:610
 msgid "WARNING: ignoring \"-g\" argument, not root"
 msgstr ""
 "ATTENTION : le paramètre « -g » est ignoré, vous n'êtes pas superutilisateur "
 "(« root »)"
 
-#: ../roundup/scripts/roundup_server.py:605
+#: ../roundup/scripts/roundup_server.py:616
 msgid "Can't change groups - no grp module"
 msgstr "Impossible de changer les groupes - le module grp n'est pas présent"
 
-#: ../roundup/scripts/roundup_server.py:614
+#: ../roundup/scripts/roundup_server.py:625
 #, python-format
 msgid "Group %(group)s doesn't exist"
 msgstr "Le groupe %(group)s n'existe pas"
 
-#: ../roundup/scripts/roundup_server.py:626
+#: ../roundup/scripts/roundup_server.py:637
 msgid "Can't run as root!"
 msgstr "Impossible d'exécuter en tant que superutilisateur (\"root\")"
 
-#: ../roundup/scripts/roundup_server.py:629
+#: ../roundup/scripts/roundup_server.py:640
 msgid "WARNING: ignoring \"-u\" argument, not root"
 msgstr ""
 "ATTENTION: le paramètre \"-u\" est ignoré, vous n'êtes pas superutilisateur "
 "(\"root\")"
 
-#: ../roundup/scripts/roundup_server.py:635
+#: ../roundup/scripts/roundup_server.py:646
 msgid "Can't change users - no pwd module"
 msgstr ""
 "Impossible de changer les utilisateurs - le module pwd n'est pas présent"
 
-#: ../roundup/scripts/roundup_server.py:644
+#: ../roundup/scripts/roundup_server.py:655
 #, python-format
 msgid "User %(user)s doesn't exist"
 msgstr "L'utilisateur %(user)s n'existe pas"
 
-#: ../roundup/scripts/roundup_server.py:856
+#: ../roundup/scripts/roundup_server.py:867
 #, python-format
 msgid "Multiprocess mode \"%s\" is not available, switching to single-process"
 msgstr ""
 "Le mode multiprocessus \"%s\" n'existe pas, passage en mode processus unique"
 
-#: ../roundup/scripts/roundup_server.py:884
+#: ../roundup/scripts/roundup_server.py:895
 #, python-format
 msgid "Unable to bind to port %s, port already in use."
 msgstr "Impossible de s'attacher au port %s, le port est déjà utilisé"
 
-#: ../roundup/scripts/roundup_server.py:888
+#: ../roundup/scripts/roundup_server.py:899
 #, fuzzy, python-format
 msgid ""
 "Unable to bind to port %(port)s, access not allowed, errno: %(errno)s %(msg)s"
 msgstr "Impossible de s'attacher au port %s, le port est déjà utilisé"
 
-#: ../roundup/scripts/roundup_server.py:967
+#: ../roundup/scripts/roundup_server.py:978
 msgid ""
 " -c <Command>  Windows Service options.\n"
 "               If you want to run the server as a Windows Service, you\n"
@@ -3477,7 +3478,7 @@ msgstr ""
 "               La commande « roundup-server -c help » donne les\n"
 "               spécificités du service Windows."
 
-#: ../roundup/scripts/roundup_server.py:974
+#: ../roundup/scripts/roundup_server.py:985
 #, fuzzy
 msgid ""
 " -u <UID>      runs the Roundup web server as this UID\n"
@@ -3498,7 +3499,7 @@ msgstr ""
 "PID\n"
 "               L'option -l option *doit* être spécifiée si -d est utilisé."
 
-#: ../roundup/scripts/roundup_server.py:982
+#: ../roundup/scripts/roundup_server.py:993
 #, fuzzy, python-format
 msgid ""
 "\n"
@@ -3625,22 +3626,22 @@ msgstr ""
 "    souhaité. Assurez-vous que « name » ne contienne pas de caractères\n"
 "    inappropriés pour une URL, comme les espaces qui perturbe IE.\n"
 
-#: ../roundup/scripts/roundup_server.py:1162
+#: ../roundup/scripts/roundup_server.py:1173
 msgid "Instances must be name=home"
 msgstr "Les instances doivent être nom=base-du-pisteur"
 
-#: ../roundup/scripts/roundup_server.py:1176
+#: ../roundup/scripts/roundup_server.py:1187
 #, python-format
 msgid "Configuration saved to %s"
 msgstr "Configuration sauvegardée dans %s"
 
-#: ../roundup/scripts/roundup_server.py:1194
+#: ../roundup/scripts/roundup_server.py:1205
 msgid "Sorry, you can't run the server as a daemon on this Operating System"
 msgstr ""
 "Désolé, vous ne pouvez pas démarrer le serveur en tâche de fond avec ce "
 "système d'exploitation"
 
-#: ../roundup/scripts/roundup_server.py:1214
+#: ../roundup/scripts/roundup_server.py:1225
 #, python-format
 msgid "Roundup server started on %(HOST)s:%(PORT)s"
 msgstr "Le serveur Roundup est démarré sur %(HOST)s:%(PORT)s"
diff --git a/locale/hu.po b/locale/hu.po
index 861d808e5..78fb8e654 100644
--- a/locale/hu.po
+++ b/locale/hu.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Roundup 2.5.0\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
-"POT-Creation-Date: 2024-12-30 22:49-0500\n"
+"POT-Creation-Date: 2025-01-12 20:17-0500\n"
 "PO-Revision-Date: 2013-10-31 12:19+0100\n"
 "Last-Translator: kilo aka Gabor Kmetyko <kg_kilo@freemail.hu>\n"
 "Language-Team: Hungarian\n"
@@ -1797,156 +1797,157 @@ msgstr ""
 "A hibakÃ¶vetÅ‘ karbantartÃ³i Ã©rtesÃ­tÃ©st kaptak a problÃ©mÃ¡rÃ³l.</p>\n"
 "</body></html>"
 
-#: ../roundup/cgi/client.py:666
+#: ../roundup/cgi/client.py:679
 msgid ""
 "XMLRPC endpoint is not using defusedxml. Improve security by installing "
 "defusedxml."
 msgstr ""
 
-#: ../roundup/cgi/client.py:728 ../roundup/cgi/client.py:1646
-#: ../roundup/cgi/client.py:728:1646
-msgid "Required Header Missing"
-msgstr ""
-
-#: ../roundup/cgi/client.py:731
+#: ../roundup/cgi/client.py:749 ../roundup/cgi/client.py:771
+#: ../roundup/cgi/client.py:749:771
 #, fuzzy
 msgid "Client is not allowed to use Rest Interface."
 msgstr "Anonim felhasznÃ¡lÃ³k nem hasznÃ¡lhatjÃ¡k a webes felÃ¼letet"
 
-#: ../roundup/cgi/client.py:985
+#: ../roundup/cgi/client.py:768 ../roundup/cgi/client.py:1682
+#: ../roundup/cgi/client.py:768:1682
+msgid "Required Header Missing"
+msgstr ""
+
+#: ../roundup/cgi/client.py:1021
 msgid "Form Error: "
 msgstr "Å°rlap hiba: "
 
-#: ../roundup/cgi/client.py:1078
+#: ../roundup/cgi/client.py:1114
 #, python-format
 msgid "Unrecognized charset: %r"
 msgstr "Ismeretlen karakterkÃ©szlet: %r"
 
-#: ../roundup/cgi/client.py:1345 ../roundup/cgi/client.py:2357
-#: ../roundup/cgi/client.py:1345:2357
+#: ../roundup/cgi/client.py:1381 ../roundup/cgi/client.py:2394
+#: ../roundup/cgi/client.py:1381:2394
 msgid "broken form: multiple @action values submitted"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1362
+#: ../roundup/cgi/client.py:1398
 msgid "Anonymous users are not allowed to use the web interface"
 msgstr "Anonim felhasznÃ¡lÃ³k nem hasznÃ¡lhatjÃ¡k a webes felÃ¼letet"
 
-#: ../roundup/cgi/client.py:1507
+#: ../roundup/cgi/client.py:1543
 msgid "Referer header not available."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1511
+#: ../roundup/cgi/client.py:1547
 #, python-format
 msgid "csrf key used with wrong method from: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1540
+#: ../roundup/cgi/client.py:1576
 #, python-format
 msgid "csrf header %(header)s required but missing for user%(userid)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1544
+#: ../roundup/cgi/client.py:1580
 #, python-format
 msgid "Missing header: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1552
+#: ../roundup/cgi/client.py:1588
 #, python-format
 msgid "csrf Referer header check failed for user%(userid)s. Value=%(referer)s"
 msgstr ""
 
 # ../roundup/cgi/actions.py:930 :934
-#: ../roundup/cgi/client.py:1557
+#: ../roundup/cgi/client.py:1593
 #, fuzzy, python-format
 msgid "Invalid Referer: %s"
 msgstr "HibÃ¡s bejelentkezÃ©s"
 
-#: ../roundup/cgi/client.py:1572
+#: ../roundup/cgi/client.py:1608
 #, python-format
 msgid "csrf Origin header check failed for user%(userid)s. Value=%(origin)s"
 msgstr ""
 
 # ../roundup/cgi/actions.py:930 :934
-#: ../roundup/cgi/client.py:1577
+#: ../roundup/cgi/client.py:1613
 #, fuzzy, python-format
 msgid "Invalid Origin %s"
 msgstr "HibÃ¡s bejelentkezÃ©s"
 
-#: ../roundup/cgi/client.py:1591
+#: ../roundup/cgi/client.py:1627
 #, python-format
 msgid ""
 "csrf X-FORWARDED-HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1597
+#: ../roundup/cgi/client.py:1633
 #, python-format
 msgid "Invalid X-FORWARDED-HOST %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1616
+#: ../roundup/cgi/client.py:1652
 #, python-format
 msgid "csrf HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1621
+#: ../roundup/cgi/client.py:1657
 #, python-format
 msgid "Invalid HOST %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1629
+#: ../roundup/cgi/client.py:1665
 msgid "Csrf: unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1630
+#: ../roundup/cgi/client.py:1666
 msgid "Unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1643
+#: ../roundup/cgi/client.py:1679
 #, python-format
 msgid "csrf X-REQUESTED-WITH xmlrpc required header check failed for user%s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1684
+#: ../roundup/cgi/client.py:1720
 #, python-format
 msgid "Required csrf field missing for user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1686 ../roundup/cgi/client.py:1713
-#: ../roundup/cgi/client.py:1730 ../roundup/cgi/client.py:1686:1713:1730
+#: ../roundup/cgi/client.py:1722 ../roundup/cgi/client.py:1749
+#: ../roundup/cgi/client.py:1766 ../roundup/cgi/client.py:1722:1749:1766
 msgid ""
 "We can't validate your session (csrf failure). Re-enter any unsaved data and "
 "try again."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1690
+#: ../roundup/cgi/client.py:1726
 #, python-format
 msgid "csrf field not supplied by user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1702
+#: ../roundup/cgi/client.py:1738
 #, python-format
 msgid ""
 "Csrf mismatch user: current user %(user)s != stored user %(stored)s, current "
 "session, stored session: %(cur_sess)s,%(stor_sess)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1720
+#: ../roundup/cgi/client.py:1756
 #, python-format
 msgid ""
 "Csrf mismatch user: current session %(curr_sess)s != stored session "
 "%(stor_sess)s, current user/stored user is: %(user)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1912
+#: ../roundup/cgi/client.py:1948
 msgid "You are not allowed to view this file."
 msgstr "Nem nÃ©zheti meg ezt a fÃ¡jlt."
 
-#: ../roundup/cgi/client.py:2235
+#: ../roundup/cgi/client.py:2272
 #, python-format
 msgid "%(starttag)sTime elapsed: %(seconds)fs%(endtag)s\n"
 msgstr "%(starttag)sEltelt idÅ‘: %(seconds)fs%(endtag)s\n"
 
-#: ../roundup/cgi/client.py:2239
+#: ../roundup/cgi/client.py:2276
 #, python-format
 msgid ""
 "%(starttag)sCache hits: %(cache_hits)d, misses %(cache_misses)d. Loading "
@@ -1955,7 +1956,7 @@ msgstr ""
 "%(starttag)sCache talÃ¡latok: %(cache_hits)d, tÃ©vedÃ©s %(cache_misses)d. "
 "Elemek betÃ¶ltÃ©se: %(get_items)f mp. SzÅ±rÃ©s: %(filtering)f mp.%(endtag)s\n"
 
-#: ../roundup/cgi/client.py:2778
+#: ../roundup/cgi/client.py:2815
 #, python-format
 msgid ""
 "Cache failure: compressed file %(compressed)s is older than its source file "
@@ -2772,35 +2773,35 @@ msgstr "HibÃ¡s bejelentkezÃ©s"
 msgid "Api rate limits exceeded. Please wait: %s seconds."
 msgstr ""
 
-#: ../roundup/rest.py:2283
+#: ../roundup/rest.py:2284
 #, python-format
 msgid ""
-"Content type '%s' requested in URL is not available.\n"
-"Acceptable types: %s\n"
+"Content type '%(requested)s' requested in URL is not available.\n"
+"Acceptable types: %(acceptable)s\n"
 msgstr ""
 
-#: ../roundup/rest.py:2304
+#: ../roundup/rest.py:2306
 #, python-format
 msgid ""
 "Unable to parse Accept Header. %(error)s. Acceptable types: */*, "
 "%(acceptable_types)s"
 msgstr ""
 
-#: ../roundup/rest.py:2376 ../roundup/rest.py:2597 ../roundup/rest.py:2376:2597
+#: ../roundup/rest.py:2378 ../roundup/rest.py:2603 ../roundup/rest.py:2378:2603
 #, python-format
 msgid ""
 "Unrecognized api version: %s. See /rest without specifying api version for "
 "supported versions."
 msgstr ""
 
-#: ../roundup/rest.py:2411 ../roundup/rest.py:2420 ../roundup/rest.py:2411:2420
+#: ../roundup/rest.py:2413 ../roundup/rest.py:2424 ../roundup/rest.py:2413:2424
 #, python-format
 msgid ""
-"Requested content type(s) '%s' not available.\n"
-"Acceptable mime types are: */*, %s"
+"Requested content type(s) '%(requested)s' not available.\n"
+"Acceptable mime types are: */*, %(acceptable)s"
 msgstr ""
 
-#: ../roundup/rest.py:2696
+#: ../roundup/rest.py:2702
 msgid ""
 "Internal error while formatting response.\n"
 "accept_mime_type is not defined. This should\n"
@@ -2989,7 +2990,7 @@ msgid ""
 "  '-----END CERTIFICATE-----' markers?"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:345
+#: ../roundup/scripts/roundup_server.py:354
 msgid ""
 "<html><head><title>Roundup trackers index</title></head>\n"
 "<body><h1>Roundup trackers index</h1><ol>\n"
@@ -2997,58 +2998,58 @@ msgstr ""
 "<html><head><title>Roundup hibakÃ¶vetÅ‘k listÃ¡ja</title></head>\n"
 "<body><h1>Roundup hibakÃ¶vetÅ‘k listÃ¡ja</h1><ol>\n"
 
-#: ../roundup/scripts/roundup_server.py:587
+#: ../roundup/scripts/roundup_server.py:598
 #, fuzzy, python-format
 msgid "Error: %(type)s: %(value)s"
 msgstr "%(key)s: %(value)s"
 
-#: ../roundup/scripts/roundup_server.py:599
+#: ../roundup/scripts/roundup_server.py:610
 msgid "WARNING: ignoring \"-g\" argument, not root"
 msgstr "FIGYELEM: \"-g\" opciÃ³ figyelmen kÃ­vÃ¼l hagyÃ¡sra kerÃ¼lt, nem root"
 
-#: ../roundup/scripts/roundup_server.py:605
+#: ../roundup/scripts/roundup_server.py:616
 msgid "Can't change groups - no grp module"
 msgstr "Nem lehet csoportot vÃ¡ltani - nincs meg a grp modul"
 
-#: ../roundup/scripts/roundup_server.py:614
+#: ../roundup/scripts/roundup_server.py:625
 #, python-format
 msgid "Group %(group)s doesn't exist"
 msgstr "%(group)s csoport nem lÃ©tezik"
 
-#: ../roundup/scripts/roundup_server.py:626
+#: ../roundup/scripts/roundup_server.py:637
 msgid "Can't run as root!"
 msgstr "Nem futhat root-kÃ©nt!"
 
-#: ../roundup/scripts/roundup_server.py:629
+#: ../roundup/scripts/roundup_server.py:640
 msgid "WARNING: ignoring \"-u\" argument, not root"
 msgstr "FIGYELEM: \"-u\" opciÃ³ figyelmen kÃ­vÃ¼l hagyÃ¡sra kerÃ¼lt, nem root"
 
-#: ../roundup/scripts/roundup_server.py:635
+#: ../roundup/scripts/roundup_server.py:646
 msgid "Can't change users - no pwd module"
 msgstr "FelhasznÃ¡lÃ³vÃ¡ltÃ¡s nem sikerÃ¼lt - nincs pwd modul"
 
-#: ../roundup/scripts/roundup_server.py:644
+#: ../roundup/scripts/roundup_server.py:655
 #, python-format
 msgid "User %(user)s doesn't exist"
 msgstr "A(z) %(user)s felhasznÃ¡lÃ³ nem lÃ©tezik"
 
-#: ../roundup/scripts/roundup_server.py:856
+#: ../roundup/scripts/roundup_server.py:867
 #, python-format
 msgid "Multiprocess mode \"%s\" is not available, switching to single-process"
 msgstr "\"%s\" tÃ¶bbszÃ¡lÃº mÃ³d nem Ã©rhetÅ‘ el, Ã¡ttÃ©rÃ©s egyszÃ¡lÃº mÃ³dra"
 
-#: ../roundup/scripts/roundup_server.py:884
+#: ../roundup/scripts/roundup_server.py:895
 #, python-format
 msgid "Unable to bind to port %s, port already in use."
 msgstr "Nem sikerÃ¼lt a(z) %s portra csatlakozni, a port mÃ¡r hasznÃ¡latban van."
 
-#: ../roundup/scripts/roundup_server.py:888
+#: ../roundup/scripts/roundup_server.py:899
 #, fuzzy, python-format
 msgid ""
 "Unable to bind to port %(port)s, access not allowed, errno: %(errno)s %(msg)s"
 msgstr "Nem sikerÃ¼lt a(z) %s portra csatlakozni, a port mÃ¡r hasznÃ¡latban van."
 
-#: ../roundup/scripts/roundup_server.py:967
+#: ../roundup/scripts/roundup_server.py:978
 msgid ""
 " -c <Command>  Windows Service options.\n"
 "               If you want to run the server as a Windows Service, you\n"
@@ -3058,7 +3059,7 @@ msgid ""
 "               specifics."
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:974
+#: ../roundup/scripts/roundup_server.py:985
 msgid ""
 " -u <UID>      runs the Roundup web server as this UID\n"
 " -g <GID>      runs the Roundup web server as this GID\n"
@@ -3068,7 +3069,7 @@ msgid ""
 " -D            run the server in the foreground even when -d is used."
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:982
+#: ../roundup/scripts/roundup_server.py:993
 #, python-format
 msgid ""
 "\n"
@@ -3141,21 +3142,21 @@ msgid ""
 "   any url-unsafe characters like spaces, as these confuse IE.\n"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:1162
+#: ../roundup/scripts/roundup_server.py:1173
 msgid "Instances must be name=home"
 msgstr "A pÃ©ldÃ¡nyoknak nÃ©v=home formÃ¡ban kell lenniÃ¼k"
 
-#: ../roundup/scripts/roundup_server.py:1176
+#: ../roundup/scripts/roundup_server.py:1187
 #, python-format
 msgid "Configuration saved to %s"
 msgstr "BeÃ¡llÃ­tÃ¡sok elmentve ide: %s"
 
-#: ../roundup/scripts/roundup_server.py:1194
+#: ../roundup/scripts/roundup_server.py:1205
 msgid "Sorry, you can't run the server as a daemon on this Operating System"
 msgstr ""
 "ElnÃ©zÃ©st, ezen az operÃ¡ciÃ³s rendszeren a szerver nem indÃ­thatÃ³ dÃ©monkÃ©nt"
 
-#: ../roundup/scripts/roundup_server.py:1214
+#: ../roundup/scripts/roundup_server.py:1225
 #, python-format
 msgid "Roundup server started on %(HOST)s:%(PORT)s"
 msgstr "Roundup server elindÃ­tva a(z) %(HOST)s:%(PORT)s gÃ©pen"
diff --git a/locale/it.po b/locale/it.po
index b11d9324f..8b4d54795 100644
--- a/locale/it.po
+++ b/locale/it.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Roundup 2.5.0\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
-"POT-Creation-Date: 2024-12-30 22:49-0500\n"
+"POT-Creation-Date: 2025-01-12 20:17-0500\n"
 "PO-Revision-Date: 2013-10-31 12:20+0100\n"
 "Last-Translator: Marco Ghidinelli <marco.ghidinelli@ing.unibs.it>\n"
 "Language-Team: italian <it@li.org>\n"
@@ -1711,165 +1711,166 @@ msgstr ""
 "La notifica del problema Ã¨ stata notificata al manutentore del tracker.</p>\n"
 "</body></html>"
 
-#: ../roundup/cgi/client.py:666
+#: ../roundup/cgi/client.py:679
 msgid ""
 "XMLRPC endpoint is not using defusedxml. Improve security by installing "
 "defusedxml."
 msgstr ""
 
-#: ../roundup/cgi/client.py:728 ../roundup/cgi/client.py:1646
-#: ../roundup/cgi/client.py:728:1646
-msgid "Required Header Missing"
-msgstr ""
-
-#: ../roundup/cgi/client.py:731
+#: ../roundup/cgi/client.py:749 ../roundup/cgi/client.py:771
+#: ../roundup/cgi/client.py:749:771
 #, fuzzy
 msgid "Client is not allowed to use Rest Interface."
 msgstr ""
 "Gli utenti anonimi non hanno il permesso di utilizzare l'interfaccia web"
 
-#: ../roundup/cgi/client.py:985
+#: ../roundup/cgi/client.py:768 ../roundup/cgi/client.py:1682
+#: ../roundup/cgi/client.py:768:1682
+msgid "Required Header Missing"
+msgstr ""
+
+#: ../roundup/cgi/client.py:1021
 msgid "Form Error: "
 msgstr "Errore nella Form: "
 
-#: ../roundup/cgi/client.py:1078
+#: ../roundup/cgi/client.py:1114
 #, python-format
 msgid "Unrecognized charset: %r"
 msgstr "Codice di carattere sconosciuto: %r"
 
-#: ../roundup/cgi/client.py:1345 ../roundup/cgi/client.py:2357
-#: ../roundup/cgi/client.py:1345:2357
+#: ../roundup/cgi/client.py:1381 ../roundup/cgi/client.py:2394
+#: ../roundup/cgi/client.py:1381:2394
 msgid "broken form: multiple @action values submitted"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1362
+#: ../roundup/cgi/client.py:1398
 msgid "Anonymous users are not allowed to use the web interface"
 msgstr ""
 "Gli utenti anonimi non hanno il permesso di utilizzare l'interfaccia web"
 
-#: ../roundup/cgi/client.py:1507
+#: ../roundup/cgi/client.py:1543
 msgid "Referer header not available."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1511
+#: ../roundup/cgi/client.py:1547
 #, python-format
 msgid "csrf key used with wrong method from: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1540
+#: ../roundup/cgi/client.py:1576
 #, python-format
 msgid "csrf header %(header)s required but missing for user%(userid)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1544
+#: ../roundup/cgi/client.py:1580
 #, python-format
 msgid "Missing header: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1552
+#: ../roundup/cgi/client.py:1588
 #, python-format
 msgid "csrf Referer header check failed for user%(userid)s. Value=%(referer)s"
 msgstr ""
 
 # ../roundup/cgi/actions.py:931:935
-#: ../roundup/cgi/client.py:1557
+#: ../roundup/cgi/client.py:1593
 #, fuzzy, python-format
 msgid "Invalid Referer: %s"
 msgstr "Login invalida"
 
-#: ../roundup/cgi/client.py:1572
+#: ../roundup/cgi/client.py:1608
 #, python-format
 msgid "csrf Origin header check failed for user%(userid)s. Value=%(origin)s"
 msgstr ""
 
 # ../roundup/cgi/actions.py:931:935
-#: ../roundup/cgi/client.py:1577
+#: ../roundup/cgi/client.py:1613
 #, fuzzy, python-format
 msgid "Invalid Origin %s"
 msgstr "Login invalida"
 
-#: ../roundup/cgi/client.py:1591
+#: ../roundup/cgi/client.py:1627
 #, python-format
 msgid ""
 "csrf X-FORWARDED-HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1597
+#: ../roundup/cgi/client.py:1633
 #, python-format
 msgid "Invalid X-FORWARDED-HOST %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1616
+#: ../roundup/cgi/client.py:1652
 #, python-format
 msgid "csrf HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1621
+#: ../roundup/cgi/client.py:1657
 #, python-format
 msgid "Invalid HOST %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1629
+#: ../roundup/cgi/client.py:1665
 msgid "Csrf: unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1630
+#: ../roundup/cgi/client.py:1666
 msgid "Unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1643
+#: ../roundup/cgi/client.py:1679
 #, python-format
 msgid "csrf X-REQUESTED-WITH xmlrpc required header check failed for user%s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1684
+#: ../roundup/cgi/client.py:1720
 #, python-format
 msgid "Required csrf field missing for user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1686 ../roundup/cgi/client.py:1713
-#: ../roundup/cgi/client.py:1730 ../roundup/cgi/client.py:1686:1713:1730
+#: ../roundup/cgi/client.py:1722 ../roundup/cgi/client.py:1749
+#: ../roundup/cgi/client.py:1766 ../roundup/cgi/client.py:1722:1749:1766
 msgid ""
 "We can't validate your session (csrf failure). Re-enter any unsaved data and "
 "try again."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1690
+#: ../roundup/cgi/client.py:1726
 #, python-format
 msgid "csrf field not supplied by user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1702
+#: ../roundup/cgi/client.py:1738
 #, python-format
 msgid ""
 "Csrf mismatch user: current user %(user)s != stored user %(stored)s, current "
 "session, stored session: %(cur_sess)s,%(stor_sess)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1720
+#: ../roundup/cgi/client.py:1756
 #, python-format
 msgid ""
 "Csrf mismatch user: current session %(curr_sess)s != stored session "
 "%(stor_sess)s, current user/stored user is: %(user)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1912
+#: ../roundup/cgi/client.py:1948
 msgid "You are not allowed to view this file."
 msgstr "Non si dispone dei permessi per visualizzare questo file."
 
-#: ../roundup/cgi/client.py:2235
+#: ../roundup/cgi/client.py:2272
 #, python-format
 msgid "%(starttag)sTime elapsed: %(seconds)fs%(endtag)s\n"
 msgstr "%(starttag)sTempo trascorso: %(seconds)fs%(endtag)s\n"
 
-#: ../roundup/cgi/client.py:2239
+#: ../roundup/cgi/client.py:2276
 #, python-format
 msgid ""
 "%(starttag)sCache hits: %(cache_hits)d, misses %(cache_misses)d. Loading "
 "items: %(get_items)f secs. Filtering: %(filtering)f secs.%(endtag)s\n"
 msgstr ""
 
-#: ../roundup/cgi/client.py:2778
+#: ../roundup/cgi/client.py:2815
 #, python-format
 msgid ""
 "Cache failure: compressed file %(compressed)s is older than its source file "
@@ -2713,35 +2714,35 @@ msgstr "Login invalida"
 msgid "Api rate limits exceeded. Please wait: %s seconds."
 msgstr ""
 
-#: ../roundup/rest.py:2283
+#: ../roundup/rest.py:2284
 #, python-format
 msgid ""
-"Content type '%s' requested in URL is not available.\n"
-"Acceptable types: %s\n"
+"Content type '%(requested)s' requested in URL is not available.\n"
+"Acceptable types: %(acceptable)s\n"
 msgstr ""
 
-#: ../roundup/rest.py:2304
+#: ../roundup/rest.py:2306
 #, python-format
 msgid ""
 "Unable to parse Accept Header. %(error)s. Acceptable types: */*, "
 "%(acceptable_types)s"
 msgstr ""
 
-#: ../roundup/rest.py:2376 ../roundup/rest.py:2597 ../roundup/rest.py:2376:2597
+#: ../roundup/rest.py:2378 ../roundup/rest.py:2603 ../roundup/rest.py:2378:2603
 #, python-format
 msgid ""
 "Unrecognized api version: %s. See /rest without specifying api version for "
 "supported versions."
 msgstr ""
 
-#: ../roundup/rest.py:2411 ../roundup/rest.py:2420 ../roundup/rest.py:2411:2420
+#: ../roundup/rest.py:2413 ../roundup/rest.py:2424 ../roundup/rest.py:2413:2424
 #, python-format
 msgid ""
-"Requested content type(s) '%s' not available.\n"
-"Acceptable mime types are: */*, %s"
+"Requested content type(s) '%(requested)s' not available.\n"
+"Acceptable mime types are: */*, %(acceptable)s"
 msgstr ""
 
-#: ../roundup/rest.py:2696
+#: ../roundup/rest.py:2702
 msgid ""
 "Internal error while formatting response.\n"
 "accept_mime_type is not defined. This should\n"
@@ -2939,7 +2940,7 @@ msgid ""
 "  '-----END CERTIFICATE-----' markers?"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:345
+#: ../roundup/scripts/roundup_server.py:354
 msgid ""
 "<html><head><title>Roundup trackers index</title></head>\n"
 "<body><h1>Roundup trackers index</h1><ol>\n"
@@ -2947,60 +2948,60 @@ msgstr ""
 "<html><head><title>indice dei ticket Roundup</title></head>\n"
 "<body><h1>indice dei ticket Roundup</h1><ol>\n"
 
-#: ../roundup/scripts/roundup_server.py:587
+#: ../roundup/scripts/roundup_server.py:598
 #, fuzzy, python-format
 msgid "Error: %(type)s: %(value)s"
 msgstr "%(key)s:Â·%(value)s"
 
-#: ../roundup/scripts/roundup_server.py:599
+#: ../roundup/scripts/roundup_server.py:610
 msgid "WARNING: ignoring \"-g\" argument, not root"
 msgstr "ATTENZIONE: ignoro il parametro \"-g\", non sei root"
 
-#: ../roundup/scripts/roundup_server.py:605
+#: ../roundup/scripts/roundup_server.py:616
 msgid "Can't change groups - no grp module"
 msgstr "Non Ã¨ possibile cambiare gruppo - nessun modulo grp"
 
-#: ../roundup/scripts/roundup_server.py:614
+#: ../roundup/scripts/roundup_server.py:625
 #, python-format
 msgid "Group %(group)s doesn't exist"
 msgstr "Il gruppo %(group)s non esiste"
 
-#: ../roundup/scripts/roundup_server.py:626
+#: ../roundup/scripts/roundup_server.py:637
 msgid "Can't run as root!"
 msgstr "Non puÃ² essere eseguito come root!"
 
-#: ../roundup/scripts/roundup_server.py:629
+#: ../roundup/scripts/roundup_server.py:640
 msgid "WARNING: ignoring \"-u\" argument, not root"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:635
+#: ../roundup/scripts/roundup_server.py:646
 msgid "Can't change users - no pwd module"
 msgstr "Non Ã¨ possibile cambiare utente - nessun modulo pwd"
 
-#: ../roundup/scripts/roundup_server.py:644
+#: ../roundup/scripts/roundup_server.py:655
 #, python-format
 msgid "User %(user)s doesn't exist"
 msgstr "L'utente %(user)s non esiste"
 
-#: ../roundup/scripts/roundup_server.py:856
+#: ../roundup/scripts/roundup_server.py:867
 #, python-format
 msgid "Multiprocess mode \"%s\" is not available, switching to single-process"
 msgstr ""
 "La modalitÃ  multiprocesso \"%s\" non Ã¨ disponibile, viene utilizzata quella "
 "a singolo processo"
 
-#: ../roundup/scripts/roundup_server.py:884
+#: ../roundup/scripts/roundup_server.py:895
 #, python-format
 msgid "Unable to bind to port %s, port already in use."
 msgstr "Impossibile bindare alla porta %s, la porta risulta giÃ  in uso."
 
-#: ../roundup/scripts/roundup_server.py:888
+#: ../roundup/scripts/roundup_server.py:899
 #, fuzzy, python-format
 msgid ""
 "Unable to bind to port %(port)s, access not allowed, errno: %(errno)s %(msg)s"
 msgstr "Impossibile bindare alla porta %s, la porta risulta giÃ  in uso."
 
-#: ../roundup/scripts/roundup_server.py:967
+#: ../roundup/scripts/roundup_server.py:978
 msgid ""
 " -c <Command>  Windows Service options.\n"
 "               If you want to run the server as a Windows Service, you\n"
@@ -3010,7 +3011,7 @@ msgid ""
 "               specifics."
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:974
+#: ../roundup/scripts/roundup_server.py:985
 msgid ""
 " -u <UID>      runs the Roundup web server as this UID\n"
 " -g <GID>      runs the Roundup web server as this GID\n"
@@ -3020,7 +3021,7 @@ msgid ""
 " -D            run the server in the foreground even when -d is used."
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:982
+#: ../roundup/scripts/roundup_server.py:993
 #, python-format
 msgid ""
 "\n"
@@ -3093,22 +3094,22 @@ msgid ""
 "   any url-unsafe characters like spaces, as these confuse IE.\n"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:1162
+#: ../roundup/scripts/roundup_server.py:1173
 msgid "Instances must be name=home"
 msgstr "L'istanza deve essere nel formato nome=home"
 
-#: ../roundup/scripts/roundup_server.py:1176
+#: ../roundup/scripts/roundup_server.py:1187
 #, python-format
 msgid "Configuration saved to %s"
 msgstr "Configurazione salvata in %s"
 
-#: ../roundup/scripts/roundup_server.py:1194
+#: ../roundup/scripts/roundup_server.py:1205
 msgid "Sorry, you can't run the server as a daemon on this Operating System"
 msgstr ""
 "Spiacente, non Ã¨ possibile utilizzare il server come demone su questo "
 "sistema operativo."
 
-#: ../roundup/scripts/roundup_server.py:1214
+#: ../roundup/scripts/roundup_server.py:1225
 #, python-format
 msgid "Roundup server started on %(HOST)s:%(PORT)s"
 msgstr "Il server Roundup Ã¨ stato attivato su %(HOST)s:%(PORT)s"
diff --git a/locale/ja.po b/locale/ja.po
index 73cdf6220..603a69588 100644
--- a/locale/ja.po
+++ b/locale/ja.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Roundup 2.5.0\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
-"POT-Creation-Date: 2024-12-30 22:49-0500\n"
+"POT-Creation-Date: 2025-01-12 20:17-0500\n"
 "PO-Revision-Date: 2013-10-31 12:20+0100\n"
 "Last-Translator: Yasushi Iwata <iwata@know-net.co.jp>\n"
 "Language-Team: Yasushi Iwata <iwata@know-net.co.jp>\n"
@@ -1662,161 +1662,162 @@ msgid ""
 "</body></html>"
 msgstr ""
 
-#: ../roundup/cgi/client.py:666
+#: ../roundup/cgi/client.py:679
 msgid ""
 "XMLRPC endpoint is not using defusedxml. Improve security by installing "
 "defusedxml."
 msgstr ""
 
-#: ../roundup/cgi/client.py:728 ../roundup/cgi/client.py:1646
-#: ../roundup/cgi/client.py:728:1646
-msgid "Required Header Missing"
-msgstr ""
-
-#: ../roundup/cgi/client.py:731
+#: ../roundup/cgi/client.py:749 ../roundup/cgi/client.py:771
+#: ../roundup/cgi/client.py:749:771
 #, fuzzy
 msgid "Client is not allowed to use Rest Interface."
 msgstr "ã‚¯ã‚¨ãƒªãƒ¼ç·¨é›†ã®æ¨©é™ãŒã‚ã‚Šã¾ã›ã‚“ã€‚"
 
-#: ../roundup/cgi/client.py:985
+#: ../roundup/cgi/client.py:768 ../roundup/cgi/client.py:1682
+#: ../roundup/cgi/client.py:768:1682
+msgid "Required Header Missing"
+msgstr ""
+
+#: ../roundup/cgi/client.py:1021
 msgid "Form Error: "
 msgstr ""
 
-#: ../roundup/cgi/client.py:1078
+#: ../roundup/cgi/client.py:1114
 #, python-format
 msgid "Unrecognized charset: %r"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1345 ../roundup/cgi/client.py:2357
-#: ../roundup/cgi/client.py:1345:2357
+#: ../roundup/cgi/client.py:1381 ../roundup/cgi/client.py:2394
+#: ../roundup/cgi/client.py:1381:2394
 msgid "broken form: multiple @action values submitted"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1362
+#: ../roundup/cgi/client.py:1398
 msgid "Anonymous users are not allowed to use the web interface"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1507
+#: ../roundup/cgi/client.py:1543
 msgid "Referer header not available."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1511
+#: ../roundup/cgi/client.py:1547
 #, python-format
 msgid "csrf key used with wrong method from: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1540
+#: ../roundup/cgi/client.py:1576
 #, python-format
 msgid "csrf header %(header)s required but missing for user%(userid)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1544
+#: ../roundup/cgi/client.py:1580
 #, python-format
 msgid "Missing header: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1552
+#: ../roundup/cgi/client.py:1588
 #, python-format
 msgid "csrf Referer header check failed for user%(userid)s. Value=%(referer)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1557
+#: ../roundup/cgi/client.py:1593
 #, fuzzy, python-format
 msgid "Invalid Referer: %s"
 msgstr "ä¸æ­£ãªãƒªã‚¯ã‚¨ã‚¹ãƒˆ"
 
-#: ../roundup/cgi/client.py:1572
+#: ../roundup/cgi/client.py:1608
 #, python-format
 msgid "csrf Origin header check failed for user%(userid)s. Value=%(origin)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1577
+#: ../roundup/cgi/client.py:1613
 #, fuzzy, python-format
 msgid "Invalid Origin %s"
 msgstr "ä¸æ­£ãªãƒªã‚¯ã‚¨ã‚¹ãƒˆ"
 
-#: ../roundup/cgi/client.py:1591
+#: ../roundup/cgi/client.py:1627
 #, python-format
 msgid ""
 "csrf X-FORWARDED-HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1597
+#: ../roundup/cgi/client.py:1633
 #, python-format
 msgid "Invalid X-FORWARDED-HOST %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1616
+#: ../roundup/cgi/client.py:1652
 #, python-format
 msgid "csrf HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1621
+#: ../roundup/cgi/client.py:1657
 #, fuzzy, python-format
 msgid "Invalid HOST %s"
 msgstr "ä¸æ­£ãªãƒªã‚¯ã‚¨ã‚¹ãƒˆ"
 
-#: ../roundup/cgi/client.py:1629
+#: ../roundup/cgi/client.py:1665
 msgid "Csrf: unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1630
+#: ../roundup/cgi/client.py:1666
 msgid "Unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1643
+#: ../roundup/cgi/client.py:1679
 #, python-format
 msgid "csrf X-REQUESTED-WITH xmlrpc required header check failed for user%s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1684
+#: ../roundup/cgi/client.py:1720
 #, python-format
 msgid "Required csrf field missing for user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1686 ../roundup/cgi/client.py:1713
-#: ../roundup/cgi/client.py:1730 ../roundup/cgi/client.py:1686:1713:1730
+#: ../roundup/cgi/client.py:1722 ../roundup/cgi/client.py:1749
+#: ../roundup/cgi/client.py:1766 ../roundup/cgi/client.py:1722:1749:1766
 msgid ""
 "We can't validate your session (csrf failure). Re-enter any unsaved data and "
 "try again."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1690
+#: ../roundup/cgi/client.py:1726
 #, python-format
 msgid "csrf field not supplied by user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1702
+#: ../roundup/cgi/client.py:1738
 #, python-format
 msgid ""
 "Csrf mismatch user: current user %(user)s != stored user %(stored)s, current "
 "session, stored session: %(cur_sess)s,%(stor_sess)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1720
+#: ../roundup/cgi/client.py:1756
 #, python-format
 msgid ""
 "Csrf mismatch user: current session %(curr_sess)s != stored session "
 "%(stor_sess)s, current user/stored user is: %(user)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1912
+#: ../roundup/cgi/client.py:1948
 msgid "You are not allowed to view this file."
 msgstr ""
 
-#: ../roundup/cgi/client.py:2235
+#: ../roundup/cgi/client.py:2272
 #, python-format
 msgid "%(starttag)sTime elapsed: %(seconds)fs%(endtag)s\n"
 msgstr ""
 
-#: ../roundup/cgi/client.py:2239
+#: ../roundup/cgi/client.py:2276
 #, python-format
 msgid ""
 "%(starttag)sCache hits: %(cache_hits)d, misses %(cache_misses)d. Loading "
 "items: %(get_items)f secs. Filtering: %(filtering)f secs.%(endtag)s\n"
 msgstr ""
 
-#: ../roundup/cgi/client.py:2778
+#: ../roundup/cgi/client.py:2815
 #, python-format
 msgid ""
 "Cache failure: compressed file %(compressed)s is older than its source file "
@@ -2561,35 +2562,35 @@ msgstr "ä¸æ­£ãªãƒªã‚¯ã‚¨ã‚¹ãƒˆ"
 msgid "Api rate limits exceeded. Please wait: %s seconds."
 msgstr ""
 
-#: ../roundup/rest.py:2283
+#: ../roundup/rest.py:2284
 #, python-format
 msgid ""
-"Content type '%s' requested in URL is not available.\n"
-"Acceptable types: %s\n"
+"Content type '%(requested)s' requested in URL is not available.\n"
+"Acceptable types: %(acceptable)s\n"
 msgstr ""
 
-#: ../roundup/rest.py:2304
+#: ../roundup/rest.py:2306
 #, python-format
 msgid ""
 "Unable to parse Accept Header. %(error)s. Acceptable types: */*, "
 "%(acceptable_types)s"
 msgstr ""
 
-#: ../roundup/rest.py:2376 ../roundup/rest.py:2597 ../roundup/rest.py:2376:2597
+#: ../roundup/rest.py:2378 ../roundup/rest.py:2603 ../roundup/rest.py:2378:2603
 #, python-format
 msgid ""
 "Unrecognized api version: %s. See /rest without specifying api version for "
 "supported versions."
 msgstr ""
 
-#: ../roundup/rest.py:2411 ../roundup/rest.py:2420 ../roundup/rest.py:2411:2420
+#: ../roundup/rest.py:2413 ../roundup/rest.py:2424 ../roundup/rest.py:2413:2424
 #, python-format
 msgid ""
-"Requested content type(s) '%s' not available.\n"
-"Acceptable mime types are: */*, %s"
+"Requested content type(s) '%(requested)s' not available.\n"
+"Acceptable mime types are: */*, %(acceptable)s"
 msgstr ""
 
-#: ../roundup/rest.py:2696
+#: ../roundup/rest.py:2702
 msgid ""
 "Internal error while formatting response.\n"
 "accept_mime_type is not defined. This should\n"
@@ -2773,64 +2774,64 @@ msgid ""
 "  '-----END CERTIFICATE-----' markers?"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:345
+#: ../roundup/scripts/roundup_server.py:354
 msgid ""
 "<html><head><title>Roundup trackers index</title></head>\n"
 "<body><h1>Roundup trackers index</h1><ol>\n"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:587
+#: ../roundup/scripts/roundup_server.py:598
 #, python-format
 msgid "Error: %(type)s: %(value)s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:599
+#: ../roundup/scripts/roundup_server.py:610
 msgid "WARNING: ignoring \"-g\" argument, not root"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:605
+#: ../roundup/scripts/roundup_server.py:616
 msgid "Can't change groups - no grp module"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:614
+#: ../roundup/scripts/roundup_server.py:625
 #, python-format
 msgid "Group %(group)s doesn't exist"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:626
+#: ../roundup/scripts/roundup_server.py:637
 msgid "Can't run as root!"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:629
+#: ../roundup/scripts/roundup_server.py:640
 msgid "WARNING: ignoring \"-u\" argument, not root"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:635
+#: ../roundup/scripts/roundup_server.py:646
 msgid "Can't change users - no pwd module"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:644
+#: ../roundup/scripts/roundup_server.py:655
 #, python-format
 msgid "User %(user)s doesn't exist"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:856
+#: ../roundup/scripts/roundup_server.py:867
 #, python-format
 msgid "Multiprocess mode \"%s\" is not available, switching to single-process"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:884
+#: ../roundup/scripts/roundup_server.py:895
 #, python-format
 msgid "Unable to bind to port %s, port already in use."
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:888
+#: ../roundup/scripts/roundup_server.py:899
 #, python-format
 msgid ""
 "Unable to bind to port %(port)s, access not allowed, errno: %(errno)s %(msg)s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:967
+#: ../roundup/scripts/roundup_server.py:978
 msgid ""
 " -c <Command>  Windows Service options.\n"
 "               If you want to run the server as a Windows Service, you\n"
@@ -2840,7 +2841,7 @@ msgid ""
 "               specifics."
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:974
+#: ../roundup/scripts/roundup_server.py:985
 msgid ""
 " -u <UID>      runs the Roundup web server as this UID\n"
 " -g <GID>      runs the Roundup web server as this GID\n"
@@ -2850,7 +2851,7 @@ msgid ""
 " -D            run the server in the foreground even when -d is used."
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:982
+#: ../roundup/scripts/roundup_server.py:993
 #, python-format
 msgid ""
 "\n"
@@ -2923,20 +2924,20 @@ msgid ""
 "   any url-unsafe characters like spaces, as these confuse IE.\n"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:1162
+#: ../roundup/scripts/roundup_server.py:1173
 msgid "Instances must be name=home"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:1176
+#: ../roundup/scripts/roundup_server.py:1187
 #, python-format
 msgid "Configuration saved to %s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:1194
+#: ../roundup/scripts/roundup_server.py:1205
 msgid "Sorry, you can't run the server as a daemon on this Operating System"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:1214
+#: ../roundup/scripts/roundup_server.py:1225
 #, python-format
 msgid "Roundup server started on %(HOST)s:%(PORT)s"
 msgstr ""
diff --git a/locale/lt.po b/locale/lt.po
index fee99e9bf..3865ce239 100644
--- a/locale/lt.po
+++ b/locale/lt.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Roundup 2.5.0\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
-"POT-Creation-Date: 2024-12-30 22:49-0500\n"
+"POT-Creation-Date: 2025-01-12 20:17-0500\n"
 "PO-Revision-Date: 2013-10-31 12:21+0100\n"
 "Last-Translator: Nerijus Baliunas <nerijus@users.sourceforge.net>\n"
 "Language-Team: \n"
@@ -2088,156 +2088,157 @@ msgstr ""
 "Apie klaidÄ… praneÅ¡Ä—me tracker'io administratoriui.</p>\n"
 "</body></html>"
 
-#: ../roundup/cgi/client.py:666
+#: ../roundup/cgi/client.py:679
 msgid ""
 "XMLRPC endpoint is not using defusedxml. Improve security by installing "
 "defusedxml."
 msgstr ""
 
-#: ../roundup/cgi/client.py:728 ../roundup/cgi/client.py:1646
-#: ../roundup/cgi/client.py:728:1646
-msgid "Required Header Missing"
-msgstr ""
-
-#: ../roundup/cgi/client.py:731
+#: ../roundup/cgi/client.py:749 ../roundup/cgi/client.py:771
+#: ../roundup/cgi/client.py:749:771
 #, fuzzy
 msgid "Client is not allowed to use Rest Interface."
 msgstr "Anoniminiai vartotojai neturi teisiÅ³ naudoti web interfeisÄ…"
 
-#: ../roundup/cgi/client.py:985
+#: ../roundup/cgi/client.py:768 ../roundup/cgi/client.py:1682
+#: ../roundup/cgi/client.py:768:1682
+msgid "Required Header Missing"
+msgstr ""
+
+#: ../roundup/cgi/client.py:1021
 msgid "Form Error: "
 msgstr "Formos klaida: "
 
-#: ../roundup/cgi/client.py:1078
+#: ../roundup/cgi/client.py:1114
 #, python-format
 msgid "Unrecognized charset: %r"
 msgstr "NeatpaÅ¾inta koduotÄ—: %r"
 
-#: ../roundup/cgi/client.py:1345 ../roundup/cgi/client.py:2357
-#: ../roundup/cgi/client.py:1345:2357
+#: ../roundup/cgi/client.py:1381 ../roundup/cgi/client.py:2394
+#: ../roundup/cgi/client.py:1381:2394
 msgid "broken form: multiple @action values submitted"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1362
+#: ../roundup/cgi/client.py:1398
 msgid "Anonymous users are not allowed to use the web interface"
 msgstr "Anoniminiai vartotojai neturi teisiÅ³ naudoti web interfeisÄ…"
 
-#: ../roundup/cgi/client.py:1507
+#: ../roundup/cgi/client.py:1543
 msgid "Referer header not available."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1511
+#: ../roundup/cgi/client.py:1547
 #, python-format
 msgid "csrf key used with wrong method from: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1540
+#: ../roundup/cgi/client.py:1576
 #, python-format
 msgid "csrf header %(header)s required but missing for user%(userid)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1544
+#: ../roundup/cgi/client.py:1580
 #, python-format
 msgid "Missing header: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1552
+#: ../roundup/cgi/client.py:1588
 #, python-format
 msgid "csrf Referer header check failed for user%(userid)s. Value=%(referer)s"
 msgstr ""
 
 # ../roundup/cgi/actions.py:897 :901
-#: ../roundup/cgi/client.py:1557
+#: ../roundup/cgi/client.py:1593
 #, fuzzy, python-format
 msgid "Invalid Referer: %s"
 msgstr "Neteisingas vartotojo vardas ar slaptaÅ¾odis"
 
-#: ../roundup/cgi/client.py:1572
+#: ../roundup/cgi/client.py:1608
 #, python-format
 msgid "csrf Origin header check failed for user%(userid)s. Value=%(origin)s"
 msgstr ""
 
 # ../roundup/cgi/actions.py:897 :901
-#: ../roundup/cgi/client.py:1577
+#: ../roundup/cgi/client.py:1613
 #, fuzzy, python-format
 msgid "Invalid Origin %s"
 msgstr "Neteisingas vartotojo vardas ar slaptaÅ¾odis"
 
-#: ../roundup/cgi/client.py:1591
+#: ../roundup/cgi/client.py:1627
 #, python-format
 msgid ""
 "csrf X-FORWARDED-HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1597
+#: ../roundup/cgi/client.py:1633
 #, python-format
 msgid "Invalid X-FORWARDED-HOST %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1616
+#: ../roundup/cgi/client.py:1652
 #, python-format
 msgid "csrf HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1621
+#: ../roundup/cgi/client.py:1657
 #, python-format
 msgid "Invalid HOST %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1629
+#: ../roundup/cgi/client.py:1665
 msgid "Csrf: unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1630
+#: ../roundup/cgi/client.py:1666
 msgid "Unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1643
+#: ../roundup/cgi/client.py:1679
 #, python-format
 msgid "csrf X-REQUESTED-WITH xmlrpc required header check failed for user%s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1684
+#: ../roundup/cgi/client.py:1720
 #, python-format
 msgid "Required csrf field missing for user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1686 ../roundup/cgi/client.py:1713
-#: ../roundup/cgi/client.py:1730 ../roundup/cgi/client.py:1686:1713:1730
+#: ../roundup/cgi/client.py:1722 ../roundup/cgi/client.py:1749
+#: ../roundup/cgi/client.py:1766 ../roundup/cgi/client.py:1722:1749:1766
 msgid ""
 "We can't validate your session (csrf failure). Re-enter any unsaved data and "
 "try again."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1690
+#: ../roundup/cgi/client.py:1726
 #, python-format
 msgid "csrf field not supplied by user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1702
+#: ../roundup/cgi/client.py:1738
 #, python-format
 msgid ""
 "Csrf mismatch user: current user %(user)s != stored user %(stored)s, current "
 "session, stored session: %(cur_sess)s,%(stor_sess)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1720
+#: ../roundup/cgi/client.py:1756
 #, python-format
 msgid ""
 "Csrf mismatch user: current session %(curr_sess)s != stored session "
 "%(stor_sess)s, current user/stored user is: %(user)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1912
+#: ../roundup/cgi/client.py:1948
 msgid "You are not allowed to view this file."
 msgstr "JÅ«s neturite teisiÅ³ Å¾iÅ«rÄ—ti Å¡Ä¯ failÄ…."
 
-#: ../roundup/cgi/client.py:2235
+#: ../roundup/cgi/client.py:2272
 #, python-format
 msgid "%(starttag)sTime elapsed: %(seconds)fs%(endtag)s\n"
 msgstr "%(starttag)sPraÄ—jÄ™s laikas: %(seconds)fs%(endtag)s\n"
 
-#: ../roundup/cgi/client.py:2239
+#: ../roundup/cgi/client.py:2276
 #, python-format
 msgid ""
 "%(starttag)sCache hits: %(cache_hits)d, misses %(cache_misses)d. Loading "
@@ -2247,7 +2248,7 @@ msgstr ""
 "%(cache_misses)d. Ä®keliami elementai: %(get_items)f sek. Filtruojama: "
 "%(filtering)f sek.%(endtag)s\n"
 
-#: ../roundup/cgi/client.py:2778
+#: ../roundup/cgi/client.py:2815
 #, python-format
 msgid ""
 "Cache failure: compressed file %(compressed)s is older than its source file "
@@ -3082,35 +3083,35 @@ msgstr "Neteisingas vartotojo vardas ar slaptaÅ¾odis"
 msgid "Api rate limits exceeded. Please wait: %s seconds."
 msgstr ""
 
-#: ../roundup/rest.py:2283
+#: ../roundup/rest.py:2284
 #, python-format
 msgid ""
-"Content type '%s' requested in URL is not available.\n"
-"Acceptable types: %s\n"
+"Content type '%(requested)s' requested in URL is not available.\n"
+"Acceptable types: %(acceptable)s\n"
 msgstr ""
 
-#: ../roundup/rest.py:2304
+#: ../roundup/rest.py:2306
 #, python-format
 msgid ""
 "Unable to parse Accept Header. %(error)s. Acceptable types: */*, "
 "%(acceptable_types)s"
 msgstr ""
 
-#: ../roundup/rest.py:2376 ../roundup/rest.py:2597 ../roundup/rest.py:2376:2597
+#: ../roundup/rest.py:2378 ../roundup/rest.py:2603 ../roundup/rest.py:2378:2603
 #, python-format
 msgid ""
 "Unrecognized api version: %s. See /rest without specifying api version for "
 "supported versions."
 msgstr ""
 
-#: ../roundup/rest.py:2411 ../roundup/rest.py:2420 ../roundup/rest.py:2411:2420
+#: ../roundup/rest.py:2413 ../roundup/rest.py:2424 ../roundup/rest.py:2413:2424
 #, python-format
 msgid ""
-"Requested content type(s) '%s' not available.\n"
-"Acceptable mime types are: */*, %s"
+"Requested content type(s) '%(requested)s' not available.\n"
+"Acceptable mime types are: */*, %(acceptable)s"
 msgstr ""
 
-#: ../roundup/rest.py:2696
+#: ../roundup/rest.py:2702
 msgid ""
 "Internal error while formatting response.\n"
 "accept_mime_type is not defined. This should\n"
@@ -3302,7 +3303,7 @@ msgid ""
 "  '-----END CERTIFICATE-----' markers?"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:345
+#: ../roundup/scripts/roundup_server.py:354
 msgid ""
 "<html><head><title>Roundup trackers index</title></head>\n"
 "<body><h1>Roundup trackers index</h1><ol>\n"
@@ -3310,58 +3311,58 @@ msgstr ""
 "<html><head><title>Roundup tracker'io indeksas</title></head>\n"
 "<body><h1>Roundup tracker'io indeksas</h1><ol>\n"
 
-#: ../roundup/scripts/roundup_server.py:587
+#: ../roundup/scripts/roundup_server.py:598
 #, fuzzy, python-format
 msgid "Error: %(type)s: %(value)s"
 msgstr "%(key)s: %(value)s"
 
-#: ../roundup/scripts/roundup_server.py:599
+#: ../roundup/scripts/roundup_server.py:610
 msgid "WARNING: ignoring \"-g\" argument, not root"
 msgstr "PERSPÄ–JIMAS: \"-g\" argumentas ignoruojamas, nÄ—ra root teisiÅ³"
 
-#: ../roundup/scripts/roundup_server.py:605
+#: ../roundup/scripts/roundup_server.py:616
 msgid "Can't change groups - no grp module"
 msgstr "Negaliu pakeisti grupiÅ³ -- nÄ—ra grp modulio"
 
-#: ../roundup/scripts/roundup_server.py:614
+#: ../roundup/scripts/roundup_server.py:625
 #, python-format
 msgid "Group %(group)s doesn't exist"
 msgstr "GrupÄ—s %(group)s nÄ—ra"
 
-#: ../roundup/scripts/roundup_server.py:626
+#: ../roundup/scripts/roundup_server.py:637
 msgid "Can't run as root!"
 msgstr "Negaliu paleisti root teisÄ—mis!"
 
-#: ../roundup/scripts/roundup_server.py:629
+#: ../roundup/scripts/roundup_server.py:640
 msgid "WARNING: ignoring \"-u\" argument, not root"
 msgstr "PERSPÄ–JIMAS: \"-u\" argumentas ignoruojamas, nÄ—ra root teisiÅ³"
 
-#: ../roundup/scripts/roundup_server.py:635
+#: ../roundup/scripts/roundup_server.py:646
 msgid "Can't change users - no pwd module"
 msgstr "Negaliu pakesiti vartotojÅ³ - nÄ—ra pwd modulio"
 
-#: ../roundup/scripts/roundup_server.py:644
+#: ../roundup/scripts/roundup_server.py:655
 #, python-format
 msgid "User %(user)s doesn't exist"
 msgstr "Vartotojo %(user)s nÄ—ra"
 
-#: ../roundup/scripts/roundup_server.py:856
+#: ../roundup/scripts/roundup_server.py:867
 #, python-format
 msgid "Multiprocess mode \"%s\" is not available, switching to single-process"
 msgstr "MultiprocesinÄ— aplinka \"%s\" neprieinama, perjungiu Ä¯ vienprocesinÄ™"
 
-#: ../roundup/scripts/roundup_server.py:884
+#: ../roundup/scripts/roundup_server.py:895
 #, python-format
 msgid "Unable to bind to port %s, port already in use."
 msgstr "Negaliu prijungti prie jungties %s, jungtis jau naudojama."
 
-#: ../roundup/scripts/roundup_server.py:888
+#: ../roundup/scripts/roundup_server.py:899
 #, fuzzy, python-format
 msgid ""
 "Unable to bind to port %(port)s, access not allowed, errno: %(errno)s %(msg)s"
 msgstr "Negaliu prijungti prie jungties %s, jungtis jau naudojama."
 
-#: ../roundup/scripts/roundup_server.py:967
+#: ../roundup/scripts/roundup_server.py:978
 msgid ""
 " -c <Command>  Windows Service options.\n"
 "               If you want to run the server as a Windows Service, you\n"
@@ -3378,7 +3379,7 @@ msgstr ""
 "               Ä®vedÄ™ \"roundup-server -c help\" pamatysite Windows Services\n"
 "               specifikÄ…."
 
-#: ../roundup/scripts/roundup_server.py:974
+#: ../roundup/scripts/roundup_server.py:985
 #, fuzzy
 msgid ""
 " -u <UID>      runs the Roundup web server as this UID\n"
@@ -3394,7 +3395,7 @@ msgstr ""
 "               nurodytÄ… PIDfaile. Parinktis -l *privalo* bÅ«ti nurodyta\n"
 "               jei naudojama -d."
 
-#: ../roundup/scripts/roundup_server.py:982
+#: ../roundup/scripts/roundup_server.py:993
 #, fuzzy, python-format
 msgid ""
 "\n"
@@ -3520,21 +3521,21 @@ msgstr ""
 "   nesupras.\n"
 "\n"
 
-#: ../roundup/scripts/roundup_server.py:1162
+#: ../roundup/scripts/roundup_server.py:1173
 msgid "Instances must be name=home"
 msgstr "Egzempliorius turi bÅ«ti nurodomas taip: vardas=namÅ³_direktorija"
 
-#: ../roundup/scripts/roundup_server.py:1176
+#: ../roundup/scripts/roundup_server.py:1187
 #, python-format
 msgid "Configuration saved to %s"
 msgstr "KonfigÅ«racija iÅ¡saugota %s"
 
-#: ../roundup/scripts/roundup_server.py:1194
+#: ../roundup/scripts/roundup_server.py:1205
 msgid "Sorry, you can't run the server as a daemon on this Operating System"
 msgstr ""
 "JÅ«s negalite paleisti serverio kaip daemon'o Å¡ioje operacinÄ—je sistemoje"
 
-#: ../roundup/scripts/roundup_server.py:1214
+#: ../roundup/scripts/roundup_server.py:1225
 #, python-format
 msgid "Roundup server started on %(HOST)s:%(PORT)s"
 msgstr "Roundup serveris paleistas ant %(HOST)s:%(PORT)s"
diff --git a/locale/nb.po b/locale/nb.po
index a51e8b4b0..d224c3596 100644
--- a/locale/nb.po
+++ b/locale/nb.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Roundup 2.5.0\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
-"POT-Creation-Date: 2024-12-30 22:49-0500\n"
+"POT-Creation-Date: 2025-01-12 20:17-0500\n"
 "PO-Revision-Date: 2013-10-31 12:21+0100\n"
 "Last-Translator: Christian Aastorp <christian.aastorp@gmail.com>\n"
 "Language-Team: Norwegian Bokmal <LL@li.org>\n"
@@ -2076,154 +2076,155 @@ msgid ""
 "</body></html>"
 msgstr ""
 
-#: ../roundup/cgi/client.py:666
+#: ../roundup/cgi/client.py:679
 msgid ""
 "XMLRPC endpoint is not using defusedxml. Improve security by installing "
 "defusedxml."
 msgstr ""
 
-#: ../roundup/cgi/client.py:728 ../roundup/cgi/client.py:1646
-#: ../roundup/cgi/client.py:728:1646
-msgid "Required Header Missing"
-msgstr ""
-
-#: ../roundup/cgi/client.py:731
+#: ../roundup/cgi/client.py:749 ../roundup/cgi/client.py:771
+#: ../roundup/cgi/client.py:749:771
 #, fuzzy
 msgid "Client is not allowed to use Rest Interface."
 msgstr "Anonyme brukere fÃ¥r ikke benytte web-grensesnittet"
 
-#: ../roundup/cgi/client.py:985
+#: ../roundup/cgi/client.py:768 ../roundup/cgi/client.py:1682
+#: ../roundup/cgi/client.py:768:1682
+msgid "Required Header Missing"
+msgstr ""
+
+#: ../roundup/cgi/client.py:1021
 msgid "Form Error: "
 msgstr "Skjema feil:"
 
-#: ../roundup/cgi/client.py:1078
+#: ../roundup/cgi/client.py:1114
 #, python-format
 msgid "Unrecognized charset: %r"
 msgstr "Ukjent tegnsett: %r"
 
-#: ../roundup/cgi/client.py:1345 ../roundup/cgi/client.py:2357
-#: ../roundup/cgi/client.py:1345:2357
+#: ../roundup/cgi/client.py:1381 ../roundup/cgi/client.py:2394
+#: ../roundup/cgi/client.py:1381:2394
 msgid "broken form: multiple @action values submitted"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1362
+#: ../roundup/cgi/client.py:1398
 msgid "Anonymous users are not allowed to use the web interface"
 msgstr "Anonyme brukere fÃ¥r ikke benytte web-grensesnittet"
 
-#: ../roundup/cgi/client.py:1507
+#: ../roundup/cgi/client.py:1543
 msgid "Referer header not available."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1511
+#: ../roundup/cgi/client.py:1547
 #, python-format
 msgid "csrf key used with wrong method from: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1540
+#: ../roundup/cgi/client.py:1576
 #, python-format
 msgid "csrf header %(header)s required but missing for user%(userid)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1544
+#: ../roundup/cgi/client.py:1580
 #, python-format
 msgid "Missing header: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1552
+#: ../roundup/cgi/client.py:1588
 #, python-format
 msgid "csrf Referer header check failed for user%(userid)s. Value=%(referer)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1557
+#: ../roundup/cgi/client.py:1593
 #, fuzzy, python-format
 msgid "Invalid Referer: %s"
 msgstr "Ugylig login"
 
-#: ../roundup/cgi/client.py:1572
+#: ../roundup/cgi/client.py:1608
 #, python-format
 msgid "csrf Origin header check failed for user%(userid)s. Value=%(origin)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1577
+#: ../roundup/cgi/client.py:1613
 #, fuzzy, python-format
 msgid "Invalid Origin %s"
 msgstr "Ugylig login"
 
-#: ../roundup/cgi/client.py:1591
+#: ../roundup/cgi/client.py:1627
 #, python-format
 msgid ""
 "csrf X-FORWARDED-HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1597
+#: ../roundup/cgi/client.py:1633
 #, python-format
 msgid "Invalid X-FORWARDED-HOST %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1616
+#: ../roundup/cgi/client.py:1652
 #, python-format
 msgid "csrf HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1621
+#: ../roundup/cgi/client.py:1657
 #, fuzzy, python-format
 msgid "Invalid HOST %s"
 msgstr "Ugyldig forespÃ¸rsel"
 
-#: ../roundup/cgi/client.py:1629
+#: ../roundup/cgi/client.py:1665
 msgid "Csrf: unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1630
+#: ../roundup/cgi/client.py:1666
 msgid "Unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1643
+#: ../roundup/cgi/client.py:1679
 #, python-format
 msgid "csrf X-REQUESTED-WITH xmlrpc required header check failed for user%s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1684
+#: ../roundup/cgi/client.py:1720
 #, python-format
 msgid "Required csrf field missing for user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1686 ../roundup/cgi/client.py:1713
-#: ../roundup/cgi/client.py:1730 ../roundup/cgi/client.py:1686:1713:1730
+#: ../roundup/cgi/client.py:1722 ../roundup/cgi/client.py:1749
+#: ../roundup/cgi/client.py:1766 ../roundup/cgi/client.py:1722:1749:1766
 msgid ""
 "We can't validate your session (csrf failure). Re-enter any unsaved data and "
 "try again."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1690
+#: ../roundup/cgi/client.py:1726
 #, python-format
 msgid "csrf field not supplied by user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1702
+#: ../roundup/cgi/client.py:1738
 #, python-format
 msgid ""
 "Csrf mismatch user: current user %(user)s != stored user %(stored)s, current "
 "session, stored session: %(cur_sess)s,%(stor_sess)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1720
+#: ../roundup/cgi/client.py:1756
 #, python-format
 msgid ""
 "Csrf mismatch user: current session %(curr_sess)s != stored session "
 "%(stor_sess)s, current user/stored user is: %(user)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1912
+#: ../roundup/cgi/client.py:1948
 msgid "You are not allowed to view this file."
 msgstr "Du har ikke lov Ã¥ se denne filen."
 
-#: ../roundup/cgi/client.py:2235
+#: ../roundup/cgi/client.py:2272
 #, python-format
 msgid "%(starttag)sTime elapsed: %(seconds)fs%(endtag)s\n"
 msgstr "%(starttag)sMedgÃ¥tt tid: %(seconds)fs%(endtag)s\n"
 
-#: ../roundup/cgi/client.py:2239
+#: ../roundup/cgi/client.py:2276
 #, python-format
 msgid ""
 "%(starttag)sCache hits: %(cache_hits)d, misses %(cache_misses)d. Loading "
@@ -2232,7 +2233,7 @@ msgstr ""
 "%(starttag)sCache treff: %(cache_hits)d, ikke-treff %(cache_misses)d. Laster "
 "saker: %(get_items)f secs. Filtrerer: %(filtering)f secs.%(endtag)s\n"
 
-#: ../roundup/cgi/client.py:2778
+#: ../roundup/cgi/client.py:2815
 #, python-format
 msgid ""
 "Cache failure: compressed file %(compressed)s is older than its source file "
@@ -3068,35 +3069,35 @@ msgstr "Ugylig login"
 msgid "Api rate limits exceeded. Please wait: %s seconds."
 msgstr ""
 
-#: ../roundup/rest.py:2283
+#: ../roundup/rest.py:2284
 #, python-format
 msgid ""
-"Content type '%s' requested in URL is not available.\n"
-"Acceptable types: %s\n"
+"Content type '%(requested)s' requested in URL is not available.\n"
+"Acceptable types: %(acceptable)s\n"
 msgstr ""
 
-#: ../roundup/rest.py:2304
+#: ../roundup/rest.py:2306
 #, python-format
 msgid ""
 "Unable to parse Accept Header. %(error)s. Acceptable types: */*, "
 "%(acceptable_types)s"
 msgstr ""
 
-#: ../roundup/rest.py:2376 ../roundup/rest.py:2597 ../roundup/rest.py:2376:2597
+#: ../roundup/rest.py:2378 ../roundup/rest.py:2603 ../roundup/rest.py:2378:2603
 #, python-format
 msgid ""
 "Unrecognized api version: %s. See /rest without specifying api version for "
 "supported versions."
 msgstr ""
 
-#: ../roundup/rest.py:2411 ../roundup/rest.py:2420 ../roundup/rest.py:2411:2420
+#: ../roundup/rest.py:2413 ../roundup/rest.py:2424 ../roundup/rest.py:2413:2424
 #, python-format
 msgid ""
-"Requested content type(s) '%s' not available.\n"
-"Acceptable mime types are: */*, %s"
+"Requested content type(s) '%(requested)s' not available.\n"
+"Acceptable mime types are: */*, %(acceptable)s"
 msgstr ""
 
-#: ../roundup/rest.py:2696
+#: ../roundup/rest.py:2702
 msgid ""
 "Internal error while formatting response.\n"
 "accept_mime_type is not defined. This should\n"
@@ -3290,7 +3291,7 @@ msgid ""
 "  '-----END CERTIFICATE-----' markers?"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:345
+#: ../roundup/scripts/roundup_server.py:354
 msgid ""
 "<html><head><title>Roundup trackers index</title></head>\n"
 "<body><h1>Roundup trackers index</h1><ol>\n"
@@ -3298,59 +3299,59 @@ msgstr ""
 "<html><head><title>Roundup saksliste</title></head>\n"
 "<body><h1>Roundup saksliste</h1><ol>\n"
 
-#: ../roundup/scripts/roundup_server.py:587
+#: ../roundup/scripts/roundup_server.py:598
 #, fuzzy, python-format
 msgid "Error: %(type)s: %(value)s"
 msgstr "%(key)s: %(value)s"
 
-#: ../roundup/scripts/roundup_server.py:599
+#: ../roundup/scripts/roundup_server.py:610
 msgid "WARNING: ignoring \"-g\" argument, not root"
 msgstr "ADVARSEL: ignorerer \"-g\" argument, ikke root"
 
-#: ../roundup/scripts/roundup_server.py:605
+#: ../roundup/scripts/roundup_server.py:616
 msgid "Can't change groups - no grp module"
 msgstr "Kan ikke skifte gruppe, ingen grp modul"
 
-#: ../roundup/scripts/roundup_server.py:614
+#: ../roundup/scripts/roundup_server.py:625
 #, python-format
 msgid "Group %(group)s doesn't exist"
 msgstr "Gruppe %(group)s finnes ikke"
 
-#: ../roundup/scripts/roundup_server.py:626
+#: ../roundup/scripts/roundup_server.py:637
 msgid "Can't run as root!"
 msgstr "Kan ikke kjÃ¸re som root"
 
-#: ../roundup/scripts/roundup_server.py:629
+#: ../roundup/scripts/roundup_server.py:640
 msgid "WARNING: ignoring \"-u\" argument, not root"
 msgstr "ADVARSEL: ignorerer \"-u\" argument, ikke root"
 
-#: ../roundup/scripts/roundup_server.py:635
+#: ../roundup/scripts/roundup_server.py:646
 msgid "Can't change users - no pwd module"
 msgstr "Kan ikke skifte bruker , ingen pwd modul"
 
-#: ../roundup/scripts/roundup_server.py:644
+#: ../roundup/scripts/roundup_server.py:655
 #, python-format
 msgid "User %(user)s doesn't exist"
 msgstr "Bruker %(user)s finnes ikke"
 
-#: ../roundup/scripts/roundup_server.py:856
+#: ../roundup/scripts/roundup_server.py:867
 #, python-format
 msgid "Multiprocess mode \"%s\" is not available, switching to single-process"
 msgstr ""
 "Multiprosess modus  \"%s\" ikke tilgjengelig, fortsetter som enkeltprosess"
 
-#: ../roundup/scripts/roundup_server.py:884
+#: ../roundup/scripts/roundup_server.py:895
 #, python-format
 msgid "Unable to bind to port %s, port already in use."
 msgstr "Ikke mulig Ã¥ binde til port %s, porten er allerede i bruk."
 
-#: ../roundup/scripts/roundup_server.py:888
+#: ../roundup/scripts/roundup_server.py:899
 #, fuzzy, python-format
 msgid ""
 "Unable to bind to port %(port)s, access not allowed, errno: %(errno)s %(msg)s"
 msgstr "Ikke mulig Ã¥ binde til port %s, porten er allerede i bruk."
 
-#: ../roundup/scripts/roundup_server.py:967
+#: ../roundup/scripts/roundup_server.py:978
 msgid ""
 " -c <Command>  Windows Service options.\n"
 "               If you want to run the server as a Windows Service, you\n"
@@ -3367,7 +3368,7 @@ msgstr ""
 "               Skriv \"roundup-server -c help\" for Ã¥ vise Windows Services\n"
 "               informasjon."
 
-#: ../roundup/scripts/roundup_server.py:974
+#: ../roundup/scripts/roundup_server.py:985
 #, fuzzy
 msgid ""
 " -u <UID>      runs the Roundup web server as this UID\n"
@@ -3383,7 +3384,7 @@ msgstr ""
 "               serverens PID til filen indikert av PIDfile.\n"
 "               -l optsjonen *mÃ¥* brukes hvis -d brukes."
 
-#: ../roundup/scripts/roundup_server.py:982
+#: ../roundup/scripts/roundup_server.py:993
 #, fuzzy, python-format
 msgid ""
 "\n"
@@ -3511,21 +3512,21 @@ msgstr ""
 "   Pass pÃ¥ at de ikke inneholder url-utrygge tegn som mellomrom, for de kan "
 "forvirre IE.\n"
 
-#: ../roundup/scripts/roundup_server.py:1162
+#: ../roundup/scripts/roundup_server.py:1173
 msgid "Instances must be name=home"
 msgstr "Instanser mÃ¥ vÃ¦re navn=home"
 
-#: ../roundup/scripts/roundup_server.py:1176
+#: ../roundup/scripts/roundup_server.py:1187
 #, python-format
 msgid "Configuration saved to %s"
 msgstr "Konfigurasjon lagret til %s"
 
-#: ../roundup/scripts/roundup_server.py:1194
+#: ../roundup/scripts/roundup_server.py:1205
 msgid "Sorry, you can't run the server as a daemon on this Operating System"
 msgstr ""
 "Beklager, du kan ikke kjÃ¸re servern som daemon under dette operativsystemet"
 
-#: ../roundup/scripts/roundup_server.py:1214
+#: ../roundup/scripts/roundup_server.py:1225
 #, python-format
 msgid "Roundup server started on %(HOST)s:%(PORT)s"
 msgstr "Roundup server startet pÃ¥ %(HOST)s:%(PORT)s"
diff --git a/locale/roundup.pot b/locale/roundup.pot
index fc8cfcab3..9307abae7 100644
--- a/locale/roundup.pot
+++ b/locale/roundup.pot
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Roundup 2.5.0\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
-"POT-Creation-Date: 2024-12-30 22:49-0500\n"
+"POT-Creation-Date: 2025-01-12 20:17-0500\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -1646,160 +1646,161 @@ msgid ""
 "</body></html>"
 msgstr ""
 
-#: ../roundup/cgi/client.py:666
+#: ../roundup/cgi/client.py:679
 msgid ""
 "XMLRPC endpoint is not using defusedxml. Improve security by installing "
 "defusedxml."
 msgstr ""
 
-#: ../roundup/cgi/client.py:728 ../roundup/cgi/client.py:1646
-#: ../roundup/cgi/client.py:728:1646
-msgid "Required Header Missing"
+#: ../roundup/cgi/client.py:749 ../roundup/cgi/client.py:771
+#: ../roundup/cgi/client.py:749:771
+msgid "Client is not allowed to use Rest Interface."
 msgstr ""
 
-#: ../roundup/cgi/client.py:731
-msgid "Client is not allowed to use Rest Interface."
+#: ../roundup/cgi/client.py:768 ../roundup/cgi/client.py:1682
+#: ../roundup/cgi/client.py:768:1682
+msgid "Required Header Missing"
 msgstr ""
 
-#: ../roundup/cgi/client.py:985
+#: ../roundup/cgi/client.py:1021
 msgid "Form Error: "
 msgstr ""
 
-#: ../roundup/cgi/client.py:1078
+#: ../roundup/cgi/client.py:1114
 #, python-format
 msgid "Unrecognized charset: %r"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1345 ../roundup/cgi/client.py:2357
-#: ../roundup/cgi/client.py:1345:2357
+#: ../roundup/cgi/client.py:1381 ../roundup/cgi/client.py:2394
+#: ../roundup/cgi/client.py:1381:2394
 msgid "broken form: multiple @action values submitted"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1362
+#: ../roundup/cgi/client.py:1398
 msgid "Anonymous users are not allowed to use the web interface"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1507
+#: ../roundup/cgi/client.py:1543
 msgid "Referer header not available."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1511
+#: ../roundup/cgi/client.py:1547
 #, python-format
 msgid "csrf key used with wrong method from: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1540
+#: ../roundup/cgi/client.py:1576
 #, python-format
 msgid "csrf header %(header)s required but missing for user%(userid)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1544
+#: ../roundup/cgi/client.py:1580
 #, python-format
 msgid "Missing header: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1552
+#: ../roundup/cgi/client.py:1588
 #, python-format
 msgid "csrf Referer header check failed for user%(userid)s. Value=%(referer)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1557
+#: ../roundup/cgi/client.py:1593
 #, python-format
 msgid "Invalid Referer: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1572
+#: ../roundup/cgi/client.py:1608
 #, python-format
 msgid "csrf Origin header check failed for user%(userid)s. Value=%(origin)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1577
+#: ../roundup/cgi/client.py:1613
 #, python-format
 msgid "Invalid Origin %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1591
+#: ../roundup/cgi/client.py:1627
 #, python-format
 msgid ""
 "csrf X-FORWARDED-HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1597
+#: ../roundup/cgi/client.py:1633
 #, python-format
 msgid "Invalid X-FORWARDED-HOST %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1616
+#: ../roundup/cgi/client.py:1652
 #, python-format
 msgid "csrf HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1621
+#: ../roundup/cgi/client.py:1657
 #, python-format
 msgid "Invalid HOST %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1629
+#: ../roundup/cgi/client.py:1665
 msgid "Csrf: unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1630
+#: ../roundup/cgi/client.py:1666
 msgid "Unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1643
+#: ../roundup/cgi/client.py:1679
 #, python-format
 msgid "csrf X-REQUESTED-WITH xmlrpc required header check failed for user%s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1684
+#: ../roundup/cgi/client.py:1720
 #, python-format
 msgid "Required csrf field missing for user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1686 ../roundup/cgi/client.py:1713
-#: ../roundup/cgi/client.py:1730 ../roundup/cgi/client.py:1686:1713 :1730
+#: ../roundup/cgi/client.py:1722 ../roundup/cgi/client.py:1749
+#: ../roundup/cgi/client.py:1766 ../roundup/cgi/client.py:1722:1749 :1766
 msgid ""
 "We can't validate your session (csrf failure). Re-enter any unsaved data and "
 "try again."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1690
+#: ../roundup/cgi/client.py:1726
 #, python-format
 msgid "csrf field not supplied by user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1702
+#: ../roundup/cgi/client.py:1738
 #, python-format
 msgid ""
 "Csrf mismatch user: current user %(user)s != stored user %(stored)s, current "
 "session, stored session: %(cur_sess)s,%(stor_sess)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1720
+#: ../roundup/cgi/client.py:1756
 #, python-format
 msgid ""
 "Csrf mismatch user: current session %(curr_sess)s != stored session "
 "%(stor_sess)s, current user/stored user is: %(user)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1912
+#: ../roundup/cgi/client.py:1948
 msgid "You are not allowed to view this file."
 msgstr ""
 
-#: ../roundup/cgi/client.py:2235
+#: ../roundup/cgi/client.py:2272
 #, python-format
 msgid "%(starttag)sTime elapsed: %(seconds)fs%(endtag)s\n"
 msgstr ""
 
-#: ../roundup/cgi/client.py:2239
+#: ../roundup/cgi/client.py:2276
 #, python-format
 msgid ""
 "%(starttag)sCache hits: %(cache_hits)d, misses %(cache_misses)d. Loading "
 "items: %(get_items)f secs. Filtering: %(filtering)f secs.%(endtag)s\n"
 msgstr ""
 
-#: ../roundup/cgi/client.py:2778
+#: ../roundup/cgi/client.py:2815
 #, python-format
 msgid ""
 "Cache failure: compressed file %(compressed)s is older than its source file "
@@ -2534,35 +2535,35 @@ msgstr ""
 msgid "Api rate limits exceeded. Please wait: %s seconds."
 msgstr ""
 
-#: ../roundup/rest.py:2283
+#: ../roundup/rest.py:2284
 #, python-format
 msgid ""
-"Content type '%s' requested in URL is not available.\n"
-"Acceptable types: %s\n"
+"Content type '%(requested)s' requested in URL is not available.\n"
+"Acceptable types: %(acceptable)s\n"
 msgstr ""
 
-#: ../roundup/rest.py:2304
+#: ../roundup/rest.py:2306
 #, python-format
 msgid ""
 "Unable to parse Accept Header. %(error)s. Acceptable types: */*, "
 "%(acceptable_types)s"
 msgstr ""
 
-#: ../roundup/rest.py:2376 ../roundup/rest.py:2597 ../roundup/rest.py:2376:2597
+#: ../roundup/rest.py:2378 ../roundup/rest.py:2603 ../roundup/rest.py:2378:2603
 #, python-format
 msgid ""
 "Unrecognized api version: %s. See /rest without specifying api version for "
 "supported versions."
 msgstr ""
 
-#: ../roundup/rest.py:2411 ../roundup/rest.py:2420 ../roundup/rest.py:2411:2420
+#: ../roundup/rest.py:2413 ../roundup/rest.py:2424 ../roundup/rest.py:2413:2424
 #, python-format
 msgid ""
-"Requested content type(s) '%s' not available.\n"
-"Acceptable mime types are: */*, %s"
+"Requested content type(s) '%(requested)s' not available.\n"
+"Acceptable mime types are: */*, %(acceptable)s"
 msgstr ""
 
-#: ../roundup/rest.py:2696
+#: ../roundup/rest.py:2702
 msgid ""
 "Internal error while formatting response.\n"
 "accept_mime_type is not defined. This should\n"
@@ -2746,64 +2747,64 @@ msgid ""
 "  '-----END CERTIFICATE-----' markers?"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:345
+#: ../roundup/scripts/roundup_server.py:354
 msgid ""
 "<html><head><title>Roundup trackers index</title></head>\n"
 "<body><h1>Roundup trackers index</h1><ol>\n"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:587
+#: ../roundup/scripts/roundup_server.py:598
 #, python-format
 msgid "Error: %(type)s: %(value)s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:599
+#: ../roundup/scripts/roundup_server.py:610
 msgid "WARNING: ignoring \"-g\" argument, not root"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:605
+#: ../roundup/scripts/roundup_server.py:616
 msgid "Can't change groups - no grp module"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:614
+#: ../roundup/scripts/roundup_server.py:625
 #, python-format
 msgid "Group %(group)s doesn't exist"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:626
+#: ../roundup/scripts/roundup_server.py:637
 msgid "Can't run as root!"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:629
+#: ../roundup/scripts/roundup_server.py:640
 msgid "WARNING: ignoring \"-u\" argument, not root"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:635
+#: ../roundup/scripts/roundup_server.py:646
 msgid "Can't change users - no pwd module"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:644
+#: ../roundup/scripts/roundup_server.py:655
 #, python-format
 msgid "User %(user)s doesn't exist"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:856
+#: ../roundup/scripts/roundup_server.py:867
 #, python-format
 msgid "Multiprocess mode \"%s\" is not available, switching to single-process"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:884
+#: ../roundup/scripts/roundup_server.py:895
 #, python-format
 msgid "Unable to bind to port %s, port already in use."
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:888
+#: ../roundup/scripts/roundup_server.py:899
 #, python-format
 msgid ""
 "Unable to bind to port %(port)s, access not allowed, errno: %(errno)s %(msg)s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:967
+#: ../roundup/scripts/roundup_server.py:978
 msgid ""
 " -c <Command>  Windows Service options.\n"
 "               If you want to run the server as a Windows Service, you\n"
@@ -2813,7 +2814,7 @@ msgid ""
 "               specifics."
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:974
+#: ../roundup/scripts/roundup_server.py:985
 msgid ""
 " -u <UID>      runs the Roundup web server as this UID\n"
 " -g <GID>      runs the Roundup web server as this GID\n"
@@ -2823,7 +2824,7 @@ msgid ""
 " -D            run the server in the foreground even when -d is used."
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:982
+#: ../roundup/scripts/roundup_server.py:993
 #, python-format
 msgid ""
 "\n"
@@ -2895,20 +2896,20 @@ msgid ""
 "   any url-unsafe characters like spaces, as these confuse IE.\n"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:1162
+#: ../roundup/scripts/roundup_server.py:1173
 msgid "Instances must be name=home"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:1176
+#: ../roundup/scripts/roundup_server.py:1187
 #, python-format
 msgid "Configuration saved to %s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:1194
+#: ../roundup/scripts/roundup_server.py:1205
 msgid "Sorry, you can't run the server as a daemon on this Operating System"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:1214
+#: ../roundup/scripts/roundup_server.py:1225
 #, python-format
 msgid "Roundup server started on %(HOST)s:%(PORT)s"
 msgstr ""
diff --git a/locale/ru.po b/locale/ru.po
index 81e578274..37cd8cf1a 100644
--- a/locale/ru.po
+++ b/locale/ru.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Roundup 2.5.0\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
-"POT-Creation-Date: 2024-12-30 22:49-0500\n"
+"POT-Creation-Date: 2025-01-12 20:17-0500\n"
 "PO-Revision-Date: 2013-10-31 12:21+0100\n"
 "Last-Translator: alexander smishlajev <alex@tycobka.lv>\n"
 "Language-Team: Russian\n"
@@ -2102,154 +2102,155 @@ msgstr ""
 "áÄÍÉÎÉÓÔÒÁÔÏÒÕ ÔÒÅËÅÒÁ ÏÔÏÓÌÁÎÏ ÓÏÏÂÝÅÎÉÅ ÏÂ ÏÛÉÂËÅ.</p>\n"
 "</body></html>"
 
-#: ../roundup/cgi/client.py:666
+#: ../roundup/cgi/client.py:679
 msgid ""
 "XMLRPC endpoint is not using defusedxml. Improve security by installing "
 "defusedxml."
 msgstr ""
 
-#: ../roundup/cgi/client.py:728 ../roundup/cgi/client.py:1646
-#: ../roundup/cgi/client.py:728:1646
-msgid "Required Header Missing"
-msgstr ""
-
-#: ../roundup/cgi/client.py:731
+#: ../roundup/cgi/client.py:749 ../roundup/cgi/client.py:771
+#: ../roundup/cgi/client.py:749:771
 #, fuzzy
 msgid "Client is not allowed to use Rest Interface."
 msgstr "áÎÏÎÉÍÎÙÍ ÐÏÌØÚÏ×ÁÔÅÌÑÍ ÎÅ ÒÁÚÒÅÛÅÎÏ ÐÏÌØÚÏ×ÁÔØÓÑ ×ÅÂ-ÉÎÔÅÒÆÅÊÓÏÍ."
 
-#: ../roundup/cgi/client.py:985
+#: ../roundup/cgi/client.py:768 ../roundup/cgi/client.py:1682
+#: ../roundup/cgi/client.py:768:1682
+msgid "Required Header Missing"
+msgstr ""
+
+#: ../roundup/cgi/client.py:1021
 msgid "Form Error: "
 msgstr "ïÛÉÂËÁ ÆÏÒÍÙ: "
 
-#: ../roundup/cgi/client.py:1078
+#: ../roundup/cgi/client.py:1114
 #, python-format
 msgid "Unrecognized charset: %r"
 msgstr "ëÏÄÉÒÏ×ËÁ %r ÎÅ ÒÁÓÐÏÚÎÁÎÁ"
 
-#: ../roundup/cgi/client.py:1345 ../roundup/cgi/client.py:2357
-#: ../roundup/cgi/client.py:1345:2357
+#: ../roundup/cgi/client.py:1381 ../roundup/cgi/client.py:2394
+#: ../roundup/cgi/client.py:1381:2394
 msgid "broken form: multiple @action values submitted"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1362
+#: ../roundup/cgi/client.py:1398
 msgid "Anonymous users are not allowed to use the web interface"
 msgstr "áÎÏÎÉÍÎÙÍ ÐÏÌØÚÏ×ÁÔÅÌÑÍ ÎÅ ÒÁÚÒÅÛÅÎÏ ÐÏÌØÚÏ×ÁÔØÓÑ ×ÅÂ-ÉÎÔÅÒÆÅÊÓÏÍ."
 
-#: ../roundup/cgi/client.py:1507
+#: ../roundup/cgi/client.py:1543
 msgid "Referer header not available."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1511
+#: ../roundup/cgi/client.py:1547
 #, python-format
 msgid "csrf key used with wrong method from: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1540
+#: ../roundup/cgi/client.py:1576
 #, python-format
 msgid "csrf header %(header)s required but missing for user%(userid)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1544
+#: ../roundup/cgi/client.py:1580
 #, python-format
 msgid "Missing header: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1552
+#: ../roundup/cgi/client.py:1588
 #, python-format
 msgid "csrf Referer header check failed for user%(userid)s. Value=%(referer)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1557
+#: ../roundup/cgi/client.py:1593
 #, fuzzy, python-format
 msgid "Invalid Referer: %s"
 msgstr "îÅÐÒÁ×ÉÌØÎÙÊ ÐÁÒÏÌØ ÉÌÉ ÉÍÑ ÐÏÌØÚÏ×ÁÔÅÌÑ."
 
-#: ../roundup/cgi/client.py:1572
+#: ../roundup/cgi/client.py:1608
 #, python-format
 msgid "csrf Origin header check failed for user%(userid)s. Value=%(origin)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1577
+#: ../roundup/cgi/client.py:1613
 #, fuzzy, python-format
 msgid "Invalid Origin %s"
 msgstr "îÅÐÒÁ×ÉÌØÎÙÊ ÐÁÒÏÌØ ÉÌÉ ÉÍÑ ÐÏÌØÚÏ×ÁÔÅÌÑ."
 
-#: ../roundup/cgi/client.py:1591
+#: ../roundup/cgi/client.py:1627
 #, python-format
 msgid ""
 "csrf X-FORWARDED-HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1597
+#: ../roundup/cgi/client.py:1633
 #, python-format
 msgid "Invalid X-FORWARDED-HOST %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1616
+#: ../roundup/cgi/client.py:1652
 #, python-format
 msgid "csrf HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1621
+#: ../roundup/cgi/client.py:1657
 #, python-format
 msgid "Invalid HOST %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1629
+#: ../roundup/cgi/client.py:1665
 msgid "Csrf: unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1630
+#: ../roundup/cgi/client.py:1666
 msgid "Unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1643
+#: ../roundup/cgi/client.py:1679
 #, python-format
 msgid "csrf X-REQUESTED-WITH xmlrpc required header check failed for user%s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1684
+#: ../roundup/cgi/client.py:1720
 #, python-format
 msgid "Required csrf field missing for user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1686 ../roundup/cgi/client.py:1713
-#: ../roundup/cgi/client.py:1730 ../roundup/cgi/client.py:1686:1713:1730
+#: ../roundup/cgi/client.py:1722 ../roundup/cgi/client.py:1749
+#: ../roundup/cgi/client.py:1766 ../roundup/cgi/client.py:1722:1749:1766
 msgid ""
 "We can't validate your session (csrf failure). Re-enter any unsaved data and "
 "try again."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1690
+#: ../roundup/cgi/client.py:1726
 #, python-format
 msgid "csrf field not supplied by user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1702
+#: ../roundup/cgi/client.py:1738
 #, python-format
 msgid ""
 "Csrf mismatch user: current user %(user)s != stored user %(stored)s, current "
 "session, stored session: %(cur_sess)s,%(stor_sess)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1720
+#: ../roundup/cgi/client.py:1756
 #, python-format
 msgid ""
 "Csrf mismatch user: current session %(curr_sess)s != stored session "
 "%(stor_sess)s, current user/stored user is: %(user)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1912
+#: ../roundup/cgi/client.py:1948
 msgid "You are not allowed to view this file."
 msgstr "õ ×ÁÓ ÎÅÔ ÒÁÚÒÅÛÅÎÉÑ ÎÁ ÐÒÏÓÍÏÔÒ ÜÔÏÇÏ ÆÁÊÌÁ."
 
-#: ../roundup/cgi/client.py:2235
+#: ../roundup/cgi/client.py:2272
 #, python-format
 msgid "%(starttag)sTime elapsed: %(seconds)fs%(endtag)s\n"
 msgstr "%(starttag)súÁÔÒÁÞÅÎÎÏÅ ×ÒÅÍÑ: %(seconds)fs%(endtag)s\n"
 
-#: ../roundup/cgi/client.py:2239
+#: ../roundup/cgi/client.py:2276
 #, python-format
 msgid ""
 "%(starttag)sCache hits: %(cache_hits)d, misses %(cache_misses)d. Loading "
@@ -2259,7 +2260,7 @@ msgstr ""
 "%(cache_misses)d. úÁÇÒÕÚËÁ ÏÂßÅËÔÏ×: %(get_items)f ÓÅË. æÉÌØÔÒÁÃÉÑ: "
 "%(filtering)f ÓÅË.%(endtag)s\n"
 
-#: ../roundup/cgi/client.py:2778
+#: ../roundup/cgi/client.py:2815
 #, python-format
 msgid ""
 "Cache failure: compressed file %(compressed)s is older than its source file "
@@ -3104,35 +3105,35 @@ msgstr "
 msgid "Api rate limits exceeded. Please wait: %s seconds."
 msgstr ""
 
-#: ../roundup/rest.py:2283
+#: ../roundup/rest.py:2284
 #, python-format
 msgid ""
-"Content type '%s' requested in URL is not available.\n"
-"Acceptable types: %s\n"
+"Content type '%(requested)s' requested in URL is not available.\n"
+"Acceptable types: %(acceptable)s\n"
 msgstr ""
 
-#: ../roundup/rest.py:2304
+#: ../roundup/rest.py:2306
 #, python-format
 msgid ""
 "Unable to parse Accept Header. %(error)s. Acceptable types: */*, "
 "%(acceptable_types)s"
 msgstr ""
 
-#: ../roundup/rest.py:2376 ../roundup/rest.py:2597 ../roundup/rest.py:2376:2597
+#: ../roundup/rest.py:2378 ../roundup/rest.py:2603 ../roundup/rest.py:2378:2603
 #, python-format
 msgid ""
 "Unrecognized api version: %s. See /rest without specifying api version for "
 "supported versions."
 msgstr ""
 
-#: ../roundup/rest.py:2411 ../roundup/rest.py:2420 ../roundup/rest.py:2411:2420
+#: ../roundup/rest.py:2413 ../roundup/rest.py:2424 ../roundup/rest.py:2413:2424
 #, python-format
 msgid ""
-"Requested content type(s) '%s' not available.\n"
-"Acceptable mime types are: */*, %s"
+"Requested content type(s) '%(requested)s' not available.\n"
+"Acceptable mime types are: */*, %(acceptable)s"
 msgstr ""
 
-#: ../roundup/rest.py:2696
+#: ../roundup/rest.py:2702
 msgid ""
 "Internal error while formatting response.\n"
 "accept_mime_type is not defined. This should\n"
@@ -3326,7 +3327,7 @@ msgid ""
 "  '-----END CERTIFICATE-----' markers?"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:345
+#: ../roundup/scripts/roundup_server.py:354
 msgid ""
 "<html><head><title>Roundup trackers index</title></head>\n"
 "<body><h1>Roundup trackers index</h1><ol>\n"
@@ -3334,62 +3335,62 @@ msgstr ""
 "<html><head><title>óÐÉÓÏË ÔÒÅËÅÒÏ× Roundup</title></head>\n"
 "<body><h1>óÐÉÓÏË ÔÒÅËÅÒÏ× Roundup</h1><ol>\n"
 
-#: ../roundup/scripts/roundup_server.py:587
+#: ../roundup/scripts/roundup_server.py:598
 #, fuzzy, python-format
 msgid "Error: %(type)s: %(value)s"
 msgstr "%(key)s: %(value)s (ËÌÀÞÅ×ÏÊ ÁÔÒÉÂÕÔ)"
 
-#: ../roundup/scripts/roundup_server.py:599
+#: ../roundup/scripts/roundup_server.py:610
 msgid "WARNING: ignoring \"-g\" argument, not root"
 msgstr ""
 "÷îéíáîéå: ÐÁÒÁÍÅÔÒ \"-g\" ÎÅ ÉÓÐÏÌØÚÕÅÔÓÑ, ÏÎ ÒÁÚÒÅÛÅÎ ÔÏÌØËÏ ÄÌÑ "
 "ÐÏÌØÚÏ×ÁÔÅÌÑ root"
 
-#: ../roundup/scripts/roundup_server.py:605
+#: ../roundup/scripts/roundup_server.py:616
 msgid "Can't change groups - no grp module"
 msgstr "ðÏÄÍÅÎÁ ÇÒÕÐÐÙ ÎÅ×ÏÚÍÏÖÎÁ - ÎÕÖÅÎ ÍÏÄÕÌØ grp"
 
-#: ../roundup/scripts/roundup_server.py:614
+#: ../roundup/scripts/roundup_server.py:625
 #, python-format
 msgid "Group %(group)s doesn't exist"
 msgstr "çÒÕÐÐÁ %(group)s ÎÅ ÓÕÝÅÓÔ×ÕÅÔ"
 
-#: ../roundup/scripts/roundup_server.py:626
+#: ../roundup/scripts/roundup_server.py:637
 msgid "Can't run as root!"
 msgstr "úÁÐÕÓË ÓÅÒ×ÅÒÁ Ó ÐÏÌÎÏÍÏÞÉÑÍÉ ÐÏÌØÚÏ×ÁÔÅÌÑ root ÚÁÐÒÅÝÅÎ!"
 
-#: ../roundup/scripts/roundup_server.py:629
+#: ../roundup/scripts/roundup_server.py:640
 msgid "WARNING: ignoring \"-u\" argument, not root"
 msgstr ""
 "÷îéíáîéå: ÐÁÒÁÍÅÔÒ \"-u\" ÎÅ ÉÓÐÏÌØÚÕÅÔÓÑ, ÏÎ ÒÁÚÒÅÛÅÎ ÔÏÌØËÏ ÄÌÑ "
 "ÐÏÌØÚÏ×ÁÔÅÌÑ root"
 
-#: ../roundup/scripts/roundup_server.py:635
+#: ../roundup/scripts/roundup_server.py:646
 msgid "Can't change users - no pwd module"
 msgstr "ðÏÄÍÅÎÁ ÐÏÌØÚÏ×ÁÔÅÌÑ ÎÅ×ÏÚÍÏÖÎÁ - ÎÕÖÅÎ ÍÏÄÕÌØ pwd"
 
-#: ../roundup/scripts/roundup_server.py:644
+#: ../roundup/scripts/roundup_server.py:655
 #, python-format
 msgid "User %(user)s doesn't exist"
 msgstr "ðÏÌØÚÏ×ÁÔÅÌØ %(user)s ÎÅ ÓÕÝÅÓÔ×ÕÅÔ"
 
-#: ../roundup/scripts/roundup_server.py:856
+#: ../roundup/scripts/roundup_server.py:867
 #, python-format
 msgid "Multiprocess mode \"%s\" is not available, switching to single-process"
 msgstr "òÅÖÉÍ \"%s\" ÎÅÄÏÓÔÕÐÅÎ, ÐÅÒÅËÌÀÞÁÅÍÓÑ × ÏÄÎÏÚÁÄÁÞÎÙÊ ÒÅÖÉÍ"
 
-#: ../roundup/scripts/roundup_server.py:884
+#: ../roundup/scripts/roundup_server.py:895
 #, python-format
 msgid "Unable to bind to port %s, port already in use."
 msgstr "îÅ×ÏÚÍÏÖÎÏ ÕÓÔÁÎÏ×ÉÔØ ÓÅÒ×ÅÒ ÎÁ ÐÏÒÔÕ %s, ÐÏÒÔ ÕÖÅ ÚÁÎÑÔ."
 
-#: ../roundup/scripts/roundup_server.py:888
+#: ../roundup/scripts/roundup_server.py:899
 #, fuzzy, python-format
 msgid ""
 "Unable to bind to port %(port)s, access not allowed, errno: %(errno)s %(msg)s"
 msgstr "îÅ×ÏÚÍÏÖÎÏ ÕÓÔÁÎÏ×ÉÔØ ÓÅÒ×ÅÒ ÎÁ ÐÏÒÔÕ %s, ÐÏÒÔ ÕÖÅ ÚÁÎÑÔ."
 
-#: ../roundup/scripts/roundup_server.py:967
+#: ../roundup/scripts/roundup_server.py:978
 msgid ""
 " -c <Command>  Windows Service options.\n"
 "               If you want to run the server as a Windows Service, you\n"
@@ -3406,7 +3407,7 @@ msgstr ""
 "               ÆÁÊÌ ÐÒÏÔÏËÏÌÁ.  ëÏÍÁÎÄÁ 'roundup-server -c help'\n"
 "               ×ÙÄÁÅÔ ÓÐÒÁ×ËÕ Ï ËÏÍÁÎÄÎÏÊ ÓÔÒÏËÅ ÓÅÒ×ÉÓÁ Windows."
 
-#: ../roundup/scripts/roundup_server.py:974
+#: ../roundup/scripts/roundup_server.py:985
 #, fuzzy
 msgid ""
 " -u <UID>      runs the Roundup web server as this UID\n"
@@ -3422,7 +3423,7 @@ msgstr ""
 "               É ÚÁÐÕÓÔÉÔØ ÓÅÒ×ÅÒ × ÆÏÎÏ×ÏÍ ÒÅÖÉÍÅ.  åÓÌÉ ÕËÁÚÁÎÏ \"-d\",\n"
 "               ÆÁÊÌ ÐÒÏÔÏËÏÌÁ *ÏÂÑÚÁÔÅÌØÎÏ* ÄÏÌÖÅÎ ÂÙÔØ ÚÁÄÁÎ ËÌÀÞÏÍ \"-l\""
 
-#: ../roundup/scripts/roundup_server.py:982
+#: ../roundup/scripts/roundup_server.py:993
 #, fuzzy, python-format
 msgid ""
 "\n"
@@ -3551,21 +3552,21 @@ msgstr ""
 "   ÎÅ ÍÏÇÕÔ ÉÓÐÏÌØÚÏ×ÁÔØÓÑ × URL (ÐÒÏÂÅÌÙ, ÒÕÓÓËÉÅ ÂÕË×Ù É ÐÒÏÞ.),\n"
 "   ÐÏÔÏÍÕ ÞÔÏ ÔÁËÉÅ ÉÍÅÎÁ ÓÂÉ×ÁÀÔ Ó ÔÏÌËÕ ÎÅËÏÔÏÒÙÅ ÂÒÁÕÚÅÒÙ ÔÉÐÁ IE.\n"
 
-#: ../roundup/scripts/roundup_server.py:1162
+#: ../roundup/scripts/roundup_server.py:1173
 msgid "Instances must be name=home"
 msgstr "óÐÉÓÏË ÔÒÅËÅÒÏ× ÄÏÌÖÅÎ ÂÙÔØ × ÆÏÒÍÁÔÅ ÉÍÑ=ËÁÔÁÌÏÇ"
 
-#: ../roundup/scripts/roundup_server.py:1176
+#: ../roundup/scripts/roundup_server.py:1187
 #, python-format
 msgid "Configuration saved to %s"
 msgstr "ëÏÎÆÉÇÕÒÁÃÉÑ ÚÁÐÉÓÁÎÁ × %s"
 
-#: ../roundup/scripts/roundup_server.py:1194
+#: ../roundup/scripts/roundup_server.py:1205
 msgid "Sorry, you can't run the server as a daemon on this Operating System"
 msgstr ""
 "éÚ×ÉÎÉÔÅ, × ÜÔÏÊ ÏÐÅÒÁÃÉÏÎÎÏÊ ÓÉÓÔÅÍÅ ÒÁÂÏÔÁ × ÆÏÎÏ×ÏÍ ÒÅÖÉÍÅ ÎÅ×ÏÚÍÏÖÎÁ"
 
-#: ../roundup/scripts/roundup_server.py:1214
+#: ../roundup/scripts/roundup_server.py:1225
 #, python-format
 msgid "Roundup server started on %(HOST)s:%(PORT)s"
 msgstr "óÅÒ×ÅÒ Roundup ÇÏÔÏ× Ë ÒÁÂÏÔÅ ÐÏ ÁÄÒÅÓÕ %(HOST)s:%(PORT)s"
diff --git a/locale/zh_CN.po b/locale/zh_CN.po
index 2718447c1..1a3ba6229 100644
--- a/locale/zh_CN.po
+++ b/locale/zh_CN.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Roundup 2.5.0\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
-"POT-Creation-Date: 2024-12-30 22:49-0500\n"
+"POT-Creation-Date: 2025-01-12 20:17-0500\n"
 "PO-Revision-Date: 2013-10-31 12:22+0100\n"
 "Last-Translator: Cheer Xiao <xiaqqaix@gmail.com>\n"
 "Language-Team: Chinese Simplified <limodou@gmail.com>\n"
@@ -1997,161 +1997,162 @@ msgid ""
 "</body></html>"
 msgstr ""
 
-#: ../roundup/cgi/client.py:666
+#: ../roundup/cgi/client.py:679
 msgid ""
 "XMLRPC endpoint is not using defusedxml. Improve security by installing "
 "defusedxml."
 msgstr ""
 
-#: ../roundup/cgi/client.py:728 ../roundup/cgi/client.py:1646
-#: ../roundup/cgi/client.py:728:1646
-msgid "Required Header Missing"
-msgstr ""
-
-#: ../roundup/cgi/client.py:731
+#: ../roundup/cgi/client.py:749 ../roundup/cgi/client.py:771
+#: ../roundup/cgi/client.py:749:771
 #, fuzzy
 msgid "Client is not allowed to use Rest Interface."
 msgstr "åŒ¿åç”¨æˆ·ä¸å…è®¸ä½¿ç”¨ web ç•Œé¢"
 
-#: ../roundup/cgi/client.py:985
+#: ../roundup/cgi/client.py:768 ../roundup/cgi/client.py:1682
+#: ../roundup/cgi/client.py:768:1682
+msgid "Required Header Missing"
+msgstr ""
+
+#: ../roundup/cgi/client.py:1021
 msgid "Form Error: "
 msgstr "è¡¨æ ¼é”™è¯¯ï¼š"
 
-#: ../roundup/cgi/client.py:1078
+#: ../roundup/cgi/client.py:1114
 #, python-format
 msgid "Unrecognized charset: %r"
 msgstr "æ— æ³•è¯†åˆ«çš„å­—ç¬¦é›†ï¼š%r"
 
-#: ../roundup/cgi/client.py:1345 ../roundup/cgi/client.py:2357
-#: ../roundup/cgi/client.py:1345:2357
+#: ../roundup/cgi/client.py:1381 ../roundup/cgi/client.py:2394
+#: ../roundup/cgi/client.py:1381:2394
 msgid "broken form: multiple @action values submitted"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1362
+#: ../roundup/cgi/client.py:1398
 msgid "Anonymous users are not allowed to use the web interface"
 msgstr "åŒ¿åç”¨æˆ·ä¸å…è®¸ä½¿ç”¨ web ç•Œé¢"
 
-#: ../roundup/cgi/client.py:1507
+#: ../roundup/cgi/client.py:1543
 msgid "Referer header not available."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1511
+#: ../roundup/cgi/client.py:1547
 #, python-format
 msgid "csrf key used with wrong method from: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1540
+#: ../roundup/cgi/client.py:1576
 #, python-format
 msgid "csrf header %(header)s required but missing for user%(userid)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1544
+#: ../roundup/cgi/client.py:1580
 #, python-format
 msgid "Missing header: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1552
+#: ../roundup/cgi/client.py:1588
 #, python-format
 msgid "csrf Referer header check failed for user%(userid)s. Value=%(referer)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1557
+#: ../roundup/cgi/client.py:1593
 #, fuzzy, python-format
 msgid "Invalid Referer: %s"
 msgstr "æ— æ•ˆç™»å½•"
 
-#: ../roundup/cgi/client.py:1572
+#: ../roundup/cgi/client.py:1608
 #, python-format
 msgid "csrf Origin header check failed for user%(userid)s. Value=%(origin)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1577
+#: ../roundup/cgi/client.py:1613
 #, fuzzy, python-format
 msgid "Invalid Origin %s"
 msgstr "æ— æ•ˆç™»å½•"
 
-#: ../roundup/cgi/client.py:1591
+#: ../roundup/cgi/client.py:1627
 #, python-format
 msgid ""
 "csrf X-FORWARDED-HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1597
+#: ../roundup/cgi/client.py:1633
 #, python-format
 msgid "Invalid X-FORWARDED-HOST %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1616
+#: ../roundup/cgi/client.py:1652
 #, python-format
 msgid "csrf HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1621
+#: ../roundup/cgi/client.py:1657
 #, fuzzy, python-format
 msgid "Invalid HOST %s"
 msgstr "æ— æ•ˆè¯·æ±‚"
 
-#: ../roundup/cgi/client.py:1629
+#: ../roundup/cgi/client.py:1665
 msgid "Csrf: unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1630
+#: ../roundup/cgi/client.py:1666
 msgid "Unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1643
+#: ../roundup/cgi/client.py:1679
 #, python-format
 msgid "csrf X-REQUESTED-WITH xmlrpc required header check failed for user%s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1684
+#: ../roundup/cgi/client.py:1720
 #, python-format
 msgid "Required csrf field missing for user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1686 ../roundup/cgi/client.py:1713
-#: ../roundup/cgi/client.py:1730 ../roundup/cgi/client.py:1686:1713:1730
+#: ../roundup/cgi/client.py:1722 ../roundup/cgi/client.py:1749
+#: ../roundup/cgi/client.py:1766 ../roundup/cgi/client.py:1722:1749:1766
 msgid ""
 "We can't validate your session (csrf failure). Re-enter any unsaved data and "
 "try again."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1690
+#: ../roundup/cgi/client.py:1726
 #, python-format
 msgid "csrf field not supplied by user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1702
+#: ../roundup/cgi/client.py:1738
 #, python-format
 msgid ""
 "Csrf mismatch user: current user %(user)s != stored user %(stored)s, current "
 "session, stored session: %(cur_sess)s,%(stor_sess)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1720
+#: ../roundup/cgi/client.py:1756
 #, python-format
 msgid ""
 "Csrf mismatch user: current session %(curr_sess)s != stored session "
 "%(stor_sess)s, current user/stored user is: %(user)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1912
+#: ../roundup/cgi/client.py:1948
 msgid "You are not allowed to view this file."
 msgstr "ä½ æ²¡æœ‰æŸ¥çœ‹æ­¤æ–‡ä»¶çš„æƒé™"
 
-#: ../roundup/cgi/client.py:2235
+#: ../roundup/cgi/client.py:2272
 #, python-format
 msgid "%(starttag)sTime elapsed: %(seconds)fs%(endtag)s\n"
 msgstr ""
 
-#: ../roundup/cgi/client.py:2239
+#: ../roundup/cgi/client.py:2276
 #, python-format
 msgid ""
 "%(starttag)sCache hits: %(cache_hits)d, misses %(cache_misses)d. Loading "
 "items: %(get_items)f secs. Filtering: %(filtering)f secs.%(endtag)s\n"
 msgstr ""
 
-#: ../roundup/cgi/client.py:2778
+#: ../roundup/cgi/client.py:2815
 #, python-format
 msgid ""
 "Cache failure: compressed file %(compressed)s is older than its source file "
@@ -2884,35 +2885,35 @@ msgstr "æ— æ•ˆç™»å½•"
 msgid "Api rate limits exceeded. Please wait: %s seconds."
 msgstr ""
 
-#: ../roundup/rest.py:2283
+#: ../roundup/rest.py:2284
 #, python-format
 msgid ""
-"Content type '%s' requested in URL is not available.\n"
-"Acceptable types: %s\n"
+"Content type '%(requested)s' requested in URL is not available.\n"
+"Acceptable types: %(acceptable)s\n"
 msgstr ""
 
-#: ../roundup/rest.py:2304
+#: ../roundup/rest.py:2306
 #, python-format
 msgid ""
 "Unable to parse Accept Header. %(error)s. Acceptable types: */*, "
 "%(acceptable_types)s"
 msgstr ""
 
-#: ../roundup/rest.py:2376 ../roundup/rest.py:2597 ../roundup/rest.py:2376:2597
+#: ../roundup/rest.py:2378 ../roundup/rest.py:2603 ../roundup/rest.py:2378:2603
 #, python-format
 msgid ""
 "Unrecognized api version: %s. See /rest without specifying api version for "
 "supported versions."
 msgstr ""
 
-#: ../roundup/rest.py:2411 ../roundup/rest.py:2420 ../roundup/rest.py:2411:2420
+#: ../roundup/rest.py:2413 ../roundup/rest.py:2424 ../roundup/rest.py:2413:2424
 #, python-format
 msgid ""
-"Requested content type(s) '%s' not available.\n"
-"Acceptable mime types are: */*, %s"
+"Requested content type(s) '%(requested)s' not available.\n"
+"Acceptable mime types are: */*, %(acceptable)s"
 msgstr ""
 
-#: ../roundup/rest.py:2696
+#: ../roundup/rest.py:2702
 msgid ""
 "Internal error while formatting response.\n"
 "accept_mime_type is not defined. This should\n"
@@ -3099,7 +3100,7 @@ msgid ""
 "  '-----END CERTIFICATE-----' markers?"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:345
+#: ../roundup/scripts/roundup_server.py:354
 msgid ""
 "<html><head><title>Roundup trackers index</title></head>\n"
 "<body><h1>Roundup trackers index</h1><ol>\n"
@@ -3107,58 +3108,58 @@ msgstr ""
 "<html><head><title>Roundup tracker ç´¢å¼•</title></head>\n"
 "<body><h1>Roundup tracker ç´¢å¼•</h1><ol>\n"
 
-#: ../roundup/scripts/roundup_server.py:587
+#: ../roundup/scripts/roundup_server.py:598
 #, fuzzy, python-format
 msgid "Error: %(type)s: %(value)s"
 msgstr "%(key)s: %(value)s"
 
-#: ../roundup/scripts/roundup_server.py:599
+#: ../roundup/scripts/roundup_server.py:610
 msgid "WARNING: ignoring \"-g\" argument, not root"
 msgstr "è­¦å‘Šï¼šå¿½ç•¥ \"-g\" å‚æ•°ï¼Œä¸æ˜¯ root"
 
-#: ../roundup/scripts/roundup_server.py:605
+#: ../roundup/scripts/roundup_server.py:616
 msgid "Can't change groups - no grp module"
 msgstr "ä¸èƒ½ä¿®æ”¹ç»„ - æ—  grp æ¨¡å—"
 
-#: ../roundup/scripts/roundup_server.py:614
+#: ../roundup/scripts/roundup_server.py:625
 #, python-format
 msgid "Group %(group)s doesn't exist"
 msgstr "ç»„ %(group)s ä¸å­˜åœ¨"
 
-#: ../roundup/scripts/roundup_server.py:626
+#: ../roundup/scripts/roundup_server.py:637
 msgid "Can't run as root!"
 msgstr "ä¸èƒ½ä»¥ root è¿è¡Œï¼"
 
-#: ../roundup/scripts/roundup_server.py:629
+#: ../roundup/scripts/roundup_server.py:640
 msgid "WARNING: ignoring \"-u\" argument, not root"
 msgstr "è­¦å‘Šï¼šå¿½ç•¥ \"-u\" å‚æ•°ï¼Œä¸æ˜¯ root"
 
-#: ../roundup/scripts/roundup_server.py:635
+#: ../roundup/scripts/roundup_server.py:646
 msgid "Can't change users - no pwd module"
 msgstr "ä¸èƒ½ä¿®æ”¹ç”¨æˆ· - æ—  pwd æ¨¡å—"
 
-#: ../roundup/scripts/roundup_server.py:644
+#: ../roundup/scripts/roundup_server.py:655
 #, python-format
 msgid "User %(user)s doesn't exist"
 msgstr "ç”¨æˆ· %(user)s ä¸å­˜åœ¨"
 
-#: ../roundup/scripts/roundup_server.py:856
+#: ../roundup/scripts/roundup_server.py:867
 #, python-format
 msgid "Multiprocess mode \"%s\" is not available, switching to single-process"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:884
+#: ../roundup/scripts/roundup_server.py:895
 #, python-format
 msgid "Unable to bind to port %s, port already in use."
 msgstr "æ— æ³•ç»‘å®šåˆ°ç«¯å£ %s, ç«¯å£å·²ç»è¢«å ç”¨ã€‚"
 
-#: ../roundup/scripts/roundup_server.py:888
+#: ../roundup/scripts/roundup_server.py:899
 #, fuzzy, python-format
 msgid ""
 "Unable to bind to port %(port)s, access not allowed, errno: %(errno)s %(msg)s"
 msgstr "æ— æ³•ç»‘å®šåˆ°ç«¯å£ %s, ç«¯å£å·²ç»è¢«å ç”¨ã€‚"
 
-#: ../roundup/scripts/roundup_server.py:967
+#: ../roundup/scripts/roundup_server.py:978
 #, fuzzy
 msgid ""
 " -c <Command>  Windows Service options.\n"
@@ -3175,7 +3176,7 @@ msgstr ""
 "               å˜é‡ä¸Šé…ç½®ä¸€ä¸ªtrackerã€‚è¿™ä¸ªé€‰é¡¹ä¸Žå…¶ç»é€‰é¡¹æ˜¯äº’æ–¥çš„ã€‚æ‰“å…¥\n"
 "               \"roundup-server -c help\" æ¥äº†è§£WindowsæœåŠ¡çš„è§„èŒƒã€‚"
 
-#: ../roundup/scripts/roundup_server.py:974
+#: ../roundup/scripts/roundup_server.py:985
 #, fuzzy
 msgid ""
 " -u <UID>      runs the Roundup web server as this UID\n"
@@ -3191,7 +3192,7 @@ msgstr ""
 "åŽ»ã€‚\n"
 "               å¦‚æžœä½¿ç”¨äº† -d é€‰é¡¹ï¼Œåˆ™ -l é€‰é¡¹ *å¿…é¡»* è¦æŒ‡å®šã€‚"
 
-#: ../roundup/scripts/roundup_server.py:982
+#: ../roundup/scripts/roundup_server.py:993
 #, fuzzy, python-format
 msgid ""
 "\n"
@@ -3293,20 +3294,20 @@ msgstr ""
 "   æ„æ•°é‡çš„ name=home å¯¹ã€‚è¦ç¡®ä¿ name éƒ¨åˆ†ä¸èƒ½åŒ…æ‹¬ä»»ä½•éžurlå®‰å…¨çš„\n"
 "   å­—ç¬¦ï¼Œè±¡ç©ºæ ¼ï¼Œå› ä¸ºå®ƒä»¬ä¼šæŠŠIEæžä¹±ã€‚\n"
 
-#: ../roundup/scripts/roundup_server.py:1162
+#: ../roundup/scripts/roundup_server.py:1173
 msgid "Instances must be name=home"
 msgstr "å®žä¾‹å¿…é¡»æ˜¯ å®žä¾‹å=å®žä¾‹è·¯å¾„"
 
-#: ../roundup/scripts/roundup_server.py:1176
+#: ../roundup/scripts/roundup_server.py:1187
 #, python-format
 msgid "Configuration saved to %s"
 msgstr "é…ç½®ä¿å­˜åˆ° %s"
 
-#: ../roundup/scripts/roundup_server.py:1194
+#: ../roundup/scripts/roundup_server.py:1205
 msgid "Sorry, you can't run the server as a daemon on this Operating System"
 msgstr "æŠ±æ­‰ï¼Œåœ¨è¿™ä¸ªæ“ä½œç³»ç»Ÿä¸Šä¸èƒ½ä»¥å®ˆæŠ¤è¿›ç¨‹çš„æ–¹å¼æ¥è¿è¡ŒæœåŠ¡"
 
-#: ../roundup/scripts/roundup_server.py:1214
+#: ../roundup/scripts/roundup_server.py:1225
 #, python-format
 msgid "Roundup server started on %(HOST)s:%(PORT)s"
 msgstr "Roundup server å¯åŠ¨äºŽ %(HOST)s:%(PORT)s"
diff --git a/locale/zh_TW.po b/locale/zh_TW.po
index 7244c367b..77821cb23 100644
--- a/locale/zh_TW.po
+++ b/locale/zh_TW.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: Roundup 2.5.0\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
-"POT-Creation-Date: 2024-12-30 22:49-0500\n"
+"POT-Creation-Date: 2025-01-12 20:17-0500\n"
 "PO-Revision-Date: 2013-10-31 12:23+0100\n"
 "Last-Translator: Fred Lin <gasolin@gmail>\n"
 "Language-Team: Chinese Traditional <gasolin@gmail.com>\n"
@@ -1998,162 +1998,163 @@ msgid ""
 "</body></html>"
 msgstr ""
 
-#: ../roundup/cgi/client.py:666
+#: ../roundup/cgi/client.py:679
 msgid ""
 "XMLRPC endpoint is not using defusedxml. Improve security by installing "
 "defusedxml."
 msgstr ""
 
-#: ../roundup/cgi/client.py:728 ../roundup/cgi/client.py:1646
-#: ../roundup/cgi/client.py:728:1646
-msgid "Required Header Missing"
-msgstr ""
-
-#: ../roundup/cgi/client.py:731
+#: ../roundup/cgi/client.py:749 ../roundup/cgi/client.py:771
+#: ../roundup/cgi/client.py:749:771
 #, fuzzy
 msgid "Client is not allowed to use Rest Interface."
 msgstr "åŒ¿åç”¨æˆ¶ä¸å…è¨±ä½¿ç”¨webç•Œé¢"
 
-#: ../roundup/cgi/client.py:985
+#: ../roundup/cgi/client.py:768 ../roundup/cgi/client.py:1682
+#: ../roundup/cgi/client.py:768:1682
+msgid "Required Header Missing"
+msgstr ""
+
+#: ../roundup/cgi/client.py:1021
 msgid "Form Error: "
 msgstr "è¡¨æ ¼éŒ¯èª¤ï¼š"
 
-#: ../roundup/cgi/client.py:1078
+#: ../roundup/cgi/client.py:1114
 #, python-format
 msgid "Unrecognized charset: %r"
 msgstr "ç„¡æ³•è­˜åˆ¥çš„å­—ç¬¦é›†ï¼š%r"
 
-#: ../roundup/cgi/client.py:1345 ../roundup/cgi/client.py:2357
-#: ../roundup/cgi/client.py:1345:2357
+#: ../roundup/cgi/client.py:1381 ../roundup/cgi/client.py:2394
+#: ../roundup/cgi/client.py:1381:2394
 msgid "broken form: multiple @action values submitted"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1362
+#: ../roundup/cgi/client.py:1398
 msgid "Anonymous users are not allowed to use the web interface"
 msgstr "åŒ¿åç”¨æˆ¶ä¸å…è¨±ä½¿ç”¨webç•Œé¢"
 
-#: ../roundup/cgi/client.py:1507
+#: ../roundup/cgi/client.py:1543
 msgid "Referer header not available."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1511
+#: ../roundup/cgi/client.py:1547
 #, python-format
 msgid "csrf key used with wrong method from: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1540
+#: ../roundup/cgi/client.py:1576
 #, python-format
 msgid "csrf header %(header)s required but missing for user%(userid)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1544
+#: ../roundup/cgi/client.py:1580
 #, python-format
 msgid "Missing header: %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1552
+#: ../roundup/cgi/client.py:1588
 #, python-format
 msgid "csrf Referer header check failed for user%(userid)s. Value=%(referer)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1557
+#: ../roundup/cgi/client.py:1593
 #, fuzzy, python-format
 msgid "Invalid Referer: %s"
 msgstr "ç„¡æ•ˆç™»éŒ„"
 
-#: ../roundup/cgi/client.py:1572
+#: ../roundup/cgi/client.py:1608
 #, python-format
 msgid "csrf Origin header check failed for user%(userid)s. Value=%(origin)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1577
+#: ../roundup/cgi/client.py:1613
 #, fuzzy, python-format
 msgid "Invalid Origin %s"
 msgstr "ç„¡æ•ˆç™»éŒ„"
 
-#: ../roundup/cgi/client.py:1591
+#: ../roundup/cgi/client.py:1627
 #, python-format
 msgid ""
 "csrf X-FORWARDED-HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1597
+#: ../roundup/cgi/client.py:1633
 #, python-format
 msgid "Invalid X-FORWARDED-HOST %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1616
+#: ../roundup/cgi/client.py:1652
 #, python-format
 msgid "csrf HOST header check failed for user%(userid)s. Value=%(host)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1621
+#: ../roundup/cgi/client.py:1657
 #, python-format
 msgid "Invalid HOST %s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1629
+#: ../roundup/cgi/client.py:1665
 msgid "Csrf: unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1630
+#: ../roundup/cgi/client.py:1666
 msgid "Unable to verify sufficient headers"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1643
+#: ../roundup/cgi/client.py:1679
 #, python-format
 msgid "csrf X-REQUESTED-WITH xmlrpc required header check failed for user%s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1684
+#: ../roundup/cgi/client.py:1720
 #, python-format
 msgid "Required csrf field missing for user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1686 ../roundup/cgi/client.py:1713
-#: ../roundup/cgi/client.py:1730 ../roundup/cgi/client.py:1686:1713:1730
+#: ../roundup/cgi/client.py:1722 ../roundup/cgi/client.py:1749
+#: ../roundup/cgi/client.py:1766 ../roundup/cgi/client.py:1722:1749:1766
 msgid ""
 "We can't validate your session (csrf failure). Re-enter any unsaved data and "
 "try again."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1690
+#: ../roundup/cgi/client.py:1726
 #, python-format
 msgid "csrf field not supplied by user%s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1702
+#: ../roundup/cgi/client.py:1738
 #, python-format
 msgid ""
 "Csrf mismatch user: current user %(user)s != stored user %(stored)s, current "
 "session, stored session: %(cur_sess)s,%(stor_sess)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1720
+#: ../roundup/cgi/client.py:1756
 #, python-format
 msgid ""
 "Csrf mismatch user: current session %(curr_sess)s != stored session "
 "%(stor_sess)s, current user/stored user is: %(user)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1912
+#: ../roundup/cgi/client.py:1948
 #, fuzzy
 msgid "You are not allowed to view this file."
 msgstr "ä½ ä¸å…è¨±æŸ¥çœ‹æ­¤é "
 
-#: ../roundup/cgi/client.py:2235
+#: ../roundup/cgi/client.py:2272
 #, python-format
 msgid "%(starttag)sTime elapsed: %(seconds)fs%(endtag)s\n"
 msgstr ""
 
-#: ../roundup/cgi/client.py:2239
+#: ../roundup/cgi/client.py:2276
 #, python-format
 msgid ""
 "%(starttag)sCache hits: %(cache_hits)d, misses %(cache_misses)d. Loading "
 "items: %(get_items)f secs. Filtering: %(filtering)f secs.%(endtag)s\n"
 msgstr ""
 
-#: ../roundup/cgi/client.py:2778
+#: ../roundup/cgi/client.py:2815
 #, python-format
 msgid ""
 "Cache failure: compressed file %(compressed)s is older than its source file "
@@ -2889,35 +2890,35 @@ msgstr "ç„¡æ•ˆç™»éŒ„"
 msgid "Api rate limits exceeded. Please wait: %s seconds."
 msgstr ""
 
-#: ../roundup/rest.py:2283
+#: ../roundup/rest.py:2284
 #, python-format
 msgid ""
-"Content type '%s' requested in URL is not available.\n"
-"Acceptable types: %s\n"
+"Content type '%(requested)s' requested in URL is not available.\n"
+"Acceptable types: %(acceptable)s\n"
 msgstr ""
 
-#: ../roundup/rest.py:2304
+#: ../roundup/rest.py:2306
 #, python-format
 msgid ""
 "Unable to parse Accept Header. %(error)s. Acceptable types: */*, "
 "%(acceptable_types)s"
 msgstr ""
 
-#: ../roundup/rest.py:2376 ../roundup/rest.py:2597 ../roundup/rest.py:2376:2597
+#: ../roundup/rest.py:2378 ../roundup/rest.py:2603 ../roundup/rest.py:2378:2603
 #, python-format
 msgid ""
 "Unrecognized api version: %s. See /rest without specifying api version for "
 "supported versions."
 msgstr ""
 
-#: ../roundup/rest.py:2411 ../roundup/rest.py:2420 ../roundup/rest.py:2411:2420
+#: ../roundup/rest.py:2413 ../roundup/rest.py:2424 ../roundup/rest.py:2413:2424
 #, python-format
 msgid ""
-"Requested content type(s) '%s' not available.\n"
-"Acceptable mime types are: */*, %s"
+"Requested content type(s) '%(requested)s' not available.\n"
+"Acceptable mime types are: */*, %(acceptable)s"
 msgstr ""
 
-#: ../roundup/rest.py:2696
+#: ../roundup/rest.py:2702
 msgid ""
 "Internal error while formatting response.\n"
 "accept_mime_type is not defined. This should\n"
@@ -3105,7 +3106,7 @@ msgid ""
 "  '-----END CERTIFICATE-----' markers?"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:345
+#: ../roundup/scripts/roundup_server.py:354
 msgid ""
 "<html><head><title>Roundup trackers index</title></head>\n"
 "<body><h1>Roundup trackers index</h1><ol>\n"
@@ -3113,58 +3114,58 @@ msgstr ""
 "<html><head><title>Roundup tracker ç´¢å¼•</title></head>\n"
 "<body><h1>Roundup tracker ç´¢å¼•</h1><ol>\n"
 
-#: ../roundup/scripts/roundup_server.py:587
+#: ../roundup/scripts/roundup_server.py:598
 #, fuzzy, python-format
 msgid "Error: %(type)s: %(value)s"
 msgstr "%(key)s: %(value)s (é—œéµå±¬æ€§)"
 
-#: ../roundup/scripts/roundup_server.py:599
+#: ../roundup/scripts/roundup_server.py:610
 msgid "WARNING: ignoring \"-g\" argument, not root"
 msgstr "è­¦å‘Šï¼šå¿½ç•¥ \"-g\" åƒæ•¸ï¼Œä¸æ˜¯ root"
 
-#: ../roundup/scripts/roundup_server.py:605
+#: ../roundup/scripts/roundup_server.py:616
 msgid "Can't change groups - no grp module"
 msgstr "ä¸èƒ½ä¿®æ”¹çµ„ - ç„¡ grp æ¨¡å¡Š"
 
-#: ../roundup/scripts/roundup_server.py:614
+#: ../roundup/scripts/roundup_server.py:625
 #, python-format
 msgid "Group %(group)s doesn't exist"
 msgstr "çµ„ %(group)s ä¸å­˜åœ¨"
 
-#: ../roundup/scripts/roundup_server.py:626
+#: ../roundup/scripts/roundup_server.py:637
 msgid "Can't run as root!"
 msgstr "ä¸èƒ½ä»¥ root é‹è¡Œï¼"
 
-#: ../roundup/scripts/roundup_server.py:629
+#: ../roundup/scripts/roundup_server.py:640
 msgid "WARNING: ignoring \"-u\" argument, not root"
 msgstr "è­¦å‘Šï¼šå¿½ç•¥ \"-u\" åƒæ•¸ï¼Œä¸æ˜¯ root"
 
-#: ../roundup/scripts/roundup_server.py:635
+#: ../roundup/scripts/roundup_server.py:646
 msgid "Can't change users - no pwd module"
 msgstr "ä¸èƒ½ä¿®æ”¹ç”¨æˆ¶ - ç„¡ pwd æ¨¡å¡Š"
 
-#: ../roundup/scripts/roundup_server.py:644
+#: ../roundup/scripts/roundup_server.py:655
 #, python-format
 msgid "User %(user)s doesn't exist"
 msgstr "ç”¨æˆ¶ %(user)s ä¸å­˜åœ¨"
 
-#: ../roundup/scripts/roundup_server.py:856
+#: ../roundup/scripts/roundup_server.py:867
 #, python-format
 msgid "Multiprocess mode \"%s\" is not available, switching to single-process"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:884
+#: ../roundup/scripts/roundup_server.py:895
 #, python-format
 msgid "Unable to bind to port %s, port already in use."
 msgstr "ç„¡æ³•ç¶å®šåˆ°ç«¯å£ %s, ç«¯å£å·²ç¶“è¢«ä½”ç”¨ã€‚"
 
-#: ../roundup/scripts/roundup_server.py:888
+#: ../roundup/scripts/roundup_server.py:899
 #, fuzzy, python-format
 msgid ""
 "Unable to bind to port %(port)s, access not allowed, errno: %(errno)s %(msg)s"
 msgstr "ç„¡æ³•ç¶å®šåˆ°ç«¯å£ %s, ç«¯å£å·²ç¶“è¢«ä½”ç”¨ã€‚"
 
-#: ../roundup/scripts/roundup_server.py:967
+#: ../roundup/scripts/roundup_server.py:978
 #, fuzzy
 msgid ""
 " -c <Command>  Windows Service options.\n"
@@ -3181,7 +3182,7 @@ msgstr ""
 "               è®Šé‡ä¸Šé…ç½®ä¸€å€‹trackerã€‚é€™å€‹é¸é …èˆ‡å…¶ç¶“é¸é …æ˜¯äº’æ–¥çš„ã€‚æ‰“å…¥\n"
 "               \"roundup-server -c help\" ä¾†çž­è§£Windowsæœå‹™çš„è¦ç¯„ã€‚"
 
-#: ../roundup/scripts/roundup_server.py:974
+#: ../roundup/scripts/roundup_server.py:985
 #, fuzzy
 msgid ""
 " -u <UID>      runs the Roundup web server as this UID\n"
@@ -3197,7 +3198,7 @@ msgstr ""
 "åŽ»ã€‚\n"
 "               å¦‚æžœä½¿ç”¨äº† -d é¸é …ï¼Œå‰‡ -l é¸é … *å¿…é ˆ* è¦æŒ‡å®šã€‚"
 
-#: ../roundup/scripts/roundup_server.py:982
+#: ../roundup/scripts/roundup_server.py:993
 #, fuzzy, python-format
 msgid ""
 "\n"
@@ -3299,20 +3300,20 @@ msgstr ""
 "   æ„æ•¸é‡çš„ name=home å°ã€‚è¦ç¢ºä¿ name éƒ¨åˆ†ä¸èƒ½åŒ…æ‹¬ä»»ä½•éžurlå®‰å…¨çš„\n"
 "   å­—ç¬¦ï¼Œåƒç©ºæ ¼ï¼Œå› ç‚ºå®ƒå€‘æœƒæŠŠIEæžäº‚ã€‚\n"
 
-#: ../roundup/scripts/roundup_server.py:1162
+#: ../roundup/scripts/roundup_server.py:1173
 msgid "Instances must be name=home"
 msgstr "å¯¦ä¾‹å¿…é ˆæ˜¯ å¯¦ä¾‹å=å¯¦ä¾‹è·¯å¾‘"
 
-#: ../roundup/scripts/roundup_server.py:1176
+#: ../roundup/scripts/roundup_server.py:1187
 #, python-format
 msgid "Configuration saved to %s"
 msgstr "é…ç½®ä¿å­˜åˆ° %s"
 
-#: ../roundup/scripts/roundup_server.py:1194
+#: ../roundup/scripts/roundup_server.py:1205
 msgid "Sorry, you can't run the server as a daemon on this Operating System"
 msgstr "æŠ±æ­‰ï¼Œåœ¨é€™å€‹æ“ä½œç³»çµ±ä¸Šä¸èƒ½ä»¥å®ˆè­·é€²ç¨‹çš„æ–¹å¼ä¾†é‹è¡Œæœå‹™"
 
-#: ../roundup/scripts/roundup_server.py:1214
+#: ../roundup/scripts/roundup_server.py:1225
 #, python-format
 msgid "Roundup server started on %(HOST)s:%(PORT)s"
 msgstr "Roundup server å•Ÿå‹•æ–¼ %(HOST)s:%(PORT)s"

From e67c356a7cbb74f71807719b2443df830d15966b Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 12 Jan 2025 20:41:31 -0500
Subject: [PATCH 138/398] doc: typo fix.

---
 doc/upgrading.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/upgrading.txt b/doc/upgrading.txt
index 52503a493..21497b3ff 100644
--- a/doc/upgrading.txt
+++ b/doc/upgrading.txt
@@ -528,7 +528,7 @@ to::
       self.form_wins = True
       self.add_error_message(' '.join(msg.args))
 
-This escapes the Referer value an prevents it from being
+This escapes the Referer value and prevents it from being
 executed.
 
 .. _CVE-2024-39126:

From 97c8928265a122fa6492155d5ad74b2e9f937759 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 12 Jan 2025 22:16:28 -0500
Subject: [PATCH 139/398] doc: update README for www.roundup-tracker.org.

New directions on building/upgrading.
---
 website/README.txt | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/website/README.txt b/website/README.txt
index 4d5fab225..f72faeb58 100644
--- a/website/README.txt
+++ b/website/README.txt
@@ -57,6 +57,17 @@ to free resources:
 
 updating www.roundup-tracker.org
 ---------------------------------
+Note that sourceforge still only has python2 available on it's
+systems. Doc updates probably need to be done by building on local
+machine using modern Sphinx (7.x or greater) and the generated files
+pushed to the website.
+
+Also the files htdocs/ahref* and htdocs/google* have to be copied from
+the current production tree to the new directory so we keep some level
+of analytics.
+
+-----
+
 Site update requires rebuilding HTML files. For that
 `sphinx` is required/
 Hopefully, it is already installed into virtualenv, so

From cf7e17dee6e4bc0e738176123a8969a3e6641ba1 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 13 Jan 2025 12:48:31 -0500
Subject: [PATCH 140/398] refactor: translator hint that 'user%s' should not be
 'user %s'

When I looked at this in the .po file, I thought it was a typo
expecting:

  user rouilj

not

  user1

add userid as a named replacement field to hint to the translator that
"user%s" becomes user1 and the token shouldn't be split.
---
 roundup/cgi/client.py | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/roundup/cgi/client.py b/roundup/cgi/client.py
index c137ee150..7c9e0148c 100644
--- a/roundup/cgi/client.py
+++ b/roundup/cgi/client.py
@@ -1677,8 +1677,8 @@ def handle_csrf(self, api=False):
             if 'HTTP_X_REQUESTED_WITH' not in self.env:
                 logger.error(self._(
                     ''"csrf X-REQUESTED-WITH xmlrpc required header "
-                    ''"check failed for user%s."),
-                             current_user)
+                    ''"check failed for user%(userid)s."),
+                    {"userid": current_user})
                 raise UsageError(self._("Required Header Missing"))
 
         # Expire old csrf tokens now so we don't use them.  These will
@@ -1717,14 +1717,16 @@ def handle_csrf(self, api=False):
         if key is None:  # we do not have an @csrf token
             if enforce == 'required':
                 logger.error(self._(
-                    "Required csrf field missing for user%s"), current_user)
+                    "Required csrf field missing for user%(userid)s"),
+                             {"userid": current_user})
                 raise UsageError(self._(
                     ''"We can't validate your session (csrf failure). "
                     ''"Re-enter any unsaved data and try again."))
             if enforce == 'logfailure':
                 # FIXME include url
-                logger.warning(self._("csrf field not supplied by user%s"),
-                               current_user)
+                logger.warning(self._(
+                    "csrf field not supplied by user%(userid)s"),
+                    {"userid": current_user})
             else:
                 # enforce is either yes or no. Both permit change if token is
                 # missing

From e7c423c5c30a20baf768e4f9b24f2d5ced05e024 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 15 Jan 2025 22:22:32 -0500
Subject: [PATCH 141/398] build: fixes for makfile to work with local autobuild
 of doc

I am autobuilding docs on every file change. This takes a while
because I unconditionally deleted the entire html output directory.
Now I use an environment var to control deletion of html. This allows
incremental rebuilds with must faster cycle time when I break the
docs.

Because I no longer delete the output directory had to:

  change mkdir call so it does not error if directory exists
  delete robots.txt to mae sphinx not complain about the file in the
      html dir.
---
 website/www/Makefile | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/website/www/Makefile b/website/www/Makefile
index 5d7eb71fc..02e6c333d 100644
--- a/website/www/Makefile
+++ b/website/www/Makefile
@@ -13,7 +13,8 @@ help:
 # fix that in postprocess
 # also sed index.html to properly format meta og:... entries.
 html: doc_links  ## make standalone HTML files
-	rm -rf html
+	if [ -z "${KEEP_HTML}" ]; then rm -rf html; fi
+	rm -f html/robots.txt  # otherwise sphinx errors
 	mkdir -p $(TMP)/doctrees $(HTML)
 	sphinx-build -n -W -b html -d $(TMP)/doctrees . $(HTML)
         # install searchtools.js into search page.
@@ -23,7 +24,7 @@ html: doc_links  ## make standalone HTML files
 	sed -i -e '/<meta/s/og\\:/og:/' \
              -e '/<meta/s/name="og:/property="og:/' html/index.html
 	cp robots.txt html/robots.txt
-	mkdir html/signatures && cp signatures/*.asc html/signatures
+	mkdir -p html/signatures && cp signatures/*.asc html/signatures
 	cp --no-clobber -r docs/html_extra/. html/docs/.
 	cp htaccess html/.htaccess
 	@echo; \

From 235a0ce90c2dec7d9b305a9a7e249786e417d635 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 16 Jan 2025 02:32:58 -0500
Subject: [PATCH 142/398] issue2551391 - checkboxes and radiobutton inputs get
 wrong id's.

Actually it breaks automatic id assignment for all inputs.

Inputs now get an automatic id assignment that matches the name.
It can be overridden by supplting an id parameter in the call to
the field() method.

This is also a partial fix for issue1513369. I think it obsoletes the
changes to templating.py.
---
 CHANGES.txt               |  3 +++
 roundup/cgi/templating.py |  2 +-
 test/test_cgi.py          |  2 +-
 test/test_liveserver.py   |  4 ++--
 test/test_templating.py   | 22 ++++++++++++----------
 5 files changed, 19 insertions(+), 14 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index 29d0d05d8..e4c5344d4 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -74,6 +74,9 @@ Fixed:
 - close http socket and send a 408 status when a timeout exception
   is handed in roundup-server. This prevents another exception
   caused by using a timed out socket. (John Rouillard)
+- issue2551391, partial fix for issue1513369. input fields were
+  not getting id's assigned. Fixed automatic id assignment to
+  input fields. Thinko in the code. (John Rouillard)
 
 Features:
 
diff --git a/roundup/cgi/templating.py b/roundup/cgi/templating.py
index 6a6fe8cea..93f1c7286 100644
--- a/roundup/cgi/templating.py
+++ b/roundup/cgi/templating.py
@@ -607,7 +607,7 @@ def _set_input_default_args(dic):
     # useful e.g for HTML LABELs:
     if 'id' not in dic:
         try:
-            if dic['text'] in ('radio', 'checkbox'):
+            if dic['type'] in ('radio', 'checkbox'):
                 dic['id'] = '%(name)s-%(value)s' % dic
             else:
                 dic['id'] = dic['name']
diff --git a/test/test_cgi.py b/test/test_cgi.py
index 022b83857..03dd0d490 100644
--- a/test/test_cgi.py
+++ b/test/test_cgi.py
@@ -950,7 +950,7 @@ def hasPermission(s, p, classname=None, d=None, e=None, **kw):
           <p>deferred</p>
           <p>admin, anonymous</p>
           <p></p>
-          <p><input name="superseder" size="30" type="text" value="5000"></p>
+          <p><input id="superseder" name="superseder" size="30" type="text" value="5000"></p>
          </body>
         </html>
         """.strip ())
diff --git a/test/test_liveserver.py b/test/test_liveserver.py
index 19479712f..ddad9f687 100644
--- a/test/test_liveserver.py
+++ b/test/test_liveserver.py
@@ -1503,9 +1503,9 @@ def test__generic_item_template_editok(self, user="admin"):
         self.assertIn(b'done-cbb', f.content)
 
         if user == 'admin':
-            self.assertIn(b'<input name="submit_button" type="submit" value="Submit Changes">', f.content)
+            self.assertIn(b'<input id="submit_button" name="submit_button" type="submit" value="Submit Changes">', f.content)
         else:
-            self.assertNotIn(b'<input name="submit_button" type="submit" value="Submit Changes">', f.content)
+            self.assertNotIn(b'<input id="submit_button" name="submit_button" type="submit" value="Submit Changes">', f.content)
 
         # logout
         f = session.get(self.url_base()+'/?@action=logout')
diff --git a/test/test_templating.py b/test/test_templating.py
index 4a34b42cd..a429609d7 100644
--- a/test/test_templating.py
+++ b/test/test_templating.py
@@ -350,14 +350,15 @@ def test_number_field(self):
         p = NumberHTMLProperty(self.client, 'testnum', '1', None, 'test',
                                2345678.2345678)
         self.assertEqual(p.field(),
-                         ('<input name="testnum1@test" size="30" type="text" '
+                         ('<input id="testnum1@test" name="testnum1@test" size="30" type="text" '
                          'value="%s">')%expected_val)
         self.assertEqual(p.field(size=10),
-                         ('<input name="testnum1@test" size="10" type="text" '
+                         ('<input id="testnum1@test" name="testnum1@test" size="10" type="text" '
                          'value="%s">')%expected_val)
         self.assertEqual(p.field(size=10, dataprop="foo", dataprop2=5),
                          ('<input dataprop="foo" dataprop2="5" '
-                          'name="testnum1@test" size="10" type="text" '
+                          'id="testnum1@test" name="testnum1@test" '
+                          'size="10" type="text" '
                           'value="%s">'%expected_val))
 
         self.assertEqual(p.field(size=10, klass="class1", 
@@ -365,7 +366,8 @@ def test_number_field(self):
                                      "data-prop": "foo",
                                      "data-prop2": 5}),
                          ('<input class="class2 class3" data-prop="foo" '
-                          'data-prop2="5" klass="class1" '
+                          'data-prop2="5" id="testnum1@test" '
+                          'klass="class1" '
                           'name="testnum1@test" size="10" type="text" '
                           'value="%s">')%expected_val)
 
@@ -377,8 +379,8 @@ def test_number_field(self):
         p = NumberHTMLProperty(self.client, 'testnum', '1', None, 'test',
                                "2345678.2345678")
         self.assertEqual(p.field(),
-                         ('<input name="testnum1@test" size="30" type="text" '
-                          'value="2345678.2345678">'))
+                         ('<input id="testnum1@test" name="testnum1@test" '
+                          'size="30" type="text" value="2345678.2345678">'))
 
         # test with None value, pretend property.__default_value = Null which
         #    is the default. It would be returned by get_default_value
@@ -387,8 +389,8 @@ def test_number_field(self):
         p = NumberHTMLProperty(self.client, 'testnum', '1', property, 
                                'test', None)
         self.assertEqual(p.field(),
-                         ('<input name="testnum1@test" size="30" type="text" '
-                          'value="">'))
+                         ('<input id="testnum1@test" name="testnum1@test" '
+                         'size="30" type="text" value="">'))
 
     def test_number_plain(self):
         import sys
@@ -570,7 +572,7 @@ def test_string_rst(self):
 
     def test_string_field(self):
         p = StringHTMLProperty(self.client, 'test', '1', None, 'test', 'A string <b> with rouilj@example.com embedded &lt; html</b>')
-        self.assertEqual(p.field(), '<input name="test1@test" size="30" type="text" value="A string &lt;b&gt; with rouilj@example.com embedded &amp;lt; html&lt;/b&gt;">')
+        self.assertEqual(p.field(), '<input id="test1@test" name="test1@test" size="30" type="text" value="A string &lt;b&gt; with rouilj@example.com embedded &amp;lt; html&lt;/b&gt;">')
 
     def test_string_multiline(self):
         p = StringHTMLProperty(self.client, 'test', '1', None, 'test', 'A string <b> with rouilj@example.com embedded &lt; html</b>')
@@ -746,7 +748,7 @@ def test_DateHTMLWithText(self):
         self.assertIs(type(d._value), str)
         self.assertEqual(d.pretty(), "2021-01-01 11:22:10")
         self.assertEqual(d.plain(), "2021-01-01 11:22:10")
-        input = """<input name="test1@test" size="30" type="text" value="2021-01-01 11:22:10"><a class="classhelp" data-calurl="test?@template=calendar&amp;amp;property=test&amp;amp;form=itemSynopsis&amp;date=2021-01-01 11:22:10" data-height="200" data-width="300" href="javascript:help_window('test?@template=calendar&amp;property=test&amp;form=itemSynopsis&date=2021-01-01 11:22:10', 300, 200)">(cal)</a>"""
+        input = """<input id="test1@test" name="test1@test" size="30" type="text" value="2021-01-01 11:22:10"><a class="classhelp" data-calurl="test?@template=calendar&amp;amp;property=test&amp;amp;form=itemSynopsis&amp;date=2021-01-01 11:22:10" data-height="200" data-width="300" href="javascript:help_window('test?@template=calendar&amp;property=test&amp;form=itemSynopsis&date=2021-01-01 11:22:10', 300, 200)">(cal)</a>"""
         self.assertEqual(d.field(), input)
 
 # common markdown test cases

From b1bdb61efbe4d18fb304ed550ced30ad4d47eba3 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 16 Jan 2025 21:13:20 -0500
Subject: [PATCH 143/398] doc: fix typo

---
 doc/installation.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/installation.txt b/doc/installation.txt
index 7e05ec5ee..ae983a6a5 100644
--- a/doc/installation.txt
+++ b/doc/installation.txt
@@ -753,7 +753,7 @@ See:
 
    https://github.com/MicrosoftDocs/iis-docs/blob/main/iis/web-dev-reference/server-variables.md
 
-More information about ISS setup may be found at:
+More information about IIS setup may be found at:
 
    https://learn.microsoft.com/en-us/iis/
 

From e5e527c2427d673b5bf0508a90fd7479c7877475 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sat, 18 Jan 2025 11:20:20 -0500
Subject: [PATCH 144/398] chore: quote some strings with variables and add
 comments

make sure that a space in a variable doesn't cause a problem. Also
merge two RUN commands.
---
 scripts/Docker/Dockerfile | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/scripts/Docker/Dockerfile b/scripts/Docker/Dockerfile
index 39a6b1c1f..828044950 100644
--- a/scripts/Docker/Dockerfile
+++ b/scripts/Docker/Dockerfile
@@ -46,13 +46,12 @@ ARG appdir
 WORKDIR $appdir
 
 # Update to get security and other improvements;
-RUN apk --no-cache upgrade
-
 # Add packages needed to compile mysql, pgsql and other python modules.
 # Can't use apk to add python packages as it installs for base image
 # in /usr.
 #        g++ installs cc1plus needed by pip install
-RUN apk --no-cache add \
+RUN apk --no-cache upgrade; \
+    apk --no-cache add \
     file \
     g++ \
     gcc \
@@ -83,14 +82,18 @@ COPY scripts/Docker/sphinxdeps.txt .
 # suppress warning when running pip as root
 ENV PIP_ROOT_USER_ACTION=ignore
 
+# force embedded script to fail on any error "-e"
+# including in a pipeline (-o pipefail) (note pipefail
+# is not documented, but setting it isn;t an error and
+# works in testing)
 SHELL ["/bin/ash", "-eo", "pipefail", "-c"]
 ARG VERBOSE
 ARG pythonversion
 
 RUN [ -z "${VERBOSE}" ] || set -xv; \
     CWD="$PWD" && \
-    upgrades=$(python3 -m pip --no-cache-dir --disable-pip-version-check \
-	list --outdated | awk 'NR > 2 {print $1}'); \
+    upgrades="$(python3 -m pip --no-cache-dir --disable-pip-version-check \
+	list --outdated | awk 'NR > 2 {print $1}')"; \
     if [ -n "$upgrades" ]; then \
         echo "Pip updating $upgrades"; \
         python -m pip --no-cache-dir --disable-pip-version-check \
@@ -98,7 +101,7 @@ RUN [ -z "${VERBOSE}" ] || set -xv; \
     else \
         echo "Nothing to pip update"; \
     fi; \
-    ls -l /usr/local/lib/python${pythonversion}/site-packages; \
+    ls -l "/usr/local/lib/python${pythonversion}/site-packages"; \
     VER=$(apk list -I 'xapian-core-dev' | \
           sed 's/^xapian-core-dev-\([0-9.]*\)-.*/\1/') && \
     cd /tmp && \
@@ -211,8 +214,8 @@ RUN apk --no-cache upgrade; \
      libstdc++ \
      libxapian \
      zstd-libs; \
-    upgrades=$(python3 -m pip --no-cache-dir --disable-pip-version-check \
-	list --outdated | awk 'NR > 2 {print $1}'); \
+    upgrades="$(python3 -m pip --no-cache-dir --disable-pip-version-check \
+	list --outdated | awk 'NR > 2 {print $1}')"; \
     if [ -n "$upgrades" ]; then \
         echo "Pip updating $upgrades"; \
         python -m pip --no-cache-dir --disable-pip-version-check \

From caf56124d178e16b4d4f6c6a7c7b5eb3790b00dc Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sat, 18 Jan 2025 12:23:23 -0500
Subject: [PATCH 145/398] fix: issue2551390 - Replace text input/calendar popup
 with native date input

Docs, code and test changes for the changeover to a native date
element.

See issue for details.
---
 CHANGES.txt                                   |   4 +
 doc/customizing.txt                           |   4 +-
 doc/reference.txt                             |  44 ++++-
 doc/upgrading.txt                             | 142 ++++++++++++++++
 doc/user_guide.txt                            |  34 +++-
 roundup/cgi/templating.py                     |  52 +++++-
 roundup/date.py                               |   2 +-
 .../templates/classic/html/datecopy.js        | 116 +++++++++++++
 .../templates/classic/html/datecopy.min.js    |   1 +
 .../roundup/templates/classic/html/page.html  |   1 +
 .../roundup/templates/devel/html/datecopy.js  | 116 +++++++++++++
 .../templates/devel/html/datecopy.min.js      |   1 +
 share/roundup/templates/devel/html/page.html  |   1 +
 .../roundup/templates/jinja2/html/datecopy.js | 116 +++++++++++++
 .../templates/jinja2/html/datecopy.min.js     |   1 +
 .../templates/jinja2/html/layout/page.html    |   1 +
 .../templates/minimal/html/datecopy.js        | 116 +++++++++++++
 .../templates/minimal/html/datecopy.min.js    |   1 +
 .../roundup/templates/minimal/html/page.html  |   1 +
 .../templates/responsive/html/datecopy.js     | 116 +++++++++++++
 .../templates/responsive/html/datecopy.min.js |   1 +
 .../templates/responsive/html/page.html       |   1 +
 test/test_dates.py                            |   5 +
 test/test_templating.py                       | 159 +++++++++++++++++-
 24 files changed, 1022 insertions(+), 14 deletions(-)
 create mode 100644 share/roundup/templates/classic/html/datecopy.js
 create mode 100644 share/roundup/templates/classic/html/datecopy.min.js
 create mode 100644 share/roundup/templates/devel/html/datecopy.js
 create mode 100644 share/roundup/templates/devel/html/datecopy.min.js
 create mode 100644 share/roundup/templates/jinja2/html/datecopy.js
 create mode 100644 share/roundup/templates/jinja2/html/datecopy.min.js
 create mode 100644 share/roundup/templates/minimal/html/datecopy.js
 create mode 100644 share/roundup/templates/minimal/html/datecopy.min.js
 create mode 100644 share/roundup/templates/responsive/html/datecopy.js
 create mode 100644 share/roundup/templates/responsive/html/datecopy.min.js

diff --git a/CHANGES.txt b/CHANGES.txt
index e4c5344d4..9baf8be5a 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -77,6 +77,10 @@ Fixed:
 - issue2551391, partial fix for issue1513369. input fields were
   not getting id's assigned. Fixed automatic id assignment to
   input fields. Thinko in the code. (John Rouillard)
+- issue2551390 - Replace text input/calendar popup with native
+  date input. Also add double-click and exit keyboard handlers to
+  allow copy/paste/editing the text version of the date.  (John
+  Rouillard)
 
 Features:
 
diff --git a/doc/customizing.txt b/doc/customizing.txt
index 46226fb08..bf717012e 100644
--- a/doc/customizing.txt
+++ b/doc/customizing.txt
@@ -90,11 +90,11 @@ caches the schema).
       <td tal:content="structure context/due_date/field" /> 
      </tr>
     
-   If you want to show only the date part of due_date then do this instead::
+   If you want to show the date and time for due_date then do this instead::
    
     <tr> 
      <th>Due Date</th> 
-     <td tal:content="structure python:context.due_date.field(format='%Y-%m-%d')" /> 
+     <td tal:content="structure context/due_date/field_time" /> 
     </tr>
 
 3. Add the property to the ``issue.index.html`` page::
diff --git a/doc/reference.txt b/doc/reference.txt
index 91868047f..1c20feb58 100644
--- a/doc/reference.txt
+++ b/doc/reference.txt
@@ -3070,17 +3070,28 @@ There are several methods available on these wrapper objects:
 	      tri-state yes/no/neither selection. This method may take some
 	      arguments:
 
-	      size
+	      size (default 30)
 		Sets the width in characters of the edit field
 
 	      format (Date properties only)
-		Sets the format of the date in the field - uses the same
-		format string argument as supplied to the ``pretty`` method
-		below.
+                Sets the format of the date in the field - uses the
+		same format string argument as supplied to the
+		``pretty`` method below. If you use this, it will
+		prevent the use of browser native date inputs. It is
+		useful if you want partial dates. For example using
+		``format="%Y-%m"`` with ``type="text"`` will display a
+		text edit box with the year and month part of your
+		date.
+
+              type (depends on property type)
+                Sets the type property of the input. To change a date
+                property field from a native date input to a text
+                input you would use ``type="text"``.
 
 	      popcal (Date properties only)
-		Include the JavaScript-based popup calendar for date
-		selection. Defaults to on.
+		Include a link to the JavaScript-based popup calendar
+		for date selection. Defaults to off/False since native
+		date inputs supply popup calendars.
 
 	      y_label, n_label, u_label (Boolean properties only)
 	        Set the labels for the true/false/undefined
@@ -3104,6 +3115,10 @@ There are several methods available on these wrapper objects:
 	      attribute without a value. This is useful for boolean
 	      properties like ``required``.
 
+  field_time  (Date properties only)
+              Create a browser native input for editing date and time.
+              The field method creates an input for editing
+              month/day/year (without time).
 
   rst         only on String properties - render the value of the property
 	      as ReStructuredText (requires the :ref:`Docutils
@@ -3164,7 +3179,11 @@ There are several methods available on these wrapper objects:
 	      is returned if the value is ``None`` otherwise it
 	      is converted to a string.
 
-  popcal      Generate a link to a popup calendar which may be used to
+  popcal      This is deprecated with Roundup 2.5 which uses the
+              native HTML5 date input. The native date input
+              includes a calendar popup on modern broswers.
+
+              Generate a link to a popup calendar which may be used to
 	      edit the date field, for example::
 
 		<span tal:replace="structure context/due/popcal" />
@@ -4027,6 +4046,17 @@ This example indicates that the value sent back to the user is actually
 comma-separated value content (i.e. something to load into a
 spreadsheet or database).
 
+CSS for the web interface
+-------------------------
+
+The web interface can be completely redesigned by the admin, However
+some parts of Roundup use classes or set attributes that can be
+selected by css to change the look of the element.
+
+The ``datecopy.js`` module used to allow editing a date value with a
+text input assigns the ``mode_textdate`` class to the input when it is
+in text mode. The class is removed when it is not in text mode.
+
 
 8-bit character set support in Web interface
 --------------------------------------------
diff --git a/doc/upgrading.txt b/doc/upgrading.txt
index 21497b3ff..7cf3b332e 100644
--- a/doc/upgrading.txt
+++ b/doc/upgrading.txt
@@ -224,6 +224,148 @@ defusedxml.
 
 .. _defusedxml: https://pypi.org/project/defusedxml/
 
+Use native date inputs (optional)
+---------------------------------
+
+Roundup now uses native date or datetime-local inputs for Date()
+properties. These inputs take the place of the text input and
+calendar popup from earlier Roundup versions. Modern browsers
+come with a built-in calendar for date selection, so the
+``(cal)`` calendar link is no longer needed. These native inputs
+show the date based on the browser's locale and translate terms
+into the local language.
+
+If you do nothing, simple uses of the field() method will
+generate date inputs to allow selection of a date.  Input fields
+for Date() properties will not have the ``(cal)`` link
+anymore. Complex uses will not be upgraded and will operate like
+earlier Roundup versions.
+
+To upgrade all date properties, there are four changes to make:
+
+  1. Replace ``field`` calls with ``field_time`` where needed.
+
+  2. Remove the format argument from field() calls on Date()
+     properties.
+
+  3. Remove popcal() calls.
+
+  4. Include datecopy.js in page.html.
+
+Use field_time() where needed
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The format used by ``field`` does not include hours, minutes or
+seconds. If your users need to enter times, you should change
+these calls to use ``field_time``. The arguments are the same as
+for field.
+
+Remove format argument
+~~~~~~~~~~~~~~~~~~~~~~
+
+Speaking of arguments, avoid setting the date format if you want
+to use native date inputs. The date value needs a specific format
+for date or datetime-local inputs. If you include the `format`
+argument in the `field` method, it should be removed.
+
+The `field` method uses the format ``%Y-%m-%d``.  The
+``field_time`` method uses the format ``%Y-%m-%dT%H:%M:%S``. If
+you use these exact formats, Roundup will accept them and use a
+native date input.
+
+.. highlight:: text
+
+If you use an format that doesn't match, you will see a text
+input and a logged warning message like::
+
+  Format '%Y-%m' prevents use of modern date input.
+  Remove format from field() call in template test.item.
+  Using text input.
+
+.. highlight:: default
+
+The log message will appear if your logging level is set to
+WARNING or lower. (Refer to your tracker's :ref:`config.ini
+logging section <config-ini-section-logging>` for details on
+logging levels.)
+
+If you want to use a text input for a specific date format, you
+can add ``type="text"`` to the field() argument list to suppress
+the warning. By default using a format argument will show the
+popup calendar link. You can disable the link by setting
+``popcal=False`` in the field() call. If you have::
+
+  tal:content="structure python:context.duedate.field(
+               placeholder='YYYY-MM, format='%Y-%m')"
+
+changing it to::
+
+  tal:content="structure python:context.duedate.field(
+               type='text',
+               placeholder='YYYY-MM, format='%Y-%m',
+               popcal=False)"
+
+will generate the input as in Roundup 2.4 or earlier without a
+popcal link.
+
+If you are using a path expression like::
+
+  tal:content="context/duedate/field"
+
+change it to::
+
+  tal:content="structure python:context.duedate.field(
+               type='text')"
+
+to get the input from before Roundup 2.5 with a popcal link.
+
+Remove popcal
+~~~~~~~~~~~~~
+
+If you use the ``popcal()`` method directly in your templates, you
+can remove them. The browser's native date selection calendar can
+be used instead.
+
+Add copy/paste/edit on double-click using datecopy.js
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+There is no way to copy/paste using a native datetime-local or
+date input. With the datecopy.js file installed, double-clicking
+on the input turns it into a normal text input with the ability
+to copy, paste, or manually edit the date.
+
+To set this up, take either ``datecopy.js`` or the smaller
+version, ``datecopy.min.js``, from the ``html`` folder of the
+classic tracker template. Put the file in the ``html`` folder of
+your tracker home.
+
+After you install the datecopy file, you can add the script
+directly to a page using::
+
+  <script tal:attributes="nonce request/client/client_nonce"
+          tal:content="structure python:utils.readfile('datecopy.min.js')">
+  </script>
+
+or get the file in a separate download using a regular script
+tag::
+
+    <script type="text/javascript" src="@@file/datecopy.js">
+    </script>
+
+You can place these at the end of ``page.html`` just before the
+close body ``</body>`` tag. This is the method used in the
+classic template. This forces the file to be run for every page
+even those that don't have any date inputs. However, it is cached
+after the first download.
+
+Alternatively you can inline or link to it using a script tag
+only on pages that will have a date input. For example
+``issue.item.html``.
+
+There is no support for activating text mode using the
+keyboard. Tablet/touch support is mixed. Chrome supports
+double-tap to activate text mode input. Firefox does not.
+
 Change in REST response for invalid CORS requests (info)
 --------------------------------------------------------
 
diff --git a/doc/user_guide.txt b/doc/user_guide.txt
index faade3492..2037e9eb7 100644
--- a/doc/user_guide.txt
+++ b/doc/user_guide.txt
@@ -177,6 +177,14 @@ Classhelper`_ for details.
 Date properties
 ~~~~~~~~~~~~~~~
 
+Date properties are usually shown using a native HTML date
+element. This provides a calendar button for choosing the
+date. The date is shown in the normal format for your location.
+
+Native date inputs do not allow the use of partial forms as
+defined below.  For this reason, you may edit a date/time
+stamp directly.
+
 Date-and-time stamps are specified with the date in
 international standard format (``yyyy-mm-dd``) joined to the time
 (``hh:mm:ss``) by a period ``.``.  Dates in this form can be easily
@@ -191,7 +199,7 @@ just the year may be omitted.  If the time is given, the time is
 interpreted in the user's local time zone. The Date constructor takes
 care of these conversions. In the following examples, suppose that
 ``yyyy`` is the current year, ``mm`` is the current month, and ``dd`` is
-the current day of the month.
+the current day of the month and the local timezone is GMT-5.
 
 -   "2000-04-17" means <Date 2000-04-17.00:00:00>
 -   "01-25" means <Date yyyy-01-25.00:00:00>
@@ -202,6 +210,30 @@ the current day of the month.
 -   "8:47:11" means <Date yyyy-mm-dd.13:47:11>
 -   the special date "." means "right now"
 
+The native date input doesn't allow copy or paste. Roundup
+enhances the native date field. If you double-click on a native
+date field, it changes to a text input mode with the date already
+selected. You can use control-C to copy the date or control-V to
+paste into the field.  Double-clicking also lets you add seconds
+in a date-time value if you need to.
+
+It will switch back to a date input and save the value when:
+
+- you move to another field using the mouse or the Tab key.
+- you press enter/return (press return again if you want to
+  submit the form).
+
+If you press Escape, it will restore the original value and
+change back to a date input.
+
+When using native date elements in text input mode, the date
+looks like a full data with ``T`` replacing ``.``. If the ``T``
+is missing, the native date elements will not recognize the value
+as a date.
+
+There is no support for activating text mode using the
+keyboard. Tablet/touch support is mixed. Chrome supports
+double-tap to activate text mode input. Firefox does not.
 
 When searching, a plain date entered as a search field will match that date
 exactly in the database.  We may also accept ranges of dates. You can
diff --git a/roundup/cgi/templating.py b/roundup/cgi/templating.py
index 93f1c7286..d97f6af70 100644
--- a/roundup/cgi/templating.py
+++ b/roundup/cgi/templating.py
@@ -2252,7 +2252,16 @@ def now(self, str_interval=None):
         return DateHTMLProperty(self._client, self._classname, self._nodeid,
                                 self._prop, self._formname, ret)
 
-    def field(self, size=30, default=None, format=_marker, popcal=True,
+
+    def field_time(self, size=30, default=None, format=_marker, popcal=None,
+                   **kwargs):
+
+        kwargs.setdefault("type", "datetime-local")
+        field = self.field(size=size, default=default, format=format,
+                           popcal=popcal, **kwargs)
+        return field
+
+    def field(self, size=30, default=None, format=_marker, popcal=None,
               **kwargs):
         """Render a form edit field for the property
 
@@ -2269,6 +2278,47 @@ def field(self, size=30, default=None, format=_marker, popcal=True,
             else:
                 return self.pretty(format)
 
+        kwargs.setdefault("type", "date")
+
+        if kwargs["type"] in ["date", "datetime-local"]:
+            acceptable_formats = {
+                "date": "%Y-%m-%d",
+                "datetime-local": "%Y-%m-%dT%H:%M:%S"
+            }
+
+            if format is not self._marker:  # user set format
+                if format != acceptable_formats[kwargs["type"]]:
+                    # format is incompatible with date type
+                    kwargs['type'] = "text"
+                    if popcal is not False:
+                        popcal = True
+                    logger.warning(self._(
+                        "Format '%(format)s' prevents use of modern "
+                        "date input. Remove format from field() call in "
+                        "template %(class)s.%(template)s. "
+                        "Using text input.") % {
+                            "format": format,
+                            "class": self._client.classname,
+                            "template": self._client.template
+                        })
+
+                    """
+                    raise ValueError(self._(
+                        "When using input type of '%(field_type)s', the "
+                        "format must not be set, or must be "
+                        "'%(format_string)s' to match RFC3339 date "
+                        "or date-time. Current format is '%(format)s'.") % {
+                            "field_type": kwargs["type"],
+                            "format_string":
+                            acceptable_formats[kwargs["type"]],
+                            "format": format,
+                      })"""
+            else:
+                # https://developer.mozilla.org/en-US/docs/Web/HTML/Date_and_time_formats#local_date_and_time_strings
+                # match date-time format in
+                # https://www.rfc-editor.org/rfc/rfc3339
+                format = acceptable_formats[kwargs['type']]
+
         value = self._value
 
         if value is None:
diff --git a/roundup/date.py b/roundup/date.py
index fcfbe3515..6515ee320 100644
--- a/roundup/date.py
+++ b/roundup/date.py
@@ -46,7 +46,7 @@ def cmp(a, b):
 date_re = re.compile(r'''^
     ((?P<y>\d\d\d\d)([/-](?P<m>\d\d?)([/-](?P<d>\d\d?))?)? # yyyy[-mm[-dd]]
     |(?P<a>\d\d?)[/-](?P<b>\d\d?))?              # or mm-dd
-    (?P<n>\.)?                                   # .
+    (?P<n>[.T])?                                 # . or T
     (((?P<H>\d?\d):(?P<M>\d\d))?(:(?P<S>\d\d?(\.\d+)?))?)?  # hh:mm:ss
     (?:(?P<tz>\s?[+-]\d{4})|(?P<o>[\d\smywd\-+]+))? # time-zone offset, offset
 $''', re.VERBOSE)
diff --git a/share/roundup/templates/classic/html/datecopy.js b/share/roundup/templates/classic/html/datecopy.js
new file mode 100644
index 000000000..b7825bf46
--- /dev/null
+++ b/share/roundup/templates/classic/html/datecopy.js
@@ -0,0 +1,116 @@
+/* Capture double-click on a date element. Turn element in text element
+   and select date for copying. Return to date element saving change on
+   focusout or Enter. Return to date element with original value on Escape.
+   Derived from
+   https://stackoverflow.com/questions/49981660/enable-copy-paste-on-html5-date-field
+*/
+
+/* TODO: keyboard support should be added to allow entering text mode. */
+
+// use iife to encapsulate handleModeExitKeys
+(function () {
+  "use strict";
+
+  // Define named function so it can be added/removed as event handler
+  //   in different scopes of the code
+  function handleModeExitKeys (event) {
+    if (event.key !== "Escape" && event.key !== "Enter") return;
+    event.preventDefault();
+    if (event.key === "Escape") {
+	event.target.value = event.target.original_value;
+    }
+    let focusout = new Event("focusout");
+    event.target.dispatchEvent(focusout);
+  }
+
+
+  document.querySelector("body").addEventListener("dblclick", (evt) => {
+    if (evt.target.tagName !== "INPUT") return;
+
+    if (! ["date", "datetime-local"].includes(
+	evt.target.attributes.type.value.toLowerCase())) return;
+
+    // we have a date type input
+    let target = evt.target;
+    let original_type = target.attributes.type.value;
+    target.type = "text";
+
+    target.original_value = target.value;
+
+    // allow admin to set CSS to change input
+    target.classList.add("mode_textdate");
+    // After changing input type with JS .select() won't
+    // work as usual
+    // Needs timeout fn() to make it work
+    setTimeout(() => {
+	target.select();
+    });
+
+    // register the focusout event to reset the input back
+    // to a date input field. Once it triggers the handler
+    // is deleted to be added on the next doubleclick.
+    // This also should end the closure of original_type.
+    target.addEventListener("focusout", () => {
+	target.type = original_type;
+	delete event.target.original_value;
+
+	target.classList.remove("mode_textdate");
+
+	target.removeEventListener("keydown", handleModeExitKeys);
+    }, {once: true});
+
+    // called on every keypress including editing the field,
+    // so can not be set with "once" like "focusout".
+    target.addEventListener("keydown", handleModeExitKeys);
+  });
+})()
+
+/* Some failed experiments that I would have liked to have work */
+/* With the date element focused, type ^c or ^v to copy/paste
+   evt.target always seems to be inconsistent. Sometimes I get the
+   input but usually I get the body.
+
+   I can find the date element using document.activeElement, but
+   this seems like a kludge.
+ */
+/*
+body.addEventListener("copy", (evt) => {
+    // target = document.activeElement;
+    target = evt.target;
+    if (target.tagName != "INPUT") {
+	//alert("copy received non-date"  + target.tagName);
+	return;
+    }
+
+    if (! ["date", "datetime-local"].includes(
+	    target.attributes.type.value)) {
+	//alert("copy received non-date");
+	return;
+	}
+
+    evt.clipboardData.setData("text/plain",
+			      target.value);
+    // default behaviour is to copy any selected text
+    // overwriting what we set
+    evt.preventDefault();
+    //alert("copy received date");
+})
+
+body.addEventListener("paste", (evt) => {
+    if (evt.target.tagName != "INPUT") {
+	//alert("paste received non-date");
+	return;
+    }
+
+    if (! ["date", "datetime-local"].includes(
+	    evt.target.attributes.type.value)) {
+	//alert("paste received non-date");
+	return;
+	}
+
+    data = evt.clipboardData.getData("text/plain");
+    evt.preventDefault();
+    evt.target.value = data;
+    //alert("paste received date " + data);
+})
+*/
diff --git a/share/roundup/templates/classic/html/datecopy.min.js b/share/roundup/templates/classic/html/datecopy.min.js
new file mode 100644
index 000000000..42c3163a0
--- /dev/null
+++ b/share/roundup/templates/classic/html/datecopy.min.js
@@ -0,0 +1 @@
+(function(){"use strict";function handleModeExitKeys(event){if(event.key!=="Escape"&&event.key!=="Enter")return;event.preventDefault();if(event.key==="Escape"){event.target.value=event.target.original_value;};let focusout=new Event("focusout");event.target.dispatchEvent(focusout);};document.querySelector("body").addEventListener("dblclick",(evt)=>{if(evt.target.tagName!=="INPUT")return;if(!["date","datetime-local"].includes(evt.target.attributes.type.value.toLowerCase()))return;let target=evt.target;let original_type=target.attributes.type.value;target.type="text";target.original_value=target.value;target.classList.add("mode_textdate");setTimeout(()=>{target.select();});target.addEventListener("focusout",()=>{target.type=original_type;delete event.target.original_value;target.classList.remove("mode_textdate");target.removeEventListener("keydown",handleModeExitKeys);},{once:true});target.addEventListener("keydown",handleModeExitKeys);});})()
\ No newline at end of file
diff --git a/share/roundup/templates/classic/html/page.html b/share/roundup/templates/classic/html/page.html
index 7f3303425..cbd531c72 100644
--- a/share/roundup/templates/classic/html/page.html
+++ b/share/roundup/templates/classic/html/page.html
@@ -200,6 +200,7 @@ <h2><span metal:define-slot="body_title">body title</span></h2>
 <pre tal:condition="request/form/debug | nothing" tal:content="request">
 </pre>
 
+<script type="text/javascript" src='@@file/datecopy.min.js'></script>
 </body>
 </html>
 </tal:block>
diff --git a/share/roundup/templates/devel/html/datecopy.js b/share/roundup/templates/devel/html/datecopy.js
new file mode 100644
index 000000000..b7825bf46
--- /dev/null
+++ b/share/roundup/templates/devel/html/datecopy.js
@@ -0,0 +1,116 @@
+/* Capture double-click on a date element. Turn element in text element
+   and select date for copying. Return to date element saving change on
+   focusout or Enter. Return to date element with original value on Escape.
+   Derived from
+   https://stackoverflow.com/questions/49981660/enable-copy-paste-on-html5-date-field
+*/
+
+/* TODO: keyboard support should be added to allow entering text mode. */
+
+// use iife to encapsulate handleModeExitKeys
+(function () {
+  "use strict";
+
+  // Define named function so it can be added/removed as event handler
+  //   in different scopes of the code
+  function handleModeExitKeys (event) {
+    if (event.key !== "Escape" && event.key !== "Enter") return;
+    event.preventDefault();
+    if (event.key === "Escape") {
+	event.target.value = event.target.original_value;
+    }
+    let focusout = new Event("focusout");
+    event.target.dispatchEvent(focusout);
+  }
+
+
+  document.querySelector("body").addEventListener("dblclick", (evt) => {
+    if (evt.target.tagName !== "INPUT") return;
+
+    if (! ["date", "datetime-local"].includes(
+	evt.target.attributes.type.value.toLowerCase())) return;
+
+    // we have a date type input
+    let target = evt.target;
+    let original_type = target.attributes.type.value;
+    target.type = "text";
+
+    target.original_value = target.value;
+
+    // allow admin to set CSS to change input
+    target.classList.add("mode_textdate");
+    // After changing input type with JS .select() won't
+    // work as usual
+    // Needs timeout fn() to make it work
+    setTimeout(() => {
+	target.select();
+    });
+
+    // register the focusout event to reset the input back
+    // to a date input field. Once it triggers the handler
+    // is deleted to be added on the next doubleclick.
+    // This also should end the closure of original_type.
+    target.addEventListener("focusout", () => {
+	target.type = original_type;
+	delete event.target.original_value;
+
+	target.classList.remove("mode_textdate");
+
+	target.removeEventListener("keydown", handleModeExitKeys);
+    }, {once: true});
+
+    // called on every keypress including editing the field,
+    // so can not be set with "once" like "focusout".
+    target.addEventListener("keydown", handleModeExitKeys);
+  });
+})()
+
+/* Some failed experiments that I would have liked to have work */
+/* With the date element focused, type ^c or ^v to copy/paste
+   evt.target always seems to be inconsistent. Sometimes I get the
+   input but usually I get the body.
+
+   I can find the date element using document.activeElement, but
+   this seems like a kludge.
+ */
+/*
+body.addEventListener("copy", (evt) => {
+    // target = document.activeElement;
+    target = evt.target;
+    if (target.tagName != "INPUT") {
+	//alert("copy received non-date"  + target.tagName);
+	return;
+    }
+
+    if (! ["date", "datetime-local"].includes(
+	    target.attributes.type.value)) {
+	//alert("copy received non-date");
+	return;
+	}
+
+    evt.clipboardData.setData("text/plain",
+			      target.value);
+    // default behaviour is to copy any selected text
+    // overwriting what we set
+    evt.preventDefault();
+    //alert("copy received date");
+})
+
+body.addEventListener("paste", (evt) => {
+    if (evt.target.tagName != "INPUT") {
+	//alert("paste received non-date");
+	return;
+    }
+
+    if (! ["date", "datetime-local"].includes(
+	    evt.target.attributes.type.value)) {
+	//alert("paste received non-date");
+	return;
+	}
+
+    data = evt.clipboardData.getData("text/plain");
+    evt.preventDefault();
+    evt.target.value = data;
+    //alert("paste received date " + data);
+})
+*/
diff --git a/share/roundup/templates/devel/html/datecopy.min.js b/share/roundup/templates/devel/html/datecopy.min.js
new file mode 100644
index 000000000..42c3163a0
--- /dev/null
+++ b/share/roundup/templates/devel/html/datecopy.min.js
@@ -0,0 +1 @@
+(function(){"use strict";function handleModeExitKeys(event){if(event.key!=="Escape"&&event.key!=="Enter")return;event.preventDefault();if(event.key==="Escape"){event.target.value=event.target.original_value;};let focusout=new Event("focusout");event.target.dispatchEvent(focusout);};document.querySelector("body").addEventListener("dblclick",(evt)=>{if(evt.target.tagName!=="INPUT")return;if(!["date","datetime-local"].includes(evt.target.attributes.type.value.toLowerCase()))return;let target=evt.target;let original_type=target.attributes.type.value;target.type="text";target.original_value=target.value;target.classList.add("mode_textdate");setTimeout(()=>{target.select();});target.addEventListener("focusout",()=>{target.type=original_type;delete event.target.original_value;target.classList.remove("mode_textdate");target.removeEventListener("keydown",handleModeExitKeys);},{once:true});target.addEventListener("keydown",handleModeExitKeys);});})()
\ No newline at end of file
diff --git a/share/roundup/templates/devel/html/page.html b/share/roundup/templates/devel/html/page.html
index 0555abdee..8f4f2a0c8 100644
--- a/share/roundup/templates/devel/html/page.html
+++ b/share/roundup/templates/devel/html/page.html
@@ -263,6 +263,7 @@ <h1 id="breadcrumb"><span metal:define-slot="body_title">body title</span></h1>
 <!-- hhmts end -->
   </div> <!-- footer -->
   <pre tal:condition="request/form/deissue | nothing" tal:content="request"></pre>
+  <script type="text/javascript" src='@@file/datecopy.min.js'></script>
  </body>
 </html>
 </tal:block>
diff --git a/share/roundup/templates/jinja2/html/datecopy.js b/share/roundup/templates/jinja2/html/datecopy.js
new file mode 100644
index 000000000..b7825bf46
--- /dev/null
+++ b/share/roundup/templates/jinja2/html/datecopy.js
@@ -0,0 +1,116 @@
+/* Capture double-click on a date element. Turn element in text element
+   and select date for copying. Return to date element saving change on
+   focusout or Enter. Return to date element with original value on Escape.
+   Derived from
+   https://stackoverflow.com/questions/49981660/enable-copy-paste-on-html5-date-field
+*/
+
+/* TODO: keyboard support should be added to allow entering text mode. */
+
+// use iife to encapsulate handleModeExitKeys
+(function () {
+  "use strict";
+
+  // Define named function so it can be added/removed as event handler
+  //   in different scopes of the code
+  function handleModeExitKeys (event) {
+    if (event.key !== "Escape" && event.key !== "Enter") return;
+    event.preventDefault();
+    if (event.key === "Escape") {
+	event.target.value = event.target.original_value;
+    }
+    let focusout = new Event("focusout");
+    event.target.dispatchEvent(focusout);
+  }
+
+
+  document.querySelector("body").addEventListener("dblclick", (evt) => {
+    if (evt.target.tagName !== "INPUT") return;
+
+    if (! ["date", "datetime-local"].includes(
+	evt.target.attributes.type.value.toLowerCase())) return;
+
+    // we have a date type input
+    let target = evt.target;
+    let original_type = target.attributes.type.value;
+    target.type = "text";
+
+    target.original_value = target.value;
+
+    // allow admin to set CSS to change input
+    target.classList.add("mode_textdate");
+    // After changing input type with JS .select() won't
+    // work as usual
+    // Needs timeout fn() to make it work
+    setTimeout(() => {
+	target.select();
+    });
+
+    // register the focusout event to reset the input back
+    // to a date input field. Once it triggers the handler
+    // is deleted to be added on the next doubleclick.
+    // This also should end the closure of original_type.
+    target.addEventListener("focusout", () => {
+	target.type = original_type;
+	delete event.target.original_value;
+
+	target.classList.remove("mode_textdate");
+
+	target.removeEventListener("keydown", handleModeExitKeys);
+    }, {once: true});
+
+    // called on every keypress including editing the field,
+    // so can not be set with "once" like "focusout".
+    target.addEventListener("keydown", handleModeExitKeys);
+  });
+})()
+
+/* Some failed experiments that I would have liked to have work */
+/* With the date element focused, type ^c or ^v to copy/paste
+   evt.target always seems to be inconsistent. Sometimes I get the
+   input but usually I get the body.
+
+   I can find the date element using document.activeElement, but
+   this seems like a kludge.
+ */
+/*
+body.addEventListener("copy", (evt) => {
+    // target = document.activeElement;
+    target = evt.target;
+    if (target.tagName != "INPUT") {
+	//alert("copy received non-date"  + target.tagName);
+	return;
+    }
+
+    if (! ["date", "datetime-local"].includes(
+	    target.attributes.type.value)) {
+	//alert("copy received non-date");
+	return;
+	}
+
+    evt.clipboardData.setData("text/plain",
+			      target.value);
+    // default behaviour is to copy any selected text
+    // overwriting what we set
+    evt.preventDefault();
+    //alert("copy received date");
+})
+
+body.addEventListener("paste", (evt) => {
+    if (evt.target.tagName != "INPUT") {
+	//alert("paste received non-date");
+	return;
+    }
+
+    if (! ["date", "datetime-local"].includes(
+	    evt.target.attributes.type.value)) {
+	//alert("paste received non-date");
+	return;
+	}
+
+    data = evt.clipboardData.getData("text/plain");
+    evt.preventDefault();
+    evt.target.value = data;
+    //alert("paste received date " + data);
+})
+*/
diff --git a/share/roundup/templates/jinja2/html/datecopy.min.js b/share/roundup/templates/jinja2/html/datecopy.min.js
new file mode 100644
index 000000000..42c3163a0
--- /dev/null
+++ b/share/roundup/templates/jinja2/html/datecopy.min.js
@@ -0,0 +1 @@
+(function(){"use strict";function handleModeExitKeys(event){if(event.key!=="Escape"&&event.key!=="Enter")return;event.preventDefault();if(event.key==="Escape"){event.target.value=event.target.original_value;};let focusout=new Event("focusout");event.target.dispatchEvent(focusout);};document.querySelector("body").addEventListener("dblclick",(evt)=>{if(evt.target.tagName!=="INPUT")return;if(!["date","datetime-local"].includes(evt.target.attributes.type.value.toLowerCase()))return;let target=evt.target;let original_type=target.attributes.type.value;target.type="text";target.original_value=target.value;target.classList.add("mode_textdate");setTimeout(()=>{target.select();});target.addEventListener("focusout",()=>{target.type=original_type;delete event.target.original_value;target.classList.remove("mode_textdate");target.removeEventListener("keydown",handleModeExitKeys);},{once:true});target.addEventListener("keydown",handleModeExitKeys);});})()
\ No newline at end of file
diff --git a/share/roundup/templates/jinja2/html/layout/page.html b/share/roundup/templates/jinja2/html/layout/page.html
index e5ca1759d..9785103e4 100644
--- a/share/roundup/templates/jinja2/html/layout/page.html
+++ b/share/roundup/templates/jinja2/html/layout/page.html
@@ -68,6 +68,7 @@ <h3>{% block page_header %} {% endblock %}</h3>
 
     <script src='@@file/jquery-1.9.0.min.js'></script>
     <script src='@@file/bootstrap.min.js'></script>
+    <script src='@@file/datecopy.min.js'></script>
     {% block extrajs %} {% endblock %}
   </body>
 </html>
diff --git a/share/roundup/templates/minimal/html/datecopy.js b/share/roundup/templates/minimal/html/datecopy.js
new file mode 100644
index 000000000..b7825bf46
--- /dev/null
+++ b/share/roundup/templates/minimal/html/datecopy.js
@@ -0,0 +1,116 @@
+/* Capture double-click on a date element. Turn element in text element
+   and select date for copying. Return to date element saving change on
+   focusout or Enter. Return to date element with original value on Escape.
+   Derived from
+   https://stackoverflow.com/questions/49981660/enable-copy-paste-on-html5-date-field
+*/
+
+/* TODO: keyboard support should be added to allow entering text mode. */
+
+// use iife to encapsulate handleModeExitKeys
+(function () {
+  "use strict";
+
+  // Define named function so it can be added/removed as event handler
+  //   in different scopes of the code
+  function handleModeExitKeys (event) {
+    if (event.key !== "Escape" && event.key !== "Enter") return;
+    event.preventDefault();
+    if (event.key === "Escape") {
+	event.target.value = event.target.original_value;
+    }
+    let focusout = new Event("focusout");
+    event.target.dispatchEvent(focusout);
+  }
+
+
+  document.querySelector("body").addEventListener("dblclick", (evt) => {
+    if (evt.target.tagName !== "INPUT") return;
+
+    if (! ["date", "datetime-local"].includes(
+	evt.target.attributes.type.value.toLowerCase())) return;
+
+    // we have a date type input
+    let target = evt.target;
+    let original_type = target.attributes.type.value;
+    target.type = "text";
+
+    target.original_value = target.value;
+
+    // allow admin to set CSS to change input
+    target.classList.add("mode_textdate");
+    // After changing input type with JS .select() won't
+    // work as usual
+    // Needs timeout fn() to make it work
+    setTimeout(() => {
+	target.select();
+    });
+
+    // register the focusout event to reset the input back
+    // to a date input field. Once it triggers the handler
+    // is deleted to be added on the next doubleclick.
+    // This also should end the closure of original_type.
+    target.addEventListener("focusout", () => {
+	target.type = original_type;
+	delete event.target.original_value;
+
+	target.classList.remove("mode_textdate");
+
+	target.removeEventListener("keydown", handleModeExitKeys);
+    }, {once: true});
+
+    // called on every keypress including editing the field,
+    // so can not be set with "once" like "focusout".
+    target.addEventListener("keydown", handleModeExitKeys);
+  });
+})()
+
+/* Some failed experiments that I would have liked to have work */
+/* With the date element focused, type ^c or ^v to copy/paste
+   evt.target always seems to be inconsistent. Sometimes I get the
+   input but usually I get the body.
+
+   I can find the date element using document.activeElement, but
+   this seems like a kludge.
+ */
+/*
+body.addEventListener("copy", (evt) => {
+    // target = document.activeElement;
+    target = evt.target;
+    if (target.tagName != "INPUT") {
+	//alert("copy received non-date"  + target.tagName);
+	return;
+    }
+
+    if (! ["date", "datetime-local"].includes(
+	    target.attributes.type.value)) {
+	//alert("copy received non-date");
+	return;
+	}
+
+    evt.clipboardData.setData("text/plain",
+			      target.value);
+    // default behaviour is to copy any selected text
+    // overwriting what we set
+    evt.preventDefault();
+    //alert("copy received date");
+})
+
+body.addEventListener("paste", (evt) => {
+    if (evt.target.tagName != "INPUT") {
+	//alert("paste received non-date");
+	return;
+    }
+
+    if (! ["date", "datetime-local"].includes(
+	    evt.target.attributes.type.value)) {
+	//alert("paste received non-date");
+	return;
+	}
+
+    data = evt.clipboardData.getData("text/plain");
+    evt.preventDefault();
+    evt.target.value = data;
+    //alert("paste received date " + data);
+})
+*/
diff --git a/share/roundup/templates/minimal/html/datecopy.min.js b/share/roundup/templates/minimal/html/datecopy.min.js
new file mode 100644
index 000000000..42c3163a0
--- /dev/null
+++ b/share/roundup/templates/minimal/html/datecopy.min.js
@@ -0,0 +1 @@
+(function(){"use strict";function handleModeExitKeys(event){if(event.key!=="Escape"&&event.key!=="Enter")return;event.preventDefault();if(event.key==="Escape"){event.target.value=event.target.original_value;};let focusout=new Event("focusout");event.target.dispatchEvent(focusout);};document.querySelector("body").addEventListener("dblclick",(evt)=>{if(evt.target.tagName!=="INPUT")return;if(!["date","datetime-local"].includes(evt.target.attributes.type.value.toLowerCase()))return;let target=evt.target;let original_type=target.attributes.type.value;target.type="text";target.original_value=target.value;target.classList.add("mode_textdate");setTimeout(()=>{target.select();});target.addEventListener("focusout",()=>{target.type=original_type;delete event.target.original_value;target.classList.remove("mode_textdate");target.removeEventListener("keydown",handleModeExitKeys);},{once:true});target.addEventListener("keydown",handleModeExitKeys);});})()
\ No newline at end of file
diff --git a/share/roundup/templates/minimal/html/page.html b/share/roundup/templates/minimal/html/page.html
index af8f4b2ef..106cafc00 100644
--- a/share/roundup/templates/minimal/html/page.html
+++ b/share/roundup/templates/minimal/html/page.html
@@ -186,6 +186,7 @@ <h2><span metal:define-slot="body_title">body title</span></h2>
 <pre tal:condition="request/form/debug | nothing" tal:content="request">
 </pre>
 
+<script type="text/javascript" src='@@file/datecopy.min.js'></script>
 </body>
 </html>
 </tal:block>
diff --git a/share/roundup/templates/responsive/html/datecopy.js b/share/roundup/templates/responsive/html/datecopy.js
new file mode 100644
index 000000000..b7825bf46
--- /dev/null
+++ b/share/roundup/templates/responsive/html/datecopy.js
@@ -0,0 +1,116 @@
+/* Capture double-click on a date element. Turn element in text element
+   and select date for copying. Return to date element saving change on
+   focusout or Enter. Return to date element with original value on Escape.
+   Derived from
+   https://stackoverflow.com/questions/49981660/enable-copy-paste-on-html5-date-field
+*/
+
+/* TODO: keyboard support should be added to allow entering text mode. */
+
+// use iife to encapsulate handleModeExitKeys
+(function () {
+  "use strict";
+
+  // Define named function so it can be added/removed as event handler
+  //   in different scopes of the code
+  function handleModeExitKeys (event) {
+    if (event.key !== "Escape" && event.key !== "Enter") return;
+    event.preventDefault();
+    if (event.key === "Escape") {
+	event.target.value = event.target.original_value;
+    }
+    let focusout = new Event("focusout");
+    event.target.dispatchEvent(focusout);
+  }
+
+
+  document.querySelector("body").addEventListener("dblclick", (evt) => {
+    if (evt.target.tagName !== "INPUT") return;
+
+    if (! ["date", "datetime-local"].includes(
+	evt.target.attributes.type.value.toLowerCase())) return;
+
+    // we have a date type input
+    let target = evt.target;
+    let original_type = target.attributes.type.value;
+    target.type = "text";
+
+    target.original_value = target.value;
+
+    // allow admin to set CSS to change input
+    target.classList.add("mode_textdate");
+    // After changing input type with JS .select() won't
+    // work as usual
+    // Needs timeout fn() to make it work
+    setTimeout(() => {
+	target.select();
+    });
+
+    // register the focusout event to reset the input back
+    // to a date input field. Once it triggers the handler
+    // is deleted to be added on the next doubleclick.
+    // This also should end the closure of original_type.
+    target.addEventListener("focusout", () => {
+	target.type = original_type;
+	delete event.target.original_value;
+
+	target.classList.remove("mode_textdate");
+
+	target.removeEventListener("keydown", handleModeExitKeys);
+    }, {once: true});
+
+    // called on every keypress including editing the field,
+    // so can not be set with "once" like "focusout".
+    target.addEventListener("keydown", handleModeExitKeys);
+  });
+})()
+
+/* Some failed experiments that I would have liked to have work */
+/* With the date element focused, type ^c or ^v to copy/paste
+   evt.target always seems to be inconsistent. Sometimes I get the
+   input but usually I get the body.
+
+   I can find the date element using document.activeElement, but
+   this seems like a kludge.
+ */
+/*
+body.addEventListener("copy", (evt) => {
+    // target = document.activeElement;
+    target = evt.target;
+    if (target.tagName != "INPUT") {
+	//alert("copy received non-date"  + target.tagName);
+	return;
+    }
+
+    if (! ["date", "datetime-local"].includes(
+	    target.attributes.type.value)) {
+	//alert("copy received non-date");
+	return;
+	}
+
+    evt.clipboardData.setData("text/plain",
+			      target.value);
+    // default behaviour is to copy any selected text
+    // overwriting what we set
+    evt.preventDefault();
+    //alert("copy received date");
+})
+
+body.addEventListener("paste", (evt) => {
+    if (evt.target.tagName != "INPUT") {
+	//alert("paste received non-date");
+	return;
+    }
+
+    if (! ["date", "datetime-local"].includes(
+	    evt.target.attributes.type.value)) {
+	//alert("paste received non-date");
+	return;
+	}
+
+    data = evt.clipboardData.getData("text/plain");
+    evt.preventDefault();
+    evt.target.value = data;
+    //alert("paste received date " + data);
+})
+*/
diff --git a/share/roundup/templates/responsive/html/datecopy.min.js b/share/roundup/templates/responsive/html/datecopy.min.js
new file mode 100644
index 000000000..42c3163a0
--- /dev/null
+++ b/share/roundup/templates/responsive/html/datecopy.min.js
@@ -0,0 +1 @@
+(function(){"use strict";function handleModeExitKeys(event){if(event.key!=="Escape"&&event.key!=="Enter")return;event.preventDefault();if(event.key==="Escape"){event.target.value=event.target.original_value;};let focusout=new Event("focusout");event.target.dispatchEvent(focusout);};document.querySelector("body").addEventListener("dblclick",(evt)=>{if(evt.target.tagName!=="INPUT")return;if(!["date","datetime-local"].includes(evt.target.attributes.type.value.toLowerCase()))return;let target=evt.target;let original_type=target.attributes.type.value;target.type="text";target.original_value=target.value;target.classList.add("mode_textdate");setTimeout(()=>{target.select();});target.addEventListener("focusout",()=>{target.type=original_type;delete event.target.original_value;target.classList.remove("mode_textdate");target.removeEventListener("keydown",handleModeExitKeys);},{once:true});target.addEventListener("keydown",handleModeExitKeys);});})()
\ No newline at end of file
diff --git a/share/roundup/templates/responsive/html/page.html b/share/roundup/templates/responsive/html/page.html
index 5f590dcd5..1b2721ed3 100644
--- a/share/roundup/templates/responsive/html/page.html
+++ b/share/roundup/templates/responsive/html/page.html
@@ -278,6 +278,7 @@ <h1><span metal:define-slot="body_title">body title</span></h1>
     </footer>
   </div> <!-- container -->
   <pre tal:condition="request/form/deissue | nothing" tal:content="request"></pre>
+  <script type="text/javascript" src='@@file/datecopy.min.js'></script>
  </body>
 </html>
 </tal:block>
diff --git a/test/test_dates.py b/test/test_dates.py
index 7638c1f65..6dc5f80bc 100644
--- a/test/test_dates.py
+++ b/test/test_dates.py
@@ -483,6 +483,11 @@ def testPyDatetime(self):
         toomuch = datetime.MAXYEAR + 1
         self.assertRaises(ValueError, Date, (toomuch, 1, 1, 0, 0, 0, 0, 1, -1))
 
+    def testRfc3339Form(self):
+        ae = self.assertEqual
+        d = Date('2003-11-01T00:00:00')
+        self.assertEqual(str(d), '2003-11-01.00:00:00')
+
     def testSimpleTZ(self):
         ae = self.assertEqual
         # local to utc
diff --git a/test/test_templating.py b/test/test_templating.py
index a429609d7..ab35c2759 100644
--- a/test/test_templating.py
+++ b/test/test_templating.py
@@ -5,6 +5,7 @@
 from roundup.anypy.cgi_ import FieldStorage, MiniFieldStorage
 from roundup.cgi.templating import *
 from roundup.cgi.ZTUtils.Iterator import Iterator
+from roundup.test import memorydb
 from .test_actions import MockNull, true
 from .html_norm import NormalizingHtmlParser
 
@@ -716,7 +717,11 @@ class HTMLPropertyTestClass(unittest.TestCase):
     def setUp(self):
         self.form = FieldStorage()
         self.client = MockNull()
-        self.client.db = db = MockDatabase()
+        self.client.db = db = memorydb.create('admin')
+        db.tx_Source = "web"
+
+        db.issue.addprop(tx_Source=hyperdb.String())
+
         db.security.hasPermission = lambda *args, **kw: True
         self.client.form = self.form
 
@@ -725,8 +730,102 @@ def setUp(self):
         self.client.session_api = MockNull(_sid="1234567890")
         self.client.db.getuid = lambda : 10
 
+    @pytest.fixture(autouse=True)
+    def inject_fixtures(self, caplog):
+        self._caplog = caplog
+
 class DateHTMLPropertyTestCase(HTMLPropertyTestClass):
 
+    def setUp(self):
+        super(DateHTMLPropertyTestCase, self).setUp()
+
+        db = self.client.db
+        db.issue.addprop(deadline=hyperdb.Date())
+
+        self.test_datestring = "2021-01-01.11:22:10"
+
+        self.client.db.issue.create(title="title",
+                                    deadline=date.Date(self.test_datestring))
+        self.client.db.getUserTimezone = lambda: "2"
+
+    def tearDown(self):
+        self.client.db.close()
+        memorydb.db_nuke('')
+
+    def test_DateHTMLWithDate(self):
+        """Test methods when DateHTMLProperty._value is a hyperdb.Date()
+        """
+        test_datestring = self.test_datestring
+        test_Date = self.client.db.issue.get("1", 'deadline')
+        test_hyperdbDate = self.client.db.issue.getprops("1")['deadline']
+
+        self.client.classname = "issue"
+        self.client.template = "item"
+
+        # client, classname, nodeid, prop, name, value,
+        #    anonymous=0, offset=None
+        d = DateHTMLProperty(self.client, 'issue', '1', test_hyperdbDate,
+                             'deadline', test_Date)
+        self.assertIsInstance(d._value, date.Date)
+        self.assertEqual(d.pretty(), " 1 January 2021")
+        self.assertEqual(d.pretty(format="%Y-%m"), "2021-01")
+        self.assertEqual(d.plain(), "2021-01-01.13:22:10")
+        self.assertEqual(d.local("-4").plain(), "2021-01-01.07:22:10")
+        input_expected = """<input id="issue1@deadline" name="issue1@deadline" size="30" type="date" value="2021-01-01">"""
+        self.assertEqual(d.field(), input_expected)
+        self.assertEqual(d.field_time(type="date"), input_expected)
+
+        input_expected = """<input id="issue1@deadline" name="issue1@deadline" size="30" type="datetime-local" value="2021-01-01T13:22:10">"""
+        self.assertEqual(d.field(type="datetime-local"), input_expected)
+        self.assertEqual(d.field_time(), input_expected)
+
+        input_expected = """<input id="issue1@deadline" name="issue1@deadline" size="30" type="text" value="2021-01-01.13:22:10">"""
+        self.assertEqual(d.field(type="text"), input_expected)
+        self.assertEqual(d.field_time(type="text"), input_expected)
+
+        # test with format
+        input_expected = """<input id="issue1@deadline" name="issue1@deadline" size="30" type="text" value="2021-01"><a class="classhelp" data-calurl="issue?@template=calendar&amp;amp;property=deadline&amp;amp;form=itemSynopsis&amp;date=2021-01-01.11:22:10" data-height="200" data-width="300" href="javascript:help_window(\'issue?@template=calendar&amp;property=deadline&amp;form=itemSynopsis&date=2021-01-01.11:22:10\', 300, 200)">(cal)</a>"""
+
+        self._caplog.clear()
+        with self._caplog.at_level(logging.WARNING,
+                                   logger="roundup"):
+            input = d.field(format="%Y-%m")
+        self.assertEqual(input_expected, input)
+
+        # name used for logging
+        log_expected = """Format '%Y-%m' prevents use of modern date input. Remove format from field() call in template issue.item. Using text input."""
+        self.assertEqual(self._caplog.record_tuples[0][2], log_expected)
+        # severity ERROR = 40
+        self.assertEqual(self._caplog.record_tuples[0][1], 30,
+                        msg="logging level != 30 (WARNING)")
+
+        # test with format and popcal=None
+        input_expected = """<input id="issue1@deadline" name="issue1@deadline" size="30" type="text" value="2021-01">"""
+
+        self._caplog.clear()
+        with self._caplog.at_level(logging.WARNING,
+                                   logger="roundup"):
+            input = d.field(format="%Y-%m", popcal=False)
+        self.assertEqual(input_expected, input)
+
+        # name used for logging
+        log_expected = """Format '%Y-%m' prevents use of modern date input. Remove format from field() call in template issue.item. Using text input."""
+        self.assertEqual(self._caplog.record_tuples[0][2], log_expected)
+        # severity ERROR = 40
+        self.assertEqual(self._caplog.record_tuples[0][1], 30,
+                        msg="logging level != 30 (WARNING)")
+
+        # test with format, type=text and popcal=None
+        input_expected = """<input id="issue1@deadline" name="issue1@deadline" size="30" type="text" value="2021-01">"""
+
+        self._caplog.clear()
+        with self._caplog.at_level(logging.WARNING,
+                                   logger="roundup"):
+            input = d.field(type="text", format="%Y-%m", popcal=False )
+        self.assertEqual(input_expected, input)
+
+        self.assertEqual(self._caplog.records, [])
+
     def test_DateHTMLWithText(self):
         """Test methods when DateHTMLProperty._value is a string
            rather than a hyperdb.Date()
@@ -741,6 +840,9 @@ def test_DateHTMLWithText(self):
             ( test = MockNull(getprops = lambda : test_date)
             )
 
+        self.client.classname = "test"
+        self.client.template = "item"
+
         # client, classname, nodeid, prop, name, value,
         #    anonymous=0, offset=None
         d = DateHTMLProperty(self.client, 'test', '1', self.client._props,
@@ -748,9 +850,62 @@ def test_DateHTMLWithText(self):
         self.assertIs(type(d._value), str)
         self.assertEqual(d.pretty(), "2021-01-01 11:22:10")
         self.assertEqual(d.plain(), "2021-01-01 11:22:10")
-        input = """<input id="test1@test" name="test1@test" size="30" type="text" value="2021-01-01 11:22:10"><a class="classhelp" data-calurl="test?@template=calendar&amp;amp;property=test&amp;amp;form=itemSynopsis&amp;date=2021-01-01 11:22:10" data-height="200" data-width="300" href="javascript:help_window('test?@template=calendar&amp;property=test&amp;form=itemSynopsis&date=2021-01-01 11:22:10', 300, 200)">(cal)</a>"""
+        input = """<input id="test1@test" name="test1@test" size="30" type="date" value="2021-01-01 11:22:10">"""
         self.assertEqual(d.field(), input)
 
+
+        input_expected = """<input id="test1@test" name="test1@test" size="40" type="date" value="2021-01-01 11:22:10">"""
+        self.assertEqual(d.field(size=40), input_expected)
+
+        input_expected = """<input id="test1@test" name="test1@test" size="30" type="text" value="2021-01-01 11:22:10"><a class="classhelp" data-calurl="test?@template=calendar&amp;amp;property=test&amp;amp;form=itemSynopsis&amp;date=2021-01-01 11:22:10" data-height="200" data-width="300" href="javascript:help_window(\'test?@template=calendar&amp;property=test&amp;form=itemSynopsis&date=2021-01-01 11:22:10\', 300, 200)">(cal)</a>"""
+        with self._caplog.at_level(logging.WARNING,
+                                   logger="roundup"):
+            input = d.field(format="%Y-%m")
+        self.assertEqual(input_expected, input)
+
+        # name used for logging
+        log_expected = """Format '%Y-%m' prevents use of modern date input. Remove format from field() call in template test.item. Using text input."""
+        self.assertEqual(self._caplog.record_tuples[0][2], log_expected)
+        # severity ERROR = 40
+        self.assertEqual(self._caplog.record_tuples[0][1], 30,
+                        msg="logging level != 30 (WARNING)")
+
+        """with self.assertRaises(ValueError) as e:
+            d.field(format="%Y-%m")
+        self.assertIn("'%Y-%m'", e.exception.args[0])
+        self.assertIn("'date'", e.exception.args[0])"""
+
+
+        # format matches rfc format, so this should pass
+        result = d.field(format="%Y-%m-%d")
+        input_expected = """<input id="test1@test" name="test1@test" size="30" type="date" value="2021-01-01 11:22:10">"""
+        self.assertEqual(result, input_expected)
+
+        input_expected = """<input id="test1@test" name="test1@test" size="30" type="text" value="2021-01-01 11:22:10"><a class="classhelp" data-calurl="test?@template=calendar&amp;amp;property=test&amp;amp;form=itemSynopsis&amp;date=2021-01-01 11:22:10" data-height="200" data-width="300" href="javascript:help_window(\'test?@template=calendar&amp;property=test&amp;form=itemSynopsis&date=2021-01-01 11:22:10\', 300, 200)">(cal)</a>"""
+        with self._caplog.at_level(logging.WARNING,
+                                   logger="roundup"):
+            input = d.field(format="%Y-%m", type="datetime-local")
+        self.assertEqual(input_expected, input)
+
+        # name used for logging
+        log_expected = """Format '%Y-%m' prevents use of modern date input. Remove format from field() call in template test.item. Using text input."""
+        self.assertEqual(self._caplog.record_tuples[0][2], log_expected)
+        # severity ERROR = 40
+        self.assertEqual(self._caplog.record_tuples[0][1], 30,
+                        msg="logging level != 30 (WARNING)")
+
+        """
+        with self.assertRaises(ValueError) as e:
+            d.field(format="%Y-%m", type="datetime-local")
+        self.assertIn("'%Y-%m'", e.exception.args[0])
+        self.assertIn("'datetime-local'", e.exception.args[0])
+        """
+
+        # format matches rfc, so this should pass
+        result = d.field(type="datetime-local", format="%Y-%m-%dT%H:%M:%S")
+        input_expected = """<input id="test1@test" name="test1@test" size="30" type="datetime-local" value="2021-01-01 11:22:10">"""
+        self.assertEqual(result, input_expected)
+
 # common markdown test cases
 class MarkdownTests:
     def mangleMarkdown2(self, s):

From 5ac6e59c49ae44b2695dcfd6cfac2cf0b5f7920d Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sat, 18 Jan 2025 14:54:31 -0500
Subject: [PATCH 146/398] feat(web) - Use native number type input for Number()
 and Integer().

When editing hyperdb.Number() or hyperdb.Integer() properties, use a
native number input.

For Number you can enter digits, +/-, . and e/E for exponent (1E2 =
100).

For integer we have the same keys as number, but also add step=1 to
the input. This stops submitting 23.5 suggesting 23 or 24. It does
allow 2E4 to be submitted that is rejected with an error from the
backend. However if the spinner is used with 2E4 it is turned into
20000, a pure integer and incremented/decremented by the spinner.

The upgrade happens automatically. Directions on going back to text
input provided. User guide updated to describe addition of spinner.

Tests added.
---
 CHANGES.txt               |   4 +-
 doc/upgrading.txt         |  22 +++++++-
 doc/user_guide.txt        |   3 +-
 roundup/cgi/templating.py |   4 ++
 test/test_templating.py   | 112 ++++++++++++++++++++++++++++++++++++++
 5 files changed, 141 insertions(+), 4 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index 9baf8be5a..19d16b3a7 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -122,7 +122,9 @@ Features:
 - Added new templating utils.set_http_response(integer) method to
   allow reporting an error to the user from a template. (John
   Rouillard)
-	
+- Use native number type input for Number() and Integer()
+  properties. Integer() uses step=1 as well. (John Rouillard)
+
 2024-07-13 2.4.0
 
 Fixed:
diff --git a/doc/upgrading.txt b/doc/upgrading.txt
index 7cf3b332e..eb19d75bc 100644
--- a/doc/upgrading.txt
+++ b/doc/upgrading.txt
@@ -224,8 +224,8 @@ defusedxml.
 
 .. _defusedxml: https://pypi.org/project/defusedxml/
 
-Use native date inputs (optional)
----------------------------------
+Enable use of native date inputs (optional)
+-------------------------------------------
 
 Roundup now uses native date or datetime-local inputs for Date()
 properties. These inputs take the place of the text input and
@@ -308,6 +308,8 @@ changing it to::
 will generate the input as in Roundup 2.4 or earlier without a
 popcal link.
 
+.. _revert_input_to_text:
+
 If you are using a path expression like::
 
   tal:content="context/duedate/field"
@@ -366,6 +368,22 @@ There is no support for activating text mode using the
 keyboard. Tablet/touch support is mixed. Chrome supports
 double-tap to activate text mode input. Firefox does not.
 
+Revert native number inputs for Number() and Integer() (optional)
+-----------------------------------------------------------------
+
+Roundup's field() method for properties of type Number() or
+Integer() now use a native browser number input.
+
+You can use the old style text inputs by calling the field
+method with ``type="text"``. You can :ref:`follow the example
+for setting the text argument on a Date()
+property. <revert_input_to_text>` for details.
+
+Note that the Integer() type also uses ``step="1"`` by default to
+add a stepper control and try to constrain the input to
+integers. This can be overridden by passing a new step
+(e.g. ``step="50"``) to the field() method.
+
 Change in REST response for invalid CORS requests (info)
 --------------------------------------------------------
 
diff --git a/doc/user_guide.txt b/doc/user_guide.txt
index 2037e9eb7..7895ffb04 100644
--- a/doc/user_guide.txt
+++ b/doc/user_guide.txt
@@ -131,7 +131,8 @@ Integer Properties
 ~~~~~~~~~~~~~~~~~~
 
 These fields take a whole/integer number without decimal marker like
-``123``, ``+123``, ``-123``. Exponents are not supported.
+``123``, ``+123``, ``-123``. Exponents are not supported. Your browser
+may show an up/down arrow spinner to change the value. 
 
 Boolean properties
 ~~~~~~~~~~~~~~~~~~
diff --git a/roundup/cgi/templating.py b/roundup/cgi/templating.py
index d97f6af70..f3e86495f 100644
--- a/roundup/cgi/templating.py
+++ b/roundup/cgi/templating.py
@@ -2066,6 +2066,7 @@ def field(self, size=30, **kwargs):
         if value is None:
             value = ''
 
+        kwargs.setdefault("type", "number")
         return self.input(name=self._formname, value=value, size=size,
                           **kwargs)
 
@@ -2104,6 +2105,9 @@ def field(self, size=30, **kwargs):
         if value is None:
             value = ''
 
+        kwargs.setdefault("type", "number")
+        if kwargs["type"] == "number":
+            kwargs.setdefault("step", "1")
         return self.input(name=self._formname, value=value, size=size,
                           **kwargs)
 
diff --git a/test/test_templating.py b/test/test_templating.py
index ab35c2759..4c760c13a 100644
--- a/test/test_templating.py
+++ b/test/test_templating.py
@@ -1253,6 +1253,118 @@ def test_string_rst(self):
         p = StringHTMLProperty(self.client, 'test', '1', None, 'test', u2s(u'A string with cmeerw@example.com *embedded* \u00df'))
         self.assertEqual(p.rst(), u2s(u'A string with <a href="mailto:cmeerw@example.com">cmeerw@example.com</a> *embedded* \u00df'))
 
+class NumberIntegerHTMLPropertyTestCase(HTMLPropertyTestClass):
+
+    def setUp(self):
+        super(NumberIntegerHTMLPropertyTestCase, self).setUp()
+
+        db = self.client.db
+        db.issue.addprop(numberval=hyperdb.Number())
+        db.issue.addprop(intval=hyperdb.Integer())
+
+        self.client.db.issue.create(title="title",
+                                    numberval = "3.14",
+                                    intval="314")
+
+    def tearDown(self):
+        self.client.db.close()
+        memorydb.db_nuke('')
+
+    def test_IntegerHTML(self):
+        test_hyperdbInteger = self.client.db.issue.getprops("1")['intval']
+        test_Integer = test_hyperdbInteger.from_raw(
+            self.client.db.issue.get("1", 'intval')
+        )
+
+        # client, classname, nodeid, prop, name, value,
+        #    anonymous=0, offset=None
+        d = IntegerHTMLProperty(self.client, 'issue', '1',
+                                test_hyperdbInteger,
+                                'intval', test_Integer)
+
+        self.assertIsInstance(d._value, int)
+
+        self.assertEqual(d.plain(), "314")
+
+        input_expected = """<input id="issue1@intval" name="issue1@intval" size="30" step="1" type="number" value="314">"""
+        self.assertEqual(d.field(), input_expected)
+
+        input_expected = """<input id="issue1@intval" name="issue1@intval" size="30" step="50" type="number" value="314">"""
+        self.assertEqual(d.field(step="50"), input_expected)
+
+        input_expected = """<input id="issue1@intval" name="issue1@intval" size="30" type="text" value="314">"""
+        self.assertEqual(d.field(type="text"), input_expected)
+
+
+        # check permissions return
+        is_view_ok_orig = d.is_view_ok
+        is_edit_ok_orig = d.is_edit_ok
+        no_access = lambda : False
+
+        d.is_view_ok = no_access
+        self.assertEqual(d.plain(), "[hidden]")
+
+        d.is_edit_ok = no_access
+        self.assertEqual(d.field(), "[hidden]")
+
+        d.is_view_ok = is_view_ok_orig
+        self.assertEqual(d.field(), "314")
+        d.is_edit_ok = is_edit_ok_orig
+
+    def test_NumberHTML(self):
+        test_hyperdbNumber = self.client.db.issue.getprops("1")['numberval']
+        test_Number = test_hyperdbNumber.from_raw(
+            self.client.db.issue.get("1", 'numberval')
+        )
+
+        # client, classname, nodeid, prop, name, value,
+        #    anonymous=0, offset=None
+        d = NumberHTMLProperty(self.client, 'issue', '1',
+                                test_hyperdbNumber,
+                                'numberval', test_Number)
+
+        # string needed for memorydb/anydbm backend. Float?? when
+        # running against sql backends.
+        self.assertIsInstance(d._value, float)
+
+        self.assertEqual(d._value, 3.14)
+
+        input_expected = """<input id="issue1@numberval" name="issue1@numberval" size="30" type="number" value="3.14">"""
+        self.assertEqual(d.field(), input_expected)
+
+        input_expected = """<input id="issue1@numberval" name="issue1@numberval" size="30" step="50" type="number" value="3.14">"""
+        self.assertEqual(d.field(step="50"), input_expected)
+
+        input_expected = """<input id="issue1@numberval" name="issue1@numberval" size="30" type="text" value="3.14">"""
+        self.assertEqual(d.field(type="text"), input_expected)
+
+        self.assertEqual(d.pretty("%0.3f"), "3.140")
+        self.assertEqual(d.pretty("%0.3d"), "003")
+        self.assertEqual(d.pretty("%2d"), " 3")
+
+        # see what happens if for other values
+        value = d._value
+        d._value = "1" # integer
+        self.assertEqual(d.pretty("%2d"), "1")
+        d._value = "I'mNotAFloat" # not a number
+        self.assertEqual(d.pretty("%2d"), "I'mNotAFloat")
+        d._value = value
+
+        # check permissions return
+        is_view_ok_orig = d.is_view_ok
+        is_edit_ok_orig = d.is_edit_ok
+        no_access = lambda : False
+
+        d.is_view_ok = no_access
+        self.assertEqual(d.plain(), "[hidden]")
+
+        d.is_edit_ok = no_access
+        self.assertEqual(d.field(), "[hidden]")
+
+        d.is_view_ok = is_view_ok_orig
+        self.assertEqual(d.field(), "3.14")
+        d.is_edit_ok = is_edit_ok_orig
+
 class ZUtilsTestcase(TemplatingTestCase):
 
     def test_Iterator(self):

From e7c285d58f74f5118a99366e21f787363e948666 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sat, 18 Jan 2025 15:15:42 -0500
Subject: [PATCH 147/398] test - fix broken test

Had a test case for number inputs that I didn't know about.
testmon didn't detect it had to be run.
---
 test/test_templating.py | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/test/test_templating.py b/test/test_templating.py
index 4c760c13a..e1dfae9c3 100644
--- a/test/test_templating.py
+++ b/test/test_templating.py
@@ -351,15 +351,15 @@ def test_number_field(self):
         p = NumberHTMLProperty(self.client, 'testnum', '1', None, 'test',
                                2345678.2345678)
         self.assertEqual(p.field(),
-                         ('<input id="testnum1@test" name="testnum1@test" size="30" type="text" '
+                         ('<input id="testnum1@test" name="testnum1@test" size="30" type="number" '
                          'value="%s">')%expected_val)
         self.assertEqual(p.field(size=10),
-                         ('<input id="testnum1@test" name="testnum1@test" size="10" type="text" '
+                         ('<input id="testnum1@test" name="testnum1@test" size="10" type="number" '
                          'value="%s">')%expected_val)
         self.assertEqual(p.field(size=10, dataprop="foo", dataprop2=5),
                          ('<input dataprop="foo" dataprop2="5" '
                           'id="testnum1@test" name="testnum1@test" '
-                          'size="10" type="text" '
+                          'size="10" type="number" '
                           'value="%s">'%expected_val))
 
         self.assertEqual(p.field(size=10, klass="class1", 
@@ -369,7 +369,7 @@ def test_number_field(self):
                          ('<input class="class2 class3" data-prop="foo" '
                           'data-prop2="5" id="testnum1@test" '
                           'klass="class1" '
-                          'name="testnum1@test" size="10" type="text" '
+                          'name="testnum1@test" size="10" type="number" '
                           'value="%s">')%expected_val)
 
         # get plain representation if user can't edit
@@ -378,10 +378,10 @@ def test_number_field(self):
 
         # test with string which is wrong type
         p = NumberHTMLProperty(self.client, 'testnum', '1', None, 'test',
-                               "2345678.2345678")
+                               "234567e.2345678")
         self.assertEqual(p.field(),
                          ('<input id="testnum1@test" name="testnum1@test" '
-                          'size="30" type="text" value="2345678.2345678">'))
+                          'size="30" type="number" value="234567e.2345678">'))
 
         # test with None value, pretend property.__default_value = Null which
         #    is the default. It would be returned by get_default_value
@@ -391,7 +391,7 @@ def test_number_field(self):
                                'test', None)
         self.assertEqual(p.field(),
                          ('<input id="testnum1@test" name="testnum1@test" '
-                         'size="30" type="text" value="">'))
+                         'size="30" type="number" value="">'))
 
     def test_number_plain(self):
         import sys
@@ -768,6 +768,7 @@ def test_DateHTMLWithDate(self):
                              'deadline', test_Date)
         self.assertIsInstance(d._value, date.Date)
         self.assertEqual(d.pretty(), " 1 January 2021")
+        self.assertEqual(d.pretty("%2d %B %Y"), "01 January 2021")
         self.assertEqual(d.pretty(format="%Y-%m"), "2021-01")
         self.assertEqual(d.plain(), "2021-01-01.13:22:10")
         self.assertEqual(d.local("-4").plain(), "2021-01-01.07:22:10")

From 361eacb6e98a82753e11795ceab6fd318e1af996 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sat, 18 Jan 2025 16:54:35 -0500
Subject: [PATCH 148/398] test: basic testing for BooleanHTMLProperty

plain and field.
---
 test/test_templating.py | 110 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 110 insertions(+)

diff --git a/test/test_templating.py b/test/test_templating.py
index e1dfae9c3..15c8bebc3 100644
--- a/test/test_templating.py
+++ b/test/test_templating.py
@@ -734,6 +734,116 @@ def setUp(self):
     def inject_fixtures(self, caplog):
         self._caplog = caplog
 
+class BooleanHTMLPropertyTestCase(HTMLPropertyTestClass):
+
+    def setUp(self):
+        super(BooleanHTMLPropertyTestCase, self).setUp()
+
+        db = self.client.db
+        db.issue.addprop(boolvalt=hyperdb.Boolean())
+        db.issue.addprop(boolvalf=hyperdb.Boolean())
+        db.issue.addprop(boolvalunset=hyperdb.Boolean())
+
+        self.client.db.issue.create(title="title",
+                                    boolvalt = True,
+                                    boolvalf = False)
+
+    def tearDown(self):
+        self.client.db.close()
+        memorydb.db_nuke('')
+
+    testdata = [
+        ("boolvalt", "Yes", True, False),
+        ("boolvalf", "No", False, True),
+        ("boolvalunset", "", False, True),
+    ]
+
+    def test_BoolHTMLRadioButtons(self):
+        #propname = "boolvalt"
+
+        #plainval = "Yes"
+
+        self.maxDiff = None
+        for test_inputs in self.testdata:
+            params = {
+                "check1": 'checked="checked" ' if test_inputs[2] else "",
+                "check2": 'checked="checked" ' if test_inputs[3] else "",
+                "propname": test_inputs[0],
+                "plainval": test_inputs[1],
+
+            }
+
+
+            test_hyperdbBoolean = self.client.db.issue.getprops("1")[
+                params['propname']]
+            test_boolean = self.client.db.issue.get("1", params['propname'])
+
+            # client, classname, nodeid, prop, name, value,
+            #    anonymous=0, offset=None
+            d = BooleanHTMLProperty(self.client, 'issue', '1',
+                                    test_hyperdbBoolean,
+                                    params['propname'], test_boolean)
+
+            self.assertIsInstance(d._value, (type(None), bool))
+
+            self.assertEqual(d.plain(), params['plainval'])
+
+            input_expected = (
+                '<input %(check1)sid="issue1@%(propname)s_yes" '
+                'name="issue1@%(propname)s" type="radio" value="yes">'
+                '<label class="rblabel" for="issue1@%(propname)s_yes">'
+                'Yes</label>'
+                '<input %(check2)sid="issue1@%(propname)s_no" name="issue1@%(propname)s" '
+                'type="radio" value="no"><label class="rblabel" '
+                'for="issue1@%(propname)s_no">No</label>') % params
+
+            self.assertEqual(d.field(), input_expected)
+
+            y_label = ( '<label class="rblabel" for="issue1@%(propname)s_yes">'
+                        'True</label>') % params
+            n_label = ('<label class="rblabel" '
+                       'for="issue1@%(propname)s_no">False</label>') % params
+
+            input_expected = (
+                '<input %(check1)sid="issue1@%(propname)s_yes" '
+                'name="issue1@%(propname)s" type="radio" value="yes">'
+                + y_label +
+                '<input %(check2)sid="issue1@%(propname)s_no" name="issue1@%(propname)s" '
+                'type="radio" value="no">' + n_label ) % params
+
+            self.assertEqual(d.field(y_label=y_label, n_label=n_label), input_expected)
+
+
+            input_expected = (
+                '<label class="rblabel" for="issue1@%(propname)s_yes">'
+                'Yes</label>'
+                '<input %(check1)sid="issue1@%(propname)s_yes" '
+                'name="issue1@%(propname)s" type="radio" value="yes">'
+                '<label class="rblabel" '
+                'for="issue1@%(propname)s_no">No</label>'
+                '<input %(check2)sid="issue1@%(propname)s_no" '
+                    'name="issue1@%(propname)s" '
+                'type="radio" value="no">') % params
+
+            print(d.field(labelfirst=True))
+            self.assertEqual(d.field(labelfirst=True), input_expected)
+
+        # one test on the last d is enough.
+        # check permissions return
+        is_view_ok_orig = d.is_view_ok
+        is_edit_ok_orig = d.is_edit_ok
+        no_access = lambda : False
+
+        d.is_view_ok = no_access
+        self.assertEqual(d.plain(), "[hidden]")
+
+        d.is_edit_ok = no_access
+        self.assertEqual(d.field(), "[hidden]")
+
+        d.is_view_ok = is_view_ok_orig
+        self.assertEqual(d.field(), params['plainval'])
+        d.is_edit_ok = is_edit_ok_orig
+
 class DateHTMLPropertyTestCase(HTMLPropertyTestClass):
 
     def setUp(self):

From 65fc103116dd9a0651dad409b48892ccb670b489 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sat, 18 Jan 2025 17:43:08 -0500
Subject: [PATCH 149/398] refactor: change method used to assign radiobuttons
 for boolean

use setdefault('type', 'radiobutton') rather than hardcoding the value
into the underlying self.input (input_html4) call.

Also add test for undefined radiobutton.
---
 roundup/cgi/templating.py | 11 ++++++-----
 test/test_templating.py   | 20 +++++++++++++++++++-
 2 files changed, 25 insertions(+), 6 deletions(-)

diff --git a/roundup/cgi/templating.py b/roundup/cgi/templating.py
index f3e86495f..ad25923f8 100644
--- a/roundup/cgi/templating.py
+++ b/roundup/cgi/templating.py
@@ -2165,26 +2165,27 @@ def field(self, labelfirst=False, y_label=None, n_label=None,
             n_label += '</label>'
 
         checked = value and "checked" or ""
+        kwargs.setdefault("type", "radio")
         if value:
-            y_rb = self.input(type="radio", name=self._formname, value="yes",
+            y_rb = self.input(name=self._formname, value="yes",
                               checked="checked", id="%s_%s" % (
                                   self._formname, 'yes'), **kwargs)
 
-            n_rb = self.input(type="radio", name=self._formname,  value="no",
+            n_rb = self.input(name=self._formname,  value="no",
                               id="%s_%s" % (
                                   self._formname, 'no'), **kwargs)
         else:
-            y_rb = self.input(type="radio", name=self._formname, value="yes",
+            y_rb = self.input(name=self._formname, value="yes",
                               id="%s_%s" % (self._formname, 'yes'), **kwargs)
 
-            n_rb = self.input(type="radio", name=self._formname,  value="no",
+            n_rb = self.input(name=self._formname,  value="no",
                               checked="checked", id="%s_%s" % (
                                   self._formname, 'no'), **kwargs)
 
         if (u_label):
             if (u_label is True):  # it was set via u_label=True
                 u_label = ''       # make it empty but a string not boolean
-            u_rb = self.input(type="radio", name=self._formname,  value="",
+            u_rb = self.input(name=self._formname,  value="",
                               id="%s_%s" % (self._formname, 'unk'), **kwargs)
         else:
             # don't generate a trivalue radiobutton.
diff --git a/test/test_templating.py b/test/test_templating.py
index 15c8bebc3..b7b4c03d7 100644
--- a/test/test_templating.py
+++ b/test/test_templating.py
@@ -803,6 +803,8 @@ def test_BoolHTMLRadioButtons(self):
                         'True</label>') % params
             n_label = ('<label class="rblabel" '
                        'for="issue1@%(propname)s_no">False</label>') % params
+            u_label = ('<label class="rblabel" '
+                       'for="issue1@%(propname)s_unk">Ignore</label>') % params
 
             input_expected = (
                 '<input %(check1)sid="issue1@%(propname)s_yes" '
@@ -828,7 +830,23 @@ def test_BoolHTMLRadioButtons(self):
             print(d.field(labelfirst=True))
             self.assertEqual(d.field(labelfirst=True), input_expected)
 
-        # one test on the last d is enough.
+            input_expected = (
+                '<label class="rblabel" for="issue1@%(propname)s_unk">'
+                'Ignore</label>'
+                '<input id="issue1@%(propname)s_unk" '
+                'name="issue1@%(propname)s" type="radio" value="">'
+                '<input %(check1)sid="issue1@%(propname)s_yes" '
+                'name="issue1@%(propname)s" type="radio" value="yes">'
+                '<label class="rblabel" for="issue1@%(propname)s_yes">'
+                'Yes</label>'
+                '<input %(check2)sid="issue1@%(propname)s_no" name="issue1@%(propname)s" '
+                'type="radio" value="no"><label class="rblabel" '
+                'for="issue1@%(propname)s_no">No</label>') % params
+
+            self.assertEqual(d.field(u_label=u_label), input_expected)
+
+
+        # one test with the last d is enough.
         # check permissions return
         is_view_ok_orig = d.is_view_ok
         is_edit_ok_orig = d.is_edit_ok

From c31c2b20dc68060a865f5b6657874809c5d29020 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sat, 18 Jan 2025 19:08:16 -0500
Subject: [PATCH 150/398] test: fix fuzz test

CI found a new condition that passes but isn't filtered as passing.

  '0 #stuff'

The space is acceptable at the end of a sring otf numbers.

New filter allows this to pass.  Added an example of this type of
value.
---
 test/test_liveserver.py | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/test/test_liveserver.py b/test/test_liveserver.py
index ddad9f687..3db518550 100644
--- a/test/test_liveserver.py
+++ b/test/test_liveserver.py
@@ -234,6 +234,7 @@ class FuzzGetUrls(WsgiSetup, ClientSetup):
            text(min_size=1))
     @example("@verbose", "1#")
     @example("@verbose", "#1stuff")
+    @example("@verbose", "0 #stuff")
     @settings(max_examples=_max_examples,
               deadline=fuzz_deadline) # in ms
     def test_class_url_param_accepting_integer_values(self, param, value):
@@ -245,8 +246,8 @@ def test_class_url_param_accepting_integer_values(self, param, value):
         query = '%s=%s'  % (param, value)
         f = session.get(url, params=query)
         try:
-            # test case '0#' '12345#stuff' '12345&stuff'
-            match = re.match('(^[0-9]*)[#&]', value)
+            # test case '0 #', '0#', '12345#stuff' '12345&stuff'
+            match = re.match(r'(^[0-9]*\s*)[#&]', value)
             if match is not None:
                 value = match[1]
             elif int(value) >= 0:

From 599ce9361717af294c937753e01524a38afd3a4d Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sat, 18 Jan 2025 22:20:38 -0500
Subject: [PATCH 151/398] fix: issue2551231 - template.py-HTMLClass::classhelp
 doesn't merge user defined classes.

It now merges them in. Also fixed same issue in popcal().
---
 CHANGES.txt               |  3 +++
 roundup/cgi/templating.py | 23 +++++++++++++++++++----
 2 files changed, 22 insertions(+), 4 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index 19d16b3a7..adbf0f647 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -124,6 +124,9 @@ Features:
   Rouillard)
 - Use native number type input for Number() and Integer()
   properties. Integer() uses step=1 as well. (John Rouillard)
+- issue2551231 - template.py-HTMLClass::classhelp doesn't merge
+  user defined classes. It now merges them in. Also fixed same
+  issue in popcal(). (John Rouillard)
 
 2024-07-13 2.4.0
 
diff --git a/roundup/cgi/templating.py b/roundup/cgi/templating.py
index ad25923f8..547d661ee 100644
--- a/roundup/cgi/templating.py
+++ b/roundup/cgi/templating.py
@@ -981,10 +981,18 @@ def classhelp(self, properties=None, label=''"(list)", width='500',
                     group, sort, pagesize, filter)
         onclick = "javascript:help_window('%s', '%s', '%s');return false;" % \
                   (help_url, width, height)
-        return ('<a class="classhelp" data-helpurl="%s" '
+
+        if 'class' in html_kwargs:
+            html_classes = ("classhelp %s" %
+                            html_escape(str(html_kwargs["class"]), True))
+            del html_kwargs["class"]
+        else:
+            html_classes = "classhelp"
+
+        return ('<a class="%s" data-helpurl="%s" '
                 'data-width="%s" data-height="%s" href="%s" '
                 'target="_blank" onclick="%s" %s>%s</a>') % (
-                    help_url, width, height,
+                    html_classes, help_url, width, height,
                     help_url, onclick, self.cgi_escape_attrs(**html_kwargs),
                     self._(label))
 
@@ -2446,9 +2454,16 @@ def popcal(self, width=300, height=200, label="(cal)",
             "data-height": height
         }
 
-        return ('<a class="classhelp" %s href="javascript:help_window('
+        if 'class' in html_kwargs:
+            html_classes = ("classhelp %s" %
+                            html_escape(str(html_kwargs["class"]), True))
+            del html_kwargs["class"]
+        else:
+            html_classes = "classhelp"
+
+        return ('<a class="%s" %s href="javascript:help_window('
                 "'%s?@template=calendar&amp;property=%s&amp;form=%s%s', %d, %d)"
-                '">%s</a>' % (self.cgi_escape_attrs(**data_attr),
+                '">%s</a>' % (html_classes, self.cgi_escape_attrs(**data_attr),
                               self._classname, self._name, form, date, width,
                               height, label))
 

From d21cce1878c44263aab8e19b10b2f753719391ae Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 19 Jan 2025 01:01:59 -0500
Subject: [PATCH 152/398] fix: revert part of changeset: ae7fadcac9e1

I misread. Popcal doesn't support submitting html_kwargs.
self.cgi_escape_attrs is used on a different variable.
---
 CHANGES.txt               |  3 +--
 roundup/cgi/templating.py | 11 ++---------
 2 files changed, 3 insertions(+), 11 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index adbf0f647..4f8ab42b8 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -125,8 +125,7 @@ Features:
 - Use native number type input for Number() and Integer()
   properties. Integer() uses step=1 as well. (John Rouillard)
 - issue2551231 - template.py-HTMLClass::classhelp doesn't merge
-  user defined classes. It now merges them in. Also fixed same
-  issue in popcal(). (John Rouillard)
+  user defined classes. It now merges them in. (John Rouillard)
 
 2024-07-13 2.4.0
 
diff --git a/roundup/cgi/templating.py b/roundup/cgi/templating.py
index 547d661ee..46ee1afa6 100644
--- a/roundup/cgi/templating.py
+++ b/roundup/cgi/templating.py
@@ -2454,16 +2454,9 @@ def popcal(self, width=300, height=200, label="(cal)",
             "data-height": height
         }
 
-        if 'class' in html_kwargs:
-            html_classes = ("classhelp %s" %
-                            html_escape(str(html_kwargs["class"]), True))
-            del html_kwargs["class"]
-        else:
-            html_classes = "classhelp"
-
-        return ('<a class="%s" %s href="javascript:help_window('
+        return ('<a class="classhelp" %s href="javascript:help_window('
                 "'%s?@template=calendar&amp;property=%s&amp;form=%s%s', %d, %d)"
-                '">%s</a>' % (html_classes, self.cgi_escape_attrs(**data_attr),
+                '">%s</a>' % (self.cgi_escape_attrs(**data_attr),
                               self._classname, self._name, form, date, width,
                               height, label))
 

From 7be5f2d0355512895d0769c00386d715ea48ff34 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 19 Jan 2025 11:42:40 -0500
Subject: [PATCH 153/398] docs: updated DNS contact points and ownership.

---
 website/README.txt | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/website/README.txt b/website/README.txt
index f72faeb58..5cdf371a5 100644
--- a/website/README.txt
+++ b/website/README.txt
@@ -205,3 +205,12 @@ wiki/_static.
 Backups are assumed to be done by Waldmann-edv. There does not appear
 to be a way to get access to the underlying filesystem via ssh or to
 do a backup/tarball via with web.
+
+DNS
+===
+Thomas Waldman is also our DNS manager. All changes should go to him
+at email: info AT waldmann-edv DOT de.
+
+Richard Jones still owns/pays for the roundup-tracker.org domain.
+It expires on: 2026-01-06T10:49:58Z.
+

From 01735e0ae1d4de1cf9b0c894490b7460933883a5 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 19 Jan 2025 19:29:17 -0500
Subject: [PATCH 154/398] fix: issue2550962. remove assert in
 Role::hasPermission

issue2550962 - Check uses of assert in roundup code.

An assert was used to make sure that a classname always accompoanied
an itemid in hasPermission. The Security::hasPErmission has an if
clause that does the same check and raises a ValueError.

Remove asserts because they ae removed when running python in
optimized mode.
---
 roundup/security.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/roundup/security.py b/roundup/security.py
index bc6602567..55ddac76e 100644
--- a/roundup/security.py
+++ b/roundup/security.py
@@ -267,7 +267,9 @@ def filter_iter (self, permission, classname):
 
     def hasPermission (self, db, perm, uid, classname, property, itemid, chk):
         # if itemid is given a classname must, too, checked in caller
-        assert not itemid or classname
+        if itemid and classname is None:
+            raise ValueError('classname must accompany itemid')
+
         perms = self._permissions
         if perm not in perms:
             return False

From ae98c2d5d17d3e6184debbc7c8204cb98821e6a9 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 19 Jan 2025 19:37:48 -0500
Subject: [PATCH 155/398] fix: issue2550815 - roundup-admin import for postgres
 causes id to be skipped.

Fixed code so that the id used to set the sequence
will be returned and not skipped. (Tom Ekberg diagnosed and
supplied the fix.)
---
 CHANGES.txt                         | 4 ++++
 roundup/backends/back_postgresql.py | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index 4f8ab42b8..a5bfcc721 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -81,6 +81,10 @@ Fixed:
   date input. Also add double-click and exit keyboard handlers to
   allow copy/paste/editing the text version of the date.  (John
   Rouillard)
+- issue2550815 - roundup-admin import for postgres causes id to
+  be skipped. Fixed code so that the id used to set the sequence
+  will be returned and not skipped. (Tom Ekberg diagnosed and
+  supplied the fix. John Rouillard committed)
 
 Features:
 
diff --git a/roundup/backends/back_postgresql.py b/roundup/backends/back_postgresql.py
index 4aa71edfd..419bdc1e3 100644
--- a/roundup/backends/back_postgresql.py
+++ b/roundup/backends/back_postgresql.py
@@ -548,7 +548,7 @@ def newid(self, classname):
         return str(self.cursor.fetchone()[0])
 
     def setid(self, classname, setid):
-        sql = "select setval('_%s_ids', %s) from dual" % (classname,
+        sql = "select setval('_%s_ids', %s, false) from dual" % (classname,
                                                           int(setid))
         self.sql(sql)
 

From f70e7e3bf0b5aae451980a7774e22c5f6fba8b3c Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 20 Jan 2025 15:21:56 -0500
Subject: [PATCH 156/398] fix: issue1895197 - translated help texts in admin.py
 not displayed correctly.

Adjust the technique used to remove the translated "Usage:" prefix
from the printed line. Support Chinese (zh) as well.

Add coding marker so I don't have to modify the tests to skip the ones
that touch the dmin module.
---
 CHANGES.txt      |  2 ++
 roundup/admin.py | 13 ++++++++++++-
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index a5bfcc721..175fdc64a 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -85,6 +85,8 @@ Fixed:
   be skipped. Fixed code so that the id used to set the sequence
   will be returned and not skipped. (Tom Ekberg diagnosed and
   supplied the fix. John Rouillard committed)
+- issue1895197 - translated help texts in admin.py not displayed
+  correctly. (Initial patch tobias-herp, John Rouillard)
 
 Features:
 
diff --git a/roundup/admin.py b/roundup/admin.py
index 01dcad2c2..093d66c32 100644
--- a/roundup/admin.py
+++ b/roundup/admin.py
@@ -1,4 +1,5 @@
 #! /usr/bin/env python
+# -*- coding: utf-8 -*-
 #
 # Copyright (c) 2001 Bizar Software Pty Ltd (http://www.bizarsoftware.com.au/)
 # This module is free software, and you may redistribute it and/or modify
@@ -232,7 +233,17 @@ def help_commands(self):
         commands = ['']
         for command in self.commands.values():
             h = _(command.__doc__).split('\n')[0]
-            commands.append(' ' + h[7:])
+            # ascii colon and space, U+003A 'ï¼š' as ascii repr (for
+            # Chinese locales), 'fallback'
+            for seq in [': ', '\uff1a', 'fallback']:
+                if seq == 'fallback':
+                    # command hasn't been printed yet so ...
+                    commands.append(' ' + h.lstrip())
+                    break
+                if seq in h:
+                    commands.append(' ' + h.split(seq, 1)[1].lstrip())
+                    break
+                    
         commands.sort()
         commands.append(_(
 """Commands may be abbreviated as long as the abbreviation

From cac1477ccb196fb73abd6e81d55039c7fb27fd10 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 20 Jan 2025 15:51:53 -0500
Subject: [PATCH 157/398] fix: issue2551238 - roundup-server should exit with
 error ...

if -d <pidfile> is used without -l <logfile>.

Now exits with error if -l or -L are not specified with -d.

This exposed a problem with relative paths when using a logging
config file. -d enables deamon mode by default. This changes the
current direcory to /. So relative paths in a logging config file
are opened in / and fail.

Added documentation to dmin guide noting the problem.
---
 CHANGES.txt                       |  4 ++++
 doc/admin_guide.txt               | 14 ++++++++++++++
 roundup/scripts/roundup_server.py |  3 +++
 3 files changed, 21 insertions(+)

diff --git a/CHANGES.txt b/CHANGES.txt
index 175fdc64a..e235cedd1 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -87,6 +87,10 @@ Fixed:
   supplied the fix. John Rouillard committed)
 - issue1895197 - translated help texts in admin.py not displayed
   correctly. (Initial patch tobias-herp, John Rouillard)
+- issue2551238 - roundup-server should exit with error if -d
+  <pidfile> is used without -l <logfile>. Added code to report
+  the issue. Added issue with relative paths for log file whn
+  using -L and -d with roundup-server. (John Rouillard)
 
 Features:
 
diff --git a/doc/admin_guide.txt b/doc/admin_guide.txt
index 726b4bc8b..43c4c0501 100644
--- a/doc/admin_guide.txt
+++ b/doc/admin_guide.txt
@@ -223,6 +223,20 @@ Additional notes for each keyword:
   ``-----END CERTIFICATE-----``.
   If not specified, roundup will generate a temporary, self-signed certificate
   for use.
+**loghttpvialogger** section
+  If you:
+
+    * have **loghttpvialogger** enabled
+    * use **pidfile**
+    * use a logging config file in the tracker's config.ini
+
+  it is essential to specify absolute paths for log files in the
+  tracker's logging.config file.  The use of pidfile causes the
+  server to switch to the root directory ('/'). As a result
+  relative paths in the logging ini configuration file (as
+  opposed to the tracker's config.ini) will be written to the
+  system's root directory. The access error will cause the server
+  to exit.
 **trackers** section
   Each line denotes a mapping from a URL component to a tracker home.
   Make sure the name part doesn't include any url-unsafe characters like
diff --git a/roundup/scripts/roundup_server.py b/roundup/scripts/roundup_server.py
index 97ccbf91a..c8aa6c2ab 100644
--- a/roundup/scripts/roundup_server.py
+++ b/roundup/scripts/roundup_server.py
@@ -1198,6 +1198,9 @@ def run(port=undefined, success_message=None):
         config.set_logging()
     if config["PIDFILE"]:
         config["PIDFILE"] = os.path.abspath(config["PIDFILE"])
+        if not (config["LOGFILE"] or config["LOGHTTPVIALOGGER"]):
+            print(_("If you specify a PID file you must use -l or -L."))
+            sys.exit(1)
 
     # fork the server from our parent if a pidfile is specified
     if config["PIDFILE"]:

From 23165ca418a6f5c21ae283fb8ce157d84bc0fa40 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 20 Jan 2025 16:32:39 -0500
Subject: [PATCH 158/398] backout bbc99def147a. All the other backends were
 programmed to accomodate the skip one nature of postgres sequences

---
 CHANGES.txt                         | 4 ----
 roundup/backends/back_postgresql.py | 2 +-
 2 files changed, 1 insertion(+), 5 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index e235cedd1..9d986705f 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -81,10 +81,6 @@ Fixed:
   date input. Also add double-click and exit keyboard handlers to
   allow copy/paste/editing the text version of the date.  (John
   Rouillard)
-- issue2550815 - roundup-admin import for postgres causes id to
-  be skipped. Fixed code so that the id used to set the sequence
-  will be returned and not skipped. (Tom Ekberg diagnosed and
-  supplied the fix. John Rouillard committed)
 - issue1895197 - translated help texts in admin.py not displayed
   correctly. (Initial patch tobias-herp, John Rouillard)
 - issue2551238 - roundup-server should exit with error if -d
diff --git a/roundup/backends/back_postgresql.py b/roundup/backends/back_postgresql.py
index 419bdc1e3..4aa71edfd 100644
--- a/roundup/backends/back_postgresql.py
+++ b/roundup/backends/back_postgresql.py
@@ -548,7 +548,7 @@ def newid(self, classname):
         return str(self.cursor.fetchone()[0])
 
     def setid(self, classname, setid):
-        sql = "select setval('_%s_ids', %s, false) from dual" % (classname,
+        sql = "select setval('_%s_ids', %s) from dual" % (classname,
                                                           int(setid))
         self.sql(sql)
 

From 56ba6f80761e230be5edaff3baf486a47d7a9ceb Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 22 Jan 2025 10:10:39 -0500
Subject: [PATCH 159/398] refactor(ruff): multiple changes to clear ruff issues

Fix a couple of missing returns of booleans for security checks.
Turns an implicit return None into an explicit return False.

Fix loop index variable being reassigned inside loop by renaming index
variable. 2 instances.

Consolidate 2 isinstance calls to 1 with tuple class argument.

Replace dict(list comprehension) with dict conprehension.

Variable renames.

Removal of unused variable.

Whitespace fixes.

sort imports
---
 roundup/security.py | 61 ++++++++++++++++++++++++---------------------
 1 file changed, 33 insertions(+), 28 deletions(-)

diff --git a/roundup/security.py b/roundup/security.py
index 55ddac76e..09555ae2b 100644
--- a/roundup/security.py
+++ b/roundup/security.py
@@ -2,11 +2,11 @@
 """
 __docformat__ = 'restructuredtext'
 
+import logging
 import weakref
 
 from roundup import hyperdb, support
 
-import logging
 logger = logging.getLogger('roundup.security')
 
 
@@ -119,6 +119,8 @@ def check(db, userid, itemid):
             for a in args:
                 if cls.filter([itemid], **a):
                     return True
+            return False
+
         return check
 
     def test(self, db, permission, classname, property, userid, itemid):
@@ -241,16 +243,16 @@ def __repr__(self):
         pl = self.permission_list()
         return '<Role 0x%x %r,%r>' % (id(self), self.name, pl)
 
-    def addPermission (self, *permissions):
+    def addPermission(self, *permissions):
         for p in permissions:
             pn = p.name
             self._permissions.setdefault(pn, {})
             cn = p.klass
             if p.klass not in self._permissions[pn]:
-                self._permissions[pn][cn] = dict (((False, []), (True, [])))
+                self._permissions[pn][cn] = {False: [], True: []}
             self._permissions[pn][cn][bool(p.check)].append(p)
 
-    def filter_iter (self, permission, classname):
+    def filter_iter(self, permission, classname):
         """ Loop over all permissions for the current role on the class
             with a check method (and props_only False).
         """
@@ -265,7 +267,7 @@ def filter_iter (self, permission, classname):
                     continue
                 yield p
 
-    def hasPermission (self, db, perm, uid, classname, property, itemid, chk):
+    def hasPermission(self, db, perm, uid, classname, property, itemid, chk):
         # if itemid is given a classname must, too, checked in caller
         if itemid and classname is None:
             raise ValueError('classname must accompany itemid')
@@ -287,32 +289,35 @@ def hasPermission (self, db, perm, uid, classname, property, itemid, chk):
             if p.test(db, perm, classname, property, uid, itemid):
                 return True
 
-    def permission_list (self):
+        return False
+
+    def permission_list(self):
         """ Used for reporting in admin tool """
-        l = []
+        perm_list = []
         for p in self._permissions:
             for c in self._permissions[p]:
                 for cond in (False, True):
-                    l.extend (self._permissions[p][c][cond])
-        l.sort (key = lambda x: (x.klass or '', x.name))
-        return l
+                    perm_list.extend(self._permissions[p][c][cond])
+        perm_list.sort(key=lambda x: (x.klass or '', x.name))
+        return perm_list
 
-    def searchable (self, classname, propname):
-        for perm in 'View', 'Search':
+    def searchable(self, classname, propname):
+        for perm_name in 'View', 'Search':
             # Only permissions without a check method
-            if perm not in self._permissions:
+            if perm_name not in self._permissions:
                 continue
-            p = self._permissions[perm]
-            if classname not in p and None not in p:
+            perms = self._permissions[perm_name]
+            if classname not in perms and None not in perms:
                 continue
-            if None in p:
-                for p in p[None][False]:
+            if None in perms:
+                for p in perms[None][False]:
                     if p.searchable(classname, propname):
                         return True
-            if classname in p:
-                for p in p[classname][False]:
+            if classname in perms:
+                for p in perms[classname][False]:
                     if p.searchable(classname, propname):
                         return True
+        return False
 
 
 class Security:
@@ -334,9 +339,10 @@ def __init__(self, db):
         self.addRole(name="Anonymous", description="An anonymous user")
 
         # default permissions - Admin may do anything
-        for p in 'create edit restore retire view'.split():
-            p = self.addPermission(name=p.title(),
-                                   description="User may %s everything" % p)
+        for perm_name in 'create edit restore retire view'.split():
+            p = self.addPermission(name=perm_name.title(),
+                                   description="User may %s everything" %
+                                   perm_name)
             self.addPermissionToRole('Admin', p)
 
         # initialise the permissions and roles needed for the UIs
@@ -441,7 +447,7 @@ def is_filterable(self, permission, userid, classname):
             no permissions with a check method found, the performed
             checks later will find no matching records.
         """
-        for perm in self.filter_iter (permission, userid, classname):
+        for perm in self.filter_iter(permission, userid, classname):
             if not perm.filter:
                 return False
         return True
@@ -450,7 +456,6 @@ def roleHasSearchPermission(self, classname, property, *rolenames):
         """ For each of the given roles, check the permissions.
             Property can be a transitive property.
         """
-        perms = []
         # Note: break from inner loop means "found"
         #       break from outer loop means "not found"
         cn = classname
@@ -478,13 +483,13 @@ def roleHasSearchPermission(self, classname, property, *rolenames):
         else:
             # for Link and Multilink require search permission on label-
             # and order-properties and on ID
-            if isinstance(prop, Multilink) or isinstance(prop, Link):
+            if isinstance(prop, (Link, Multilink)):
                 try:
                     cls = self.db.getclass(prop.classname)
                 except KeyError:
                     return 0
                 props = dict.fromkeys(('id', cls.labelprop(), cls.orderprop()))
-                for p in props.keys():
+                for p in props:
                     for rn in rolenames:
                         if self.role[rn].searchable(prop.classname, p):
                             break
@@ -568,8 +573,8 @@ def addPermissionToRole(self, rolename, permission, classname=None,
     def filterFilterspec(self, userid, classname, filterspec):
         """ Return a filterspec that has all non-allowed properties removed.
         """
-        return dict([(k, v) for k, v in filterspec.items()
-                     if self.hasSearchPermission(userid, classname, k)])
+        return {k: v for k, v in filterspec.items()
+                     if self.hasSearchPermission(userid, classname, k)}
 
     def filterSortspec(self, userid, classname, sort):
         """ Return a sort- or group-list that has all non-allowed properties

From 926b5dbde2902e9ef0c129216af4054a45b35722 Mon Sep 17 00:00:00 2001
From: Ralf Schlatterbeck <rsc@runtux.com>
Date: Wed, 19 Feb 2025 12:38:06 +0100
Subject: [PATCH 160/398] Make native date and number elements configurable

Now for Number() and Integer() properties the browser-native number
format can be configured with the use_browser_number_input config item
in seciont [web]. The default is 'yes'. For Date() properties the config
item is use_browser_date_input (also in section [web]) but the default
is 'no'.

In addition when defining Date() properties, these now have a parameter
'display_time' which defaults to 'yes' and a 'format' parameter which
defaults to None. These set defaults for the field() method of the
DateHTMLProperty which have the same parameters (but the display_time
parameter of field() takes a boolean, not 'yes'/'no').
---
 .hgignore                 |   1 +
 CHANGES.txt               |  10 ++-
 doc/customizing.txt       |   4 +-
 doc/reference.txt         |  48 ++++++----
 doc/tracker_config.txt    |  20 +++++
 doc/upgrading.txt         | 154 +++++++++++++++----------------
 doc/user_guide.txt        |  10 ++-
 roundup/cgi/templating.py |  99 +++++++++-----------
 roundup/configuration.py  |  14 +++
 roundup/hyperdb.py        |  10 ++-
 test/test_templating.py   | 185 +++++++++++++++++---------------------
 11 files changed, 284 insertions(+), 271 deletions(-)

diff --git a/.hgignore b/.hgignore
index 75ef4674b..5f09b9db2 100644
--- a/.hgignore
+++ b/.hgignore
@@ -47,3 +47,4 @@ website/www/COPYING.txt
 website/www/docs
 website/www/html/
 .pytest_cache
+.hypothesis
diff --git a/CHANGES.txt b/CHANGES.txt
index 9d986705f..48a2b43ca 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -79,8 +79,10 @@ Fixed:
   input fields. Thinko in the code. (John Rouillard)
 - issue2551390 - Replace text input/calendar popup with native
   date input. Also add double-click and exit keyboard handlers to
-  allow copy/paste/editing the text version of the date.  (John
-  Rouillard)
+  allow copy/paste/editing the text version of the date. Configurable
+  via the use_browser_date_input setting in the [web] section of
+  config.ini. By default browser native dates are turned off.
+  (John Rouillard, Ralf Schlatterbeck)
 - issue1895197 - translated help texts in admin.py not displayed
   correctly. (Initial patch tobias-herp, John Rouillard)
 - issue2551238 - roundup-server should exit with error if -d
@@ -129,7 +131,9 @@ Features:
   allow reporting an error to the user from a template. (John
   Rouillard)
 - Use native number type input for Number() and Integer()
-  properties. Integer() uses step=1 as well. (John Rouillard)
+  properties. Integer() uses step=1 as well. Configurable via the
+  use_browser_number_input setting in the [web] section of config.ini
+  (John Rouillard, Ralf Schlatterbeck)
 - issue2551231 - template.py-HTMLClass::classhelp doesn't merge
   user defined classes. It now merges them in. (John Rouillard)
 
diff --git a/doc/customizing.txt b/doc/customizing.txt
index bf717012e..1658ceb4f 100644
--- a/doc/customizing.txt
+++ b/doc/customizing.txt
@@ -90,11 +90,11 @@ caches the schema).
       <td tal:content="structure context/due_date/field" /> 
      </tr>
     
-   If you want to show the date and time for due_date then do this instead::
+   If you want to show only the date part of due_date then do this instead:
    
     <tr> 
      <th>Due Date</th> 
-     <td tal:content="structure context/due_date/field_time" /> 
+     <td tal:content="structure python:context.due_date.field(display_time=False)" />
     </tr>
 
 3. Add the property to the ``issue.index.html`` page::
diff --git a/doc/reference.txt b/doc/reference.txt
index 1c20feb58..e857b9772 100644
--- a/doc/reference.txt
+++ b/doc/reference.txt
@@ -3070,8 +3070,11 @@ There are several methods available on these wrapper objects:
 	      tri-state yes/no/neither selection. This method may take some
 	      arguments:
 
-	      size (default 30)
-		Sets the width in characters of the edit field
+              display_time (Date properties only)
+                By default this uses the display_time paramter of the
+                Date property (which by default is True) and displays
+                date and time for Date properties. You can set this to
+                False for displaying only the date.
 
 	      format (Date properties only)
                 Sets the format of the date in the field - uses the
@@ -3083,15 +3086,26 @@ There are several methods available on these wrapper objects:
 		text edit box with the year and month part of your
 		date.
 
-              type (depends on property type)
-                Sets the type property of the input. To change a date
-                property field from a native date input to a text
-                input you would use ``type="text"``.
+	      labelfirst (Boolean properties only)
+	        place the labels before the radio buttons
 
 	      popcal (Date properties only)
 		Include a link to the JavaScript-based popup calendar
-		for date selection. Defaults to off/False since native
-		date inputs supply popup calendars.
+		for date selection. Defaults to off/False when browser
+                native dates are in use and on/True otherwise because
+                browser native dates support a date popup on most
+                browsers.
+
+	      size (default 30)
+		Sets the width in characters of the edit field
+
+              type (depends on property type)
+                Sets the type property of the input. To change a date
+                property field from a native date input to a text
+                input you would use ``type="text"``. For Date properties
+                the type cannot be set by the user and is enforced via
+                the configuration (if browser native date input should
+                be used).
 
 	      y_label, n_label, u_label (Boolean properties only)
 	        Set the labels for the true/false/undefined
@@ -3099,9 +3113,6 @@ There are several methods available on these wrapper objects:
 	        tri-state radio button selector. Otherwise, it
 		allows selection of true/yes or false/no only.
 
-	      labelfirst (Boolean properties only)
-	        place the labels before the radio buttons
-
               Other arguments are added as properties directly on the
               input tag. For example::
 
@@ -3115,11 +3126,6 @@ There are several methods available on these wrapper objects:
 	      attribute without a value. This is useful for boolean
 	      properties like ``required``.
 
-  field_time  (Date properties only)
-              Create a browser native input for editing date and time.
-              The field method creates an input for editing
-              month/day/year (without time).
-
   rst         only on String properties - render the value of the property
 	      as ReStructuredText (requires the :ref:`Docutils
 	      module to be installed separately<install/docutils>`).
@@ -3179,9 +3185,10 @@ There are several methods available on these wrapper objects:
 	      is returned if the value is ``None`` otherwise it
 	      is converted to a string.
 
-  popcal      This is deprecated with Roundup 2.5 which uses the
-              native HTML5 date input. The native date input
-              includes a calendar popup on modern broswers.
+  popcal      This is deprecated with Roundup 2.5 which either uses the
+              native HTML5 date input or can generate a date popup with
+              the popcal option of the ``field`` method. The native date
+              input includes a calendar popup on modern broswers.
 
               Generate a link to a popup calendar which may be used to
 	      edit the date field, for example::
@@ -3193,6 +3200,9 @@ There are several methods available on these wrapper objects:
 
 		<span tal:replace="structure context/due/field" />
 		<span tal:replace="structure context/due/popcal" />
+              
+              Since the ``field`` by default already produces a popup
+              calendar this use is deprecated.
 
   menu        only on Link and Multilink properties - render a form select
 	      list for this property. Takes a number of optional arguments
diff --git a/doc/tracker_config.txt b/doc/tracker_config.txt
index 994a91074..14f7e0a8c 100644
--- a/doc/tracker_config.txt
+++ b/doc/tracker_config.txt
@@ -624,6 +624,26 @@
   # Default: disabled
   jwt_secret = disabled
 
+  # HTML input elements for Date properties: This determines
+  # if we use the input type 'datetime-local' (or 'date') for
+  # date input fields. If the option is turned off (the default),
+  # the type is set to 'text'. Since the widgets generated by
+  # browsers determine the date format from the language
+  # setting (it is currently not possible to force the
+  # international date format server-side) and some browsers
+  # ignore the date format set by the operating system, the
+  # default is 'no'.
+  # Allowed values: yes, no
+  # Default: no
+  use_browser_date_input = no
+
+  # HTML input elements for Number properties: This determines
+  # if we use the input type 'number' for Number (and Integer)
+  # properties. If set to 'no' we use input type 'text'.
+  # Allowed values: yes, no
+  # Default: yes
+  use_browser_number_input = no
+
 .. index:: config.ini; sections rdbms
 .. _`config-ini-section-rdbms`:
 .. code:: ini
diff --git a/doc/upgrading.txt b/doc/upgrading.txt
index eb19d75bc..88b080b0a 100644
--- a/doc/upgrading.txt
+++ b/doc/upgrading.txt
@@ -227,71 +227,74 @@ defusedxml.
 Enable use of native date inputs (optional)
 -------------------------------------------
 
-Roundup now uses native date or datetime-local inputs for Date()
-properties. These inputs take the place of the text input and
-calendar popup from earlier Roundup versions. Modern browsers
-come with a built-in calendar for date selection, so the
-``(cal)`` calendar link is no longer needed. These native inputs
-show the date based on the browser's locale and translate terms
-into the local language.
-
-If you do nothing, simple uses of the field() method will
-generate date inputs to allow selection of a date.  Input fields
-for Date() properties will not have the ``(cal)`` link
-anymore. Complex uses will not be upgraded and will operate like
-earlier Roundup versions.
-
-To upgrade all date properties, there are four changes to make:
-
-  1. Replace ``field`` calls with ``field_time`` where needed.
-
-  2. Remove the format argument from field() calls on Date()
+Roundup now can use native ``date`` or ``datetime-local`` inputs for
+``Date()`` properties. These inputs take the place of the text input and
+calendar popup from earlier Roundup versions. Modern browsers come with
+a built-in calendar for date selection, so the ``(cal)`` calendar link
+is no longer needed. These native inputs show the date based on the
+browser's locale and translate terms into the local language.
+
+Note that the date format is tied to the language setting in most
+browsers, with some browsers you need special configurations to make the
+browser use the operating system date format.
+
+By default the old input mechanism (using type=text inputs) is used.
+To enable native date input you need to set the config variable ::
+
+  use_browser_date_input = yes
+
+in section ``[web]`` in the ``config.ini`` file.
+ 
+If native date input is used, simple uses of the ``field()`` method will
+generate ``datetime-local`` inputs to allow selection of a date and time.
+Input fields for ``Date()`` properties will not have the ``(cal)`` link
+anymore. If fields should only use a date (without time) you can specify
+the parameter ``display_time=no`` in ``schema.py`` for a ``Date()``
+property (the default is ``yes``). This will use ``date`` inputs in the
+generated html to select a date only. If you need this only for a single
+date, the ``field()`` method now has a boolean parameter
+``display_time`` (which by default is set to the ``display_time``
+parameter of ``Date()``)
+
+Complex uses using a ``format`` specification in ``field()`` will not be
+upgraded and will operate like earlier Roundup versions. In addition the
+``format`` can now also be specified in the ``Date()`` constructor.
+
+To upgrade all date properties, there are five changes to make:
+
+  1. Configure ``use_browser_date_input = yes`` in section ``[web]`` in
+     ``config.ini``
+
+  2. Optionally add ``display_time = no`` in the schema for Date()
+     properties that should have no time displayed
+
+  3. Remove the format argument from field() calls on Date()
      properties.
 
-  3. Remove popcal() calls.
+  4. Remove popcal() calls.
+
+  5. Include datecopy.js in page.html.
 
-  4. Include datecopy.js in page.html.
+The ``display_time`` option
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-Use field_time() where needed
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+Both the ``Date()`` constructor and the ``field`` call take a
+``display_time`` option which by default is ``yes`` in the ``Date()``
+constructor and ``True`` in ``field``. The ``display_time`` setting of
+``Date()`` is inherited by the html property, so it doesn't need to be
+specified in each ``field()`` call for this property.
 
-The format used by ``field`` does not include hours, minutes or
-seconds. If your users need to enter times, you should change
-these calls to use ``field_time``. The arguments are the same as
-for field.
+When ``display_time`` is off, the date field does not include hours,
+minutes or seconds.
 
 Remove format argument
 ~~~~~~~~~~~~~~~~~~~~~~
 
-Speaking of arguments, avoid setting the date format if you want
-to use native date inputs. The date value needs a specific format
-for date or datetime-local inputs. If you include the `format`
-argument in the `field` method, it should be removed.
-
-The `field` method uses the format ``%Y-%m-%d``.  The
-``field_time`` method uses the format ``%Y-%m-%dT%H:%M:%S``. If
-you use these exact formats, Roundup will accept them and use a
-native date input.
-
-.. highlight:: text
-
-If you use an format that doesn't match, you will see a text
-input and a logged warning message like::
-
-  Format '%Y-%m' prevents use of modern date input.
-  Remove format from field() call in template test.item.
-  Using text input.
-
-.. highlight:: default
+Speaking of arguments, avoid setting the date ``format`` if you want to
+use native date inputs. If you include the `format` argument in the
+`field` method, it should be removed.
 
-The log message will appear if your logging level is set to
-WARNING or lower. (Refer to your tracker's :ref:`config.ini
-logging section <config-ini-section-logging>` for details on
-logging levels.)
-
-If you want to use a text input for a specific date format, you
-can add ``type="text"`` to the field() argument list to suppress
-the warning. By default using a format argument will show the
+By default using a format argument will show the
 popup calendar link. You can disable the link by setting
 ``popcal=False`` in the field() call. If you have::
 
@@ -301,38 +304,26 @@ popup calendar link. You can disable the link by setting
 changing it to::
 
   tal:content="structure python:context.duedate.field(
-               type='text',
                placeholder='YYYY-MM, format='%Y-%m',
                popcal=False)"
 
 will generate the input as in Roundup 2.4 or earlier without a
 popcal link.
 
-.. _revert_input_to_text:
-
-If you are using a path expression like::
-
-  tal:content="context/duedate/field"
-
-change it to::
-
-  tal:content="structure python:context.duedate.field(
-               type='text')"
-
-to get the input from before Roundup 2.5 with a popcal link.
-
 Remove popcal
 ~~~~~~~~~~~~~
 
-If you use the ``popcal()`` method directly in your templates, you
-can remove them. The browser's native date selection calendar can
+if you have enabled date input types in the configuration and you
+use the ``popcal()`` method directly in your templates, you
+should remove them. The browser's native date selection calendar should
 be used instead.
 
 Add copy/paste/edit on double-click using datecopy.js
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-There is no way to copy/paste using a native datetime-local or
-date input. With the datecopy.js file installed, double-clicking
+When using date input types,
+there is no way to copy/paste using a native ``datetime-local`` or
+``date`` input. With the ``datecopy.js`` file installed, double-clicking
 on the input turns it into a normal text input with the ability
 to copy, paste, or manually edit the date.
 
@@ -371,18 +362,19 @@ double-tap to activate text mode input. Firefox does not.
 Revert native number inputs for Number() and Integer() (optional)
 -----------------------------------------------------------------
 
-Roundup's field() method for properties of type Number() or
-Integer() now use a native browser number input.
+Roundup's ``field()`` method for properties of type ``Number()`` or
+``Integer()`` now use a native browser number input by default.
+
+This is configurable for *all* ``Number()`` and ``Integer()`` properties
+with the config option ``use_browser_number_input`` in section ``[web]``.
 
-You can use the old style text inputs by calling the field
-method with ``type="text"``. You can :ref:`follow the example
-for setting the text argument on a Date()
-property. <revert_input_to_text>` for details.
+You can use the old style text inputs for individual fields
+by calling the field method with ``type="text"``.
 
-Note that the Integer() type also uses ``step="1"`` by default to
+Note that the ``Integer()`` type also uses ``step="1"`` by default to
 add a stepper control and try to constrain the input to
 integers. This can be overridden by passing a new step
-(e.g. ``step="50"``) to the field() method.
+(e.g. ``step="50"``) to the ``field()`` method.
 
 Change in REST response for invalid CORS requests (info)
 --------------------------------------------------------
diff --git a/doc/user_guide.txt b/doc/user_guide.txt
index 7895ffb04..5b78d109e 100644
--- a/doc/user_guide.txt
+++ b/doc/user_guide.txt
@@ -132,7 +132,7 @@ Integer Properties
 
 These fields take a whole/integer number without decimal marker like
 ``123``, ``+123``, ``-123``. Exponents are not supported. Your browser
-may show an up/down arrow spinner to change the value. 
+may show an up/down arrow spinner to change the value.
 
 Boolean properties
 ~~~~~~~~~~~~~~~~~~
@@ -178,9 +178,11 @@ Classhelper`_ for details.
 Date properties
 ~~~~~~~~~~~~~~~
 
-Date properties are usually shown using a native HTML date
-element. This provides a calendar button for choosing the
-date. The date is shown in the normal format for your location.
+Date properties can be shown using a native HTML date (or
+datetime-local) element by setting ``use_browser_date_input=yes`` in
+section ``[web]`` in ``config.ini``. This provides a calendar button for
+choosing the date. The date is shown in the normal format for your
+location.
 
 Native date inputs do not allow the use of partial forms as
 defined below.  For this reason, you may edit a date/time
diff --git a/roundup/cgi/templating.py b/roundup/cgi/templating.py
index 46ee1afa6..8b57a40f6 100644
--- a/roundup/cgi/templating.py
+++ b/roundup/cgi/templating.py
@@ -2074,7 +2074,10 @@ def field(self, size=30, **kwargs):
         if value is None:
             value = ''
 
-        kwargs.setdefault("type", "number")
+        if self._client.db.config.WEB_USE_BROWSER_NUMBER_INPUT:
+            kwargs.setdefault("type", "number")
+        else:
+            kwargs.setdefault("type", "text")
         return self.input(name=self._formname, value=value, size=size,
                           **kwargs)
 
@@ -2113,11 +2116,13 @@ def field(self, size=30, **kwargs):
         if value is None:
             value = ''
 
-        kwargs.setdefault("type", "number")
-        if kwargs["type"] == "number":
+        if self._client.db.config.WEB_USE_BROWSER_NUMBER_INPUT:
+            kwargs.setdefault("type", "number")
+        else:
+            kwargs.setdefault("type", "text")
+        if kwargs['type'] == "number":
             kwargs.setdefault("step", "1")
-        return self.input(name=self._formname, value=value, size=size,
-                          **kwargs)
+        return self.input(name=self._formname, value=value, size=size, **kwargs)
 
     def __int__(self):
         """ Return an int of me
@@ -2213,7 +2218,7 @@ class DateHTMLProperty(HTMLProperty):
     _marker = ('HTMLPropertyMarker')
 
     def __init__(self, client, classname, nodeid, prop, name, value,
-                 anonymous=0, offset=None):
+                 anonymous=0, offset=None, display_time=None, format=None):
         HTMLProperty.__init__(self, client, classname, nodeid, prop, name,
                               value, anonymous=anonymous)
         if self._value and not is_us(self._value):
@@ -2221,6 +2226,10 @@ def __init__(self, client, classname, nodeid, prop, name, value,
         self._offset = offset
         if self._offset is None:
             self._offset = self._prop.offset(self._db)
+        self.display_time = display_time
+        if self.display_time is None:
+            self.display_time = self._prop.display_time
+        self.format = format or self._prop.format
 
     def plain(self, escape=0):
         """ Render a "plain" representation of the property
@@ -2266,71 +2275,51 @@ def now(self, str_interval=None):
                                 self._prop, self._formname, ret)
 
 
-    def field_time(self, size=30, default=None, format=_marker, popcal=None,
-                   **kwargs):
-
-        kwargs.setdefault("type", "datetime-local")
-        field = self.field(size=size, default=default, format=format,
-                           popcal=popcal, **kwargs)
-        return field
-
     def field(self, size=30, default=None, format=_marker, popcal=None,
-              **kwargs):
+              display_time=None, **kwargs):
         """Render a form edit field for the property
 
         If not editable, just display the value via plain().
 
+        If a format is specified or the use_browser_date_input config
+        option is set to 'no' we use a type="text" input. Otherwise we
+        use a type="date" or type="datetime-local" input depending on
+        the setting of display_time.
+
         If "popcal" then include the Javascript calendar editor.
-        Default=yes.
+        Default=yes for text input fields, otherwise no.
 
         The format string is a standard python strftime format string.
         """
+        if format is self._marker and self.format is not None:
+            format = self.format
         if not self.is_edit_ok():
             if format is self._marker:
                 return self.plain(escape=1)
             else:
                 return self.pretty(format)
 
-        kwargs.setdefault("type", "date")
-
-        if kwargs["type"] in ["date", "datetime-local"]:
-            acceptable_formats = {
-                "date": "%Y-%m-%d",
-                "datetime-local": "%Y-%m-%dT%H:%M:%S"
-            }
-
-            if format is not self._marker:  # user set format
-                if format != acceptable_formats[kwargs["type"]]:
-                    # format is incompatible with date type
-                    kwargs['type'] = "text"
-                    if popcal is not False:
-                        popcal = True
-                    logger.warning(self._(
-                        "Format '%(format)s' prevents use of modern "
-                        "date input. Remove format from field() call in "
-                        "template %(class)s.%(template)s. "
-                        "Using text input.") % {
-                            "format": format,
-                            "class": self._client.classname,
-                            "template": self._client.template
-                        })
-
-                    """
-                    raise ValueError(self._(
-                        "When using input type of '%(field_type)s', the "
-                        "format must not be set, or must be "
-                        "'%(format_string)s' to match RFC3339 date "
-                        "or date-time. Current format is '%(format)s'.") % {
-                            "field_type": kwargs["type"],
-                            "format_string":
-                            acceptable_formats[kwargs["type"]],
-                            "format": format,
-                      })"""
+        if display_time is None:
+            display_time = self.display_time
+        use_date = self._client.db.config.WEB_USE_BROWSER_DATE_INPUT
+
+        # https://developer.mozilla.org/en-US/docs/Web/HTML/Date_and_time_formats#local_date_and_time_strings
+        if format is not self._marker or not use_date:
+            kwargs ['type'] = "text"
+            # popcal is None by default, only when explicitly turned off
+            # do we use no popcal
+            popcal = popcal != False
+            # emulate display_time with old-style input
+            if not display_time and format is self._marker:
+                format = '%Y-%m-%d'
+        else:
+            if display_time:
+                kwargs ['type'] = "datetime-local"
+                format = '%Y-%m-%dT%H:%M:%S'
             else:
-                # https://developer.mozilla.org/en-US/docs/Web/HTML/Date_and_time_formats#local_date_and_time_strings
-                # match date-time format in
-                # https://www.rfc-editor.org/rfc/rfc3339
-                format = acceptable_formats[kwargs['type']]
+                kwargs ['type'] = "date"
+                format = '%Y-%m-%d'
+            popcal = False
 
         value = self._value
 
diff --git a/roundup/configuration.py b/roundup/configuration.py
index ad628ba0f..c37021d32 100644
--- a/roundup/configuration.py
+++ b/roundup/configuration.py
@@ -1459,6 +1459,20 @@ def str2value(self, value):
             "the secret. JWT support is experimental and disabled by\n"
             "default. The secrets must be persistent across\n"
             "application restarts.\n"),
+        (BooleanOption, "use_browser_date_input", "no",
+            "HTML input elements for Date properties: This determines\n"
+            "if we use the input type 'datetime-local' (or 'date') for\n"
+            "date input fields. If the option is turned off (the default),\n"
+            "the type is set to 'text'. Since the widgets generated by\n"
+            "browsers determine the date format from the language\n"
+            "setting (it is currently not possible to force the\n"
+            "international date format server-side) and some browsers\n"
+            "ignore the date format set by the operating system, the\n"
+            "default is 'no'."),
+        (BooleanOption, "use_browser_number_input", "yes",
+            "HTML input elements for Number properties: This determines\n"
+            "if we use the input type 'number' for Number (and Integer)\n"
+            "properties. If set to 'no' we use input type 'text'."),
     )),
     ("rdbms", (
         (DatabaseBackend, 'backend', NODEFAULT,
diff --git a/roundup/hyperdb.py b/roundup/hyperdb.py
index 55c2b4cba..2426498c0 100644
--- a/roundup/hyperdb.py
+++ b/roundup/hyperdb.py
@@ -128,13 +128,19 @@ def sort_repr(self, cls, val, name):
 
 
 class Date(_Type):
-    """An object designating a Date property."""
+    """An object designating a Date property.
+       The display_time parameter specifies if we want date and time or
+       date only. Both display_time and format are defaults for the
+       field method of the DateHTMLProperty (for rendering html).
+    """
     def __init__(self, offset=None, required=False, default_value=None,
-                 quiet=False):
+                 quiet=False, display_time='yes', format=None):
         super(Date, self).__init__(required=required,
                                    default_value=default_value,
                                    quiet=quiet)
         self._offset = offset
+        self.display_time = display_time == 'yes'
+        self.format = format
 
     def offset(self, db):
         if self._offset is not None:
diff --git a/test/test_templating.py b/test/test_templating.py
index b7b4c03d7..72f886d4c 100644
--- a/test/test_templating.py
+++ b/test/test_templating.py
@@ -47,6 +47,13 @@
 
 from roundup.backends.sessions_common import SessionCommon
 
+class MockConfig(dict):
+    def __getattr__(self, name):
+        try:
+            return self[name]
+        except KeyError as err:
+            raise AttributeError(err)
+
 class MockDatabase(MockNull, SessionCommon):
     def getclass(self, name):
         # limit class names
@@ -95,7 +102,9 @@ def setUp(self):
         # add client props for testing anti_csrf_nonce
         self.client.session_api = MockNull(_sid="1234567890")
         self.client.db.getuid = lambda : 10
-        self.client.db.config = {'WEB_CSRF_TOKEN_LIFETIME': 10, 'MARKDOWN_BREAK_ON_NEWLINE': False }
+        self.client.db.config = MockConfig (
+            {'WEB_CSRF_TOKEN_LIFETIME': 10,
+             'MARKDOWN_BREAK_ON_NEWLINE': False })
 
 class HTMLDatabaseTestCase(TemplatingTestCase):
     def test_HTMLDatabase___getitem__(self):
@@ -350,12 +359,17 @@ def test_number_field(self):
         # test with number
         p = NumberHTMLProperty(self.client, 'testnum', '1', None, 'test',
                                2345678.2345678)
+        self.client.db.config['WEB_USE_BROWSER_NUMBER_INPUT'] = False
+        self.assertEqual(p.field(),
+                         ('<input id="testnum1@test" name="testnum1@test" '
+                         'size="30" type="text" value="%s">')%expected_val)
+        self.client.db.config['WEB_USE_BROWSER_NUMBER_INPUT'] = True
         self.assertEqual(p.field(),
-                         ('<input id="testnum1@test" name="testnum1@test" size="30" type="number" '
-                         'value="%s">')%expected_val)
+                         ('<input id="testnum1@test" name="testnum1@test" '
+                         'size="30" type="number" value="%s">')%expected_val)
         self.assertEqual(p.field(size=10),
-                         ('<input id="testnum1@test" name="testnum1@test" size="10" type="number" '
-                         'value="%s">')%expected_val)
+                         ('<input id="testnum1@test" name="testnum1@test" '
+                         'size="10" type="number" value="%s">')%expected_val)
         self.assertEqual(p.field(size=10, dataprop="foo", dataprop2=5),
                          ('<input dataprop="foo" dataprop2="5" '
                           'id="testnum1@test" name="testnum1@test" '
@@ -880,9 +894,20 @@ def tearDown(self):
         self.client.db.close()
         memorydb.db_nuke('')
 
+    def exp_classhelp(self, cls='issue', prop='deadline', dlm='.'):
+        value = dlm.join (('2021-01-01', '11:22:10'))
+        return ('<a class="classhelp" data-calurl="%(cls)s?'
+        '@template=calendar&amp;amp;property=%(prop)s&amp;amp;'
+        'form=itemSynopsis&amp;date=%(value)s" '
+        'data-height="200" data-width="300" href="javascript:help_window'
+        '(\'%(cls)s?@template=calendar&amp;property=%(prop)s&amp;'
+        'form=itemSynopsis&date=%(value)s\', 300, 200)">(cal)</a>'
+        ) % {'cls': cls, 'prop': prop, 'value': value}
+
     def test_DateHTMLWithDate(self):
         """Test methods when DateHTMLProperty._value is a hyperdb.Date()
         """
+        self.client.db.config['WEB_USE_BROWSER_DATE_INPUT'] = True
         test_datestring = self.test_datestring
         test_Date = self.client.db.issue.get("1", 'deadline')
         test_hyperdbDate = self.client.db.issue.getprops("1")['deadline']
@@ -901,59 +926,28 @@ def test_DateHTMLWithDate(self):
         self.assertEqual(d.plain(), "2021-01-01.13:22:10")
         self.assertEqual(d.local("-4").plain(), "2021-01-01.07:22:10")
         input_expected = """<input id="issue1@deadline" name="issue1@deadline" size="30" type="date" value="2021-01-01">"""
-        self.assertEqual(d.field(), input_expected)
-        self.assertEqual(d.field_time(type="date"), input_expected)
+        self.assertEqual(d.field(display_time=False), input_expected)
 
-        input_expected = """<input id="issue1@deadline" name="issue1@deadline" size="30" type="datetime-local" value="2021-01-01T13:22:10">"""
-        self.assertEqual(d.field(type="datetime-local"), input_expected)
-        self.assertEqual(d.field_time(), input_expected)
+        input_expected = '<input id="issue1@deadline" name="issue1@deadline" '\
+            'size="30" type="datetime-local" value="2021-01-01T13:22:10">'
+        self.assertEqual(d.field(), input_expected)
 
-        input_expected = """<input id="issue1@deadline" name="issue1@deadline" size="30" type="text" value="2021-01-01.13:22:10">"""
-        self.assertEqual(d.field(type="text"), input_expected)
-        self.assertEqual(d.field_time(type="text"), input_expected)
+        input_expected = '<input id="issue1@deadline" name="issue1@deadline" '\
+            'size="30" type="text" value="2021-01-01.13:22:10">'
+        field = d.field(format='%Y-%m-%d.%H:%M:%S', popcal=False)
+        self.assertEqual(field, input_expected)
 
         # test with format
-        input_expected = """<input id="issue1@deadline" name="issue1@deadline" size="30" type="text" value="2021-01"><a class="classhelp" data-calurl="issue?@template=calendar&amp;amp;property=deadline&amp;amp;form=itemSynopsis&amp;date=2021-01-01.11:22:10" data-height="200" data-width="300" href="javascript:help_window(\'issue?@template=calendar&amp;property=deadline&amp;form=itemSynopsis&date=2021-01-01.11:22:10\', 300, 200)">(cal)</a>"""
-
-        self._caplog.clear()
-        with self._caplog.at_level(logging.WARNING,
-                                   logger="roundup"):
-            input = d.field(format="%Y-%m")
-        self.assertEqual(input_expected, input)
-
-        # name used for logging
-        log_expected = """Format '%Y-%m' prevents use of modern date input. Remove format from field() call in template issue.item. Using text input."""
-        self.assertEqual(self._caplog.record_tuples[0][2], log_expected)
-        # severity ERROR = 40
-        self.assertEqual(self._caplog.record_tuples[0][1], 30,
-                        msg="logging level != 30 (WARNING)")
-
-        # test with format and popcal=None
-        input_expected = """<input id="issue1@deadline" name="issue1@deadline" size="30" type="text" value="2021-01">"""
-
-        self._caplog.clear()
-        with self._caplog.at_level(logging.WARNING,
-                                   logger="roundup"):
-            input = d.field(format="%Y-%m", popcal=False)
-        self.assertEqual(input_expected, input)
-
-        # name used for logging
-        log_expected = """Format '%Y-%m' prevents use of modern date input. Remove format from field() call in template issue.item. Using text input."""
-        self.assertEqual(self._caplog.record_tuples[0][2], log_expected)
-        # severity ERROR = 40
-        self.assertEqual(self._caplog.record_tuples[0][1], 30,
-                        msg="logging level != 30 (WARNING)")
-
-        # test with format, type=text and popcal=None
-        input_expected = """<input id="issue1@deadline" name="issue1@deadline" size="30" type="text" value="2021-01">"""
-
-        self._caplog.clear()
-        with self._caplog.at_level(logging.WARNING,
-                                   logger="roundup"):
-            input = d.field(type="text", format="%Y-%m", popcal=False )
-        self.assertEqual(input_expected, input)
-
-        self.assertEqual(self._caplog.records, [])
+        input_expected = '<input id="issue1@deadline" name="issue1@deadline" '\
+            'size="30" type="text" value="2021-01">' + self.exp_classhelp()
+
+        self.assertEqual(d.field(format="%Y-%m"), input_expected)
+
+        input_expected = '<input id="issue1@deadline" name="issue1@deadline" '\
+            'size="30" type="text" value="2021-01">'
+
+        input = d.field(format="%Y-%m", popcal=False)
+        self.assertEqual(input, input_expected)
 
     def test_DateHTMLWithText(self):
         """Test methods when DateHTMLProperty._value is a string
@@ -964,6 +958,7 @@ def test_DateHTMLWithText(self):
 
         self.form.list.append(MiniFieldStorage("test1@test", test_datestring))
         self.client._props=test_date
+        self.client.db.config['WEB_USE_BROWSER_DATE_INPUT'] = False
 
         self.client.db.classes = dict \
             ( test = MockNull(getprops = lambda : test_date)
@@ -979,60 +974,40 @@ def test_DateHTMLWithText(self):
         self.assertIs(type(d._value), str)
         self.assertEqual(d.pretty(), "2021-01-01 11:22:10")
         self.assertEqual(d.plain(), "2021-01-01 11:22:10")
-        input = """<input id="test1@test" name="test1@test" size="30" type="date" value="2021-01-01 11:22:10">"""
-        self.assertEqual(d.field(), input)
-
-
-        input_expected = """<input id="test1@test" name="test1@test" size="40" type="date" value="2021-01-01 11:22:10">"""
-        self.assertEqual(d.field(size=40), input_expected)
-
-        input_expected = """<input id="test1@test" name="test1@test" size="30" type="text" value="2021-01-01 11:22:10"><a class="classhelp" data-calurl="test?@template=calendar&amp;amp;property=test&amp;amp;form=itemSynopsis&amp;date=2021-01-01 11:22:10" data-height="200" data-width="300" href="javascript:help_window(\'test?@template=calendar&amp;property=test&amp;form=itemSynopsis&date=2021-01-01 11:22:10\', 300, 200)">(cal)</a>"""
-        with self._caplog.at_level(logging.WARNING,
-                                   logger="roundup"):
-            input = d.field(format="%Y-%m")
-        self.assertEqual(input_expected, input)
-
-        # name used for logging
-        log_expected = """Format '%Y-%m' prevents use of modern date input. Remove format from field() call in template test.item. Using text input."""
-        self.assertEqual(self._caplog.record_tuples[0][2], log_expected)
-        # severity ERROR = 40
-        self.assertEqual(self._caplog.record_tuples[0][1], 30,
-                        msg="logging level != 30 (WARNING)")
-
-        """with self.assertRaises(ValueError) as e:
-            d.field(format="%Y-%m")
-        self.assertIn("'%Y-%m'", e.exception.args[0])
-        self.assertIn("'date'", e.exception.args[0])"""
-
-
-        # format matches rfc format, so this should pass
-        result = d.field(format="%Y-%m-%d")
-        input_expected = """<input id="test1@test" name="test1@test" size="30" type="date" value="2021-01-01 11:22:10">"""
+        input_expected = '<input id="test1@test" name="test1@test" size="30" '\
+            'type="text" value="2021-01-01 11:22:10">'
+        self.assertEqual(d.field(popcal=False), input_expected)
+        self.client.db.config['WEB_USE_BROWSER_DATE_INPUT'] = True
+        input_expected = '<input id="test1@test" name="test1@test" size="30" '\
+            'type="datetime-local" value="2021-01-01 11:22:10">'
+        self.assertEqual(d.field(), input_expected)
+        self.client.db.config['WEB_USE_BROWSER_DATE_INPUT'] = False
+
+        input_expected = '<input id="test1@test" name="test1@test" size="40" '\
+            'type="text" value="2021-01-01 11:22:10">'
+        self.assertEqual(d.field(size=40, popcal=False), input_expected)
+
+        input_expected = ('<input id="test1@test" name="test1@test" size="30" '
+            'type="text" value="2021-01-01 11:22:10">'
+            + self.exp_classhelp(cls='test', prop='test', dlm=' '))
+        self.maxDiff=None
+        self.assertEqual(d.field(format="%Y-%m"), input_expected)
+
+        # format always uses type="text" even when date input is set
+        self.client.db.config['WEB_USE_BROWSER_DATE_INPUT'] = True
+        result = d.field(format="%Y-%m-%d", popcal=False)
+        input_expected = '<input id="test1@test" name="test1@test" size="30" '\
+            'type="text" value="2021-01-01 11:22:10">'
         self.assertEqual(result, input_expected)
 
-        input_expected = """<input id="test1@test" name="test1@test" size="30" type="text" value="2021-01-01 11:22:10"><a class="classhelp" data-calurl="test?@template=calendar&amp;amp;property=test&amp;amp;form=itemSynopsis&amp;date=2021-01-01 11:22:10" data-height="200" data-width="300" href="javascript:help_window(\'test?@template=calendar&amp;property=test&amp;form=itemSynopsis&date=2021-01-01 11:22:10\', 300, 200)">(cal)</a>"""
-        with self._caplog.at_level(logging.WARNING,
-                                   logger="roundup"):
-            input = d.field(format="%Y-%m", type="datetime-local")
-        self.assertEqual(input_expected, input)
-
-        # name used for logging
-        log_expected = """Format '%Y-%m' prevents use of modern date input. Remove format from field() call in template test.item. Using text input."""
-        self.assertEqual(self._caplog.record_tuples[0][2], log_expected)
-        # severity ERROR = 40
-        self.assertEqual(self._caplog.record_tuples[0][1], 30,
-                        msg="logging level != 30 (WARNING)")
-
-        """
-        with self.assertRaises(ValueError) as e:
-            d.field(format="%Y-%m", type="datetime-local")
-        self.assertIn("'%Y-%m'", e.exception.args[0])
-        self.assertIn("'datetime-local'", e.exception.args[0])
-        """
+        input_expected = ('<input id="test1@test" name="test1@test" size="30" '
+            'type="text" value="2021-01-01 11:22:10">'
+            + self.exp_classhelp(cls='test', prop='test', dlm=' '))
+        self.assertEqual(d.field(format="%Y-%m"), input_expected)
 
-        # format matches rfc, so this should pass
-        result = d.field(type="datetime-local", format="%Y-%m-%dT%H:%M:%S")
-        input_expected = """<input id="test1@test" name="test1@test" size="30" type="datetime-local" value="2021-01-01 11:22:10">"""
+        result = d.field(format="%Y-%m-%dT%H:%M:%S", popcal=False)
+        input_expected = '<input id="test1@test" name="test1@test" size="30" '\
+            'type="text" value="2021-01-01 11:22:10">'
         self.assertEqual(result, input_expected)
 
 # common markdown test cases

From b7167fef649c8f5721b3368c3e728291f8e5ac10 Mon Sep 17 00:00:00 2001
From: Ralf Schlatterbeck <rsc@runtux.com>
Date: Wed, 19 Feb 2025 12:50:07 +0100
Subject: [PATCH 161/398] Add "form" parameter for Date field method

Allow the specification of a "form" parameter for Date fields to make
the popup calendar work when the enclosing form has a name different
from "itemSynopsis".
---
 CHANGES.txt               | 3 +++
 doc/reference.txt         | 5 +++++
 roundup/cgi/templating.py | 6 +++---
 3 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index 48a2b43ca..c863bb6ac 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -89,6 +89,9 @@ Fixed:
   <pidfile> is used without -l <logfile>. Added code to report
   the issue. Added issue with relative paths for log file whn
   using -L and -d with roundup-server. (John Rouillard)
+- Allow the specification of a "form" parameter for Date fields to make
+  the popup calendar work when the enclosing form has a name different
+  from "itemSynopsis".
 
 Features:
 
diff --git a/doc/reference.txt b/doc/reference.txt
index e857b9772..67ad999de 100644
--- a/doc/reference.txt
+++ b/doc/reference.txt
@@ -3076,6 +3076,11 @@ There are several methods available on these wrapper objects:
                 date and time for Date properties. You can set this to
                 False for displaying only the date.
 
+              form (Date properties only)
+                When using a popup calendar (see popcal below) and the
+                enclosing form name is different from "itemSynopsis",
+                the form name must be specified for the field.
+
 	      format (Date properties only)
                 Sets the format of the date in the field - uses the
 		same format string argument as supplied to the
diff --git a/roundup/cgi/templating.py b/roundup/cgi/templating.py
index 8b57a40f6..1b4e39323 100644
--- a/roundup/cgi/templating.py
+++ b/roundup/cgi/templating.py
@@ -2276,7 +2276,7 @@ def now(self, str_interval=None):
 
 
     def field(self, size=30, default=None, format=_marker, popcal=None,
-              display_time=None, **kwargs):
+              display_time=None, form='itemSynopsis', **kwargs):
         """Render a form edit field for the property
 
         If not editable, just display the value via plain().
@@ -2344,7 +2344,7 @@ def field(self, size=30, default=None, format=_marker, popcal=None,
             s = self.input(name=self._formname, value=value, size=size,
                            **kwargs)
             if popcal:
-                s += self.popcal()
+                s += self.popcal(form=form)
             return s
         else:
             raw_value = value
@@ -2368,7 +2368,7 @@ def field(self, size=30, default=None, format=_marker, popcal=None,
         s = self.input(name=self._formname, value=value, size=size,
                        **kwargs)
         if popcal:
-            s += self.popcal()
+            s += self.popcal(form=form)
         return s
 
     def reldate(self, pretty=1):

From e813e6ebfdc3ab01b1c3cb4b0d1ce3e87afc73fc Mon Sep 17 00:00:00 2001
From: Ralf Schlatterbeck <rsc@runtux.com>
Date: Wed, 26 Feb 2025 11:24:13 +0100
Subject: [PATCH 162/398] issue2551376: Fix tracebacks in item templates

---
 CHANGES.txt                         |  3 +-
 roundup/backends/back_postgresql.py | 43 +++++++++++++++++++++++++++--
 roundup/backends/rdbms_common.py    |  9 +++++-
 roundup/cgi/templating.py           | 11 +++++---
 4 files changed, 57 insertions(+), 9 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index c863bb6ac..c40407dc9 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -91,7 +91,8 @@ Fixed:
   using -L and -d with roundup-server. (John Rouillard)
 - Allow the specification of a "form" parameter for Date fields to make
   the popup calendar work when the enclosing form has a name different
-  from "itemSynopsis".
+  from "itemSynopsis". (Ralf Schlatterbeck)
+- issue2551376: Fix tracebacks in item templates (Ralf Schlatterbeck)
 
 Features:
 
diff --git a/roundup/backends/back_postgresql.py b/roundup/backends/back_postgresql.py
index 4aa71edfd..cd015396f 100644
--- a/roundup/backends/back_postgresql.py
+++ b/roundup/backends/back_postgresql.py
@@ -116,7 +116,7 @@ def get_database_schema_names(config):
         #
         # Database name is any character sequence not including a " or
         # whitespace. Arguably both are allowed by:
-        # 
+        #
         #  https://www.postgresql.org/docs/current/sql-syntax-lexical.html#SQL-SYNTAX-IDENTIFIERS
         #
         # with suitable quoting but ... really.
@@ -170,7 +170,7 @@ def get_database_user_name(config):
         #
         # Database name is any character sequence not including a " or
         # whitespace. Arguably both are allowed by:
-        # 
+        #
         #  https://www.postgresql.org/docs/current/sql-syntax-lexical.html#SQL-SYNTAX-IDENTIFIERS
         #
         # with suitable quoting but ... really.
@@ -560,6 +560,16 @@ def clear(self):
             self.cursor.execute('DROP SEQUENCE _%s_ids' % cn)
             self.cursor.execute('CREATE SEQUENCE _%s_ids' % cn)
 
+    def getnode (self, classname, nodeid, fetch_multilinks=True):
+        """ For use of savepoint see 'Class' below """
+        self.sql('savepoint sp')
+        try:
+            getnode = rdbms_common.Database.getnode
+            return getnode(self, classname, nodeid, fetch_multilinks)
+        except psycopg2.errors.DataError as err:
+            self.sql('rollback to savepoint sp')
+            raise hyperdb.HyperdbValueError(str (err).split('\n')[0])
+
 
 class PostgresqlClass:
     order_by_null_values = '(%s is not NULL)'
@@ -567,7 +577,34 @@ class PostgresqlClass:
 
 
 class Class(PostgresqlClass, rdbms_common.Class):
-    pass
+    """ We re-raise database-specific data errors as HyperdbValueError
+        Note that we re-use the savepoint so that at most one savepoint
+        is used.
+    """
+
+    def filter(self, *args, **kw):
+        self.db.sql('savepoint sp')
+        try:
+            return rdbms_common.Class.filter(self, *args, **kw)
+        except psycopg2.errors.DataError as err:
+            self.db.sql('rollback to savepoint sp')
+            raise hyperdb.HyperdbValueError(str (err).split('\n')[0])
+
+    def filter_iter(self, *args, **kw):
+        self.db.sql('savepoint sp')
+        try:
+            return rdbms_common.Class.filter_iter(self, *args, **kw)
+        except psycopg2.errors.DataError as err:
+            self.db.sql('rollback to savepoint sp')
+            raise hyperdb.HyperdbValueError(str (err).split('\n')[0])
+
+    def is_retired(self, nodeid):
+        self.db.sql('savepoint sp')
+        try:
+            return rdbms_common.Class.is_retired(self, nodeid)
+        except psycopg2.errors.DataError as err:
+            self.db.sql('rollback to savepoint sp')
+            raise hyperdb.HyperdbValueError (str (err).split('\n')[0])
 
 
 class IssueClass(PostgresqlClass, rdbms_common.IssueClass):
diff --git a/roundup/backends/rdbms_common.py b/roundup/backends/rdbms_common.py
index d2360be96..cb7913803 100644
--- a/roundup/backends/rdbms_common.py
+++ b/roundup/backends/rdbms_common.py
@@ -2248,8 +2248,15 @@ def restore(self, nodeid):
         self.fireReactors('restore', nodeid, None)
 
     def is_retired(self, nodeid):
-        """Return true if the node is rerired
+        """Return true if the node is retired
         """
+        # Do not produce invalid sql, the id must be numeric
+        try:
+            id = int(nodeid)
+        except ValueError:
+            raise hyperdb.HyperdbValueError(_(
+                'class %(cls)s: %(value)r is not an id')
+                % {'cls': self.classname, 'value': nodeid})
         sql = 'select __retired__ from _%s where id=%s' % (self.classname,
                                                            self.db.arg)
         self.db.sql(sql, (nodeid,))
diff --git a/roundup/cgi/templating.py b/roundup/cgi/templating.py
index 1b4e39323..238848b90 100644
--- a/roundup/cgi/templating.py
+++ b/roundup/cgi/templating.py
@@ -1122,7 +1122,7 @@ def __getitem__(self, item):
         try:
             if int(self._nodeid) > 0:
                 value = self._klass.get(self._nodeid, items[0], None)
-        except ValueError:
+        except (IndexError, ValueError):
             value = self._nodeid
         if value is None:
             if isinstance(prop, hyperdb.Multilink):
@@ -2573,9 +2573,9 @@ def field(self, showid=0, size=None, **kwargs):
             if k and num_re.match(self._value):
                 try:
                     value = linkcl.get(self._value, k)
-                except IndexError:
+                except (IndexError, hyperdb.HyperdbValueError) as err:
                     if idparse:
-                        raise
+                        self._client.add_error_message(str(err))
                     value = ''
             else:
                 value = self._value
@@ -2880,7 +2880,10 @@ def field(self, size=30, showid=0, **kwargs):
                 showid = 1
             if not showid:
                 k = linkcl.labelprop(1)
-                value = lookupKeys(linkcl, k, value)
+                try:
+                    value = lookupKeys(linkcl, k, value)
+                except (ValueError, IndexError) as err:
+                    self._client.add_error_message (str(err))
             value = ','.join(value)
             kwargs["value"] = value
 

From 44dfa19064fda0b15cc6b05946efa49fca70bdc6 Mon Sep 17 00:00:00 2001
From: Ralf Schlatterbeck <rsc@runtux.com>
Date: Thu, 27 Feb 2025 10:05:38 +0100
Subject: [PATCH 163/398] Fix filter_iter so that exception is caught

---
 roundup/backends/back_postgresql.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/roundup/backends/back_postgresql.py b/roundup/backends/back_postgresql.py
index cd015396f..b92b45db1 100644
--- a/roundup/backends/back_postgresql.py
+++ b/roundup/backends/back_postgresql.py
@@ -593,7 +593,8 @@ def filter(self, *args, **kw):
     def filter_iter(self, *args, **kw):
         self.db.sql('savepoint sp')
         try:
-            return rdbms_common.Class.filter_iter(self, *args, **kw)
+            for v in rdbms_common.Class.filter_iter(self, *args, **kw):
+                yield v
         except psycopg2.errors.DataError as err:
             self.db.sql('rollback to savepoint sp')
             raise hyperdb.HyperdbValueError(str (err).split('\n')[0])

From 02b65d79ba1734d92afd6eac2cc1e007199617dc Mon Sep 17 00:00:00 2001
From: Ralf Schlatterbeck <rsc@runtux.com>
Date: Sat, 1 Mar 2025 13:08:09 +0100
Subject: [PATCH 164/398] Factor common code to hyperdb/roundupdb

There was some common copied code in backends/back_anydbm.py and
backends/rdbms_common.py. This is now moved to hyperdb.py and
roundupdb.py, respectively (the FileClass lives in hyperdb.py while the
IssueClass is in roundupdb.py)
---
 roundup/backends/back_anydbm.py  | 169 ++----------------------------
 roundup/backends/rdbms_common.py | 171 ++-----------------------------
 roundup/hyperdb.py               | 160 +++++++++++++++++++++++++++--
 roundup/roundupdb.py             |  23 ++++-
 4 files changed, 193 insertions(+), 330 deletions(-)

diff --git a/roundup/backends/back_anydbm.py b/roundup/backends/back_anydbm.py
index da9cbf321..d5dad6af6 100644
--- a/roundup/backends/back_anydbm.py
+++ b/roundup/backends/back_anydbm.py
@@ -31,7 +31,7 @@
 import time
 
 from roundup.anypy.dbm_ import anydbm, whichdb
-from roundup.anypy.strings import b2s, bs2b, repr_export, eval_import, is_us
+from roundup.anypy.strings import b2s, repr_export, eval_import, is_us
 
 from roundup import hyperdb, date, password, roundupdb, security, support
 from roundup.mlink_expr import Expression, ExpressionError
@@ -48,8 +48,6 @@
 
 from roundup.backends.indexer_common import get_indexer
 
-from hashlib import md5
-
 
 def db_exists(config):
     # check for the user db
@@ -2221,168 +2219,19 @@ def export_journals(self):
 
 
 class FileClass(hyperdb.FileClass, Class):
-    """This class defines a large chunk of data. To support this, it has a
-       mandatory String property "content" which is typically saved off
-       externally to the hyperdb.
-
-       The default MIME type of this data is defined by the
-       "default_mime_type" class attribute, which may be overridden by each
-       node if the class defines a "type" String property.
-    """
+    # Use for explicit upcalls in generic code, for py2 compat we cannot
+    # use super() without making everything a new-style class.
+    subclass = Class
     def __init__(self, db, classname, **properties):
-        """The newly-created class automatically includes the "content"
-        and "type" properties.
-        """
-        if 'content' not in properties:
-            properties['content'] = hyperdb.String(indexme='yes')
-        if 'type' not in properties:
-            properties['type'] = hyperdb.String()
+        self._update_properties(properties)
         Class.__init__(self, db, classname, **properties)
 
-    def create(self, **propvalues):
-        """ Snarf the "content" propvalue and store in a file
-        """
-        # we need to fire the auditors now, or the content property won't
-        # be in propvalues for the auditors to play with
-        self.fireAuditors('create', None, propvalues)
-
-        # now remove the content property so it's not stored in the db
-        content = propvalues['content']
-        del propvalues['content']
-
-        # make sure we have a MIME type
-        mime_type = propvalues.get('type', self.default_mime_type)
-
-        # do the database create
-        newid = self.create_inner(**propvalues)
-
-        # store off the content as a file
-        self.db.storefile(self.classname, newid, None, bs2b(content))
-
-        # fire reactors
-        self.fireReactors('create', newid, None)
-
-        return newid
-
-    def get(self, nodeid, propname, default=_marker, cache=1):
-        """ Trap the content propname and get it from the file
-
-        'cache' exists for backwards compatibility, and is not used.
-        """
-        poss_msg = 'Possibly an access right configuration problem.'
-        if propname == 'content':
-            try:
-                return b2s(self.db.getfile(self.classname, nodeid, None))
-            except IOError as strerror:
-                # XXX by catching this we don't see an error in the log.
-                return 'ERROR reading file: %s%s\n%s\n%s' % (
-                        self.classname, nodeid, poss_msg, strerror)
-            except UnicodeDecodeError as e:
-                # if content is not text (e.g. jpeg file) we get
-                # unicode error trying to convert to string in python 3.
-                # trap it and supply an error message. Include md5sum
-                # of content as this string is included in the etag
-                # calculation of the object.
-                return ('%s%s is not text, retrieve using '
-                        'binary_content property. mdsum: %s') % (
-                            self.classname, nodeid,
-                            md5(self.db.getfile(
-                                self.classname, nodeid, None)).hexdigest())  # nosec - bandit md5 use ok
-        elif propname == 'binary_content':
-            return self.db.getfile(self.classname, nodeid, None)
-
-        if default is not _marker:
-            return Class.get(self, nodeid, propname, default)
-        else:
-            return Class.get(self, nodeid, propname)
-
-    def set(self, itemid, **propvalues):
-        """ Snarf the "content" propvalue and update it in a file
-        """
-        self.fireAuditors('set', itemid, propvalues)
-
-        # create the oldvalues dict - fill in any missing values
-        oldvalues = copy.deepcopy(self.db.getnode(self.classname, itemid))
-        for name, prop in self.getprops(protected=0).items():
-            if name in oldvalues:
-                continue
-            if isinstance(prop, hyperdb.Multilink):
-                oldvalues[name] = []
-            else:
-                oldvalues[name] = None
-
-        # now remove the content property so it's not stored in the db
-        content = None
-        if 'content' in propvalues:
-            content = propvalues['content']
-            del propvalues['content']
-
-        # do the database update
-        propvalues = self.set_inner(itemid, **propvalues)
-
-        # do content?
-        if content:
-            # store and possibly index
-            self.db.storefile(self.classname, itemid, None, bs2b(content))
-            if self.properties['content'].indexme:
-                index_content = content
-                if bytes != str and isinstance(content, bytes):
-                    index_content = content.decode('utf-8', errors='ignore')
-                mime_type = self.get(itemid, 'type', self.default_mime_type)
-                self.db.indexer.add_text((self.classname, itemid, 'content'),
-                                         index_content, mime_type)
-            propvalues['content'] = content
-
-        # fire reactors
-        self.fireReactors('set', itemid, oldvalues)
-        return propvalues
-
-    def index(self, nodeid):
-        """ Add (or refresh) the node to search indexes.
-
-        Use the content-type property for the content property.
-        """
-        # find all the String properties that have indexme
-        for prop, propclass in self.getprops().items():
-            if prop == 'content' and propclass.indexme:
-                mime_type = self.get(nodeid, 'type', self.default_mime_type)
-                index_content = self.get(nodeid, 'binary_content')
-                if bytes != str and isinstance(index_content, bytes):
-                    index_content = index_content.decode('utf-8',
-                                                         errors='ignore')
-                self.db.indexer.add_text((self.classname, nodeid, 'content'),
-                                         index_content, mime_type)
-            elif isinstance(propclass, hyperdb.String) and propclass.indexme:
-                # index them under (classname, nodeid, property)
-                try:
-                    value = str(self.get(nodeid, prop))
-                except IndexError:
-                    # node has been destroyed
-                    continue
-                self.db.indexer.add_text((self.classname, nodeid, prop), value)
-
-
-# deviation from spec - was called ItemClass
 class IssueClass(Class, roundupdb.IssueClass):
-    # Overridden methods:
+    # Use for explicit upcalls in generic code, for py2 compat we cannot
+    # use super() without making everything a new-style class.
+    subclass = Class
     def __init__(self, db, classname, **properties):
-        """The newly-created class automatically includes the "messages",
-        "files", "nosy", and "superseder" properties.  If the 'properties'
-        dictionary attempts to specify any of these properties or a
-        "creation" or "activity" property, a ValueError is raised.
-        """
-        if 'title' not in properties:
-            properties['title'] = hyperdb.String(indexme='yes')
-        if 'messages' not in properties:
-            properties['messages'] = hyperdb.Multilink("msg")
-        if 'files' not in properties:
-            properties['files'] = hyperdb.Multilink("file")
-        if 'nosy' not in properties:
-            # note: journalling is turned off as it really just wastes
-            # space. this behaviour may be overridden in an instance
-            properties['nosy'] = hyperdb.Multilink("user", do_journal="no")
-        if 'superseder' not in properties:
-            properties['superseder'] = hyperdb.Multilink(classname)
+        self._update_properties(classname, properties)
         Class.__init__(self, db, classname, **properties)
 
 # vim: set et sts=4 sw=4 :
diff --git a/roundup/backends/rdbms_common.py b/roundup/backends/rdbms_common.py
index cb7913803..af941e5e6 100644
--- a/roundup/backends/rdbms_common.py
+++ b/roundup/backends/rdbms_common.py
@@ -59,11 +59,9 @@
 import re
 import time
 
-from hashlib import md5
-
 # roundup modules
 from roundup import hyperdb, date, password, roundupdb, security, support
-from roundup.anypy.strings import b2s, bs2b, us2s, repr_export, eval_import
+from roundup.anypy.strings import us2s, repr_export, eval_import
 from roundup.backends.blobfiles import FileStorage
 from roundup.backends.indexer_common import get_indexer
 from roundup.backends.indexer_common import Indexer as CommonIndexer
@@ -3411,170 +3409,19 @@ def export_journals(self):
 
 
 class FileClass(hyperdb.FileClass, Class):
-    """This class defines a large chunk of data. To support this, it has a
-       mandatory String property "content" which is typically saved off
-       externally to the hyperdb.
-
-       The default MIME type of this data is defined by the
-       "default_mime_type" class attribute, which may be overridden by each
-       node if the class defines a "type" String property.
-    """
+    # Use for explicit upcalls in generic code, for py2 compat we cannot
+    # use super() without making everything a new-style class.
+    subclass = Class
     def __init__(self, db, classname, **properties):
-        """The newly-created class automatically includes the "content"
-        and "type" properties.
-        """
-        if 'content' not in properties:
-            properties['content'] = hyperdb.String(indexme='yes')
-        if 'type' not in properties:
-            properties['type'] = hyperdb.String()
+        self._update_properties(properties)
         Class.__init__(self, db, classname, **properties)
 
-    def create(self, **propvalues):
-        """ snaffle the file propvalue and store in a file
-        """
-        # we need to fire the auditors now, or the content property won't
-        # be in propvalues for the auditors to play with
-        self.fireAuditors('create', None, propvalues)
-
-        # now remove the content property so it's not stored in the db
-        content = propvalues['content']
-        del propvalues['content']
-
-        # do the database create
-        newid = self.create_inner(**propvalues)
-
-        # figure the mime type
-        mime_type = propvalues.get('type', self.default_mime_type)
-
-        # and index!
-        if self.properties['content'].indexme:
-            index_content = content
-            if bytes != str and isinstance(content, bytes):
-                index_content = content.decode('utf-8', errors='ignore')
-            self.db.indexer.add_text((self.classname, newid, 'content'),
-                                     index_content, mime_type)
-
-        # store off the content as a file
-        self.db.storefile(self.classname, newid, None, bs2b(content))
-
-        # fire reactors
-        self.fireReactors('create', newid, None)
-
-        return newid
-
-    def get(self, nodeid, propname, default=_marker, cache=1):
-        """ Trap the content propname and get it from the file
-
-        'cache' exists for backwards compatibility, and is not used.
-        """
-        poss_msg = 'Possibly a access right configuration problem.'
-        if propname == 'content':
-            try:
-                return b2s(self.db.getfile(self.classname, nodeid, None))
-            except IOError as strerror:
-                # BUG: by catching this we donot see an error in the log.
-                return 'ERROR reading file: %s%s\n%s\n%s' % (
-                        self.classname, nodeid, poss_msg, strerror)
-            except UnicodeDecodeError:
-                # if content is not text (e.g. jpeg file) we get
-                # unicode error trying to convert to string in python 3.
-                # trap it and supply an error message. Include md5sum
-                # of content as this string is included in the etag
-                # calculation of the object.
-                return ('%s%s is not text, retrieve using '
-                        'binary_content property. mdsum: %s') % (
-                            self.classname, nodeid,
-                            md5(self.db.getfile(
-                                self.classname,
-                                nodeid,
-                                None)).hexdigest())  # nosec - bandit md5 use ok
-        elif propname == 'binary_content':
-            return self.db.getfile(self.classname, nodeid, None)
-
-        if default is not _marker:
-            return Class.get(self, nodeid, propname, default)
-        else:
-            return Class.get(self, nodeid, propname)
-
-    def set(self, itemid, **propvalues):
-        """ Snarf the "content" propvalue and update it in a file
-        """
-        self.fireAuditors('set', itemid, propvalues)
-        oldvalues = copy.deepcopy(self.db.getnode(self.classname, itemid))
-
-        # now remove the content property so it's not stored in the db
-        content = None
-        if 'content' in propvalues:
-            content = propvalues['content']
-            del propvalues['content']
-
-        # do the database create
-        propvalues = self.set_inner(itemid, **propvalues)
-
-        # do content?
-        if content:
-            # store and possibly index
-            self.db.storefile(self.classname, itemid, None, bs2b(content))
-            if self.properties['content'].indexme:
-                mime_type = self.get(itemid, 'type', self.default_mime_type)
-                index_content = content
-                if bytes != str and isinstance(content, bytes):
-                    index_content = content.decode('utf-8', errors='ignore')
-                self.db.indexer.add_text((self.classname, itemid, 'content'),
-                                         index_content, mime_type)
-            propvalues['content'] = content
-
-        # fire reactors
-        self.fireReactors('set', itemid, oldvalues)
-        return propvalues
-
-    def index(self, nodeid):
-        """ Add (or refresh) the node to search indexes.
-
-        Use the content-type property for the content property.
-        """
-        # find all the String properties that have indexme
-        for prop, propclass in self.getprops().items():
-            if prop == 'content' and propclass.indexme:
-                mime_type = self.get(nodeid, 'type', self.default_mime_type)
-                index_content = self.get(nodeid, 'binary_content')
-                if bytes != str and isinstance(index_content, bytes):
-                    index_content = index_content.decode('utf-8',
-                                                         errors='ignore')
-                self.db.indexer.add_text((self.classname, nodeid, 'content'),
-                                         index_content, mime_type)
-            elif isinstance(propclass, hyperdb.String) and propclass.indexme:
-                # index them under (classname, nodeid, property)
-                try:
-                    value = str(self.get(nodeid, prop))
-                except IndexError:
-                    # node has been destroyed
-                    continue
-                self.db.indexer.add_text((self.classname, nodeid, prop), value)
-
-
-# XXX deviation from spec - was called ItemClass
 class IssueClass(Class, roundupdb.IssueClass):
-    # Overridden methods:
+    # Use for explicit upcalls in generic code, for py2 compat we cannot
+    # use super() without making everything a new-style class.
+    subclass = Class
     def __init__(self, db, classname, **properties):
-        """The newly-created class automatically includes the "messages",
-        "files", "nosy", and "superseder" properties.  If the 'properties'
-        dictionary attempts to specify any of these properties or a
-        "creation", "creator", "activity" or "actor" property, a ValueError
-        is raised.
-        """
-        if 'title' not in properties:
-            properties['title'] = hyperdb.String(indexme='yes')
-        if 'messages' not in properties:
-            properties['messages'] = hyperdb.Multilink("msg")
-        if 'files' not in properties:
-            properties['files'] = hyperdb.Multilink("file")
-        if 'nosy' not in properties:
-            # note: journalling is turned off as it really just wastes
-            # space. this behaviour may be overridden in an instance
-            properties['nosy'] = hyperdb.Multilink("user", do_journal="no")
-        if 'superseder' not in properties:
-            properties['superseder'] = hyperdb.Multilink(classname)
+        self._update_properties(classname, properties)
         Class.__init__(self, db, classname, **properties)
 
 # vim: set et sts=4 sw=4 :
diff --git a/roundup/hyperdb.py b/roundup/hyperdb.py
index 2426498c0..5132d3c89 100644
--- a/roundup/hyperdb.py
+++ b/roundup/hyperdb.py
@@ -21,6 +21,7 @@
 __docformat__ = 'restructuredtext'
 
 # standard python modules
+import copy
 import logging
 import os
 import re
@@ -29,6 +30,8 @@
 import traceback
 import weakref
 
+from hashlib import md5
+
 # roundup modules
 from . import date, password
 from .support import ensureParentsExist, PrioList
@@ -36,10 +39,13 @@
 from roundup.i18n import _
 from roundup.cgi.exceptions import DetectorError
 from roundup.anypy.cmp_ import NoneAndDictComparable
-from roundup.anypy.strings import eval_import
+from roundup.anypy.strings import b2s, bs2b, eval_import
 
 logger = logging.getLogger('roundup.hyperdb')
 
+# marker used for an unspecified keyword argument
+_marker = []
+
 
 #
 # Types
@@ -1229,8 +1235,6 @@ def create(self, **propvalues):
         """
         raise NotImplementedError
 
-    _marker = []
-
     def get(self, nodeid, propname, default=_marker, cache=1):
         """Get the value of a property on an existing node of this class.
 
@@ -2098,17 +2102,59 @@ def rawToHyperdb(db, klass, itemid, propname, value, **kw):
 
 
 class FileClass:
-    """ A class that requires the "content" property and stores it on
-        disk.
+    """ This class defines a large chunk of data. To support this, it
+        has a mandatory String property "content" which is saved off
+        externally to the hyperdb.
+
+        The default MIME type of this data is defined by the
+        "default_mime_type" class attribute, which may be overridden by
+        each node if the class defines a "type" String property.
     """
     default_mime_type = 'text/plain'
 
-    def __init__(self, db, classname, **properties):
+    def _update_properties(self, properties):
         """The newly-created class automatically includes the "content"
-        property.
+        and "type" properties. This method must be called by __init__.
         """
         if 'content' not in properties:
             properties['content'] = String(indexme='yes')
+        if 'type' not in properties:
+            properties['type'] = String()
+
+    def create(self, **propvalues):
+        """ snaffle the file propvalue and store in a file
+        """
+        # we need to fire the auditors now, or the content property won't
+        # be in propvalues for the auditors to play with
+        self.fireAuditors('create', None, propvalues)
+
+        # now remove the content property so it's not stored in the db
+        content = propvalues['content']
+        del propvalues['content']
+
+        # do the database create
+        newid = self.create_inner(**propvalues)
+
+        # figure the mime type
+        mime_type = propvalues.get('type', self.default_mime_type)
+
+        # optionally index
+        # This wasn't done for the anydbm backend (but the 'set' method
+        # *did* update the index) so this is probably a bug-fix for anydbm
+        if self.properties['content'].indexme:
+            index_content = content
+            if bytes != str and isinstance(content, bytes):
+                index_content = content.decode('utf-8', errors='ignore')
+            self.db.indexer.add_text((self.classname, newid, 'content'),
+                                     index_content, mime_type)
+
+        # store off the content as a file
+        self.db.storefile(self.classname, newid, None, bs2b(content))
+
+        # fire reactors
+        self.fireReactors('create', newid, None)
+
+        return newid
 
     def export_propnames(self):
         """ Don't export the "content" property
@@ -2136,6 +2182,40 @@ def export_files(self, dirname, nodeid):
         ensureParentsExist(dest)
         shutil.copyfile(source, dest)
 
+    def get(self, nodeid, propname, default=_marker, cache=1):
+        """ Trap the content propname and get it from the file
+
+        'cache' exists for backwards compatibility, and is not used.
+        """
+        poss_msg = 'Possibly an access right configuration problem.'
+        if propname == 'content':
+            try:
+                return b2s(self.db.getfile(self.classname, nodeid, None))
+            except IOError as strerror:
+                # BUG: by catching this we don't see an error in the log.
+                return 'ERROR reading file: %s%s\n%s\n%s' % (
+                        self.classname, nodeid, poss_msg, strerror)
+            except UnicodeDecodeError:
+                # if content is not text (e.g. jpeg file) we get
+                # unicode error trying to convert to string in python 3.
+                # trap it and supply an error message. Include md5sum
+                # of content as this string is included in the etag
+                # calculation of the object.
+                return ('%s%s is not text, retrieve using '
+                        'binary_content property. mdsum: %s') % (
+                            self.classname, nodeid,
+                            md5(self.db.getfile(
+                                self.classname,
+                                nodeid,
+                                None)).hexdigest())  # nosec - bandit md5 use ok
+        elif propname == 'binary_content':
+            return self.db.getfile(self.classname, nodeid, None)
+
+        if default is not _marker:
+            return self.subclass.get(self, nodeid, propname, default)
+        else:
+            return self.subclass.get(self, nodeid, propname)
+
     def import_files(self, dirname, nodeid):
         """ Import the "content" property as a file
         """
@@ -2161,6 +2241,72 @@ def import_files(self, dirname, nodeid):
             self.db.indexer.add_text((self.classname, nodeid, 'content'),
                                      index_content, mime_type)
 
+    def index(self, nodeid):
+        """ Add (or refresh) the node to search indexes.
+
+        Use the content-type property for the content property.
+        """
+        # find all the String properties that have indexme
+        for prop, propclass in self.getprops().items():
+            if prop == 'content' and propclass.indexme:
+                mime_type = self.get(nodeid, 'type', self.default_mime_type)
+                index_content = self.get(nodeid, 'binary_content')
+                if bytes != str and isinstance(index_content, bytes):
+                    index_content = index_content.decode('utf-8',
+                                                         errors='ignore')
+                self.db.indexer.add_text((self.classname, nodeid, 'content'),
+                                         index_content, mime_type)
+            elif isinstance(propclass, String) and propclass.indexme:
+                # index them under (classname, nodeid, property)
+                try:
+                    value = str(self.get(nodeid, prop))
+                except IndexError:
+                    # node has been destroyed
+                    continue
+                self.db.indexer.add_text((self.classname, nodeid, prop), value)
+
+    def set(self, itemid, **propvalues):
+        """ Snarf the "content" propvalue and update it in a file
+        """
+        self.fireAuditors('set', itemid, propvalues)
+
+        # create the oldvalues dict - fill in any missing values
+        oldvalues = copy.deepcopy(self.db.getnode(self.classname, itemid))
+        # The following is redundant for rdbms backends but needed for anydbm
+        # the performance impact is so low we that we don't factor this.
+        for name, prop in self.getprops(protected=0).items():
+            if name in oldvalues:
+                continue
+            if isinstance(prop, Multilink):
+                oldvalues[name] = []
+            else:
+                oldvalues[name] = None
+
+        # now remove the content property so it's not stored in the db
+        content = None
+        if 'content' in propvalues:
+            content = propvalues['content']
+            del propvalues['content']
+
+        # do the database update
+        propvalues = self.set_inner(itemid, **propvalues)
+
+        # do content?
+        if content:
+            # store and possibly index
+            self.db.storefile(self.classname, itemid, None, bs2b(content))
+            if self.properties['content'].indexme:
+                index_content = content
+                if bytes != str and isinstance(content, bytes):
+                    index_content = content.decode('utf-8', errors='ignore')
+                mime_type = self.get(itemid, 'type', self.default_mime_type)
+                self.db.indexer.add_text((self.classname, itemid, 'content'),
+                                         index_content, mime_type)
+            propvalues['content'] = content
+
+        # fire reactors
+        self.fireReactors('set', itemid, oldvalues)
+        return propvalues
 
 class Node:
     """ A convenience wrapper for the given node
diff --git a/roundup/roundupdb.py b/roundup/roundupdb.py
index cdc1426a9..d511a7f6d 100644
--- a/roundup/roundupdb.py
+++ b/roundup/roundupdb.py
@@ -197,7 +197,7 @@ class DetectorError(RuntimeError):
     pass
 
 
-# deviation from spec - was called IssueClass
+# deviation from spec - was called ItemClass
 class IssueClass:
     """This class is intended to be mixed-in with a hyperdb backend
     implementation. The backend should provide a mechanism that
@@ -228,6 +228,27 @@ class IssueClass:
         ''"actor", ''"activity", ''"creator", ''"creation",
     )
 
+    def _update_properties(self, classname, properties):
+        """The newly-created class automatically includes the "messages",
+        "files", "nosy", and "superseder" properties.  If the 'properties'
+        dictionary attempts to specify any of these properties or a
+        "creation", "creator", "activity" or "actor" property, a ValueError
+        is raised. This method must be called by __init__.
+
+        """
+        if 'title' not in properties:
+            properties['title'] = hyperdb.String(indexme='yes')
+        if 'messages' not in properties:
+            properties['messages'] = hyperdb.Multilink("msg")
+        if 'files' not in properties:
+            properties['files'] = hyperdb.Multilink("file")
+        if 'nosy' not in properties:
+            # note: journalling is turned off as it really just wastes
+            # space. this behaviour may be overridden in an instance
+            properties['nosy'] = hyperdb.Multilink("user", do_journal="no")
+        if 'superseder' not in properties:
+            properties['superseder'] = hyperdb.Multilink(classname)
+
     # New methods:
     def addmessage(self, issueid, summary, text):
         """Add a message to an issue's mail spool.

From 41b16fad435e6819380c21ce594adeff8c191612 Mon Sep 17 00:00:00 2001
From: Ralf Schlatterbeck <rsc@runtux.com>
Date: Sat, 1 Mar 2025 18:55:54 +0100
Subject: [PATCH 165/398] Generate savepoint only if necessary

Now some methods got an additional 'allow_abort' parameter. By default
this is True. When False the postgres backend generates a savepoint.
The methods are called with allow_abort=False from some of the cgi
methods which can produce a traceback when called with data from the
web-interface.
---
 roundup/backends/back_anydbm.py     | 11 ++++++++---
 roundup/backends/back_postgresql.py | 21 +++++++++++----------
 roundup/backends/rdbms_common.py    | 19 ++++++++++++++-----
 roundup/cgi/actions.py              |  9 +++++++--
 roundup/cgi/templating.py           | 11 ++++++-----
 roundup/hyperdb.py                  | 23 +++++++++++++++++------
 test/test_templating.py             |  6 ++++--
 7 files changed, 67 insertions(+), 33 deletions(-)

diff --git a/roundup/backends/back_anydbm.py b/roundup/backends/back_anydbm.py
index d5dad6af6..6f5eedcbb 100644
--- a/roundup/backends/back_anydbm.py
+++ b/roundup/backends/back_anydbm.py
@@ -381,11 +381,13 @@ def savenode(self, classname, nodeid, node):
                 'save %s%s %r' % (classname, nodeid, node))
         self.transactions.append((self.doSaveNode, (classname, nodeid, node)))
 
-    def getnode(self, classname, nodeid, db=None, cache=1):
+    def getnode(self, classname, nodeid, db=None, cache=1, allow_abort=True):
         """ get a node from the database
 
             Note the "cache" parameter is not used, and exists purely for
             backward compatibility!
+
+            'allow_abort' is used only in sql backends.
         """
         # try the cache
         cache_dict = self.cache.setdefault(classname, {})
@@ -1026,7 +1028,7 @@ def create_inner(self, **propvalues):
 
         return newid
 
-    def get(self, nodeid, propname, default=_marker, cache=1):
+    def get(self, nodeid, propname, default=_marker, cache=1, allow_abort=True):
         """Get the value of a property on an existing node of this class.
 
         'nodeid' must be the id of an existing node of this class or an
@@ -1035,6 +1037,8 @@ def get(self, nodeid, propname, default=_marker, cache=1):
 
         'cache' exists for backward compatibility, and is not used.
 
+        'allow_abort' is used only in sql backends.
+
         Attempts to get the "creation" or "activity" properties should
         do the right thing.
         """
@@ -1459,8 +1463,9 @@ def restore(self, nodeid):
 
         self.fireReactors('restore', nodeid, None)
 
-    def is_retired(self, nodeid, cldb=None):
+    def is_retired(self, nodeid, cldb=None, allow_abort=True):
         """Return true if the node is retired.
+           'allow_abort' is used only in sql backends.
         """
         node = self.db.getnode(self.classname, nodeid, cldb)
         if self.db.RETIRED_FLAG in node:
diff --git a/roundup/backends/back_postgresql.py b/roundup/backends/back_postgresql.py
index b92b45db1..66392eb71 100644
--- a/roundup/backends/back_postgresql.py
+++ b/roundup/backends/back_postgresql.py
@@ -560,14 +560,17 @@ def clear(self):
             self.cursor.execute('DROP SEQUENCE _%s_ids' % cn)
             self.cursor.execute('CREATE SEQUENCE _%s_ids' % cn)
 
-    def getnode (self, classname, nodeid, fetch_multilinks=True):
+    def getnode(self, classname, nodeid, fetch_multilinks=True,
+                allow_abort=True):
         """ For use of savepoint see 'Class' below """
-        self.sql('savepoint sp')
+        if not allow_abort:
+            self.sql('savepoint sp')
         try:
             getnode = rdbms_common.Database.getnode
             return getnode(self, classname, nodeid, fetch_multilinks)
         except psycopg2.errors.DataError as err:
-            self.sql('rollback to savepoint sp')
+            if not allow_abort:
+                self.sql('rollback to savepoint sp')
             raise hyperdb.HyperdbValueError(str (err).split('\n')[0])
 
 
@@ -583,28 +586,26 @@ class Class(PostgresqlClass, rdbms_common.Class):
     """
 
     def filter(self, *args, **kw):
-        self.db.sql('savepoint sp')
         try:
             return rdbms_common.Class.filter(self, *args, **kw)
         except psycopg2.errors.DataError as err:
-            self.db.sql('rollback to savepoint sp')
             raise hyperdb.HyperdbValueError(str (err).split('\n')[0])
 
     def filter_iter(self, *args, **kw):
-        self.db.sql('savepoint sp')
         try:
             for v in rdbms_common.Class.filter_iter(self, *args, **kw):
                 yield v
         except psycopg2.errors.DataError as err:
-            self.db.sql('rollback to savepoint sp')
             raise hyperdb.HyperdbValueError(str (err).split('\n')[0])
 
-    def is_retired(self, nodeid):
-        self.db.sql('savepoint sp')
+    def is_retired(self, nodeid, allow_abort=True):
+        if not allow_abort:
+            self.db.sql('savepoint sp')
         try:
             return rdbms_common.Class.is_retired(self, nodeid)
         except psycopg2.errors.DataError as err:
-            self.db.sql('rollback to savepoint sp')
+            if not allow_abort:
+                self.db.sql('rollback to savepoint sp')
             raise hyperdb.HyperdbValueError (str (err).split('\n')[0])
 
 
diff --git a/roundup/backends/rdbms_common.py b/roundup/backends/rdbms_common.py
index af941e5e6..771afecc7 100644
--- a/roundup/backends/rdbms_common.py
+++ b/roundup/backends/rdbms_common.py
@@ -1,4 +1,4 @@
-#
+
 # Copyright (c) 2001 Bizar Software Pty Ltd (http://www.bizarsoftware.com.au/)
 # This module is free software, and you may redistribute it and/or modify
 # under the same terms as Python, so long as this copyright message and
@@ -1251,11 +1251,14 @@ def _materialize_multilinks(self, classname, nodeid, node, props=None):
             if propname not in node:
                 self._materialize_multilink(classname, nodeid, node, propname)
 
-    def getnode(self, classname, nodeid, fetch_multilinks=True):
+    def getnode(self, classname, nodeid, fetch_multilinks=True,
+                allow_abort=True):
         """ Get a node from the database.
             For optimisation optionally we don't fetch multilinks
             (lazy Multilinks).
             But for internal database operations we need them.
+            'allow_abort' determines if we allow that the current
+            transaction is aborted due to a data error (e.g. invalid nodeid).
         """
         # see if we have this node cached
         key = (classname, nodeid)
@@ -1863,7 +1866,7 @@ def create_inner(self, **propvalues):
         # XXX numeric ids
         return str(newid)
 
-    def get(self, nodeid, propname, default=_marker, cache=1):
+    def get(self, nodeid, propname, default=_marker, cache=1, allow_abort=True):
         """Get the value of a property on an existing node of this class.
 
         'nodeid' must be the id of an existing node of this class or an
@@ -1871,12 +1874,16 @@ def get(self, nodeid, propname, default=_marker, cache=1):
         of this class or a KeyError is raised.
 
         'cache' exists for backwards compatibility, and is not used.
+
+        'allow_abort' determines if we allow that the current
+        transaction is aborted due to a data error (e.g.  invalid nodeid).
         """
         if propname == 'id':
             return nodeid
 
         # get the node's dict
-        d = self.db.getnode(self.classname, nodeid, fetch_multilinks=False)
+        d = self.db.getnode(self.classname, nodeid, fetch_multilinks=False,
+                            allow_abort=allow_abort)
         # handle common case -- that property is in dict -- first
         # if None and one of creator/creation actor/activity return None
         if propname in d:
@@ -2245,8 +2252,10 @@ def restore(self, nodeid):
 
         self.fireReactors('restore', nodeid, None)
 
-    def is_retired(self, nodeid):
+    def is_retired(self, nodeid, allow_abort=True):
         """Return true if the node is retired
+           The allow_abort parameter determines if we allow the
+           transaction to be aborted when an invalid nodeid has been passed.
         """
         # Do not produce invalid sql, the id must be numeric
         try:
diff --git a/roundup/cgi/actions.py b/roundup/cgi/actions.py
index dcfe979bf..0aa9cb064 100644
--- a/roundup/cgi/actions.py
+++ b/roundup/cgi/actions.py
@@ -661,8 +661,13 @@ def _editnodes(self, all_props, all_links):
             cn, nodeid = needed
             if props:
                 if nodeid is not None and int(nodeid) > 0:
-                    # make changes to the node
-                    props = self._changenode(cn, nodeid, props)
+                    # make changes to the node, if an error occurs the
+                    # db may be in a state that needs rollback
+                    try:
+                        props = self._changenode(cn, nodeid, props)
+                    except (IndexError, ValueError):
+                        self.db.rollback ()
+                        raise
 
                     # and some nice feedback for the user
                     if props:
diff --git a/roundup/cgi/templating.py b/roundup/cgi/templating.py
index 238848b90..2a07519ba 100644
--- a/roundup/cgi/templating.py
+++ b/roundup/cgi/templating.py
@@ -587,7 +587,7 @@ def lookupKeys(linkcl, key, ids, num_re=num_re):
     for entry in ids:
         if num_re.match(entry):
             try:
-                label = linkcl.get(entry, key)
+                label = linkcl.get(entry, key, allow_abort=False)
             except IndexError:
                 # fall back to id if illegal (avoid template crash)
                 label = entry
@@ -1121,7 +1121,8 @@ def __getitem__(self, item):
         value = None
         try:
             if int(self._nodeid) > 0:
-                value = self._klass.get(self._nodeid, items[0], None)
+                value = self._klass.get(self._nodeid, items[0], None,
+                                        allow_abort=False)
         except (IndexError, ValueError):
             value = self._nodeid
         if value is None:
@@ -1157,7 +1158,7 @@ def designator(self):
 
     def is_retired(self):
         """Is this item retired?"""
-        return self._klass.is_retired(self._nodeid)
+        return self._klass.is_retired(self._nodeid, allow_abort=False)
 
     def submit(self, label=''"Submit Changes", action="edit", html_kwargs={}):
         """Generate a submit button.
@@ -2572,7 +2573,7 @@ def field(self, showid=0, size=None, **kwargs):
             idparse = self._prop.try_id_parsing
             if k and num_re.match(self._value):
                 try:
-                    value = linkcl.get(self._value, k)
+                    value = linkcl.get(self._value, k, allow_abort=False)
                 except (IndexError, hyperdb.HyperdbValueError) as err:
                     if idparse:
                         self._client.add_error_message(str(err))
@@ -3043,7 +3044,7 @@ def make_key_function(db, classname, sort_on=None):
 
     def keyfunc(a):
         if num_re.match(a):
-            a = linkcl.get(a, sort_on)
+            a = linkcl.get(a, sort_on, allow_abort=False)
             # In Python3 we may not compare numbers/strings and None
             if a is None:
                 if isinstance(prop, (hyperdb.Number, hyperdb.Integer)):
diff --git a/roundup/hyperdb.py b/roundup/hyperdb.py
index 5132d3c89..25d3119c3 100644
--- a/roundup/hyperdb.py
+++ b/roundup/hyperdb.py
@@ -1065,10 +1065,12 @@ def unserialise(self, classname, node):
         """
         return node
 
-    def getnode(self, classname, nodeid):
+    def getnode(self, classname, nodeid, allow_abort=True):
         """Get a node from the database.
 
         'cache' exists for backwards compatibility, and is not used.
+        'allow_abort' determines if we allow that the current
+        transaction is aborted due to a data error (e.g. invalid nodeid).
         """
         raise NotImplementedError
 
@@ -1235,7 +1237,7 @@ def create(self, **propvalues):
         """
         raise NotImplementedError
 
-    def get(self, nodeid, propname, default=_marker, cache=1):
+    def get(self, nodeid, propname, default=_marker, cache=1, allow_abort=True):
         """Get the value of a property on an existing node of this class.
 
         'nodeid' must be the id of an existing node of this class or an
@@ -1243,6 +1245,8 @@ def get(self, nodeid, propname, default=_marker, cache=1):
         of this class or a KeyError is raised.
 
         'cache' exists for backwards compatibility, and is not used.
+        'allow_abort' determines if we allow that the current
+        transaction is aborted due to a data error (e.g. invalid nodeid).
         """
         raise NotImplementedError
 
@@ -1300,8 +1304,10 @@ def restore(self, nodeid):
         """
         raise NotImplementedError
 
-    def is_retired(self, nodeid):
+    def is_retired(self, nodeid, allow_abort=True):
         """Return true if the node is rerired
+           'allow_abort' specifies if we allow the transaction to be
+           aborted if a syntactically invalid nodeid is passed.
         """
         raise NotImplementedError
 
@@ -2182,10 +2188,13 @@ def export_files(self, dirname, nodeid):
         ensureParentsExist(dest)
         shutil.copyfile(source, dest)
 
-    def get(self, nodeid, propname, default=_marker, cache=1):
+    def get(self, nodeid, propname, default=_marker, cache=1, allow_abort=True):
         """ Trap the content propname and get it from the file
 
         'cache' exists for backwards compatibility, and is not used.
+
+        'allow_abort' determines if we allow that the current
+        transaction is aborted due to a data error (e.g. invalid nodeid).
         """
         poss_msg = 'Possibly an access right configuration problem.'
         if propname == 'content':
@@ -2212,9 +2221,11 @@ def get(self, nodeid, propname, default=_marker, cache=1):
             return self.db.getfile(self.classname, nodeid, None)
 
         if default is not _marker:
-            return self.subclass.get(self, nodeid, propname, default)
+            return self.subclass.get(self, nodeid, propname, default,
+                                     allow_abort=allow_abort)
         else:
-            return self.subclass.get(self, nodeid, propname)
+            return self.subclass.get(self, nodeid, propname,
+                                     allow_abort=allow_abort)
 
     def import_files(self, dirname, nodeid):
         """ Import the "content" property as a file
diff --git a/test/test_templating.py b/test/test_templating.py
index 72f886d4c..1adca37e4 100644
--- a/test/test_templating.py
+++ b/test/test_templating.py
@@ -143,7 +143,9 @@ def test_HTMLDatabase_list(self):
         db = MockNull(issue = HTMLDatabase(self.client).issue)
         db.issue._klass.list = lambda : ['23', 'a', 'b']
         # Make db.getclass return something that has a sensible 'get' method
-        mock = MockNull(get = lambda x, y : None)
+        def get(x, y, allow_abort=True):
+            return None
+        mock = MockNull(get = get)
         db.issue._db.getclass = lambda x : mock
         l = db.issue.list()
 
@@ -170,7 +172,7 @@ def lookup(key):
 
     def test_lookupKeys(self):
         db = HTMLDatabase(self.client)
-        def get(entry, key):
+        def get(entry, key, allow_abort=True):
             return {'1': 'green', '2': 'eggs'}.get(entry, entry)
         shrubbery = MockNull(get=get)
         db._db.classes = {'shrubbery': shrubbery}

From 1d6cc8cf9367ef2190ea4851e20e4950236066a8 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 10 Mar 2025 21:48:06 -0400
Subject: [PATCH 166/398] chore: update to latest 3.13 python alpine base
 image.

---
 scripts/Docker/Dockerfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/scripts/Docker/Dockerfile b/scripts/Docker/Dockerfile
index 828044950..e319bce53 100644
--- a/scripts/Docker/Dockerfile
+++ b/scripts/Docker/Dockerfile
@@ -23,10 +23,10 @@ ARG source=local
 
 # parameterize the sha256 sum to pin version of python:3-alpine
 # Must use the same version in both build stages.
-ARG SHA256=8287ca207e905649e9f399b5f91a119e5e9051d8cd110d5f8c3b4bd9458ebd1d
+ARG SHA256=323a717dc4a010fee21e3f1aac738ee10bb485de4e7593ce242b36ee48d6b352
 
 
-# Set to any non-empy value to enable shell debugging for troubleshooting
+# Set to any non-empty value to enable shell debugging for troubleshooting
 ARG VERBOSE=
 
 # application directory

From e4bb9919e78d0c2429ee01c36e7b8afa3e73c850 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 11 May 2025 16:41:19 -0400
Subject: [PATCH 167/398] chore: update ptyhon3-alpine hash.

---
 scripts/Docker/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/Docker/Dockerfile b/scripts/Docker/Dockerfile
index e319bce53..6edc7eb1d 100644
--- a/scripts/Docker/Dockerfile
+++ b/scripts/Docker/Dockerfile
@@ -23,7 +23,7 @@ ARG source=local
 
 # parameterize the sha256 sum to pin version of python:3-alpine
 # Must use the same version in both build stages.
-ARG SHA256=323a717dc4a010fee21e3f1aac738ee10bb485de4e7593ce242b36ee48d6b352
+ARG SHA256=18159b2be11db91f84b8f8f655cd860f805dbd9e49a583ddaac8ab39bf4fe1a7
 
 
 # Set to any non-empty value to enable shell debugging for troubleshooting

From 7be3c8bcbbe4637147efe4b28dd21648aa6e89d3 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 11 May 2025 16:53:22 -0400
Subject: [PATCH 168/398] build: issue2551399 - CI is failing with flake8
 syntax error F824

Removed global declaration when only reading, not writing
module/global variable in block scope.
---
 roundup/anypy/vendored/cgi.py | 2 +-
 roundup/pygettext.py          | 1 -
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/roundup/anypy/vendored/cgi.py b/roundup/anypy/vendored/cgi.py
index 22897a14a..caebe57e9 100755
--- a/roundup/anypy/vendored/cgi.py
+++ b/roundup/anypy/vendored/cgi.py
@@ -82,7 +82,7 @@ def initlog(*allargs):
     send an error message).
 
     """
-    global log, logfile, logfp
+    global log, logfp
     warnings.warn("cgi.log() is deprecated as of 3.10. Use logging instead",
                   DeprecationWarning, stacklevel=2)
     if logfile and not logfp:
diff --git a/roundup/pygettext.py b/roundup/pygettext.py
index 1fe997559..8a345b5cc 100644
--- a/roundup/pygettext.py
+++ b/roundup/pygettext.py
@@ -231,7 +231,6 @@ def make_escapes(pass_iso8859):
 
 
 def escape(s):
-    global escapes
     s = list(s)
     for i in range(len(s)):
         s[i] = escapes[ord(s[i])]

From 77a414602aaed7049409bfada4d56d6f9c8748c9 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 11 May 2025 17:13:31 -0400
Subject: [PATCH 169/398] build: issue2551397: remove support for python 3.6

Try CI build on python 3.7. If this fails go to python 3.8 build.
---
 .github/workflows/ci-test.yml | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index 448f9a81e..6877139d3 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -78,9 +78,9 @@ jobs:
             #  os: ubuntu-22.04
             #  experimental: true
             
-            # 3.6 not available on new 22.04 runners, so run on 20.04 ubuntu
-            - python-version: 3.6
-              os: ubuntu-20.04
+            # 3.7 not available on new 22.04 runners, so run on 22.04 ubuntu
+            - python-version: 3.7
+              os: ubuntu-22.04
 
             # 3.8 not available on new 24.04 runners, so run on 22.04 ubuntu
             - python-version: 3.8
@@ -303,10 +303,7 @@ jobs:
               -W "ignore:unclosed:ResourceWarning:roundup.roundup.demo" \
               -W "ignore:unclosed file:ResourceWarning:enum" \
               -v  test/ --cov=roundup
-            if [[ "$PYTHON_VERSION" != "3.6" ]]; then
-              # coverage before 3.6 doesn't support lcov output
               coverage lcov
-            fi
           else
             # python2 case
             pytest -v -r a --durations=20 test/ --cov=roundup

From 32854cf7eb0806d61259cbbc2b310462942523d3 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 11 May 2025 17:24:34 -0400
Subject: [PATCH 170/398] chore: update 3-alpine image to resolve medium sev
 sqlite-lib issue

Anchore scan reports medium sev issue with sqlite-libs - buffer
overflow.

Also various low sev issues for ssl_client and busybox-binsh, busybox.
---
 scripts/Docker/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/Docker/Dockerfile b/scripts/Docker/Dockerfile
index 6edc7eb1d..6ae3421d3 100644
--- a/scripts/Docker/Dockerfile
+++ b/scripts/Docker/Dockerfile
@@ -23,7 +23,7 @@ ARG source=local
 
 # parameterize the sha256 sum to pin version of python:3-alpine
 # Must use the same version in both build stages.
-ARG SHA256=18159b2be11db91f84b8f8f655cd860f805dbd9e49a583ddaac8ab39bf4fe1a7
+ARG SHA256=452682e4648deafe431ad2f2391d726d7c52f0ff291be8bd4074b10379bb89ff
 
 
 # Set to any non-empty value to enable shell debugging for troubleshooting

From 364a8872e112f32c36a2c5f326d85556cbc818a3 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 11 May 2025 17:37:57 -0400
Subject: [PATCH 171/398] fix: issue2551396: os.path.stat.ST_MTIME + windows
 python 3.13 crashes

Looks like os.path.stat was removed in 3.13 on windows. Use
stat.ST_MTIME instead. stat.ST_MTIME is also used in cgi/client.py.
---
 roundup/cgi/engine_zopetal.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/roundup/cgi/engine_zopetal.py b/roundup/cgi/engine_zopetal.py
index e6f6052cf..6b8987d6f 100644
--- a/roundup/cgi/engine_zopetal.py
+++ b/roundup/cgi/engine_zopetal.py
@@ -7,6 +7,7 @@
 import mimetypes
 import os
 import os.path
+import stat
 
 from roundup.cgi.templating import StringIO, context, TALLoaderBase
 from roundup.cgi.PageTemplates import PageTemplate
@@ -30,7 +31,7 @@ def load(self, tplname):
 
         # has it changed?
         try:
-            stime = os.stat(src)[os.path.stat.ST_MTIME]
+            stime = os.stat(src)[stat.ST_MTIME]
         except os.error as error:
             if error.errno != errno.ENOENT:
                 raise

From c24deeb16b74c84266cc8d69bbe8ead9d9ae599e Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 11 May 2025 17:40:23 -0400
Subject: [PATCH 172/398] fix: issue2551396: os.path.stat.ST_MTIME + windows
 ... CHANGES.txt

Commit CHANGES.txt
---
 CHANGES.txt | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGES.txt b/CHANGES.txt
index c40407dc9..e19e3933d 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -93,6 +93,8 @@ Fixed:
   the popup calendar work when the enclosing form has a name different
   from "itemSynopsis". (Ralf Schlatterbeck)
 - issue2551376: Fix tracebacks in item templates (Ralf Schlatterbeck)
+- issue2551396: Use of os.path.stat.ST_MTIME in python 3.13 crashes
+  roundup on windows. Replaced with equivalent stat.ST_MTIME.
 
 Features:
 

From abbe039f763e77e5587ae57541b79da00c9c622e Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 11 May 2025 17:50:44 -0400
Subject: [PATCH 173/398] build: issue2551397: remove support for python 3.6

3.7 ci build works. Make changes to make 3.7 current minimum supported
version. Also removed some references that apply only when running
under 2.7.
---
 doc/announcement.txt      | 14 +++++++-------
 doc/installation.txt      |  5 +----
 doc/tracker_templates.txt |  6 +++---
 setup.py                  |  1 -
 4 files changed, 11 insertions(+), 15 deletions(-)

diff --git a/doc/announcement.txt b/doc/announcement.txt
index f04286aba..b45319be8 100644
--- a/doc/announcement.txt
+++ b/doc/announcement.txt
@@ -117,12 +117,12 @@ all your trackers to update the database schema version. Do
 this before you use the web, command-line or mail interface
 and before any users access the tracker.
 
-Roundup requires Python 2 newer than version 2.7.12 or Python 3
-newer than or equal to version 3.6 for correct operation. (Python
-3.4 or 3.5 may work, but are not tested.) Note that Roundup 2.4.0
-will be the last release to support Python 2. You should deploy
-new trackers with Python 3 and plan on upgrading older trackers
-from Python 2 to Python 3. See the upgrade guide.
+Roundup requires Python 3 newer than or equal to version 3.7 for
+correct operation. (Python 3.4 or 3.5, or 3.6 may work, but are not
+tested.) Note that Roundup 2.4.0 was the last release to support
+Python 2. You should deploy new trackers with Python 3 and plan on
+upgrading older trackers from Python 2 to Python 3. See the upgrade
+guide.
 
 To give Roundup a try, just download (directions above),
 unpack and run::
@@ -164,7 +164,7 @@ The system facilitates communication among the participants
 by managing discussions and notifying interested parties
 when issues are edited. One of the major design goals for
 Roundup that it be simple to get going. Roundup is therefore
-usable "out of the box" with any Python 3.6+
+usable "out of the box" with any Python 3.7+
 installation. It doesn't even need to be "installed" to be
 operational, though an install script is provided.
 
diff --git a/doc/installation.txt b/doc/installation.txt
index ae983a6a5..db8ec54b0 100644
--- a/doc/installation.txt
+++ b/doc/installation.txt
@@ -178,7 +178,7 @@ can remove the tracker using ``rm -f`` on the ``demo`` directory.
 Prerequisites
 =============
 
-Roundup requires Python 2.7 [3]_ or 3.6 or newer with a functioning anydbm
+Roundup requires Python 3.7 or newer with a functioning anydbm
 or sqlite module. The version installed by most vendors should work if
 it meets the version requirements. If necessary, you can download the
 latest version from https://www.python.org/. It is highly recommended
@@ -318,9 +318,6 @@ requests
 .. _Using Redis for Session Databases:
    admin_guide.html#using-redis-for-session-databases
 
-.. [3] Do not use Python 2 for new installs. The next minor release
-       (2.5.0 expected summer 2025) will drop support for Python 2.
-
 Installing Roundup
 ==================
 
diff --git a/doc/tracker_templates.txt b/doc/tracker_templates.txt
index 5addb90c1..03300fba3 100644
--- a/doc/tracker_templates.txt
+++ b/doc/tracker_templates.txt
@@ -5,7 +5,7 @@ Roundup Tracker Templates
 The templates distributed with Roundup are stored in the "share" directory
 nominated by Python. On Unix this is typically
 ``/usr/share/roundup/templates/`` (or ``/usr/local/share...``) and
-on Windows this is ``c:\python27\share\roundup\templates\``.
+on Windows this is ``c:\python38\share\roundup\templates\``.
 
 The template loading looks in four places to find the templates:
 
@@ -17,9 +17,9 @@ The template loading looks in four places to find the templates:
    `sys.base_prefix/local``. This finds templates (and locales)
    installed by pip. E.G. in a virtualenv located at (``sys.prefix``):
    ``/tools/roundup``, roundup would be at:
-   ``/tools/roundup/lib/python3.6/site-packages/roundup``. The
+   ``/tools/roundup/lib/python3.7/site-packages/roundup``. The
    templates would be at:
-   ``/tools/roundup/lib/python3.6/site-packages/tools/roundup/share/roundup/templates/``.
+   ``/tools/roundup/lib/python3.7/site-packages/tools/roundup/share/roundup/templates/``. (Replace 3.7 with the Python version you are running.)
 3. ``<roundup.admin.__file__>/../../share/roundup/templates/*``.
    This will be used if Roundup's run in the distro (aka. source)
    directory.
diff --git a/setup.py b/setup.py
index da1d00061..9cb517252 100755
--- a/setup.py
+++ b/setup.py
@@ -245,7 +245,6 @@ def main():
                        'Programming Language :: Python :: 2',
                        'Programming Language :: Python :: 2.7',
                        'Programming Language :: Python :: 3',
-                       'Programming Language :: Python :: 3.6',
                        'Programming Language :: Python :: 3.7',
                        'Programming Language :: Python :: 3.8',
                        'Programming Language :: Python :: 3.9',

From 23e391fde0497f78ae3eb776c4a3f96cb3ea11c5 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 11 May 2025 17:59:32 -0400
Subject: [PATCH 174/398] issue2551398 - Browser number input

Disable use of native browser number inputs. There are issues
including use of comma decimal separators.

More extensive remditaion/granularity is needed for this so disable
but leave available for people to test with for now.

Also moved the implentation of native date type from fixed area to
feature area because of the issues with the native date popup and it
defaulting to off. This means it's not a bugfix for the various bugs
lodged against the roundup date picker component.
---
 CHANGES.txt              | 19 +++++++++++--------
 roundup/configuration.py |  2 +-
 2 files changed, 12 insertions(+), 9 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index e19e3933d..cc51a6c25 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -77,12 +77,6 @@ Fixed:
 - issue2551391, partial fix for issue1513369. input fields were
   not getting id's assigned. Fixed automatic id assignment to
   input fields. Thinko in the code. (John Rouillard)
-- issue2551390 - Replace text input/calendar popup with native
-  date input. Also add double-click and exit keyboard handlers to
-  allow copy/paste/editing the text version of the date. Configurable
-  via the use_browser_date_input setting in the [web] section of
-  config.ini. By default browser native dates are turned off.
-  (John Rouillard, Ralf Schlatterbeck)
 - issue1895197 - translated help texts in admin.py not displayed
   correctly. (Initial patch tobias-herp, John Rouillard)
 - issue2551238 - roundup-server should exit with error if -d
@@ -136,10 +130,19 @@ Features:
 - Added new templating utils.set_http_response(integer) method to
   allow reporting an error to the user from a template. (John
   Rouillard)
+- issue2551390 - Replace text input/calendar popup with native
+  date input. Also add double-click and exit keyboard handlers to
+  allow copy/paste/editing the text version of the date. Configurable
+  via the use_browser_date_input setting in the [web] section of
+  config.ini. By default browser native dates are turned off.
+  (John Rouillard, Ralf Schlatterbeck)
 - Use native number type input for Number() and Integer()
   properties. Integer() uses step=1 as well. Configurable via the
-  use_browser_number_input setting in the [web] section of config.ini
-  (John Rouillard, Ralf Schlatterbeck)
+  use_browser_number_input setting in the [web] section of config.ini.
+  Set off by default. See
+  https://issues.roundup-tracker.org/issue2551398 for discussion of
+  issues with native number inputs.  (John Rouillard, Ralf
+  Schlatterbeck)
 - issue2551231 - template.py-HTMLClass::classhelp doesn't merge
   user defined classes. It now merges them in. (John Rouillard)
 
diff --git a/roundup/configuration.py b/roundup/configuration.py
index c37021d32..421d91bcd 100644
--- a/roundup/configuration.py
+++ b/roundup/configuration.py
@@ -1469,7 +1469,7 @@ def str2value(self, value):
             "international date format server-side) and some browsers\n"
             "ignore the date format set by the operating system, the\n"
             "default is 'no'."),
-        (BooleanOption, "use_browser_number_input", "yes",
+        (BooleanOption, "use_browser_number_input", "no",
             "HTML input elements for Number properties: This determines\n"
             "if we use the input type 'number' for Number (and Integer)\n"
             "properties. If set to 'no' we use input type 'text'."),

From 8185714d58283c4ac438a8ebd01b70be92f2689f Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 11 May 2025 18:51:57 -0400
Subject: [PATCH 175/398] docs: use bulleted list for deprecation; pydoc for
 shared dir

pydoc update for embedded/released docs isn't working quite right.
The html file is generated but no docs are extracted into it.
But the error emitted by the presence of pydoc.txt is suppressed.
---
 doc/customizing.txt |  2 +-
 doc/index.txt       |  6 ++++++
 doc/upgrading.txt   | 17 ++++++++++-------
 3 files changed, 17 insertions(+), 8 deletions(-)

diff --git a/doc/customizing.txt b/doc/customizing.txt
index 1658ceb4f..060a5bd2a 100644
--- a/doc/customizing.txt
+++ b/doc/customizing.txt
@@ -90,7 +90,7 @@ caches the schema).
       <td tal:content="structure context/due_date/field" /> 
      </tr>
     
-   If you want to show only the date part of due_date then do this instead:
+   If you want to show only the date part of due_date then do this instead::
    
     <tr> 
      <th>Due Date</th> 
diff --git a/doc/index.txt b/doc/index.txt
index 9f1028e16..4b5676e66 100644
--- a/doc/index.txt
+++ b/doc/index.txt
@@ -13,6 +13,7 @@ Contents
 
 .. toctree::
    :maxdepth: 2
+   :includehidden:
 
    features
 
@@ -50,6 +51,11 @@ Contents
    Richard Jones implementation notes <implementation>
    security-history
 
+.. toctree::
+   :hidden:
+
+   pydoc
+
 See: https://wiki.roundup-tracker.org/ReleaseErrata for fixes to
 documentation.
 
diff --git a/doc/upgrading.txt b/doc/upgrading.txt
index 88b080b0a..8ccb17431 100644
--- a/doc/upgrading.txt
+++ b/doc/upgrading.txt
@@ -47,7 +47,8 @@ Repeat for each tracker instance.
    Python v2.5 and v2.6.  Starting with the v1.6 releases of Roundup
    Python version 2.7 that is newer than 2.7.2 is required to run
    Roundup.  Starting with Roundup version 2.0.0 we also support Python 3
-   versions newer than 3.6.
+   versions newer than 3.6. Roundup version 2.5 supports Python
+   3.7 and newer.
 
 Recent release notes have the following labels:
 
@@ -100,13 +101,15 @@ Contents:
 Migrating from 2.4.0 to 2.5.0
 =============================
 
-Deprecation Notices (info)
---------------------------
+Deprecation Notices (required)
+------------------------------
 
-Support for SQLite version 2 has been removed in 2.5.0.  Support for
-the `PySQLite <https://github.com/ghaering/pysqlite>`_ library has
-been removed in 2.5.0. Only the Python supplied sqlite3 library will
-be supported.
+  * Support for SQLite version 2 has been removed in 2.5.0.
+  * Support for the `PySQLite <https://github.com/ghaering/pysqlite>`_
+    library has been removed in 2.5.0. Only the Python supplied
+    sqlite3 library is supported.
+  * Roundup 2.5.0 supports Python 3.7 or newer. (It is not tested
+    on Python 3.6. It may work but we don;t support it.)
 
 Update responsive template _generic.404.html and query.item.html (recommended)
 ------------------------------------------------------------------------------

From c2f9e26d1aae4d771e42b0856e6cc863f622d49d Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 11 May 2025 20:02:31 -0400
Subject: [PATCH 176/398] fix: double escaping of data-calurl prevent use.

data-calurl escaped the '&'s replacing them with the entity code.
Then the value was processed again by cgi_escape_attrs double escaping
the value making it unusable if passed to help_window().
---
 roundup/cgi/templating.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roundup/cgi/templating.py b/roundup/cgi/templating.py
index 2a07519ba..c7da8e09e 100644
--- a/roundup/cgi/templating.py
+++ b/roundup/cgi/templating.py
@@ -2438,7 +2438,7 @@ def popcal(self, width=300, height=200, label="(cal)",
             date = ""
 
         data_attr = {
-            "data-calurl": '%s?@template=calendar&amp;property=%s&amp;form=%s%s' % (
+            "data-calurl": '%s?@template=calendar&property=%s&form=%s%s' % (
                 self._classname, self._name, form, date),
             "data-width": width,
             "data-height": height

From b20ec93942bcec45c6bcfa211e638118642ae300 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 11 May 2025 20:22:45 -0400
Subject: [PATCH 177/398] fix: tests for changeset:   8314:7ff47307b4b1 use
 text for number input

---
 test/test_templating.py | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/test/test_templating.py b/test/test_templating.py
index 1adca37e4..66fbc96ca 100644
--- a/test/test_templating.py
+++ b/test/test_templating.py
@@ -899,7 +899,7 @@ def tearDown(self):
     def exp_classhelp(self, cls='issue', prop='deadline', dlm='.'):
         value = dlm.join (('2021-01-01', '11:22:10'))
         return ('<a class="classhelp" data-calurl="%(cls)s?'
-        '@template=calendar&amp;amp;property=%(prop)s&amp;amp;'
+        '@template=calendar&amp;property=%(prop)s&amp;'
         'form=itemSynopsis&amp;date=%(value)s" '
         'data-height="200" data-width="300" href="javascript:help_window'
         '(\'%(cls)s?@template=calendar&amp;property=%(prop)s&amp;'
@@ -1392,10 +1392,10 @@ def test_IntegerHTML(self):
 
         self.assertEqual(d.plain(), "314")
 
-        input_expected = """<input id="issue1@intval" name="issue1@intval" size="30" step="1" type="number" value="314">"""
+        input_expected = """<input id="issue1@intval" name="issue1@intval" size="30" type="text" value="314">"""
         self.assertEqual(d.field(), input_expected)
 
-        input_expected = """<input id="issue1@intval" name="issue1@intval" size="30" step="50" type="number" value="314">"""
+        input_expected = """<input id="issue1@intval" name="issue1@intval" size="30" step="50" type="text" value="314">"""
         self.assertEqual(d.field(step="50"), input_expected)
 
         input_expected = """<input id="issue1@intval" name="issue1@intval" size="30" type="text" value="314">"""
@@ -1435,10 +1435,10 @@ def test_NumberHTML(self):
 
         self.assertEqual(d._value, 3.14)
 
-        input_expected = """<input id="issue1@numberval" name="issue1@numberval" size="30" type="number" value="3.14">"""
+        input_expected = """<input id="issue1@numberval" name="issue1@numberval" size="30" type="text" value="3.14">"""
         self.assertEqual(d.field(), input_expected)
 
-        input_expected = """<input id="issue1@numberval" name="issue1@numberval" size="30" step="50" type="number" value="3.14">"""
+        input_expected = """<input id="issue1@numberval" name="issue1@numberval" size="30" step="50" type="text" value="3.14">"""
         self.assertEqual(d.field(step="50"), input_expected)
 
         input_expected = """<input id="issue1@numberval" name="issue1@numberval" size="30" type="text" value="3.14">"""

From 0178a129ce5d42106daa822dcde1d75033c501e9 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 11 May 2025 20:26:42 -0400
Subject: [PATCH 178/398] issue2551323: Remove XHTML support

Deprecated in Roundup 2.3.0, invalid in 2.4.0, and removing supporting
code in 2.5.0.
---
 CHANGES.txt               |  3 +++
 roundup/cgi/templating.py | 28 ++--------------------------
 test/test_templating.py   | 19 -------------------
 3 files changed, 5 insertions(+), 45 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index cc51a6c25..b2b7f1aed 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -89,6 +89,9 @@ Fixed:
 - issue2551376: Fix tracebacks in item templates (Ralf Schlatterbeck)
 - issue2551396: Use of os.path.stat.ST_MTIME in python 3.13 crashes
   roundup on windows. Replaced with equivalent stat.ST_MTIME.
+- issue2551323: remove functions used for XHTML template
+  support. XHTML was deprecated in Roundup 2.3.0 and an invalid value
+  in 2.4.0.
 
 Features:
 
diff --git a/roundup/cgi/templating.py b/roundup/cgi/templating.py
index c7da8e09e..c3ba4fae9 100644
--- a/roundup/cgi/templating.py
+++ b/roundup/cgi/templating.py
@@ -628,44 +628,20 @@ def html4_cgi_escape_attrs(**attrs):
                      for k, v in sorted(attrs.items())])
 
 
-def xhtml_cgi_escape_attrs(**attrs):
-    ''' Boolean attributes like 'disabled', 'required'
-        are represented with a value that is the same as
-        the attribute name.. E.G.
-           <input required="required" ...> not <input required ..>
-        The latter is html4 or 5. Recognize booleans by:
-          value is None
-        Code can use None to indicate a pure boolean.
-    '''
-    return ' '.join(['%s="%s"' % (k, html_escape(str(v), True))
-                     if v is not None else '%s="%s"' % (k, k)
-                     for k, v in sorted(attrs.items())])
-
-
 def input_html4(**attrs):
     """Generate an 'input' (html4) element with given attributes"""
     _set_input_default_args(attrs)
     return '<input %s>' % html4_cgi_escape_attrs(**attrs)
 
 
-def input_xhtml(**attrs):
-    """Generate an 'input' (xhtml) element with given attributes"""
-    _set_input_default_args(attrs)
-    return '<input %s/>' % xhtml_cgi_escape_attrs(**attrs)
-
-
 class HTMLInputMixin(object):
     """ requires a _client property """
     def __init__(self):
         html_version = 'html4'
         if hasattr(self._client.instance.config, 'HTML_VERSION'):
             html_version = self._client.instance.config.HTML_VERSION
-        if html_version == 'xhtml':
-            self.input = input_xhtml
-            self.cgi_escape_attrs = xhtml_cgi_escape_attrs
-        else:
-            self.input = input_html4
-            self.cgi_escape_attrs = html4_cgi_escape_attrs
+        self.input = input_html4
+        self.cgi_escape_attrs = html4_cgi_escape_attrs
         # self._context is used for translations.
         # will be initialized by the first call to .gettext()
         self._context = None
diff --git a/test/test_templating.py b/test/test_templating.py
index 66fbc96ca..df3316167 100644
--- a/test/test_templating.py
+++ b/test/test_templating.py
@@ -710,24 +710,6 @@ def test_input_html4(self):
         input=input_html4(**attrs)
         self.assertEqual(input, '<input class="required" disabled="disabled" size="30" type="text">')
 
-    def test_input_xhtml(self):
-        # boolean attributes are attribute name="attribute name"
-        # indicate with attr=None or attr="attr"
-        #    e.g. disabled="disabled"
-        input=input_xhtml(required=None, size=30)
-        self.assertEqual(input, '<input required="required" size="30" type="text"/>')
-
-        input=input_xhtml(required="required", size=30)
-        self.assertEqual(input, '<input required="required" size="30" type="text"/>')
-
-        attrs={"required": None, "class": "required", "size": 30}
-        input=input_xhtml(**attrs)
-        self.assertEqual(input, '<input class="required" required="required" size="30" type="text"/>')
-
-        attrs={"disabled": "disabled", "class": "required", "size": 30}
-        input=input_xhtml(**attrs)
-        self.assertEqual(input, '<input class="required" disabled="disabled" size="30" type="text"/>')
-
 
 class HTMLPropertyTestClass(unittest.TestCase):
     def setUp(self):
@@ -1613,7 +1595,6 @@ def view_check(self):
     def edit_check(self):
 
 def input_html4(**attrs):
-def input_xhtml(**attrs):
 
 class HTMLInputMixin:
     def __init__(self):

From 0b7a2a0b4eecd042ad298aa45fa8e44f0819faf3 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 11 May 2025 20:31:16 -0400
Subject: [PATCH 179/398] build: issue2551397: remove support for python 3.6

One last file with a 3.6 reference.
---
 roundup/rest.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roundup/rest.py b/roundup/rest.py
index 36e8f3270..80078dcc2 100644
--- a/roundup/rest.py
+++ b/roundup/rest.py
@@ -38,7 +38,7 @@
 logger = logging.getLogger('roundup.rest')
 
 try:
-    # if dicttoxml2 (or dicttoxml for Python <= 3.6)
+    # if dicttoxml2
     # is installed in roundup directory, use it
     from roundup.dicttoxml2 import dicttoxml
 except ImportError:

From bcd9215717f94a24ac82a5803b9b9bfe95c3113b Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 2 Jun 2025 08:52:39 -0400
Subject: [PATCH 180/398] fix(web): issue2551406 - dont crash when handed
 invalid @template=a|b|c

Only two template cases (ok and error) are handled. Presence of second
'|' caused crash.  Discovered/patch provided by Christof Meerwald
(cmeerw).
---
 CHANGES.txt           |  3 +++
 roundup/cgi/client.py |  2 +-
 test/test_cgi.py      | 33 +++++++++++++++++++++++++++++++++
 3 files changed, 37 insertions(+), 1 deletion(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index b2b7f1aed..6180339ae 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -92,6 +92,9 @@ Fixed:
 - issue2551323: remove functions used for XHTML template
   support. XHTML was deprecated in Roundup 2.3.0 and an invalid value
   in 2.4.0.
+- issue2551406: 'Templating Error: too many values to unpack' crash
+  fixed. (reported by and patch Christof Meerwald, commit/test John
+  Rouillard)
 
 Features:
 
diff --git a/roundup/cgi/client.py b/roundup/cgi/client.py
index 7c9e0148c..5811eda85 100644
--- a/roundup/cgi/client.py
+++ b/roundup/cgi/client.py
@@ -2195,7 +2195,7 @@ def selectTemplate(self, name, view):
         # templates, just leave view alone.
         if (view and view.find('|') != -1):
             # we have alternate templates, parse them apart.
-            (oktmpl, errortmpl) = view.split("|", 2)
+            (oktmpl, errortmpl) = view.split("|", 1)
 
             # Choose the right template
             view = errortmpl if self._error_message else oktmpl
diff --git a/test/test_cgi.py b/test/test_cgi.py
index 03dd0d490..73f6ca71d 100644
--- a/test/test_cgi.py
+++ b/test/test_cgi.py
@@ -2941,6 +2941,39 @@ def testRenderAltTemplates(self):
         sha1sum = '<!-- SHA: 952568414163cd12b2e89e91e59ef336da64fbbe -->'
         self.assertNotEqual(-1, result.index(sha1sum))
 
+    def testRenderAltTemplatesError(self):
+        # check that an error is reported to user when rendering using
+        #  @template=oktempl|errortmpl|oops|foo
+
+        # template names can not include |
+
+        # set up the client;
+        # run determine_context to set the required client attributes
+        # run renderContext(); check result for proper page
+
+        # Test ok state template that uses user.forgotten.html
+        self.client.form=db_test_base.makeForm({"@template": "forgotten|item|oops|foo"})
+        self.client.path = 'user'
+        self.client.determine_context()
+        self.client.session_api = MockNull(_sid="1234567890")
+        self.assertEqual(
+          (self.client.classname, self.client.template, self.client.nodeid),
+          ('user', 'forgotten|item|oops|foo', None))
+        self.assertEqual(self.client._ok_message, [])
+        
+        result = self.client.renderContext()
+        print(result)
+        # sha1sum of classic tracker user.forgotten.template must be found
+        sha1sum = '<!-- SHA: f93570f95f861da40f9c45bbd2b049bb3a7c0fc5 -->'
+        self.assertNotEqual(-1, result.index(sha1sum))
+
+        # now set an error in the form to get error template user.item.html
+        self.client.form=db_test_base.makeForm({"@template": "forgotten|item|oops|foo",
+                                   "@error_message": "this is an error"})
+        self.client.path = 'user'
+        self.client.determine_context()
+        result = self.client.renderContext()
+        self.assertEqual(result, '<strong>No template file exists for templating "user" with template "item|oops|foo" (neither "user.item|oops|foo" nor "_generic.item|oops|foo")</strong>')
 
     def testexamine_url(self):
         ''' test the examine_url function '''

From 301fefe2b10bcce21fe730f43dda792fae832649 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Tue, 3 Jun 2025 21:43:29 -0400
Subject: [PATCH 181/398] chore(ci): issue2551368 make pip install gpg work for
 24.04 ubuntu

Use the version installed on the test pypi server.
---
 .github/workflows/ci-test.yml | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index 6877139d3..3832cf835 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -235,13 +235,18 @@ jobs:
           # docutils for ReStructuredText
           pip install beautifulsoup4 brotli docutils jinja2 \
             mistune==0.8.4 pyjwt pytz whoosh
-          # gpg doesn't build on Ubuntu 24.04. Ignore failure on that
-          # platform only. Grep os-release to cover matrix.os in
-          # [ubunutu-latest, ubuntu-24.04].
-          pip install gpg || ( save_status=$?; \
-             if grep 24.04 /etc/os-release > /dev/null; then \
-                 echo "Ignoring error ubuntu-24.04: issue2551368"; exit 0; \
-                 else exit $save_status; fi; )
+          # gpg on PyPi is currently broken with newer OS platform
+          #   ubuntu 24.04
+          # used for newer Python versions. Temporarily use the
+          # testing index, which contains a newer version of the
+          # bindings on 24.04 or released version for other OS
+          # versions. See issue2551368
+          if grep 24.04 /etc/os-release > /dev/null; then \
+            pip install --index-url https://test.pypi.org/simple/ \
+                --extra-index-url https://pypi.org/simple --pre gpg; \
+          else \
+            pip install gpg; \
+          fi
 
       - name: Install aux packages that need versions differences
         # if zstd fails install, keep going with test, don't abort

From af839b6eb26060ce1bdaccd6d7cc2160cbc5ff2e Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Tue, 3 Jun 2025 22:23:10 -0400
Subject: [PATCH 182/398] fix: fix possible HTTP Response Splitting in
 roundup-server

CodeQL flagged a possible HTTP Response Splitting in the Location
header's URL.

The AI suggested cleaning the Host value, except the URL also includes
the query parameters in the URL so they could potentially trigger the
issue. Th host header probably doesn;t have a newline or cr in it
otherwise it wouldn't have been recognized by the server as a valid
host.

In any case strip all \n or \r from the url before use.

Also update CHANGES.txt with fixing the gpg install.
---
 CHANGES.txt                       | 4 ++++
 roundup/scripts/roundup_server.py | 4 ++++
 2 files changed, 8 insertions(+)

diff --git a/CHANGES.txt b/CHANGES.txt
index 6180339ae..bc7c1f91b 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -95,6 +95,8 @@ Fixed:
 - issue2551406: 'Templating Error: too many values to unpack' crash
   fixed. (reported by and patch Christof Meerwald, commit/test John
   Rouillard)
+- fix potential HTTP Response Splitting issue in
+  roundup-server. Discovered by CodeQL in CI. (John Rouillard)
 
 Features:
 
@@ -151,6 +153,8 @@ Features:
   Schlatterbeck)
 - issue2551231 - template.py-HTMLClass::classhelp doesn't merge
   user defined classes. It now merges them in. (John Rouillard)
+- re-enable support for GPG/PGP encrypted emails using new python gpg
+  pakage on the test pypi instance. (Paul Schwabauer)
 
 2024-07-13 2.4.0
 
diff --git a/roundup/scripts/roundup_server.py b/roundup/scripts/roundup_server.py
index c8aa6c2ab..89b58f4d6 100644
--- a/roundup/scripts/roundup_server.py
+++ b/roundup/scripts/roundup_server.py
@@ -432,6 +432,10 @@ def inner_run_cgi(self):
             url = '%s://%s%s/' % (protocol, self.headers['host'], rest)
             if query:
                 url += '?' + query
+
+            # Do not allow literal \n or \r in URL to prevent
+            # HTTP Response Splitting
+            url = re.sub("[\r\n]", "", url)
             self.send_header('Location', url)
             self.send_header('Content-Length', 17)
             self.end_headers()

From 9deb803190a8251fefcf2a9d34a606887d227610 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 4 Jun 2025 19:20:27 -0400
Subject: [PATCH 183/398] chore(ci): issue2551368 use new gpg for all releases.

I was the new version only for 3.10 and newer running on ubuntu 24.04.
Paul said it should work on 3.7 and 3.8 which runn on unbuntu 22.04.
So enable it and see if it works.
---
 .github/workflows/ci-test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index 3832cf835..ae7f83ab7 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -241,7 +241,7 @@ jobs:
           # testing index, which contains a newer version of the
           # bindings on 24.04 or released version for other OS
           # versions. See issue2551368
-          if grep 24.04 /etc/os-release > /dev/null; then \
+          if true || grep 24.04 /etc/os-release > /dev/null; then \
             pip install --index-url https://test.pypi.org/simple/ \
                 --extra-index-url https://pypi.org/simple --pre gpg; \
           else \

From bb0a55a58348e845562ad60708e9001662287de0 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 4 Jun 2025 19:27:35 -0400
Subject: [PATCH 184/398] chore(docker): update python alpine image - fix for
 security alerts?

Also add doc on which digest to use and remove extra blank line.
---
 scripts/Docker/Dockerfile | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/scripts/Docker/Dockerfile b/scripts/Docker/Dockerfile
index 6ae3421d3..27783085d 100644
--- a/scripts/Docker/Dockerfile
+++ b/scripts/Docker/Dockerfile
@@ -23,8 +23,10 @@ ARG source=local
 
 # parameterize the sha256 sum to pin version of python:3-alpine
 # Must use the same version in both build stages.
-ARG SHA256=452682e4648deafe431ad2f2391d726d7c52f0ff291be8bd4074b10379bb89ff
-
+# Note this is the index digest for the image, not the manifest digest.
+# The index digest is shared across archetectures (amd64, arm64 etc.)
+# while the manifest digest is unique per platform/arch.
+ARG SHA256=b4d299311845147e7e47c970566906caf8378a1f04e5d3de65b5f2e834f8e3bf
 
 # Set to any non-empty value to enable shell debugging for troubleshooting
 ARG VERBOSE=

From 1fa433d74ac83bd450d4fc94621455c16cf0b6d8 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 4 Jun 2025 20:12:24 -0400
Subject: [PATCH 185/398] chore(ci): issue2551368 cleanup new gpg use

Remove the old if statement that selected how gpg was installed
now that operation under 3.7 and 3.8 work in testing.
---
 .github/workflows/ci-test.yml | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index ae7f83ab7..53c02357f 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -240,13 +240,9 @@ jobs:
           # used for newer Python versions. Temporarily use the
           # testing index, which contains a newer version of the
           # bindings on 24.04 or released version for other OS
-          # versions. See issue2551368
-          if true || grep 24.04 /etc/os-release > /dev/null; then \
-            pip install --index-url https://test.pypi.org/simple/ \
-                --extra-index-url https://pypi.org/simple --pre gpg; \
-          else \
-            pip install gpg; \
-          fi
+          # versions. See issue2551368. 'pip install gpg' should work.
+          pip install --index-url https://test.pypi.org/simple/ \
+                --extra-index-url https://pypi.org/simple --pre gpg;
 
       - name: Install aux packages that need versions differences
         # if zstd fails install, keep going with test, don't abort

From 7d765c9b11b2031d01cfc02d43d21786e959bc76 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 11 Jun 2025 16:00:44 -0400
Subject: [PATCH 186/398] docs: change some last 3.6 references to 3.7 with
 dropping of 3.6.

---
 doc/features.txt | 2 +-
 doc/rest.txt     | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/doc/features.txt b/doc/features.txt
index 6c2f946ab..880e20ef5 100644
--- a/doc/features.txt
+++ b/doc/features.txt
@@ -18,7 +18,7 @@ from Ka-Ping Yee in the :index:`Software Carpentry` "Track" design competition.
   ``python demo.py`` or `a Docker container`_ in under 5 minutes. 
 - Choose from `five included templates`_ for your tracker.
 - `Customize`_ and use the demo as a template for your production tracker.
-- No need for additional support software, just Python (3.6+ or 2.7)
+- No need for additional support software, just Python (3.7+ or 2.7)
   to get started.
 - Basic installation (including a web interface) takes about 30 minutes.
 - Supports embedded databases like `SQLite`_ and dbm. Upgradable
diff --git a/doc/rest.txt b/doc/rest.txt
index 89d2bad2d..3b0a47f8c 100644
--- a/doc/rest.txt
+++ b/doc/rest.txt
@@ -375,8 +375,8 @@ The rest interface returns status 406 if you use an unrecognized
 extension.  You will also get a 406 status if none of the entries in
 the accept header are available or if the accept header is invalid.
 
-Note: ``dicttoxml2.py`` is an updated version of ``dicttoxml.py``. If
-you are still using Python 2.7 or 3.6, you can use ``dicttoxml.py``.
+Note: ``dicttoxml2.py`` is an updated version of ``dicttoxml.py`` and
+should be used for Roundup running on Python 3.7 or newer.
 
 Also the ``/binary_content`` attribute endpoint can be used to
 retrieve raw file data in many formats.

From 09aca118f132c92bfbe5c0f584a5c11d0f0da5f9 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 11 Jun 2025 16:19:00 -0400
Subject: [PATCH 187/398] docs: Update attributions in CHANGES.txt.

---
 CHANGES.txt | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index bc7c1f91b..cb4b79724 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -13,7 +13,7 @@ Roundup 2.0 supports Python 3.4 and later. Roundup 2.1.0 supports
 python 3.6 or newer (3.4/3.5 might work, but they are not tested).
 Roundup 2.4.0 is the last release to support Python 2.
 
-2025-XX-XX 2.5.0
+2025-XX-XX 2.5.0beta1
 
 Fixed:
 
@@ -88,10 +88,11 @@ Fixed:
   from "itemSynopsis". (Ralf Schlatterbeck)
 - issue2551376: Fix tracebacks in item templates (Ralf Schlatterbeck)
 - issue2551396: Use of os.path.stat.ST_MTIME in python 3.13 crashes
-  roundup on windows. Replaced with equivalent stat.ST_MTIME.
+  roundup on windows. Replaced with equivalent stat.ST_MTIME. (Randy
+  on IRC, fix: John Rouillard and R. David Murray (bitdancer))
 - issue2551323: remove functions used for XHTML template
   support. XHTML was deprecated in Roundup 2.3.0 and an invalid value
-  in 2.4.0.
+  in 2.4.0. (John Rouillard)
 - issue2551406: 'Templating Error: too many values to unpack' crash
   fixed. (reported by and patch Christof Meerwald, commit/test John
   Rouillard)
@@ -107,7 +108,7 @@ Features:
   Marcus Priesch, cleanup to remove python 2 issues, John Rouillard.)
 - issue2551315 - Document use of
   RestfulInstance.max_response_row_size to limit data returned
-  from rest request.
+  from rest request. (John Rouillard)
 - issue2551330 - Add an optional 'filter' function to the Permission
   objects and the addPermission method. This is used to optimize search
   performance by not checking items returned from a database query

From 7dbb35adb85bb94ad3110d532d3248916022239d Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 11 Jun 2025 17:04:51 -0400
Subject: [PATCH 188/398] chore: update files for release 2.5.0b1.

---
 COPYING.txt               |   2 +-
 doc/acknowledgements.txt  |  30 ++
 doc/announcement.txt      | 483 +++++++++----------------
 locale/de.po              | 720 ++++++++++++++++++-------------------
 locale/en.po              | 720 ++++++++++++++++++-------------------
 locale/es.po              | 722 +++++++++++++++++++-------------------
 locale/fr.po              | 722 +++++++++++++++++++-------------------
 locale/hu.po              | 720 ++++++++++++++++++-------------------
 locale/it.po              | 721 ++++++++++++++++++-------------------
 locale/ja.po              | 720 ++++++++++++++++++-------------------
 locale/lt.po              | 720 ++++++++++++++++++-------------------
 locale/nb.po              | 720 ++++++++++++++++++-------------------
 locale/roundup.pot        | 716 ++++++++++++++++++-------------------
 locale/ru.po              | 720 ++++++++++++++++++-------------------
 locale/zh_CN.po           | 720 ++++++++++++++++++-------------------
 locale/zh_TW.po           | 720 ++++++++++++++++++-------------------
 roundup/__init__.py       |   2 +-
 scripts/Docker/Dockerfile |   2 +-
 setup.py                  |   4 +-
 19 files changed, 4952 insertions(+), 4932 deletions(-)

diff --git a/COPYING.txt b/COPYING.txt
index ac8764339..18d9f1c3b 100644
--- a/COPYING.txt
+++ b/COPYING.txt
@@ -5,7 +5,7 @@ Roundup, exclusive of the Zope page templates, is `MIT licensed`_.
 Roundup Licensing
 -----------------
 
-| Copyright (c) 2009-2024 Roundup-Team (https://opensource.org/license/mit)
+| Copyright (c) 2009-2025 Roundup-Team (https://opensource.org/license/mit)
 | Copyright (c) 2003-2009 Richard Jones  (richard@mechanicalcat.net)
 | Copyright (c) 2002 eKit.com Inc
 | Copyright (c) 2001 Bizar Software Pty Ltd
diff --git a/doc/acknowledgements.txt b/doc/acknowledgements.txt
index af3e8029a..ab6840b6f 100644
--- a/doc/acknowledgements.txt
+++ b/doc/acknowledgements.txt
@@ -16,6 +16,36 @@ ideas and everything else that helped!
 
 .. _`Announcement with changelog for current release.`: announcement.html
 
+2.5
+---
+
+2.5.0
+~~~~~
+
+Maintainer: John Rouillard
+
+Release Manager: John Rouillard
+
+Developer activity by changesets::
+
+
+  rouilj@ieee.org  222 *****************************************************
+  rsc@runtux.com    27 ******
+
+Other contributers:
+
+Christof Meerwald - reported issue 2551387
+
+Ludwig Reiter - reported issue 2551074
+
+Marcus Priesch - patch for issue 2551287
+
+Paul Schwabauer - updates to gpg python module so it still works for Roundup.
+
+Randy - reported issue 2551396
+
+Tobias Herp - patch for issue 1895197
+
 2.4
 ---
 
diff --git a/doc/announcement.txt b/doc/announcement.txt
index b45319be8..af9535591 100644
--- a/doc/announcement.txt
+++ b/doc/announcement.txt
@@ -1,15 +1,13 @@
-I'm proud to release version 2.4.0 of the Roundup issue
+I'm proud to release version 2.5.0b1 of the Roundup issue
 tracker.  This release is a bugfix and feature release, so
 make sure to read `docs/upgrading.txt
 <https://www.roundup-tracker.org/docs/upgrading.html>`_ to
 bring your tracker up to date.
 
-The 79 changes, as usual, include some new features and many
+The 41 changes, as usual, include some new features and many
 bug fixes.
 
-Version 2.4.0 will be the last release to support Python
-2. The next minor release, planned for mid 2025, will occur
-5 years after Roundup started supporting Python 3.
+Version 2.5.0b1 does not support Python 2.
 
 Note that you should run ``roundup-admin ... migrate`` to
 update the database schema version. Do this before you use
@@ -26,73 +24,54 @@ You can install it with::
 
 then unpack and test/install from the tarball.
 
-Among the notable improvements in 2.4.0 from the 2.3.0
+Among the notable improvements in 2.5.0 from the 2.4.0
 release are:
 
-* three CVE's have been fixed. One requires changes to your
-  tracker's home directory. The other two are fixed by
-  installing 2.4.0.  See
-  https://www.roundup-tracker.org/docs/security.html for
-  details and instructions on how to fix these in 2.4.0 and
-  earlier releases.
+* detect more errors in RPN search expressions. Return more
+  useful error messages. Documented (advanced) RPN search expressions
+  in the user guide.
 
-* new classhelper component thanks to a team of students
-  from CS682 at U-Mass Boston. This fixes many issues with
-  the old classhelper. It is implemented as a web-component
-  and needs REST interface access. It will fall back to the
-  classic classhelper if REST is not available or if the
-  browser does not support web-components.
+* change default password hash method to PBKDF2 with SHA512. You
+  may need to reset password_pbkdf2_default_rounds to a lower
+  value. See upgrading doc.
 
-* fix Windows Python installation using pip. It used to go
-  into an infinite loop during install or download. Also fix
-  installation of shared files (templates) so roundup-admin
-  can find them.
+* add filter function to Permission objects. This pushes some
+  permission checks down to the SQL database and speeds up display of
+  index pages.
 
-* using ``@current_user`` as a value in a search URL for a
-  user property will use the current logged in user. Now you
-  can share searches like: "My issues" as "my" will become
-  the current logged in user.
+* fix crash bug on windows with Python 3.13
 
-* login failures to the REST/XML-RPC interfaces are now rate
-  limited to limit password guessing attacks.
+* update doc on required REST headers. Also other docs updates.
 
-* utf8mb4 is the default charset for MySQL. This requires
-  migrating your database using the mysql client. You can
-  choose to keep the older character set in config.ini.
+* detect error condition early when we can't respond with requested
+  REST format response (e.g. xml is requested).
 
-* PostgreSQL services defined in pg_service.conf can be
-  used.  PostgreSQL schemas are supported to eliminate the
-  need for the roundup user to have database
-  creation/deletion privileges.
+* do not generate an error if a PUT REST request sets the user's
+  address to the current value.
 
-* fix out of memory issue when importing larger trackers
-  into PostgreSQL.
+* make ``roundup-gettext`` extract translatable strings from detectors
+  and extensions.
 
-* multiple roundup-admin improvements: display protected
-  properties (like creation date), better formatting of
-  output, command history. Also on windows, pyreadline3 is
-  supported to provide an editable interactive command line.
+* improve security of session cookies by marking them with the magic
+  ``__Secure__`` prefix.
 
-* an experimental wsgi performance improvement in 2.3.0 is
-  now now the default and is opt-out.
+* make the rest endpoint return raw message or file content data. Use
+  the ``binary_content`` endpoint and a suitable ``Accept``` header in
+  the request.
 
-* new template functions: utils.readfile and
-  utils.expandfile. Javascript that is included in the
-  Python core will be moved to external files and be able to
-  have values from Roundup substituted in the Javascript.
+* add support for the ``defusedxml`` Python module to improve security when
+  using XML.
 
-* allow content-type of a template to be set from inside the
-  template.  This allows returning json or xml from a
-  template without a .json or .xml extention.
+* add templating function: ``utils.set_http_response(integer)`` to set
+  HTTP return code from your template.
 
-* fix import/export on windows to use Unix style line
-  endings fixing export/import on Windows and making exports
-  portable across platforms.
+* add generation of native HTML date and number/integer inputs. See
+  Upgrading for caveats this is disabled by default.
 
-* various other Windows platform fixes including test suite
-  fixes.
+* re-enable support for GPG/PGP signed emails. Requires installing
+  from the test PyPi repository.
 
-* sqlite version 1 and StructuredText support removed.
+* remove XHTML support simplifying the code base
 
 The file CHANGES.txt has a detailed list of feature
 additions and bug fixes for each release. The most recent
@@ -182,270 +161,146 @@ and postgresql).
 Recent Changes
 ==============
 
-From 2.3.0 to 2.4.0
+From 2.4.0 to 2.5.0
 
 Fixed:
 
-- CVE-2024-39124 - The classhelpers (_generic.help.html) are
-  vulnerable to an XSS attack. A specially crafted URL that used
-  that endpoint would result in running a script embedded in the
-  URL. (Found/reported by Alec Romano (4rdr), fix/tests John
+- issue2551343 - Remove support for PySQLite. It is unmaintained
+  and sqlite3 is used which is the default for a Python
+  distribution.  (John Rouillard)
+- replace use of os.listdir with os.scandir. Performance
+  improvement.  Using with Python 2 requires 'pip install
+  scandir'. (John Rouillard)
+- issue2551131 - Return accept-patch if patch body not accepted
+  (415 code). Accept-Patch returned with acceptable values. (John
   Rouillard)
-- CVE-2024-39125 - If the Referer header is set to a script tag,
-  it will be executed when the error in the Referer header is
-  reported. (Found/reported by Alec Romano (4rdr), fix/tests John
+- issue2551074 - In "responsive" template: click on hide comment leads
+  to a red error msg. (Report by Ludwig Reiter; fix John Rouillard)
+- issue2550698 - added documentation on filtering using RPN property
+  expressions. (John Rouillard)
+- issue2551372 - Better document necessary headers for REST and fix
+  logging to log missing Origin header (Ralf Schlatterbeck with
+  suggestions on documentation by John Rouillard)
+- issue2551289 - Invalid REST Accept header with post/put performs
+  change before returning 406. Error before making any changes to the
+  db if we can't respond with requested format. (John Rouillard)
+- issue2551356 - Add etag header when If-Modified-Since GET request
+  returns not-modified (304). Breaking change to function signature
+  for client.py-Client::_serve_file(). (John Rouillard)
+- issue2551381 - roundup-server parses URI's with multiple '?"
+  incorrectly. (John Rouillard)
+- issue2551382 - invalid @verbose, @page_* values in rest uri's
+  generate 409 not 400 error. (John Rouillard)
+- fix issues with rest doc and use of PUT on a property item. Response
+  is similar to use of PUT on the item, not a GET on the
+  item. Discovered while fuzz testing. (John Rouillard)
+- issue2551383 - Setting same address via REST PUT command results in
+  an error. Now the userauditor does not trigger an error if a user
+  sets the primary address to the existing value. (John Rouillard)
+- issue2551253 - Modify password PBKDF2 method to use SHA512. The
+  default password hashing algorithm has been upgraded to
+  PBKDF2-SHA512 from PBKDF2-SHA1. The default pbkdf2 rounds in the
+  config file has been changed to 250000. The admin should change it
+  manually if it is at 2 million. PBKDF2-SHA512 (PBKDF2S5) has been
+  available since release 2.3, but it required a manual step to make
+  it the default. (John Rouillard)
+- fixed a crash with roundup-admin perftest password when rounds not set
+  on command line. (John Rouillard)
+- issue2551374 - Add error handling for filter expressions. Filter
+  expression errors are now reported. (John Rouillard)
+- issue2551384: Modify flow in client.py's REST handler to verify
+  authorization earlier. The validation order for REST requests
+  has been changed. Checking user authorization to use the REST
+  interface is done before validating the Origin header. As a
+  result, incorrectly formatted CORS preflight requests
+  (e.g. missing Origin header) can now return HTTP status 403 as
+  well as status 400. (John Rouillard)
+- issue2551387 - TypeError: not indexable. Fix crash due to
+  uninitialized list element on a (Mini)FieldStorage when unexpected
+  input is posted via wsgi. (Reported and debugged by Christof
+  Meerwald; fix John Rouillard)
+- close http socket and send a 408 status when a timeout exception
+  is handed in roundup-server. This prevents another exception
+  caused by using a timed out socket. (John Rouillard)
+- issue2551391, partial fix for issue1513369. input fields were
+  not getting id's assigned. Fixed automatic id assignment to
+  input fields. Thinko in the code. (John Rouillard)
+- issue1895197 - translated help texts in admin.py not displayed
+  correctly. (Initial patch tobias-herp, John Rouillard)
+- issue2551238 - roundup-server should exit with error if -d
+  <pidfile> is used without -l <logfile>. Added code to report
+  the issue. Added issue with relative paths for log file whn
+  using -L and -d with roundup-server. (John Rouillard)
+- Allow the specification of a "form" parameter for Date fields to make
+  the popup calendar work when the enclosing form has a name different
+  from "itemSynopsis". (Ralf Schlatterbeck)
+- issue2551376: Fix tracebacks in item templates (Ralf Schlatterbeck)
+- issue2551396: Use of os.path.stat.ST_MTIME in python 3.13 crashes
+  roundup on windows. Replaced with equivalent stat.ST_MTIME. (Randy
+  on IRC, fix: John Rouillard and R. David Murray (bitdancer))
+- issue2551323: remove functions used for XHTML template
+  support. XHTML was deprecated in Roundup 2.3.0 and an invalid value
+  in 2.4.0. (John Rouillard)
+- issue2551406: 'Templating Error: too many values to unpack' crash
+  fixed. (reported by and patch Christof Meerwald, commit/test John
   Rouillard)
-- CVE-2024-39126 - PDF, XML and SVG files attached to an issue can contain
-  embedded JavaScript. This JavaScript was executed when the file was
-  accessed. PDF files are now downloaded and not displayed in the
-  browser. A content security policy is added for all download files
-  which prevents code execution in SVG files.  (Found/reported by Alec
-  Romano (4rdr), fix/tests John Rouillard)
-- issue2551282 - MySQL utf8mb4 issues and
-  issue2551115 - Use utf8mb4 as a default for MySQL instead of utf8
-  The default database type and collations have been set to:
-  utf8mb4, utf8mb4_unicode_ci and utf8mb4_0900_bin. They are (sadly)
-  configurable from config.ini. Require directions on upgrading the
-  MySQL db have been documented in upgrading.txt.
-- issue2551063 - Rest/Xmlrpc interfaces needs failed login protection.
-  Failed API login rate limiting with expiring lockout added. (John
-  Rouillard)
-- issue2551184 - improve i18n handling. Patch to test to make sure it
-  uses the test tracker's locale files and not other locale
-  files. (Marcus Priesch)
-- issue2551283 - fail if version 2.4.9 of markdown2 is used, it broke
-  [issue1](issue1) style links. Support markdown2 2.4.8 and earlier
-  and 2.4.10 with its new schema filtering method. (John Rouillard)
-- multiple flake8 fixes (John Rouillard)
-- rename loop variable in 'for sendto in sendto:' (John Rouillard)
-- issue2551193 - Fix roundup for removal of cgi and cgitb standard
-  python modules (and FieldStorage/MiniFieldStorage). Replaced imports
-  from cgi to use roundup.anypy.cgi\_ which will load the system cgi
-  unless it is missing. Then it will load roundup.anypy.vendored.cgi
-  and make \*FieldStorage symbols available. Roundup uses its own
-  cgitb.py and not the system cgitb.py. It looks like it's the
-  precursor to the system cgitb.py. (John Rouillard)
-- issue2551278 - datetime.datetime.utcnow deprecation. Replace
-  calls with equivalent that produces timezone aware dates rather than
-  naive dates. (John Rouillard)
-- when using "roundup-admin display" indent the listing only if
-  headers or protected fields are requested. This makes the output
-  look like it did previously to 2.3.0 if the new features aren't
-  used.  Roundup-admin output was never meant to be machine parsed, but
-  don't break it unless required. (John Rouillard)
-- issue2551290 - pip install roundup Hangs on Windows 10
-  The install under windows goes into an infinite loop using pip or
-  source install. (John Rouillard)
-- Document use of pyreadline3 to allow roundup-admin to have CLI editing
-  on windows. (John Rouillard)
-- issue2551293 - remove schema_hook from Tracker instance. Looks like
-  it was an obsolete hook used for testing. Never documented and not
-  accessible from schema.py.
-- Fix roundup-admin security command. Lowercase its optional
-  argument. Roles are indexed by lower case role name. So 'security
-  User' and 'security user' should generate the same output. (John
-  Rouillard from issue on mailing list by Chuck Cunningham)
-- make roundup-server exit more quickly on ^C. This seems to be
-  limited to windows. (John Rouillard)
-- Fix error handling so failure during import of a non-user item
-  doesn't cause a second traceback. (Found by Norbert Schlemmer, fix
-  John Rouillard)
-- Handle out of memory error when importing large trackers in
-  PostgreSQL. (Found by Norbert Schlemmer, extensive testing by
-  Norbert, fix John Rouillard)
-- use unittest.mock rather than mock for
-  test/test_hyperdbvals.py. (found by Ralf Schlatterbeck. Fix John
-  Rouillard)
-- disable proxy with wget in roundup_healthcheck. (Norbert Schlemmer
-  Noschvie on github.com)
-- support dicttoxml2.py for Roundup running on 3.7 and
-  newer. dicttoxml uses a type alias: collection.Iterator that is
-  dropped in Python 3.10. (found by Norbert Schlemmer, fix John
-  Rouillard)
-- fix duplicate html id 'password' in user.item.html in all templates except
-  jinja2. (John Rouillard)
-- fix unclosed file when saving index in indexer_dbm.py. (John Rouillard)
-- fix task index in devel tracker so it doesn't cause a crash if all
-  fields are selected. (John Rouillard)
-- fix windows install. When using pip share directory is installed in
-  a directory tree under the lib directory. Fix it so that Lib/share
-  is used to install the share tree. The lets Roundup find tracker
-  templates and translation files. (Found by Simon Eigeldinger, fix
-  John Rouillard)
-- fix roundup-demo, interactive mode would nuke an existing tracker.
-  (Found Tonu Mikk, fix John Rouillard)
-- fix detection/reporting when using a SQLite3 library without FTS5
-  support. Install docs updated to state that FTS5 support is required
-  when using SQLite for back end. (Found Tonu Mikk, fix John
-  Rouillard)
-- issue2551320: user.help-search.html doesn't respect
-  properties. Setting url parameter properties when using the
-  classhelp for users now shows the requested properties. (Found by
-  Patel Malav and Nikunj Thakkar of the UMass-Boston CS682 Spring
-  2024 class; fix John Rouillard)
-- use ast.eval_literal() rather than eval() to turn CSV exported
-  string values into Python object/values.
-- use template's guess at Content-Type in headers only if Content-Type
-  is not already set. This allows a template to set its own content
-  type. For example: _generic.translate can set content type (via
-  request.client.additional_headers) to application/json and return
-  json from the template. This json could access the 1i18n functions
-  for a javascript helper. (John Rouillard)
-- when template processing raises an exception the line number is
-  sometimes missing. This causes cgitb to raise a second exception
-  which clobbers the info about the template issue. As a stop-gap set
-  the line number to -1 so the original traceback can be seen. This
-  could be a bug in ZopeTAL. (John Rouillard)
-- issue2551328 - REST results show next link if number of results is a
-  multiple of page size. There should be no next link. (Found by Patel
-  Malav and Bharath Kanama of the UMass-Boston CS682 Spring 2024
-  class; fix John Rouillard)
-- issue2551264 - REST X-Total-Count header and @total_size count
-  incorrect when paginated - correct values are now returned.
-  (John Rouillard)
-- issue2551331 - Fix repeat first/last methods. (John Rouillard)
-- Fix import/export on windows. Use unix line terminating characters.
-  (John Rouillard)
-- Fix anydbm session/otks clear() method on windows when backed by
-  dumbdbm. Also make anydbm detect the initialized database when
-  using dumbdbm. (John Rouillard)
-- Use of '-' directory in static_files config option under windows
-  Python fixed. (John Rouillard)
-- issue2551334 - number of test bugs that prevented test suite from
-  running under Windows Python are fixed. WIP. (John Rouillard)
-- issue2551302 - Remove support for sqlite version 1 from
-  back_sqlite.py. We have been using sqlite3 for over a decade. (John
-  Rouillard)
-- issue2551285 - Remove StructuredText support. reStructuredText is
-  still supported. (John Rouillard)
-- Use roundup-demo -p option to set listening port. Was ignored
-  before. (John Rouillard)
-- issue2551346 - Classic tracker's statusauditor raises error if
-  detectors/config.ini missing
-  STATUSAUDITOR_CHATTING_REQUIRES_TWO_USERS.  The statusauditor.py for
-  jinja2 and classic templates has been changed to assume that this
-  option is off when the setting is missing from
-  detectors/config.ini. Other templates do not implement this option.
-  (John Rouillard)
-- issue2551350 - Python changes for 3.12 with roundup 2.3.0. Fixes for
-  cgitb.py crash due to pydoc.html.header() signature change. (Patch
-  by Andrew (kragacles), applied John Rouillard)
-- issue2551350 - Python changes for 3.12 with roundup 2.3.0. Fixes for
-  mailer.py crash due to change in starttls signature change. (Patch
-  by Andrew (kragacles), modified and applied John Rouillard)
-- make classhelper link open in a new window by setting
-  target="_blank". This prevents overwriting of current page with the
-  classhelper if javascript is disabled. (John Rouillard)
-- issue2551341 - if @columns missing from an index url, the
-  group headers colspan property = 0. Add "or 100" in
-  stanza's so headers span all rows (up to 100).
-- fix roundup-server response requiring a 301 redirect. Did
-  not set content length leading to hang/error. (John
-  Rouillard)
-- report basename of filename when template file is invalid
-  rather than reporting a TypeError. (John Rouillard)
-- Make Last-Modified header use GMT not -0000 timezone. Fix error
-  reported by redbot testing. (John Rouillard)
-- Send Vary: Accept-Encoding on any file that could be compressed
-  even if the file is not encoded/compressed. Found by Redbot
-  testing. (John Rouillard)
-- make If-None-Match work for static file (@@file) case. Found by
-  Redbot testing (John Rouillard)
-- Send vary: accept-encoding for if-modified-since conditional
-  requests where the file is not modified. (John Rouillard)
-- Update JWT example in rest.py to use replacement for
-  datetime.datetime.utcnow(). (John Rouillard)
-- issue2551219 - document requirements of PEM file when using
-  roundup-server in SSL/TLS mode. Report better error messages
-  when PEM file is missing certificate or private key. (John
-  Rouillard)
-- Cleanup tracker index generation by roundup-server. Send
-  correct Content-Length headers so HTTP/1.1 connections don't
-  hang. (John Rouillard)
-- Fix delay when using csv export actions. The CSV file is written
-  incrementally, so we can't determine the Content-Length. When using
-  HTTP/1.1, this causes a delay while the browser waits for a timeout.
-  Forcing the connection to close after the CSV file is written
-  removes the delay. (John Rouillard)
+- fix potential HTTP Response Splitting issue in
+  roundup-server. Discovered by CodeQL in CI. (John Rouillard)
 
 Features:
 
-- issue2551323 - Remove XHTML support. Disabled option to set
-  html_version to xhtml. Running roundup commands with html_version
-  set to xhtml will result in an "Invalid value for HTML_VERSION:
-  'xhtml'" error. (John Rouillard)
-- issue2551103 - add pragma 'display_protected' to roundup-admin. If
-  true, print protected attributes like id, activity, actor...
-  when using display or specification subcommands. (John Rouillard)
-- add -P pragma=value command line option to roundup-admin. Allows
-  setting pragmas when using non-interactive mode. (John Rouillard)
-- issue685275 - add pragma show_retired to control display of retired
-  items when using list/table. Add pragma display_header to print
-  headers for display command. Header displays designator and
-  retired/active status. (John Rouillard)
-- issue2551299 - support config.ini rdbms option 'service'. Allow use
-  of a PostgreSQL connection service file (pg_service.conf) for
-  configuring database on a per-tracker basis. Also replaces use of
-  PGSERVICE env variable for single instance trackers. (From ML
-  question by ivanov. John Rouillard)
-- issue2550852 - support for specifying a PostgreSQL schema to use for
-  the Roundup database. (Patch by Stuart McGraw; slight modifications,
-  tests, docs: John Rouillard).
-- issue2551274: add configurable logging for REST API when something
-  fails, we now log status code and error message.
-  (Ralf Schlatterbeck)
-- issue2551317 - add some Jinja2 examples to customizing.txt
-  document. (John Rouillard)
-- multiple scripts/... updates - Python3, linting, enhancements:
-  weekly-report,schema-dump.py, roundup-reminder, copy-user.py,
-  dump_dbm_sessions_db.py, contributors.py (John Rouillard)
-- roundup/msgfile.py can now be called as 'python msgfmt.py de.po de.mo'
-  or 'python msgfmt.py -o de.mo de.po' to compile a translation file if
-  GNU msgfmt is missing. (John Rouillard)
-- save roundup-admin history between sessions. Load
-  ~/.roundup_admin_rlrc file to set history-size persistently. Add
-  pragma history_length to override for a session. (John Rouillard)
-- the roundup-admin history command now dumps the journal entries
-  in a more human readable format. Use the raw option to get the older
-  machine parsible output. (John Rouillard)
-- Multiple JWT secrets are supported to allow key rotation. See
-  an updated config.ini for details. (John Rouillard)
-- issue2551212 - wsgi performance improvement feature added in 2.2.0
-  is active by default. Can be turned off if needed. See upgrading.txt
-  for info. (John Rouillard)
-- issue2551270 - Better templating support for JavaScript. Add
-  utils.readfile(file, optional=False) and utils.expandfile(file,
-  token_dict=None, optional=False). Allows reading an external file
-  (e.g. JavaScript) and inserting it using tal:contents or equivalent
-  jinja function. expandfile allows setting a dictionary and tokens in
-  the file of the form "%(token_name)s" will be replaced in the file
-  with the values from the dict. (John Rouillard)
-- add @group to rest interface collection queries. Useful when using
-  optgroup in select elements. (John Rouillard)
-- roundup-demo can set the hostname in the URL using the -H
-  parameter. So you can start a demo tracker that is available from
-  your network using 'roundup-demo ... -B hostname -H hostname'. (John
-  Rouillard)
-- issue2551347 - make _generic.help.html work without property
-  settings. THis applies to classic or minimal trackers. It allows use
-  of classhelp without the property seting for informtion only
-  (e.g. description of what a priority or status means) without being
-  able to select the property in the classhelper.  Good for adding help
-  for Link properties. (John Rouilllard)
-- issue1525113 - notation to filter by logged-in user. Use
-  @current_user with properties that are a Link to the 'user' class to
-  match the currently logged in user. Allows sharing of queries like
-  "Issues I created" or "Issues I am assigned to" by removing the
-  hard coded user id number and replacing it with the current user's
-  id. Tracker templates updated to use it. (John Rouillard from a
-  patch by Jon C. Thomason)
-- Add a /rest/data/user/roles REST endpoint. (John Rouillard)
-- issue2551353 - Add roundup-classhelper for 2.4.0
-  release. Integrate new classhelper web component to wrap
-  existing classhelper link. This fixes a number of
-  outstanding bugs against the current classhelper using
-  current web features. (Patel Malav, Nikunj Thakkar,
-  Bharath Kanama with integration by John Rouillard)
-- disable spellcheck on all password fields to try to prevent
-  browser from exposing passwords to external servers. (John
+- issue2551287 - Enhance roundup_gettext.py to extract strings from
+  detectors/extensions. If the polib module is available,
+  roundup-gettext will extract translatable strings from the tracker's
+  Python code. If polib is missing, it will print a warning. (Patch
+  Marcus Priesch, cleanup to remove python 2 issues, John Rouillard.)
+- issue2551315 - Document use of
+  RestfulInstance.max_response_row_size to limit data returned
+  from rest request. (John Rouillard)
+- issue2551330 - Add an optional 'filter' function to the Permission
+  objects and the addPermission method. This is used to optimize search
+  performance by not checking items returned from a database query
+  one-by-one (using the check function) but instead offload the
+  permission checks to the database. For SQL backends this performs the
+  filtering in the database.  (Ralf Schlatterbeck)
+- issue2551370 - mark roundup session cookie with __Secure-
+  prefix. (John Rouillard)
+- add -P flag to roundup-server to log client address from
+  X-Forwarded-For reverse proxy header rather than connecting
+  address. This logs the actual client address when
+  roundup-server is run behind a reverse proxy. It also appends a
+  + sign to the logged address/name. (John Rouillard)
+- issue2551068 - Provide way to retrieve file/msg data via rest
+  endpoint. Raw file/msg data can be retrieved using the
+  /binary_content attribute and an Accept header to select the mime
+  type for the data (e.g. image/png for a png file). The existing html
+  interface method still works and is supported, but is legacy. (John
+  Rouillard) 
+- added fuzz testing for some code. Found issue2551382 and
+  others. (John Rouillard)
+- issue2551116 - Replace xmlrpclib (xmlrpc.client) with defusedxml.
+  Added support for defusedxml to better secure the xmlrpc
+  endpoint. (John Rouillard)
+- Added new instance.registerUtilMethod() method to make using complex
+  templating easier as it provides a default Client instance to the
+  templating method. (John Rouillard)
+- Added new templating utils.set_http_response(integer) method to
+  allow reporting an error to the user from a template. (John
   Rouillard)
+- issue2551390 - Replace text input/calendar popup with native
+  date input. Also add double-click and exit keyboard handlers to
+  allow copy/paste/editing the text version of the date. Configurable
+  via the use_browser_date_input setting in the [web] section of
+  config.ini. By default browser native dates are turned off.
+  (John Rouillard, Ralf Schlatterbeck)
+- Use native number type input for Number() and Integer()
+  properties. Integer() uses step=1 as well. Configurable via the
+  use_browser_number_input setting in the [web] section of config.ini.
+  Set off by default. See
+  https://issues.roundup-tracker.org/issue2551398 for discussion of
+  issues with native number inputs.  (John Rouillard, Ralf
+  Schlatterbeck)
+- issue2551231 - template.py-HTMLClass::classhelp doesn't merge
+  user defined classes. It now merges them in. (John Rouillard)
+- re-enable support for GPG/PGP encrypted emails using new python gpg
+  package on the test pypi instance. (Paul Schwabauer)
diff --git a/locale/de.po b/locale/de.po
index 634d5ef13..5ec70f049 100644
--- a/locale/de.po
+++ b/locale/de.po
@@ -5,9 +5,9 @@
 #
 msgid ""
 msgstr ""
-"Project-Id-Version: Roundup 2.5.0\n"
+"Project-Id-Version: Roundup 2.5.0b1\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
-"POT-Creation-Date: 2025-01-12 20:17-0500\n"
+"POT-Creation-Date: 2025-06-11 16:02-0400\n"
 "PO-Revision-Date: 2016-04-11 09:13+0200\n"
 "Last-Translator: Tobias Herp <tobias.herp@gmx.de>\n"
 "Language-Team: German Translators <roundup-devel@lists.sourceforge.net>\n"
@@ -30,19 +30,19 @@ msgstr ""
 msgid "You may not retire the admin or anonymous user"
 msgstr "Sie kÃ¶nnen den Administrator oder den Gast-Benutzer nicht lÃ¶schen"
 
-#: ../roundup/admin.py:131
+#: ../roundup/admin.py:132
 msgid ""
 "Have 'display designator[,designator*]' show header inside\n"
 "      []'s before items. Includes retired/active status.\n"
 msgstr ""
 
-#: ../roundup/admin.py:135
+#: ../roundup/admin.py:136
 msgid ""
 "Have 'display designator' and 'specification class' show\n"
 "      protected fields: creator, id etc.\n"
 msgstr ""
 
-#: ../roundup/admin.py:139
+#: ../roundup/admin.py:140
 msgid ""
 "Controls history options. It is a bitstring where setting\n"
 "      the bit disables the feature. A value of 0 (default)\n"
@@ -53,51 +53,51 @@ msgid ""
 "      history.\n"
 msgstr ""
 
-#: ../roundup/admin.py:148
+#: ../roundup/admin.py:149
 msgid ""
 "Set the number of lines of history to keep for this session.\n"
 "      -1 is infinite.\n"
 msgstr ""
 
-#: ../roundup/admin.py:152
+#: ../roundup/admin.py:153
 msgid "Set indexer to use when running 'reindex' NYI\n"
 msgstr ""
 
-#: ../roundup/admin.py:155
+#: ../roundup/admin.py:156
 msgid "Force reopening of tracker when running each command.\n"
 msgstr ""
 
-#: ../roundup/admin.py:158
+#: ../roundup/admin.py:159
 msgid ""
 "set the number of rows imported before a database commit is\n"
 "      done. Used only for imports on PostgreSQL.\n"
 msgstr ""
 
-#: ../roundup/admin.py:160
+#: ../roundup/admin.py:161
 msgid "Show retired items in table, list etc. One of 'no', 'only', 'both'\n"
 msgstr ""
 
-#: ../roundup/admin.py:162
+#: ../roundup/admin.py:163
 msgid "internal mapping for show_retired.\n"
 msgstr ""
 
-#: ../roundup/admin.py:163
+#: ../roundup/admin.py:164
 msgid "Enable verbose output: tracing, descriptions...\n"
 msgstr ""
 
-#: ../roundup/admin.py:175 ../roundup/admin.py:1188 ../roundup/admin.py:1858
-#: ../roundup/admin.py:1890 ../roundup/admin.py:175:1188 :1858:1890
+#: ../roundup/admin.py:176 ../roundup/admin.py:1199 ../roundup/admin.py:1869
+#: ../roundup/admin.py:1901 ../roundup/admin.py:176:1199 :1869:1901
 #, python-format
 msgid "no such class \"%(classname)s\""
 msgstr "Die Klasse \"%(classname)s\" existiert nicht"
 
 # ../roundup/admin.py:93 :97
-#: ../roundup/admin.py:188
+#: ../roundup/admin.py:189
 #, python-format
 msgid "argument \"%(arg)s\" not propname=value"
 msgstr "Der Parameter \"%(arg)s\" entspricht nicht dem Format Eigenschaft=Wert"
 
-#: ../roundup/admin.py:201
+#: ../roundup/admin.py:202
 #, python-format
 msgid ""
 "Problem: %(message)s\n"
@@ -106,7 +106,7 @@ msgstr ""
 "Problem: %(message)s\n"
 "\n"
 
-#: ../roundup/admin.py:202
+#: ../roundup/admin.py:203
 #, fuzzy, python-format
 msgid ""
 "%(message)sUsage: roundup-admin [options] [<command> <arguments>]\n"
@@ -158,12 +158,12 @@ msgstr ""
 " roundup-admin help <Befehl>              -- Hilfe zu einem Befehl anzeigen\n"
 " roundup-admin help all                   -- sÃ¤mtliche Hilfen anzeigen\n"
 
-#: ../roundup/admin.py:231
+#: ../roundup/admin.py:232
 #, fuzzy
 msgid "Commands: "
 msgstr "Befehle:"
 
-#: ../roundup/admin.py:238
+#: ../roundup/admin.py:249
 msgid ""
 "Commands may be abbreviated as long as the abbreviation\n"
 "matches only one command, e.g. l == li == lis == list."
@@ -171,7 +171,7 @@ msgstr ""
 "Befehle kÃ¶nnen abgekÃ¼rzt werden, solange sie eindeutig bleiben, \n"
 "z.B. l == li == lis == list."
 
-#: ../roundup/admin.py:270
+#: ../roundup/admin.py:281
 #, fuzzy
 msgid ""
 "\n"
@@ -299,25 +299,25 @@ msgstr ""
 "\n"
 "Befehlshilfe:\n"
 
-#: ../roundup/admin.py:334
+#: ../roundup/admin.py:345
 #, python-format
 msgid "%s:"
 msgstr "%s:"
 
 # ../roundup/admin.py:336 :382
-#: ../roundup/admin.py:439 ../roundup/admin.py:1415
-#: ../roundup/admin.py:439:1415
+#: ../roundup/admin.py:450 ../roundup/admin.py:1426
+#: ../roundup/admin.py:450:1426
 msgid "Templates:"
 msgstr "Vorlagen:"
 
 # ../roundup/admin.py:339 :393
-#: ../roundup/admin.py:442 ../roundup/admin.py:1425
-#: ../roundup/admin.py:442:1425
+#: ../roundup/admin.py:453 ../roundup/admin.py:1436
+#: ../roundup/admin.py:453:1436
 msgid "Back ends:"
 msgstr "Datenbanken:"
 
 #. noqa: ARG002
-#: ../roundup/admin.py:459
+#: ../roundup/admin.py:470
 msgid ""
 "Usage: commit\n"
 "        Commit changes made to the database during an interactive session.\n"
@@ -342,7 +342,7 @@ msgstr ""
 "        geschrieben.\n"
 "        "
 
-#: ../roundup/admin.py:474
+#: ../roundup/admin.py:485
 msgid ""
 "Usage: create classname property=value ...\n"
 "        Create a new entry of a given class.\n"
@@ -362,42 +362,42 @@ msgstr ""
 
 # ../roundup/admin.py:358 :483 :562 :612 :682 :703 :731 :802 :869 :940 :988
 # :1010 :1037 :1098 :1156
-#: ../roundup/admin.py:482 ../roundup/admin.py:555 ../roundup/admin.py:606
-#: ../roundup/admin.py:733 ../roundup/admin.py:806 ../roundup/admin.py:851
-#: ../roundup/admin.py:902 ../roundup/admin.py:999 ../roundup/admin.py:1216
-#: ../roundup/admin.py:1388 ../roundup/admin.py:1516 ../roundup/admin.py:1599
-#: ../roundup/admin.py:1725 ../roundup/admin.py:1848 ../roundup/admin.py:1880
-#: ../roundup/admin.py:1996 ../roundup/admin.py:2050 ../roundup/admin.py:2098
-#: ../roundup/admin.py:482:555 :1216:1388:1516 :1599:1725 :1848:1880 :1996:2050
-#: :2098 :606:733 :806:851 :902:999
+#: ../roundup/admin.py:493 ../roundup/admin.py:566 ../roundup/admin.py:617
+#: ../roundup/admin.py:744 ../roundup/admin.py:817 ../roundup/admin.py:862
+#: ../roundup/admin.py:913 ../roundup/admin.py:1010 ../roundup/admin.py:1227
+#: ../roundup/admin.py:1399 ../roundup/admin.py:1527 ../roundup/admin.py:1610
+#: ../roundup/admin.py:1736 ../roundup/admin.py:1859 ../roundup/admin.py:1891
+#: ../roundup/admin.py:2007 ../roundup/admin.py:2061 ../roundup/admin.py:2109
+#: ../roundup/admin.py:493:566 :1227:1399 :1527:1610 :1736:1859 :1891:2007
+#: :2061:2109 :617:744 :817:862 :913:1010
 msgid "Not enough arguments supplied"
 msgstr "Zu wenig Parameter Ã¼bergeben"
 
-#: ../roundup/admin.py:502
+#: ../roundup/admin.py:513
 #, python-format
 msgid "%(propname)s (Password): "
 msgstr "%(propname)s (Passwort):"
 
-#: ../roundup/admin.py:505
+#: ../roundup/admin.py:516
 #, python-format
 msgid "   %(propname)s (Again): "
 msgstr "   %(propname)s (Wiederholen):"
 
-#: ../roundup/admin.py:509
+#: ../roundup/admin.py:520
 msgid "Sorry, try again..."
 msgstr "Bitte erneut versuchen..."
 
-#: ../roundup/admin.py:514
+#: ../roundup/admin.py:525
 #, python-format
 msgid "%(propname)s (%(proptype)s): "
 msgstr "%(propname)s (%(proptype)s): "
 
-#: ../roundup/admin.py:533
+#: ../roundup/admin.py:544
 #, python-format
 msgid "you must provide the \"%(propname)s\" property."
 msgstr "Sie mÃ¼ssen einen Wert fÃ¼r \"%(propname)s\" angeben."
 
-#: ../roundup/admin.py:545
+#: ../roundup/admin.py:556
 #, fuzzy
 msgid ""
 "Usage: display designator[,designator]*\n"
@@ -417,13 +417,13 @@ msgstr ""
 "        gewÃ¤hlten Eintrags an.\n"
 "        "
 
-#: ../roundup/admin.py:586
+#: ../roundup/admin.py:597
 #, fuzzy, python-format
 msgid "%(protected)s%(key)s: %(value)s"
 msgstr "%(protected)s%(key)s: %(value)s"
 
 #. grab the directory to export to
-#: ../roundup/admin.py:589
+#: ../roundup/admin.py:600
 #, fuzzy
 msgid ""
 "Usage: export [[-]class[,class]] export_dir\n"
@@ -456,7 +456,7 @@ msgstr ""
 "        Exportverzeichnis geschrieben.\n"
 "        "
 
-#: ../roundup/admin.py:704
+#: ../roundup/admin.py:715
 #, fuzzy
 msgid ""
 "Usage: exporttables [[-]class[,class]] export_dir\n"
@@ -491,7 +491,7 @@ msgstr ""
 "        Exportverzeichnis geschrieben.\n"
 "        "
 
-#: ../roundup/admin.py:723
+#: ../roundup/admin.py:734
 #, fuzzy
 msgid ""
 "Usage: filter classname propname=value ...\n"
@@ -513,20 +513,20 @@ msgstr ""
 "        "
 
 # ../roundup/admin.py:631 :669 :822 :834 :888
-#: ../roundup/admin.py:764
+#: ../roundup/admin.py:775
 #, fuzzy, python-format
 msgid "Class %(curclassname)s has no property %(pn)s in %(propname)s."
 msgstr "Die Klasse \"%(curclassname)s\" hat keine Eigenschaft \"%(propname)s\""
 
 # ../roundup/admin.py:631 :669 :822 :834 :888
-#: ../roundup/admin.py:791 ../roundup/admin.py:840 ../roundup/admin.py:1536
-#: ../roundup/admin.py:1549 ../roundup/admin.py:2120
-#: ../roundup/admin.py:791:840 :1536:1549:2120
+#: ../roundup/admin.py:802 ../roundup/admin.py:851 ../roundup/admin.py:1547
+#: ../roundup/admin.py:1560 ../roundup/admin.py:2131
+#: ../roundup/admin.py:802:851 :1547:1560:2131
 #, python-format
 msgid "%(classname)s has no property \"%(propname)s\""
 msgstr "Die Klasse \"%(classname)s\" hat keine Eigenschaft \"%(propname)s\""
 
-#: ../roundup/admin.py:798
+#: ../roundup/admin.py:809
 msgid ""
 "Usage: find classname propname=value ...\n"
 "        Find the nodes of the given class with a given link property value.\n"
@@ -544,7 +544,7 @@ msgstr ""
 "        als ID oder als Bezeichner (\"msg23\") spezifiziert werden.\n"
 "        "
 
-#: ../roundup/admin.py:847
+#: ../roundup/admin.py:858
 #, fuzzy
 msgid ""
 "Usage: genconfig filename\n"
@@ -556,7 +556,7 @@ msgstr ""
 "        Standardwerten in die Datei <filename>.\n"
 "        "
 
-#: ../roundup/admin.py:864
+#: ../roundup/admin.py:875
 #, python-format
 msgid ""
 "Changing option\n"
@@ -564,20 +564,20 @@ msgid ""
 "from old default of %(old_number)s to new default of %(new_number)s."
 msgstr ""
 
-#: ../roundup/admin.py:875
+#: ../roundup/admin.py:886
 #, python-format
 msgid ""
 "Update 'password_pbkdf2_default_rounds' to a number equal to or larger\n"
 "  than %s.\n"
 msgstr ""
 
-#: ../roundup/admin.py:882
+#: ../roundup/admin.py:893
 msgid ""
 "Check the rdbms mysql_* settings. Your charset and collations may need\n"
 "  to be changed. See upgrading instructions.\n"
 msgstr ""
 
-#: ../roundup/admin.py:892
+#: ../roundup/admin.py:903
 #, fuzzy
 msgid ""
 "Usage: get property designator[,designator]*\n"
@@ -598,7 +598,7 @@ msgstr ""
 "        "
 
 # ../roundup/admin.py:516 :531
-#: ../roundup/admin.py:925
+#: ../roundup/admin.py:936
 #, python-format
 msgid "property %s is not of type Multilink or Link so -d flag does not apply."
 msgstr ""
@@ -606,21 +606,21 @@ msgstr ""
 "hier nicht ausgewertet."
 
 # ../roundup/admin.py:539 :951 :1000 :1022
-#: ../roundup/admin.py:942 ../roundup/admin.py:1190 ../roundup/admin.py:1864
-#: ../roundup/admin.py:1892 ../roundup/admin.py:942:1190 :1864:1892
+#: ../roundup/admin.py:953 ../roundup/admin.py:1201 ../roundup/admin.py:1875
+#: ../roundup/admin.py:1903 ../roundup/admin.py:953:1201 :1875:1903
 #, python-format
 msgid "no such %(classname)s node \"%(nodeid)s\""
 msgstr ""
 "Es existiert kein Eintrag der Klasse %(classname)s mit der ID \"%(nodeid)s\""
 
-#: ../roundup/admin.py:945
+#: ../roundup/admin.py:956
 #, python-format
 msgid "no such %(classname)s property \"%(propname)s\""
 msgstr ""
 "Die Eigenschaft \"%(propname)s\" ist fÃ¼r die Klasse \"%(classname)s\" nicht "
 "definiert"
 
-#: ../roundup/admin.py:950
+#: ../roundup/admin.py:961
 msgid ""
 "Usage: help topic\n"
 "        Give help about topic.\n"
@@ -640,12 +640,12 @@ msgstr ""
 "        all       -- sÃ¤mtlichen Hilfetext anzeigen\n"
 "        "
 
-#: ../roundup/admin.py:969
+#: ../roundup/admin.py:980
 #, python-format
 msgid "Sorry, no help for \"%(topic)s\""
 msgstr "Zum Thema \"%(topic)s\" existiert leider kein Hilfetext"
 
-#: ../roundup/admin.py:986
+#: ../roundup/admin.py:997
 #, fuzzy
 msgid ""
 "Usage: history designator [skipquiet] [raw]\n"
@@ -668,27 +668,27 @@ msgstr ""
 "        kann zudem wiederverwendet werden.\n"
 "        "
 
-#: ../roundup/admin.py:1011
+#: ../roundup/admin.py:1022
 #, python-format
 msgid "Unexpected argument(s): %s. Expected 'skipquiet' or 'raw'."
 msgstr ""
 
-#: ../roundup/admin.py:1062
+#: ../roundup/admin.py:1073
 #, fuzzy
 msgid "removed"
 msgstr "verbergen"
 
-#: ../roundup/admin.py:1064
+#: ../roundup/admin.py:1075
 msgid "added"
 msgstr ""
 
-#: ../roundup/admin.py:1066
+#: ../roundup/admin.py:1077
 #, python-format
 msgid "Unknown history set operation '%s'. Expected +/-."
 msgstr ""
 
 #. .Hint added issue23 to superseder
-#: ../roundup/admin.py:1091
+#: ../roundup/admin.py:1102
 #, fuzzy, python-format
 msgid "added %(class)s%(item_id)s to %(propname)s"
 msgstr "Eigenschaft \"%(propname)s\" bei \"%(class)s %(item_id)s\" bearbeitet"
@@ -696,29 +696,29 @@ msgstr "Eigenschaft \"%(propname)s\" bei \"%(class)s %(item_id)s\" bearbeitet"
 #. .Hint read as: assignedto was admin(1)
 #. where assignedto is the property
 #. admin is the key name for value 1
-#: ../roundup/admin.py:1112
+#: ../roundup/admin.py:1123
 #, fuzzy, python-format
 msgid "%(prop)s was %(name)s(%(value)s)"
 msgstr "%(propname)s (%(proptype)s): "
 
-#: ../roundup/admin.py:1118 ../roundup/admin.py:1147
-#: ../roundup/admin.py:1118:1147
+#: ../roundup/admin.py:1129 ../roundup/admin.py:1158
+#: ../roundup/admin.py:1129:1158
 #, fuzzy, python-format
 msgid "%(prop)s was %(value)s"
 msgstr "%(prop)s: %(value)s"
 
-#: ../roundup/admin.py:1137
+#: ../roundup/admin.py:1148
 #, python-format
 msgid "%(prop)s was [%(value_list)s]"
 msgstr ""
 
 #. .Hint modified nosy: added demo(3)
-#: ../roundup/admin.py:1144
+#: ../roundup/admin.py:1155
 #, python-format
 msgid "modified %(prop)s: %(how)s"
 msgstr ""
 
-#: ../roundup/admin.py:1195
+#: ../roundup/admin.py:1206
 #, fuzzy
 msgid ""
 "Usage: import import_dir\n"
@@ -764,7 +764,7 @@ msgstr ""
 "        verbergen).\n"
 "        "
 
-#: ../roundup/admin.py:1306
+#: ../roundup/admin.py:1317
 msgid ""
 "Usage: importtables export_dir\n"
 "        This imports the database tables exported using exporttables.\n"
@@ -774,7 +774,7 @@ msgid ""
 msgstr ""
 
 #. password
-#: ../roundup/admin.py:1314
+#: ../roundup/admin.py:1325
 msgid ""
 "Usage: initialise [adminpw]\n"
 "        Initialise a new Roundup tracker.\n"
@@ -792,23 +792,23 @@ msgstr ""
 "        Die Funktion dbinit.init() wird aufgerufen\n"
 "        "
 
-#: ../roundup/admin.py:1328
+#: ../roundup/admin.py:1339
 msgid "Admin Password: "
 msgstr "Administratorpasswort: "
 
-#: ../roundup/admin.py:1329
+#: ../roundup/admin.py:1340
 msgid "       Confirm: "
 msgstr "  Wiederholen: "
 
-#: ../roundup/admin.py:1333
+#: ../roundup/admin.py:1344
 msgid "Instance home does not exist"
 msgstr "Tracker-Verzeichnis existiert nicht"
 
-#: ../roundup/admin.py:1337
+#: ../roundup/admin.py:1348
 msgid "Instance has not been installed"
 msgstr "Tracker-Instanz wurde nicht installiert"
 
-#: ../roundup/admin.py:1345
+#: ../roundup/admin.py:1356
 msgid ""
 "WARNING: The database is already initialised!\n"
 "If you re-initialise it, you will lose all the data!\n"
@@ -818,7 +818,7 @@ msgstr ""
 "Eine erneute Initialisierung lÃ¶scht sÃ¤mtliche Daten!\n"
 "Wirklich lÃ¶schen? Y/N: "
 
-#: ../roundup/admin.py:1365
+#: ../roundup/admin.py:1376
 msgid ""
 "Usage: install [template [backend [key=val[,key=val]]]]\n"
 "        Install a new Roundup tracker.\n"
@@ -871,12 +871,12 @@ msgstr ""
 "        Siehe auch unter dem Hilfethema \"initopts\".\n"
 "        "
 
-#: ../roundup/admin.py:1394
+#: ../roundup/admin.py:1405
 #, python-format
 msgid "Instance home parent directory \"%(parent)s\" does not exist"
 msgstr "Das angegebene Tracker-Verzeichnis \"%(parent)s\" existiert nicht"
 
-#: ../roundup/admin.py:1403
+#: ../roundup/admin.py:1414
 #, python-format
 msgid ""
 "WARNING: There appears to be a tracker in \"%(tracker_home)s\"!\n"
@@ -887,22 +887,22 @@ msgstr ""
 "installiert zu sein! Eine erneute Installation lÃ¶scht sÃ¤mtliche Daten!\n"
 "Wirklich lÃ¶schen? Y/N: "
 
-#: ../roundup/admin.py:1416
+#: ../roundup/admin.py:1427
 #, fuzzy
 msgid "Select template"
 msgstr "Vorlagensatz auswÃ¤hlen [classic]:"
 
-#: ../roundup/admin.py:1426
+#: ../roundup/admin.py:1437
 #, fuzzy
 msgid "Select backend"
 msgstr "Datenbank auswÃ¤hlen [anydbm]"
 
-#: ../roundup/admin.py:1437
+#: ../roundup/admin.py:1448
 #, python-format
 msgid "Error in configuration settings: \"%s\""
 msgstr "Fehler in der Konfiguration: \"%s\""
 
-#: ../roundup/admin.py:1470
+#: ../roundup/admin.py:1481
 #, fuzzy, python-format
 msgid ""
 "\n"
@@ -914,11 +914,11 @@ msgstr ""
 " Sie sollten nun die Konfigurationsdatei des Trackers bearbeiten:\n"
 "   %(config_file)s"
 
-#: ../roundup/admin.py:1480
+#: ../roundup/admin.py:1491
 msgid " ... at a minimum, you must set following options:"
 msgstr " ... passen sie zumindest folgende Optionen an:"
 
-#: ../roundup/admin.py:1485
+#: ../roundup/admin.py:1496
 #, python-format
 msgid ""
 "\n"
@@ -944,7 +944,7 @@ msgstr ""
 " AnschlieÃŸend MÃœSSEN Sie \"roundup-admin initialise\" ausfÃ¼hren.\n"
 "---------------------------------------------------------------------------\n"
 
-#: ../roundup/admin.py:1501
+#: ../roundup/admin.py:1512
 msgid ""
 "Usage: list classname [property]\n"
 "        List the instances of a class.\n"
@@ -975,17 +975,17 @@ msgstr ""
 "aufgelistet.\n"
 "        "
 
-#: ../roundup/admin.py:1514
+#: ../roundup/admin.py:1525
 msgid "Too many arguments supplied"
 msgstr "Sie haben zuviele Argumente Ã¼bergeben"
 
-#: ../roundup/admin.py:1547
+#: ../roundup/admin.py:1558
 #, python-format
 msgid "%(nodeid)4s: %(value)s"
 msgstr "%(nodeid)4s: %(value)s"
 
 #. noqa: ARG002  - args unused
-#: ../roundup/admin.py:1554
+#: ../roundup/admin.py:1565
 #, fuzzy
 msgid ""
 "Usage: migrate\n"
@@ -1028,17 +1028,17 @@ msgstr ""
 "        es nicht nÃ¶tig ist; also gewÃ¶hnen Sie es sich einfach an.\n"
 "        "
 
-#: ../roundup/admin.py:1574
+#: ../roundup/admin.py:1585
 #, python-format
 msgid "Tracker updated to schema version %s."
 msgstr ""
 
-#: ../roundup/admin.py:1578
+#: ../roundup/admin.py:1589
 #, fuzzy, python-format
 msgid "No migration action required. At schema version %s."
 msgstr "Keine Migration notwendig"
 
-#: ../roundup/admin.py:1583
+#: ../roundup/admin.py:1594
 #, fuzzy
 msgid ""
 "Usage: pack period | date\n"
@@ -1076,11 +1076,11 @@ msgstr ""
 "\n"
 "        "
 
-#: ../roundup/admin.py:1609
+#: ../roundup/admin.py:1620
 msgid "Invalid format"
 msgstr "UngÃ¼ltiges Format"
 
-#: ../roundup/admin.py:1620
+#: ../roundup/admin.py:1631
 msgid ""
 "Usage: perftest [mode] [arguments]*\n"
 "        Time operations in Roundup.\n"
@@ -1098,25 +1098,25 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1657
+#: ../roundup/admin.py:1668
 msgid "Invalid 'rounds'. Must be larger than 999."
 msgstr ""
 
-#: ../roundup/admin.py:1661
+#: ../roundup/admin.py:1672
 #, python-format
 msgid "Invalid 'rounds'. It must be an integer not: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1688
+#: ../roundup/admin.py:1699
 msgid "scheme does not support rounds."
 msgstr ""
 
-#: ../roundup/admin.py:1691
+#: ../roundup/admin.py:1702
 #, python-format
 msgid "Hash time: %(time)0.9f seconds, scheme: %(scheme)s, rounds: %(rounds)s"
 msgstr ""
 
-#: ../roundup/admin.py:1697
+#: ../roundup/admin.py:1708
 msgid ""
 "Usage: pragma setting=value | 'list'\n"
 "        Set internal admin settings to a value.\n"
@@ -1145,49 +1145,49 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1732
+#: ../roundup/admin.py:1743
 #, python-format
 msgid "Argument must be setting=value, was given: %s."
 msgstr ""
 
-#: ../roundup/admin.py:1735
+#: ../roundup/admin.py:1746
 msgid "Current settings and values (NYI - not yet implemented):"
 msgstr ""
 
-#: ../roundup/admin.py:1746
+#: ../roundup/admin.py:1757
 msgid ""
 "      Help for this pragma is missing. Please report it to the Roundup "
 "project.\n"
 msgstr ""
 
-#: ../roundup/admin.py:1752
+#: ../roundup/admin.py:1763
 #, fuzzy, python-format
 msgid "Unknown setting %s. Try \"pragma list\"."
 msgstr "Benutzername unbekannt"
 
-#: ../roundup/admin.py:1762
+#: ../roundup/admin.py:1773
 #, python-format
 msgid "Incorrect value for boolean setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1769
+#: ../roundup/admin.py:1780
 #, python-format
 msgid "Incorrect value for integer setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1776
+#: ../roundup/admin.py:1787
 #, python-format
 msgid ""
 "Incorrect value for setting %(setting)s: %(value)s. Should be no, both, or "
 "only."
 msgstr ""
 
-#: ../roundup/admin.py:1786
+#: ../roundup/admin.py:1797
 #, python-format
 msgid "Internal error: pragma can not handle values of type: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1795
+#: ../roundup/admin.py:1806
 #, fuzzy
 msgid ""
 "Usage: reindex [classname|classname:#-#|designator]*\n"
@@ -1211,17 +1211,17 @@ msgstr ""
 "        normalerweise automatisch.\n"
 "        "
 
-#: ../roundup/admin.py:1817
+#: ../roundup/admin.py:1828
 #, python-format
 msgid "no such item \"%(designator)s\""
 msgstr "Der Eintrag \"%(designator)s\" existiert nicht"
 
-#: ../roundup/admin.py:1827
+#: ../roundup/admin.py:1838
 #, fuzzy, python-format
 msgid "no such item \"%(class)s%(id)s\""
 msgstr "Der Eintrag \"%(class)s%(id)s\" existiert nicht"
 
-#: ../roundup/admin.py:1839
+#: ../roundup/admin.py:1850
 #, fuzzy
 msgid ""
 "Usage: restore designator[,designator]*\n"
@@ -1240,7 +1240,7 @@ msgstr ""
 "        fÃ¼r die Benutzer wieder sichtbar.\n"
 "        "
 
-#: ../roundup/admin.py:1870
+#: ../roundup/admin.py:1881
 #, fuzzy
 msgid ""
 "Usage: retire designator[,designator]*\n"
@@ -1262,7 +1262,7 @@ msgstr ""
 "        "
 
 #. noqa: ARG002 - args unused
-#: ../roundup/admin.py:1898
+#: ../roundup/admin.py:1909
 msgid ""
 "Usage: rollback\n"
 "        Undo all changes that are pending commit to the database.\n"
@@ -1281,7 +1281,7 @@ msgstr ""
 "        verworfen.\n"
 "        "
 
-#: ../roundup/admin.py:1911
+#: ../roundup/admin.py:1922
 msgid ""
 "Usage: security [Role name]\n"
 "        Display the Permissions available to one or all Roles.\n"
@@ -1294,48 +1294,48 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1926
+#: ../roundup/admin.py:1937
 #, fuzzy, python-format
 msgid "No such Role \"%(role)s\"\n"
 msgstr "Die Rolle \"%(role)s\" existiert nicht "
 
-#: ../roundup/admin.py:1932
+#: ../roundup/admin.py:1943
 #, fuzzy, python-format
 msgid "New Web users get the Roles \"%(role)s\"\n"
 msgstr "Neue Web-Benutzer erhalten die Rollen \"%(role)s\""
 
-#: ../roundup/admin.py:1935
+#: ../roundup/admin.py:1946
 #, fuzzy, python-format
 msgid "New Web users get the Role \"%(role)s\"\n"
 msgstr "Neue Web-Benutzer erhalten die Rolle \"%(role)s\""
 
-#: ../roundup/admin.py:1939
+#: ../roundup/admin.py:1950
 #, fuzzy, python-format
 msgid "New Email users get the Roles \"%(role)s\"\n"
 msgstr "Neue E-Mail-Benutzer erhalten die Rollen \"%(role)s\""
 
-#: ../roundup/admin.py:1941
+#: ../roundup/admin.py:1952
 #, fuzzy, python-format
 msgid "New Email users get the Role \"%(role)s\"\n"
 msgstr "Neue E-Mail-Benutzer erhalten die Rolle \"%(role)s\""
 
-#: ../roundup/admin.py:1944
+#: ../roundup/admin.py:1955
 #, fuzzy, python-format
 msgid "Role \"%(name)s\":\n"
 msgstr "Rolle \"%(name)s\":"
 
-#: ../roundup/admin.py:1950
+#: ../roundup/admin.py:1961
 #, fuzzy
 msgid " %(description)s (%(name)s for \"%(klass)s\""
 msgstr "%(description)s (%(name)s einzig fÃ¼r \"%(klass)s\")"
 
-#: ../roundup/admin.py:1950
+#: ../roundup/admin.py:1961
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\": %(properties)s only)\n"
 msgstr ""
 " %(description)s (%(name)s fÃ¼r \"%(klass)s\": ausschlieÃŸlich %(properties)s)"
 
-#: ../roundup/admin.py:1963
+#: ../roundup/admin.py:1974
 #, python-format
 msgid ""
 "\n"
@@ -1343,17 +1343,17 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/admin.py:1969
+#: ../roundup/admin.py:1980
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\" only)\n"
 msgstr "%(description)s (%(name)s einzig fÃ¼r \"%(klass)s\")"
 
-#: ../roundup/admin.py:1972
+#: ../roundup/admin.py:1983
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s)\n"
 msgstr " %(description)s (%(name)s)"
 
-#: ../roundup/admin.py:1976
+#: ../roundup/admin.py:1987
 #, fuzzy
 msgid ""
 "Usage: set items property=value [property=value ...]\n"
@@ -1390,7 +1390,7 @@ msgstr ""
 "(\"1,2,3\").\n"
 "        "
 
-#: ../roundup/admin.py:2044
+#: ../roundup/admin.py:2055
 msgid ""
 "Usage: specification classname\n"
 "        Show the properties for a classname.\n"
@@ -1404,17 +1404,17 @@ msgstr ""
 "        Zeigt sÃ¤mtliche Eigenschaften der Klasse auf.\n"
 "        "
 
-#: ../roundup/admin.py:2063
+#: ../roundup/admin.py:2074
 #, fuzzy, python-format
 msgid "%(key)s: %(value)s (key property)\n"
 msgstr "%(key)s: %(value)s (SchlÃ¼sseleigenschaft)"
 
-#: ../roundup/admin.py:2066
+#: ../roundup/admin.py:2077
 #, fuzzy, python-format
 msgid "%(key)s: %(value)s\n"
 msgstr "%(key)s: %(value)s"
 
-#: ../roundup/admin.py:2069
+#: ../roundup/admin.py:2080
 msgid ""
 "Usage: table classname [property[,property]*]\n"
 "        List the instances of a class in tabular form.\n"
@@ -1477,17 +1477,17 @@ msgstr ""
 "\n"
 "        "
 
-#: ../roundup/admin.py:2115
+#: ../roundup/admin.py:2126
 #, python-format
 msgid "\"%(spec)s\" not name:width"
 msgstr "\"%(spec)s\" entspricht nicht dem Format Eigenschaft:Breite"
 
-#: ../roundup/admin.py:2137
+#: ../roundup/admin.py:2148
 #, python-format
 msgid "\"%(spec)s\" does not have an integer width: \"%(width)s\""
 msgstr ""
 
-#: ../roundup/admin.py:2173
+#: ../roundup/admin.py:2184
 msgid ""
 "Usage: templates [trace_search]\n"
 "        List templates and their installed directories.\n"
@@ -1497,7 +1497,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2201
+#: ../roundup/admin.py:2212
 #, fuzzy
 msgid ""
 "Usage: updateconfig <filename>\n"
@@ -1513,34 +1513,34 @@ msgstr ""
 "        "
 
 # ../roundup/cgi/actions.py:546 :556
-#: ../roundup/admin.py:2210 ../roundup/cgi/actions.py:886
-#: ../roundup/cgi/actions.py:897 ../roundup/cgi/actions.py:1099
-#: ../roundup/cgi/actions.py:1113 ../roundup/cgi/actions.py:886:897 :1099:1113
+#: ../roundup/admin.py:2221 ../roundup/cgi/actions.py:891
+#: ../roundup/cgi/actions.py:902 ../roundup/cgi/actions.py:1104
+#: ../roundup/cgi/actions.py:1118 ../roundup/cgi/actions.py:891:902 :1104:1118
 #, python-format
 msgid "Error: %s"
 msgstr "Fehler: %s"
 
-#: ../roundup/admin.py:2242
+#: ../roundup/admin.py:2253
 #, python-format
 msgid "Unknown command \"%(command)s\" (\"help commands\" for a list)"
 msgstr "Der Befehl \"%(command)s\" existiert nicht (siehe \"help commands\")"
 
-#: ../roundup/admin.py:2248
+#: ../roundup/admin.py:2259
 #, python-format
 msgid "Multiple commands match \"%(command)s\": %(list)s"
 msgstr "Zur AbkÃ¼rzung \"%(command)s\" passen mehrere Befehle: %(list)s"
 
-#: ../roundup/admin.py:2263
+#: ../roundup/admin.py:2274
 msgid "Enter tracker home: "
 msgstr "Tracker-Verzeichnis: "
 
-#: ../roundup/admin.py:2292 ../roundup/admin.py:2296
-#: ../roundup/admin.py:2292:2296
+#: ../roundup/admin.py:2303 ../roundup/admin.py:2307
+#: ../roundup/admin.py:2303:2307
 #, python-format
 msgid "Error: Couldn't open tracker: %(message)s"
 msgstr "Fehler: Die Tracker-Instanz konnte nicht geÃ¶ffnet werden: %(message)s"
 
-#: ../roundup/admin.py:2344
+#: ../roundup/admin.py:2355
 #, python-format
 msgid ""
 "Roundup %s ready for input.\n"
@@ -1549,30 +1549,30 @@ msgstr ""
 "Roundup %s ist bereit.\n"
 "Schreiben Sie \"help\", um zur Hilfe zu gelangen."
 
-#: ../roundup/admin.py:2377
+#: ../roundup/admin.py:2388
 msgid "Note: command history and editing not available"
 msgstr "Bemerkung: Befehlsverlauf/-bearbeitung mÃ¶glicherweise nicht verfÃ¼gbar"
 
-#: ../roundup/admin.py:2383
+#: ../roundup/admin.py:2394
 msgid "exit..."
 msgstr "beenden..."
 
-#: ../roundup/admin.py:2396
+#: ../roundup/admin.py:2407
 msgid "There are unsaved changes. Commit them (y/N)? "
 msgstr "Es gibt noch ungespeicherte Ã„nderungen. Ã„nderungen speichern (y/N)?"
 
-#: ../roundup/backends/back_anydbm.py:215
-#: ../roundup/backends/rdbms_common.py:928
+#: ../roundup/backends/back_anydbm.py:213
+#: ../roundup/backends/rdbms_common.py:926
 #, python-format
 msgid "Class \"%s\" already defined."
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:280
+#: ../roundup/backends/back_anydbm.py:278
 #: ../roundup/backends/sessions_dbm.py:61
 msgid "Couldn't identify database type"
 msgstr "Konnte den Datenbanktyp nicht ermitteln"
 
-#: ../roundup/backends/back_anydbm.py:314
+#: ../roundup/backends/back_anydbm.py:312
 #, fuzzy, python-format
 msgid ""
 "Couldn't open database - the required module '%s' (as dbm.gnu) is not "
@@ -1581,7 +1581,7 @@ msgstr ""
 "Konnte die Datenbank nicht Ã¶ffnen - das erforderliche Modul '%s' ist nicht "
 "verfÃ¼gbar"
 
-#: ../roundup/backends/back_anydbm.py:318
+#: ../roundup/backends/back_anydbm.py:316
 #, python-format
 msgid "Couldn't open database - the required module '%s' is not available"
 msgstr ""
@@ -1590,21 +1590,21 @@ msgstr ""
 
 #: ../roundup/backends/back_anydbm.py:873
 #: ../roundup/backends/back_anydbm.py:886
-#: ../roundup/backends/back_anydbm.py:1160
-#: ../roundup/backends/back_anydbm.py:1195
-#: ../roundup/backends/back_anydbm.py:1424
-#: ../roundup/backends/back_anydbm.py:1442
-#: ../roundup/backends/back_anydbm.py:1489
-#: ../roundup/backends/back_anydbm.py:2135
+#: ../roundup/backends/back_anydbm.py:1162
+#: ../roundup/backends/back_anydbm.py:1197
+#: ../roundup/backends/back_anydbm.py:1426
+#: ../roundup/backends/back_anydbm.py:1444
+#: ../roundup/backends/back_anydbm.py:1492
+#: ../roundup/backends/back_anydbm.py:2138
 #: ../roundup/backends/back_anydbm.py:873:886
-#: ../roundup/backends/rdbms_common.py:1720
-#: ../roundup/backends/rdbms_common.py:1967
-#: ../roundup/backends/rdbms_common.py:2206
-#: ../roundup/backends/rdbms_common.py:2226
-#: ../roundup/backends/rdbms_common.py:2279
-#: ../roundup/backends/rdbms_common.py:3254
-#: ../roundup/backends/rdbms_common.py:1720:1967 :1160:1195 :1424:1442:1489
-#: :2135 :2206:2226 :2279:3254
+#: ../roundup/backends/rdbms_common.py:1721
+#: ../roundup/backends/rdbms_common.py:1972
+#: ../roundup/backends/rdbms_common.py:2211
+#: ../roundup/backends/rdbms_common.py:2231
+#: ../roundup/backends/rdbms_common.py:2293
+#: ../roundup/backends/rdbms_common.py:3268
+#: ../roundup/backends/rdbms_common.py:1721:1972 :1162:1197 :1426:1444:1492
+#: :2138 :2211:2231 :2293:3268
 msgid "Database open read-only"
 msgstr "Datenbank nur zum Lesen geÃ¶ffnet"
 
@@ -1630,45 +1630,50 @@ msgstr ""
 msgid "Unable to get lock after 10 retries on %s."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:632
+#: ../roundup/backends/rdbms_common.py:630
 #, python-format
 msgid "ALTER operation disallowed: %(old)r -> %(new)r."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:867
+#: ../roundup/backends/rdbms_common.py:865
 #, python-format
 msgid "CREATE operation disallowed: \"%s\"."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:884
+#: ../roundup/backends/rdbms_common.py:882
 #, python-format
 msgid "DROP operation disallowed: \"%s\"."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:1863
+#: ../roundup/backends/rdbms_common.py:1864
 msgid "create"
 msgstr "erstellt"
 
-#: ../roundup/backends/rdbms_common.py:2038
+#: ../roundup/backends/rdbms_common.py:2043
 msgid "unlink"
 msgstr "Link gelÃ¶scht"
 
-#: ../roundup/backends/rdbms_common.py:2042
+#: ../roundup/backends/rdbms_common.py:2047
 msgid "link"
 msgstr "verlinkt"
 
-#: ../roundup/backends/rdbms_common.py:2187
+#: ../roundup/backends/rdbms_common.py:2192
 msgid "set"
 msgstr "geÃ¤ndert"
 
-#: ../roundup/backends/rdbms_common.py:2216
+#: ../roundup/backends/rdbms_common.py:2221
 msgid "retired"
 msgstr "verborgen"
 
-#: ../roundup/backends/rdbms_common.py:2246
+#: ../roundup/backends/rdbms_common.py:2251
 msgid "restored"
 msgstr "wiederhergestellt"
 
+#: ../roundup/backends/rdbms_common.py:2265
+#, fuzzy, python-format
+msgid "class %(cls)s: %(value)r is not an id"
+msgstr "Eigenschaft %s: %r ist keine Zahl"
+
 #: ../roundup/backends/sessions_redis.py:78
 #: ../roundup/backends/sessions_redis.py:97
 #: ../roundup/backends/sessions_redis.py:78:97
@@ -1753,10 +1758,10 @@ msgid "\"%(input)s\" is not an ID (%(classname)s ID required)"
 msgstr "\"%(input)s\" ist keine ID (%(classname)s ID wird erwartet)"
 
 #: ../roundup/cgi/actions.py:228 ../roundup/cgi/actions.py:266
-#: ../roundup/cgi/actions.py:493 ../roundup/cgi/actions.py:833
-#: ../roundup/cgi/actions.py:880 ../roundup/cgi/actions.py:1084
-#: ../roundup/cgi/actions.py:1246 ../roundup/cgi/actions.py:228:266:1246
-#: :493:833 :880:1084
+#: ../roundup/cgi/actions.py:493 ../roundup/cgi/actions.py:838
+#: ../roundup/cgi/actions.py:885 ../roundup/cgi/actions.py:1089
+#: ../roundup/cgi/actions.py:1251 ../roundup/cgi/actions.py:228:266:1251
+#: :493:838 :885:1089
 msgid "Invalid request"
 msgstr "UngÃ¼ltige Anforderung"
 
@@ -1810,8 +1815,8 @@ msgstr "UngÃ¼ltige Anforderung"
 msgid "Invalid integer: "
 msgstr "UngÃ¼ltiger Benutzername"
 
-#: ../roundup/cgi/actions.py:531 ../roundup/cgi/actions.py:735
-#: ../roundup/cgi/actions.py:531:735
+#: ../roundup/cgi/actions.py:531 ../roundup/cgi/actions.py:740
+#: ../roundup/cgi/actions.py:531:740
 #, python-format
 msgid "You do not have permission to create %(class)s"
 msgstr ""
@@ -1822,8 +1827,8 @@ msgstr ""
 msgid "Not enough values on line %(line)s"
 msgstr "Nicht genÃ¼gend Werte in Zeile %(line)s"
 
-#: ../roundup/cgi/actions.py:556 ../roundup/cgi/actions.py:723
-#: ../roundup/cgi/actions.py:556:723
+#: ../roundup/cgi/actions.py:556 ../roundup/cgi/actions.py:728
+#: ../roundup/cgi/actions.py:556:728
 #, python-format
 msgid "You do not have permission to edit %(class)s"
 msgstr ""
@@ -1833,17 +1838,17 @@ msgstr ""
 msgid "Items edited OK"
 msgstr "Die EintrÃ¤ge wurden aktualisiert"
 
-#: ../roundup/cgi/actions.py:671
+#: ../roundup/cgi/actions.py:676
 #, python-format
 msgid "%(class)s %(id)s %(properties)s edited ok"
 msgstr "Eigenschaft \"%(properties)s\" bei \"%(class)s %(id)s\" bearbeitet"
 
-#: ../roundup/cgi/actions.py:689
+#: ../roundup/cgi/actions.py:694
 #, python-format
 msgid "%(class)s %(id)s created"
 msgstr "Der Eintrag \"%(class)s%(id)s\" wurde erstellt"
 
-#: ../roundup/cgi/actions.py:817
+#: ../roundup/cgi/actions.py:822
 #, fuzzy, python-format
 msgid ""
 "Edit Error: someone else has edited this %(klass)s (%(props)s). View <a "
@@ -1853,12 +1858,12 @@ msgstr ""
 "<a target=\"_new\" href=\"%(klass)s%(id)s\">dessen Ã„nderungen</a> in einem "
 "neuen Fenster."
 
-#: ../roundup/cgi/actions.py:850
+#: ../roundup/cgi/actions.py:855
 #, python-format
 msgid "Edit Error: %s"
 msgstr "Fehler bei der Bearbeitung: %s"
 
-#: ../roundup/cgi/actions.py:931
+#: ../roundup/cgi/actions.py:936
 msgid ""
 "Invalid One Time Key!\n"
 "(a Mozilla bug may cause this message to show up erroneously, please check "
@@ -1868,12 +1873,12 @@ msgstr ""
 "(Ein Fehler in Mozilla kann diese Meldung hervorrufen, bitte prÃ¼fen Sie Ihr "
 "E-Mail-Konto)"
 
-#: ../roundup/cgi/actions.py:972
+#: ../roundup/cgi/actions.py:977
 #, fuzzy, python-format
 msgid "Password reset for %s"
 msgstr "Passwort zurÃ¼cksetzen"
 
-#: ../roundup/cgi/actions.py:973
+#: ../roundup/cgi/actions.py:978
 #, python-format
 msgid ""
 "\n"
@@ -1882,29 +1887,29 @@ msgid ""
 "Your password is now: %(password)s\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:982
+#: ../roundup/cgi/actions.py:987
 #, python-format
 msgid "Password reset and email sent to %s"
 msgstr "Ihr Passwort wurde zurÃ¼ckgesetzt und per E-Mail an %s versandt"
 
-#: ../roundup/cgi/actions.py:991
+#: ../roundup/cgi/actions.py:996
 msgid "Unknown username"
 msgstr "Benutzername unbekannt"
 
-#: ../roundup/cgi/actions.py:999
+#: ../roundup/cgi/actions.py:1004
 msgid "Unknown email address"
 msgstr "E-Mail-Adresse unbekannt"
 
-#: ../roundup/cgi/actions.py:1004
+#: ../roundup/cgi/actions.py:1009
 msgid "You need to specify a username or address"
 msgstr "Sie mÃ¼ssen einen Benutzernamen oder eine E-Mail-Adresse angeben"
 
-#: ../roundup/cgi/actions.py:1015
+#: ../roundup/cgi/actions.py:1020
 #, fuzzy, python-format
 msgid "Confirm reset of password for %s"
 msgstr "Passwort bestÃ¤tigen"
 
-#: ../roundup/cgi/actions.py:1016
+#: ../roundup/cgi/actions.py:1021
 #, python-format
 msgid ""
 "\n"
@@ -1918,31 +1923,31 @@ msgid ""
 "You should then receive another email with the new password.\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1029
+#: ../roundup/cgi/actions.py:1034
 #, python-format
 msgid "Email sent to primary notification address for %s."
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1031
+#: ../roundup/cgi/actions.py:1036
 #, fuzzy, python-format
 msgid "Email sent to %s."
 msgstr "Eine E-Mail wurde an %s versandt"
 
-#: ../roundup/cgi/actions.py:1046
+#: ../roundup/cgi/actions.py:1051
 msgid "You are now registered, welcome!"
 msgstr "Sie sind nun registriert. Willkommen!"
 
-#: ../roundup/cgi/actions.py:1139
+#: ../roundup/cgi/actions.py:1144
 #, python-format
 msgid "Username '%s' is already used."
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1163
+#: ../roundup/cgi/actions.py:1168
 #, python-format
 msgid "Complete your registration to %(tracker_name)s -- key %(key)s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1167
+#: ../roundup/cgi/actions.py:1172
 #, python-format
 msgid ""
 "To complete your registration of the user \"%(name)s\" with\n"
@@ -1958,12 +1963,12 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1181
+#: ../roundup/cgi/actions.py:1186
 #, python-format
 msgid "Complete your registration to %s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1182
+#: ../roundup/cgi/actions.py:1187
 #, python-format
 msgid ""
 "To complete your registration of the user \"%(name)s\" with\n"
@@ -1973,44 +1978,44 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1206
+#: ../roundup/cgi/actions.py:1211
 msgid "It is not permitted to supply roles at registration."
 msgstr "Bei der Registrierung dÃ¼rfen keine Rollen angegeben werden"
 
-#: ../roundup/cgi/actions.py:1220
+#: ../roundup/cgi/actions.py:1225
 msgid "You are logged out"
 msgstr "Sie wurden vom System abgemeldet"
 
-#: ../roundup/cgi/actions.py:1250
+#: ../roundup/cgi/actions.py:1255
 msgid "Username required"
 msgstr "Benutzername notwendig"
 
-#: ../roundup/cgi/actions.py:1354
+#: ../roundup/cgi/actions.py:1359
 #, python-format
 msgid "Welcome %(username)s!"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1477
+#: ../roundup/cgi/actions.py:1482
 #, python-format
 msgid "Logins occurring too fast. Please wait: %s seconds."
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1515 ../roundup/cgi/actions.py:1526
-#: ../roundup/cgi/actions.py:1515:1526
+#: ../roundup/cgi/actions.py:1520 ../roundup/cgi/actions.py:1531
+#: ../roundup/cgi/actions.py:1520:1531
 msgid "Invalid login"
 msgstr "UngÃ¼ltiger Benutzername"
 
-#: ../roundup/cgi/actions.py:1532
+#: ../roundup/cgi/actions.py:1537
 msgid "You do not have permission to login"
 msgstr "Sie sind nicht berechtigt, sich anzumelden"
 
-#: ../roundup/cgi/actions.py:1577 ../roundup/cgi/actions.py:1757
-#: ../roundup/cgi/actions.py:1577:1757
+#: ../roundup/cgi/actions.py:1582 ../roundup/cgi/actions.py:1762
+#: ../roundup/cgi/actions.py:1582:1762
 #, python-format
 msgid "Column \"%(column)s\" not found in %(class)s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1822
+#: ../roundup/cgi/actions.py:1827
 #, python-format
 msgid "You do not have permission to view %(class)s"
 msgstr "Sie sind nicht berechtigt, EintrÃ¤ge der Klasse \"%(class)s\" zu lesen"
@@ -2143,8 +2148,8 @@ msgstr "Formular-Fehler: "
 msgid "Unrecognized charset: %r"
 msgstr "Zeichensatz nicht erkannt: %r"
 
-#: ../roundup/cgi/client.py:1381 ../roundup/cgi/client.py:2394
-#: ../roundup/cgi/client.py:1381:2394
+#: ../roundup/cgi/client.py:1381 ../roundup/cgi/client.py:2396
+#: ../roundup/cgi/client.py:1381:2396
 msgid "broken form: multiple @action values submitted"
 msgstr ""
 
@@ -2222,50 +2227,51 @@ msgstr ""
 
 #: ../roundup/cgi/client.py:1679
 #, python-format
-msgid "csrf X-REQUESTED-WITH xmlrpc required header check failed for user%s."
+msgid ""
+"csrf X-REQUESTED-WITH xmlrpc required header check failed for user%(userid)s."
 msgstr ""
 
 #: ../roundup/cgi/client.py:1720
 #, python-format
-msgid "Required csrf field missing for user%s"
+msgid "Required csrf field missing for user%(userid)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1722 ../roundup/cgi/client.py:1749
-#: ../roundup/cgi/client.py:1766 ../roundup/cgi/client.py:1722:1749:1766
+#: ../roundup/cgi/client.py:1723 ../roundup/cgi/client.py:1751
+#: ../roundup/cgi/client.py:1768 ../roundup/cgi/client.py:1723:1751:1768
 msgid ""
 "We can't validate your session (csrf failure). Re-enter any unsaved data and "
 "try again."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1726
+#: ../roundup/cgi/client.py:1728
 #, python-format
-msgid "csrf field not supplied by user%s"
+msgid "csrf field not supplied by user%(userid)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1738
+#: ../roundup/cgi/client.py:1740
 #, python-format
 msgid ""
 "Csrf mismatch user: current user %(user)s != stored user %(stored)s, current "
 "session, stored session: %(cur_sess)s,%(stor_sess)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1756
+#: ../roundup/cgi/client.py:1758
 #, python-format
 msgid ""
 "Csrf mismatch user: current session %(curr_sess)s != stored session "
 "%(stor_sess)s, current user/stored user is: %(user)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1948
+#: ../roundup/cgi/client.py:1950
 msgid "You are not allowed to view this file."
 msgstr "Sie sind nicht berechtigt, diese Seite anzuzeigen."
 
-#: ../roundup/cgi/client.py:2272
+#: ../roundup/cgi/client.py:2274
 #, python-format
 msgid "%(starttag)sTime elapsed: %(seconds)fs%(endtag)s\n"
 msgstr "%(starttag)sBenÃ¶tigte Zeit: %(seconds)fs%(endtag)s\n"
 
-#: ../roundup/cgi/client.py:2276
+#: ../roundup/cgi/client.py:2278
 #, python-format
 msgid ""
 "%(starttag)sCache hits: %(cache_hits)d, misses %(cache_misses)d. Loading "
@@ -2274,7 +2280,7 @@ msgstr ""
 "%(starttag)sCache benutzt: %(cache_hits)d, verfehlt: %(cache_misses)d. "
 "EintrÃ¤ge laden: %(get_items)fs; filtern: %(filtering)fs.%(endtag)s\n"
 
-#: ../roundup/cgi/client.py:2815
+#: ../roundup/cgi/client.py:2817
 #, python-format
 msgid ""
 "Cache failure: compressed file %(compressed)s is older than its source file "
@@ -2347,65 +2353,65 @@ msgstr ""
 "Sie sind nicht berechtigt, die Aktion  \"%(action)s\" auf EintrÃ¤ge der "
 "Klasse \"%(class)s\" anzuwenden"
 
-#: ../roundup/cgi/templating.py:916
+#: ../roundup/cgi/templating.py:892
 msgid "(list)"
 msgstr "(Liste)"
 
-#: ../roundup/cgi/templating.py:991
+#: ../roundup/cgi/templating.py:975
 msgid "Submit New Entry"
 msgstr "Eintrag speichern"
 
-#: ../roundup/cgi/templating.py:1013 ../roundup/cgi/templating.py:1189
-#: ../roundup/cgi/templating.py:1824 ../roundup/cgi/templating.py:1855
-#: ../roundup/cgi/templating.py:1876 ../roundup/cgi/templating.py:1914
-#: ../roundup/cgi/templating.py:1967 ../roundup/cgi/templating.py:1991
-#: ../roundup/cgi/templating.py:1998 ../roundup/cgi/templating.py:2035
-#: ../roundup/cgi/templating.py:2088 ../roundup/cgi/templating.py:2121
-#: ../roundup/cgi/templating.py:2216 ../roundup/cgi/templating.py:2237
-#: ../roundup/cgi/templating.py:2328 ../roundup/cgi/templating.py:2348
-#: ../roundup/cgi/templating.py:2370 ../roundup/cgi/templating.py:2413
-#: ../roundup/cgi/templating.py:2423 ../roundup/cgi/templating.py:2488
-#: ../roundup/cgi/templating.py:2791 ../roundup/cgi/templating.py:1013:1189
-#: :1824:1855 :1876:1914 :1967:1991 :1998:2035 :2088:2121 :2216:2237 :2328:2348
-#: :2370:2413 :2423:2488:2791
+#: ../roundup/cgi/templating.py:997 ../roundup/cgi/templating.py:1174
+#: ../roundup/cgi/templating.py:1809 ../roundup/cgi/templating.py:1840
+#: ../roundup/cgi/templating.py:1861 ../roundup/cgi/templating.py:1899
+#: ../roundup/cgi/templating.py:1952 ../roundup/cgi/templating.py:1976
+#: ../roundup/cgi/templating.py:1983 ../roundup/cgi/templating.py:2020
+#: ../roundup/cgi/templating.py:2077 ../roundup/cgi/templating.py:2115
+#: ../roundup/cgi/templating.py:2215 ../roundup/cgi/templating.py:2236
+#: ../roundup/cgi/templating.py:2357 ../roundup/cgi/templating.py:2377
+#: ../roundup/cgi/templating.py:2399 ../roundup/cgi/templating.py:2442
+#: ../roundup/cgi/templating.py:2452 ../roundup/cgi/templating.py:2517
+#: ../roundup/cgi/templating.py:2820 ../roundup/cgi/templating.py:997:1174
+#: :1809:1840 :1861:1899 :1952:1976 :1983:2020 :2077:2115 :2215:2236 :2357:2377
+#: :2399:2442 :2452:2517:2820
 msgid "[hidden]"
 msgstr "[verborgen]"
 
-#: ../roundup/cgi/templating.py:1014
+#: ../roundup/cgi/templating.py:998
 msgid "New node - no history"
 msgstr "Neuer Eintrag - Noch kein Verlauf"
 
-#: ../roundup/cgi/templating.py:1154
+#: ../roundup/cgi/templating.py:1139
 msgid "Submit Changes"
 msgstr "Speichern"
 
-#: ../roundup/cgi/templating.py:1232
+#: ../roundup/cgi/templating.py:1217
 msgid "<em>The indicated property no longer exists</em>"
 msgstr "<em>Die gewÃ¤hlte Eigenschaft existiert nicht mehr</em>"
 
-#: ../roundup/cgi/templating.py:1268
+#: ../roundup/cgi/templating.py:1253
 #, python-format
 msgid "The linked class %(classname)s no longer exists"
 msgstr "Die verlinkte Klasse \"%(classname)s\" existiert nicht mehr"
 
-#: ../roundup/cgi/templating.py:1305 ../roundup/cgi/templating.py:1335
-#: ../roundup/cgi/templating.py:2497 ../roundup/cgi/templating.py:2800
-#: ../roundup/cgi/templating.py:1305:1335 :2497:2800
+#: ../roundup/cgi/templating.py:1290 ../roundup/cgi/templating.py:1320
+#: ../roundup/cgi/templating.py:2526 ../roundup/cgi/templating.py:2829
+#: ../roundup/cgi/templating.py:1290:1320 :2526:2829
 msgid "[label is missing]"
 msgstr ""
 
 # ../roundup/cgi/templating.py:905 :926
-#: ../roundup/cgi/templating.py:1309 ../roundup/cgi/templating.py:1338
-#: ../roundup/cgi/templating.py:1309:1338
+#: ../roundup/cgi/templating.py:1294 ../roundup/cgi/templating.py:1323
+#: ../roundup/cgi/templating.py:1294:1323
 msgid "<strike>The linked node no longer exists</strike>"
 msgstr "<strike>Der verknÃ¼pfte Eintrag existiert nicht mehr</strike>"
 
-#: ../roundup/cgi/templating.py:1400
+#: ../roundup/cgi/templating.py:1385
 #, python-format
 msgid "%s: (no value)"
 msgstr "%s: (kein Wert)"
 
-#: ../roundup/cgi/templating.py:1416
+#: ../roundup/cgi/templating.py:1401
 #, fuzzy, python-format
 msgid ""
 "<strong><em>This event %s is not handled by the history display!</em></"
@@ -2414,46 +2420,46 @@ msgstr ""
 "<strong><em>Dieses Ereignis kann nicht im Verlauf angezeigt werden!</em></"
 "strong>"
 
-#: ../roundup/cgi/templating.py:1429
+#: ../roundup/cgi/templating.py:1414
 msgid "<tr><td colspan=4><strong>Note:</strong></td></tr>"
 msgstr "<tr><td colspan=\"4\"><strong>Bitte beachten:</strong></td></tr>"
 
-#: ../roundup/cgi/templating.py:1438
+#: ../roundup/cgi/templating.py:1423
 msgid "History"
 msgstr "Verlauf"
 
-#: ../roundup/cgi/templating.py:1440
+#: ../roundup/cgi/templating.py:1425
 msgid "<th>Date</th>"
 msgstr "<th>Datum</th>"
 
-#: ../roundup/cgi/templating.py:1441
+#: ../roundup/cgi/templating.py:1426
 msgid "<th>User</th>"
 msgstr "<th>Benutzer</th>"
 
-#: ../roundup/cgi/templating.py:1442
+#: ../roundup/cgi/templating.py:1427
 msgid "<th>Action</th>"
 msgstr "<th>Aktion</th>"
 
-#: ../roundup/cgi/templating.py:1443
+#: ../roundup/cgi/templating.py:1428
 msgid "<th>Args</th>"
 msgstr "<th>Argumente</th>"
 
-#: ../roundup/cgi/templating.py:1494
+#: ../roundup/cgi/templating.py:1479
 #, python-format
 msgid "Copy of %(class)s %(id)s"
 msgstr "Kopie von %(class)s %(id)s"
 
-#: ../roundup/cgi/templating.py:2125 ../roundup/cgi/templating.py:2160
-#: ../roundup/cgi/templating.py:1382:2125:2160
+#: ../roundup/cgi/templating.py:2119 ../roundup/cgi/templating.py:2154
+#: ../roundup/cgi/templating.py:1367:2119:2154
 msgid "No"
 msgstr "Nein"
 
-#: ../roundup/cgi/templating.py:2125 ../roundup/cgi/templating.py:2154
-#: ../roundup/cgi/templating.py:1382:2125:2154
+#: ../roundup/cgi/templating.py:2119 ../roundup/cgi/templating.py:2148
+#: ../roundup/cgi/templating.py:1367:2119:2148
 msgid "Yes"
 msgstr "Ja"
 
-#: ../roundup/cgi/templating.py:2286
+#: ../roundup/cgi/templating.py:2315
 msgid ""
 "default value for DateHTMLProperty must be either DateHTMLProperty or string "
 "date representation."
@@ -2461,29 +2467,29 @@ msgstr ""
 "Der voreingestellte Wert einer DateHTML-Eigenschaft muss entweder ein\n"
 "DateHTML-Objekt sein oder ein Datum reprÃ¤sentieren."
 
-#: ../roundup/cgi/templating.py:2468
+#: ../roundup/cgi/templating.py:2497
 #, python-format
 msgid "Attempt to look up %(attr)s on a missing value"
 msgstr ""
 "Versuch, das Attribut %(attr)s eines nicht vorhandenen Werts abzufragen"
 
-#: ../roundup/cgi/templating.py:2479
+#: ../roundup/cgi/templating.py:2508
 #, fuzzy, python-format
 msgid "Attempt to look up %(item)s on a missing value"
 msgstr ""
 "Versuch, das Attribut %(item)s eines nicht vorhandenen Werts abzufragen"
 
-#: ../roundup/cgi/templating.py:2584
+#: ../roundup/cgi/templating.py:2613
 #, python-format
 msgid "<option %svalue=\"-1\">- no selection -</option>"
 msgstr "<option %svalue=\"-1\">- nichts ausgewÃ¤hlt -</option>"
 
-#: ../roundup/cgi/templating.py:3745
+#: ../roundup/cgi/templating.py:3777
 #, python-format
 msgid "Unable to read or expand file '%(name)s' in template '%(template)s'."
 msgstr ""
 
-#: ../roundup/cgi/templating.py:3795
+#: ../roundup/cgi/templating.py:3827
 #, python-format
 msgid ""
 "Found an incorrect token when expandfile applied string subsitution on "
@@ -2656,54 +2662,54 @@ msgstr "vor %s"
 msgid "in %s"
 msgstr "in %s"
 
-#: ../roundup/hyperdb.py:120
+#: ../roundup/hyperdb.py:126
 #, fuzzy, python-format
 msgid "property %(property)s: %(errormsg)s"
 msgstr "Eigenschaft %s: %s"
 
-#: ../roundup/hyperdb.py:149
+#: ../roundup/hyperdb.py:161
 #, fuzzy, python-format
 msgid "property %(property)s: %(value)r is an invalid date (%(errormsg)s)"
 msgstr "Eigenschaft %s: %r ist kein gÃ¼ltiges Datum (%s)"
 
-#: ../roundup/hyperdb.py:172
+#: ../roundup/hyperdb.py:184
 #, fuzzy, python-format
 msgid ""
 "property %(property)s: %(value)r is an invalid date interval (%(errormsg)s)"
 msgstr "Eigenschaft %s: %r ist kein gÃ¼ltiges Datumsintervall (%s)"
 
-#: ../roundup/hyperdb.py:434
+#: ../roundup/hyperdb.py:446
 #, fuzzy, python-format
 msgid "property %(property)s: %(value)r is not a number"
 msgstr "Eigenschaft %s: %r ist keine Zahl"
 
-#: ../roundup/hyperdb.py:448
+#: ../roundup/hyperdb.py:460
 #, fuzzy, python-format
 msgid "property %(property)s: %(value)r is not an integer"
 msgstr "Eigenschaft %s: %r ist keine Zahl"
 
-#: ../roundup/hyperdb.py:470
+#: ../roundup/hyperdb.py:482
 #, python-format
 msgid "\"%s\" not a node designator"
 msgstr "\"%s\" ist kein gÃ¼ltiger Bezeichner"
 
-#: ../roundup/hyperdb.py:1499 ../roundup/hyperdb.py:1507
-#: ../roundup/hyperdb.py:1499:1507
+#: ../roundup/hyperdb.py:1515 ../roundup/hyperdb.py:1523
+#: ../roundup/hyperdb.py:1515:1523
 #, python-format
 msgid "Not a property name: %s"
 msgstr "Keine Eigenschaft: %s"
 
-#: ../roundup/hyperdb.py:2038
+#: ../roundup/hyperdb.py:2054
 #, fuzzy, python-format
 msgid "property %(property)s: %(value)r is not a %(classname)s."
 msgstr "Der Wert \"%(value)s\" ist nicht in der Liste fÃ¼r \"%(property)s\""
 
-#: ../roundup/hyperdb.py:2044
+#: ../roundup/hyperdb.py:2060
 #, python-format
 msgid "you may only enter ID values for property %s"
 msgstr "Sie kÃ¶nnen fÃ¼r die Eigenschaft %s  nur IDs eingeben"
 
-#: ../roundup/hyperdb.py:2079
+#: ../roundup/hyperdb.py:2095
 #, fuzzy, python-format
 msgid "%(property)r is not a property of %(classname)s"
 msgstr "%r ist keine Eigenschaft von %s"
@@ -3046,60 +3052,60 @@ msgid ""
 "are: %(stack)s"
 msgstr ""
 
-#: ../roundup/pygettext.py:401
+#: ../roundup/pygettext.py:400
 #, python-format
 msgid "*** %(file)s:%(lineno)s: Seen unexpected token \"%(token)s\""
 msgstr ""
 
-#: ../roundup/pygettext.py:457
+#: ../roundup/pygettext.py:456
 #, python-format
 msgid "# File: %(filename)s, line: %(lineno)d"
 msgstr ""
 
-#: ../roundup/pygettext.py:464
+#: ../roundup/pygettext.py:463
 #, python-format
 msgid " %(filename)s:%(lineno)d"
 msgstr ""
 
-#: ../roundup/pygettext.py:540
+#: ../roundup/pygettext.py:539
 #, fuzzy, python-format
 msgid "Invalid value for --style: %s"
 msgstr "UngÃ¼ltiger Benutzername %s"
 
-#: ../roundup/pygettext.py:548
+#: ../roundup/pygettext.py:547
 #, python-format
 msgid "pygettext.py (xgettext for Python) %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:554
+#: ../roundup/pygettext.py:553
 #, python-format
 msgid "--width argument must be an integer: %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:582
+#: ../roundup/pygettext.py:581
 #, python-format
 msgid "Can't read --exclude-file: %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:601
+#: ../roundup/pygettext.py:600
 msgid "Reading standard input"
 msgstr ""
 
-#: ../roundup/pygettext.py:606
+#: ../roundup/pygettext.py:605
 #, python-format
 msgid "Working on %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:640
+#: ../roundup/pygettext.py:639
 msgid "a unicode string"
 msgstr ""
 
-#: ../roundup/pygettext.py:642
+#: ../roundup/pygettext.py:641
 #, python-format
 msgid "*** Seen unexpected token \"%(token)s\""
 msgstr ""
 
-#: ../roundup/pygettext.py:643
+#: ../roundup/pygettext.py:642
 msgid "morethanonestring"
 msgstr ""
 
@@ -3219,34 +3225,34 @@ msgstr "Erstellungsdatum"
 msgid "creator"
 msgstr "Ersteller"
 
-#: ../roundup/roundupdb.py:426
+#: ../roundup/roundupdb.py:447
 #, python-format
 msgid "No key for \"%(adr)s\" in keyring"
 msgstr ""
 
-#: ../roundup/roundupdb.py:504
+#: ../roundup/roundupdb.py:525
 #, python-format
 msgid "New submission from %(authname)s%(authaddr)s:"
 msgstr "Neue Nachricht von %(authname)s%(authaddr)s:"
 
-#: ../roundup/roundupdb.py:507
+#: ../roundup/roundupdb.py:528
 #, python-format
 msgid "%(authname)s%(authaddr)s added the comment:"
 msgstr "%(authname)s%(authaddr)s merkte an:"
 
-#: ../roundup/roundupdb.py:510
+#: ../roundup/roundupdb.py:531
 #, python-format
 msgid "Change by %(authname)s%(authaddr)s:"
 msgstr "Ã„nderung von %(authname)s%(authaddr)s:"
 
-#: ../roundup/roundupdb.py:529
+#: ../roundup/roundupdb.py:550
 #, python-format
 msgid "File '%(filename)s' not attached - you can download it from %(link)s."
 msgstr ""
 "Die Datei '%(filename)s' ist nicht beigefÃ¼gt - Sie kÃ¶nnen Sie unter\n"
 "%(link)s herunterladen."
 
-#: ../roundup/roundupdb.py:904
+#: ../roundup/roundupdb.py:925
 #, python-format
 msgid ""
 "\n"
@@ -3356,63 +3362,63 @@ msgstr ""
 "<html><head><title>Roundup Tracker-Liste</title></head>\n"
 "<body><h1>Roundup Tracker-Liste</h1><ol>\n"
 
-#: ../roundup/scripts/roundup_server.py:598
+#: ../roundup/scripts/roundup_server.py:602
 #, fuzzy, python-format
 msgid "Error: %(type)s: %(value)s"
 msgstr "%(type)s: %(value)s"
 
-#: ../roundup/scripts/roundup_server.py:610
+#: ../roundup/scripts/roundup_server.py:614
 msgid "WARNING: ignoring \"-g\" argument, not root"
 msgstr ""
 "WARNUNG: die Option \"-g\" wird ignoriert, da Sie nicht Administrator sind"
 
-#: ../roundup/scripts/roundup_server.py:616
+#: ../roundup/scripts/roundup_server.py:620
 msgid "Can't change groups - no grp module"
 msgstr "Die Gruppe kann nicht gewechselt werden - das Modul grp fehlt"
 
-#: ../roundup/scripts/roundup_server.py:625
+#: ../roundup/scripts/roundup_server.py:629
 #, python-format
 msgid "Group %(group)s doesn't exist"
 msgstr "Die Gruppe %(group)s existiert nicht"
 
-#: ../roundup/scripts/roundup_server.py:637
+#: ../roundup/scripts/roundup_server.py:641
 msgid "Can't run as root!"
 msgstr ""
 "Dieser Prozess kann nicht unter dem Administrator-Konto (\"root\") laufen!"
 
-#: ../roundup/scripts/roundup_server.py:640
+#: ../roundup/scripts/roundup_server.py:644
 msgid "WARNING: ignoring \"-u\" argument, not root"
 msgstr ""
 "WARNUNG: die Option \"-u\" wird ignoriert, da Sie nicht Administrator sind"
 
-#: ../roundup/scripts/roundup_server.py:646
+#: ../roundup/scripts/roundup_server.py:650
 msgid "Can't change users - no pwd module"
 msgstr "Der Benutzer kann nicht gewechselt werden - das Modul pwd fehlt"
 
-#: ../roundup/scripts/roundup_server.py:655
+#: ../roundup/scripts/roundup_server.py:659
 #, python-format
 msgid "User %(user)s doesn't exist"
 msgstr "Der Benutzer %(user)s existiert nicht"
 
-#: ../roundup/scripts/roundup_server.py:867
+#: ../roundup/scripts/roundup_server.py:871
 #, python-format
 msgid "Multiprocess mode \"%s\" is not available, switching to single-process"
 msgstr ""
 "Der Multiprozessmodus \"%s\" ist nicht verfÃ¼gbar, Einprozessmodus aktiviert"
 
-#: ../roundup/scripts/roundup_server.py:895
+#: ../roundup/scripts/roundup_server.py:899
 #, python-format
 msgid "Unable to bind to port %s, port already in use."
 msgstr "Start des Servers auf Port %s schlug fehl. Port bereits verwendet."
 
-#: ../roundup/scripts/roundup_server.py:899
+#: ../roundup/scripts/roundup_server.py:903
 #, fuzzy, python-format
 msgid ""
 "Unable to bind to port %(port)s, access not allowed, errno: %(errno)s %(msg)s"
 msgstr ""
 "Start des Servers auf Port %(port)s schlug fehl. Port bereits verwendet."
 
-#: ../roundup/scripts/roundup_server.py:978
+#: ../roundup/scripts/roundup_server.py:982
 msgid ""
 " -c <Command>  Windows Service options.\n"
 "               If you want to run the server as a Windows Service, you\n"
@@ -3428,7 +3434,7 @@ msgstr ""
 "               Zudem mÃ¼ssen Sie die Logfile-Option aktivieren.\n"
 "               \"roundup-server -c help\" zeigt eine weitere Hilfe zum Thema."
 
-#: ../roundup/scripts/roundup_server.py:985
+#: ../roundup/scripts/roundup_server.py:989
 #, fuzzy
 msgid ""
 " -u <UID>      runs the Roundup web server as this UID\n"
@@ -3444,7 +3450,7 @@ msgstr ""
 "               die Prozess-ID in die Datei PIDDatei.\n"
 "               Die Option -l muss dann auch angegeben werden."
 
-#: ../roundup/scripts/roundup_server.py:993
+#: ../roundup/scripts/roundup_server.py:997
 #, fuzzy, python-format
 msgid ""
 "\n"
@@ -3570,21 +3576,25 @@ msgstr ""
 "   URLs Probleme bereiten kÃ¶nnten. Am besten verwenden Sie nur Buchstaben, \n"
 "   Zahlen und \"-_\".\n"
 
-#: ../roundup/scripts/roundup_server.py:1173
+#: ../roundup/scripts/roundup_server.py:1177
 msgid "Instances must be name=home"
 msgstr "Instanzen mÃ¼ssen als Tracker-Name=Tracker-Verzeichnis angegeben werden"
 
-#: ../roundup/scripts/roundup_server.py:1187
+#: ../roundup/scripts/roundup_server.py:1191
 #, python-format
 msgid "Configuration saved to %s"
 msgstr "Konfiguration in der Datei %s gespeichert"
 
-#: ../roundup/scripts/roundup_server.py:1205
+#: ../roundup/scripts/roundup_server.py:1206
+msgid "If you specify a PID file you must use -l or -L."
+msgstr ""
+
+#: ../roundup/scripts/roundup_server.py:1212
 msgid "Sorry, you can't run the server as a daemon on this Operating System"
 msgstr ""
 "Auf diesem Betriebssystem kann der Server nicht als Hintergrundprozess laufen"
 
-#: ../roundup/scripts/roundup_server.py:1225
+#: ../roundup/scripts/roundup_server.py:1232
 #, python-format
 msgid "Roundup server started on %(HOST)s:%(PORT)s"
 msgstr "Der Roundup-Server wurde unter %(HOST)s:%(PORT)s gestartet"
@@ -4867,46 +4877,46 @@ msgstr "Roundup-Handbuch"
 msgid "clear this message"
 msgstr "diese Nachricht lÃ¶schen"
 
-#: ../share/roundup/templates/classic/html/page.html:257
-#: ../share/roundup/templates/classic/html/page.html:270
-#: ../share/roundup/templates/classic/html/page.html:288
-#: ../share/roundup/templates/classic/html/page.html:302
-#: ../share/roundup/templates/devel/html/page.html:316
-#: ../share/roundup/templates/devel/html/page.html:329
-#: ../share/roundup/templates/devel/html/page.html:347
-#: ../share/roundup/templates/devel/html/page.html:361
-#: ../share/roundup/templates/minimal/html/page.html:239
-#: ../share/roundup/templates/minimal/html/page.html:254
-#: ../share/roundup/templates/minimal/html/page.html:268
-#: ../share/roundup/templates/responsive/html/page.html:331
-#: ../share/roundup/templates/responsive/html/page.html:344
-#: ../share/roundup/templates/responsive/html/page.html:362
-#: ../share/roundup/templates/responsive/html/page.html:376
-msgid "don't care"
-msgstr "egal"
-
-#: ../share/roundup/templates/classic/html/page.html:259
-#: ../share/roundup/templates/classic/html/page.html:272
-#: ../share/roundup/templates/classic/html/page.html:290
+#: ../share/roundup/templates/classic/html/page.html:258
+#: ../share/roundup/templates/classic/html/page.html:271
+#: ../share/roundup/templates/classic/html/page.html:289
 #: ../share/roundup/templates/classic/html/page.html:303
-#: ../share/roundup/templates/devel/html/page.html:318
-#: ../share/roundup/templates/devel/html/page.html:331
-#: ../share/roundup/templates/devel/html/page.html:349
+#: ../share/roundup/templates/devel/html/page.html:317
+#: ../share/roundup/templates/devel/html/page.html:330
+#: ../share/roundup/templates/devel/html/page.html:348
 #: ../share/roundup/templates/devel/html/page.html:362
-#: ../share/roundup/templates/minimal/html/page.html:241
-#: ../share/roundup/templates/minimal/html/page.html:256
+#: ../share/roundup/templates/minimal/html/page.html:240
+#: ../share/roundup/templates/minimal/html/page.html:255
 #: ../share/roundup/templates/minimal/html/page.html:269
-#: ../share/roundup/templates/responsive/html/page.html:333
-#: ../share/roundup/templates/responsive/html/page.html:346
-#: ../share/roundup/templates/responsive/html/page.html:364
+#: ../share/roundup/templates/responsive/html/page.html:332
+#: ../share/roundup/templates/responsive/html/page.html:345
+#: ../share/roundup/templates/responsive/html/page.html:363
 #: ../share/roundup/templates/responsive/html/page.html:377
+msgid "don't care"
+msgstr "egal"
+
+#: ../share/roundup/templates/classic/html/page.html:260
+#: ../share/roundup/templates/classic/html/page.html:273
+#: ../share/roundup/templates/classic/html/page.html:291
+#: ../share/roundup/templates/classic/html/page.html:304
+#: ../share/roundup/templates/devel/html/page.html:319
+#: ../share/roundup/templates/devel/html/page.html:332
+#: ../share/roundup/templates/devel/html/page.html:350
+#: ../share/roundup/templates/devel/html/page.html:363
+#: ../share/roundup/templates/minimal/html/page.html:242
+#: ../share/roundup/templates/minimal/html/page.html:257
+#: ../share/roundup/templates/minimal/html/page.html:270
+#: ../share/roundup/templates/responsive/html/page.html:334
+#: ../share/roundup/templates/responsive/html/page.html:347
+#: ../share/roundup/templates/responsive/html/page.html:365
+#: ../share/roundup/templates/responsive/html/page.html:378
 msgid "------------"
 msgstr "------------"
 
-#: ../share/roundup/templates/classic/html/page.html:335
-#: ../share/roundup/templates/devel/html/page.html:390
-#: ../share/roundup/templates/minimal/html/page.html:297
-#: ../share/roundup/templates/responsive/html/page.html:405
+#: ../share/roundup/templates/classic/html/page.html:336
+#: ../share/roundup/templates/devel/html/page.html:391
+#: ../share/roundup/templates/minimal/html/page.html:298
+#: ../share/roundup/templates/responsive/html/page.html:406
 msgid "no value"
 msgstr "kein Wert"
 
diff --git a/locale/en.po b/locale/en.po
index bcaa0c3ac..dfa00c7bb 100644
--- a/locale/en.po
+++ b/locale/en.po
@@ -9,9 +9,9 @@
 #
 msgid ""
 msgstr ""
-"Project-Id-Version: Roundup 2.5.0\n"
+"Project-Id-Version: Roundup 2.5.0b1\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
-"POT-Creation-Date: 2025-01-12 20:17-0500\n"
+"POT-Creation-Date: 2025-06-11 16:02-0400\n"
 "PO-Revision-Date: 2004-11-20 13:47+0200\n"
 "Last-Translator: Not applicable\n"
 "Language-Team: English\n"
@@ -30,19 +30,19 @@ msgstr ""
 msgid "You may not retire the admin or anonymous user"
 msgstr ""
 
-#: ../roundup/admin.py:131
+#: ../roundup/admin.py:132
 msgid ""
 "Have 'display designator[,designator*]' show header inside\n"
 "      []'s before items. Includes retired/active status.\n"
 msgstr ""
 
-#: ../roundup/admin.py:135
+#: ../roundup/admin.py:136
 msgid ""
 "Have 'display designator' and 'specification class' show\n"
 "      protected fields: creator, id etc.\n"
 msgstr ""
 
-#: ../roundup/admin.py:139
+#: ../roundup/admin.py:140
 msgid ""
 "Controls history options. It is a bitstring where setting\n"
 "      the bit disables the feature. A value of 0 (default)\n"
@@ -53,57 +53,57 @@ msgid ""
 "      history.\n"
 msgstr ""
 
-#: ../roundup/admin.py:148
+#: ../roundup/admin.py:149
 msgid ""
 "Set the number of lines of history to keep for this session.\n"
 "      -1 is infinite.\n"
 msgstr ""
 
-#: ../roundup/admin.py:152
+#: ../roundup/admin.py:153
 msgid "Set indexer to use when running 'reindex' NYI\n"
 msgstr ""
 
-#: ../roundup/admin.py:155
+#: ../roundup/admin.py:156
 msgid "Force reopening of tracker when running each command.\n"
 msgstr ""
 
-#: ../roundup/admin.py:158
+#: ../roundup/admin.py:159
 msgid ""
 "set the number of rows imported before a database commit is\n"
 "      done. Used only for imports on PostgreSQL.\n"
 msgstr ""
 
-#: ../roundup/admin.py:160
+#: ../roundup/admin.py:161
 msgid "Show retired items in table, list etc. One of 'no', 'only', 'both'\n"
 msgstr ""
 
-#: ../roundup/admin.py:162
+#: ../roundup/admin.py:163
 msgid "internal mapping for show_retired.\n"
 msgstr ""
 
-#: ../roundup/admin.py:163
+#: ../roundup/admin.py:164
 msgid "Enable verbose output: tracing, descriptions...\n"
 msgstr ""
 
-#: ../roundup/admin.py:175 ../roundup/admin.py:1188 ../roundup/admin.py:1858
-#: ../roundup/admin.py:1890 ../roundup/admin.py:175:1188 :1858:1890
+#: ../roundup/admin.py:176 ../roundup/admin.py:1199 ../roundup/admin.py:1869
+#: ../roundup/admin.py:1901 ../roundup/admin.py:176:1199 :1869:1901
 #, python-format
 msgid "no such class \"%(classname)s\""
 msgstr ""
 
-#: ../roundup/admin.py:188
+#: ../roundup/admin.py:189
 #, python-format
 msgid "argument \"%(arg)s\" not propname=value"
 msgstr ""
 
-#: ../roundup/admin.py:201
+#: ../roundup/admin.py:202
 #, python-format
 msgid ""
 "Problem: %(message)s\n"
 "\n"
 msgstr ""
 
-#: ../roundup/admin.py:202
+#: ../roundup/admin.py:203
 #, python-format
 msgid ""
 "%(message)sUsage: roundup-admin [options] [<command> <arguments>]\n"
@@ -134,17 +134,17 @@ msgid ""
 " roundup-admin help all                   -- all available help\n"
 msgstr ""
 
-#: ../roundup/admin.py:231
+#: ../roundup/admin.py:232
 msgid "Commands: "
 msgstr ""
 
-#: ../roundup/admin.py:238
+#: ../roundup/admin.py:249
 msgid ""
 "Commands may be abbreviated as long as the abbreviation\n"
 "matches only one command, e.g. l == li == lis == list."
 msgstr ""
 
-#: ../roundup/admin.py:270
+#: ../roundup/admin.py:281
 msgid ""
 "\n"
 "All commands (except help) require a tracker specifier. This is just\n"
@@ -212,23 +212,23 @@ msgid ""
 "Command help:\n"
 msgstr ""
 
-#: ../roundup/admin.py:334
+#: ../roundup/admin.py:345
 #, python-format
 msgid "%s:"
 msgstr ""
 
-#: ../roundup/admin.py:439 ../roundup/admin.py:1415
-#: ../roundup/admin.py:439:1415
+#: ../roundup/admin.py:450 ../roundup/admin.py:1426
+#: ../roundup/admin.py:450:1426
 msgid "Templates:"
 msgstr ""
 
-#: ../roundup/admin.py:442 ../roundup/admin.py:1425
-#: ../roundup/admin.py:442:1425
+#: ../roundup/admin.py:453 ../roundup/admin.py:1436
+#: ../roundup/admin.py:453:1436
 msgid "Back ends:"
 msgstr ""
 
 #. noqa: ARG002
-#: ../roundup/admin.py:459
+#: ../roundup/admin.py:470
 msgid ""
 "Usage: commit\n"
 "        Commit changes made to the database during an interactive session.\n"
@@ -242,7 +242,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:474
+#: ../roundup/admin.py:485
 msgid ""
 "Usage: create classname property=value ...\n"
 "        Create a new entry of a given class.\n"
@@ -254,42 +254,42 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:482 ../roundup/admin.py:555 ../roundup/admin.py:606
-#: ../roundup/admin.py:733 ../roundup/admin.py:806 ../roundup/admin.py:851
-#: ../roundup/admin.py:902 ../roundup/admin.py:999 ../roundup/admin.py:1216
-#: ../roundup/admin.py:1388 ../roundup/admin.py:1516 ../roundup/admin.py:1599
-#: ../roundup/admin.py:1725 ../roundup/admin.py:1848 ../roundup/admin.py:1880
-#: ../roundup/admin.py:1996 ../roundup/admin.py:2050 ../roundup/admin.py:2098
-#: ../roundup/admin.py:482:555 :1216:1388:1516 :1599:1725 :1848:1880 :1996:2050
-#: :2098 :606:733 :806:851 :902:999
+#: ../roundup/admin.py:493 ../roundup/admin.py:566 ../roundup/admin.py:617
+#: ../roundup/admin.py:744 ../roundup/admin.py:817 ../roundup/admin.py:862
+#: ../roundup/admin.py:913 ../roundup/admin.py:1010 ../roundup/admin.py:1227
+#: ../roundup/admin.py:1399 ../roundup/admin.py:1527 ../roundup/admin.py:1610
+#: ../roundup/admin.py:1736 ../roundup/admin.py:1859 ../roundup/admin.py:1891
+#: ../roundup/admin.py:2007 ../roundup/admin.py:2061 ../roundup/admin.py:2109
+#: ../roundup/admin.py:493:566 :1227:1399 :1527:1610 :1736:1859 :1891:2007
+#: :2061:2109 :617:744 :817:862 :913:1010
 msgid "Not enough arguments supplied"
 msgstr ""
 
-#: ../roundup/admin.py:502
+#: ../roundup/admin.py:513
 #, python-format
 msgid "%(propname)s (Password): "
 msgstr ""
 
-#: ../roundup/admin.py:505
+#: ../roundup/admin.py:516
 #, python-format
 msgid "   %(propname)s (Again): "
 msgstr ""
 
-#: ../roundup/admin.py:509
+#: ../roundup/admin.py:520
 msgid "Sorry, try again..."
 msgstr ""
 
-#: ../roundup/admin.py:514
+#: ../roundup/admin.py:525
 #, python-format
 msgid "%(propname)s (%(proptype)s): "
 msgstr ""
 
-#: ../roundup/admin.py:533
+#: ../roundup/admin.py:544
 #, python-format
 msgid "you must provide the \"%(propname)s\" property."
 msgstr ""
 
-#: ../roundup/admin.py:545
+#: ../roundup/admin.py:556
 msgid ""
 "Usage: display designator[,designator]*\n"
 "        Show the property values for the given node(s).\n"
@@ -302,13 +302,13 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:586
+#: ../roundup/admin.py:597
 #, python-format
 msgid "%(protected)s%(key)s: %(value)s"
 msgstr ""
 
 #. grab the directory to export to
-#: ../roundup/admin.py:589
+#: ../roundup/admin.py:600
 msgid ""
 "Usage: export [[-]class[,class]] export_dir\n"
 "        Export the database and file content.\n"
@@ -327,7 +327,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:704
+#: ../roundup/admin.py:715
 msgid ""
 "Usage: exporttables [[-]class[,class]] export_dir\n"
 "        Export only the database to files, no file content.\n"
@@ -347,7 +347,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:723
+#: ../roundup/admin.py:734
 msgid ""
 "Usage: filter classname propname=value ...\n"
 "        Find the nodes of the given class with a given property value.\n"
@@ -360,19 +360,19 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:764
+#: ../roundup/admin.py:775
 #, python-format
 msgid "Class %(curclassname)s has no property %(pn)s in %(propname)s."
 msgstr ""
 
-#: ../roundup/admin.py:791 ../roundup/admin.py:840 ../roundup/admin.py:1536
-#: ../roundup/admin.py:1549 ../roundup/admin.py:2120
-#: ../roundup/admin.py:791:840 :1536:1549:2120
+#: ../roundup/admin.py:802 ../roundup/admin.py:851 ../roundup/admin.py:1547
+#: ../roundup/admin.py:1560 ../roundup/admin.py:2131
+#: ../roundup/admin.py:802:851 :1547:1560:2131
 #, python-format
 msgid "%(classname)s has no property \"%(propname)s\""
 msgstr ""
 
-#: ../roundup/admin.py:798
+#: ../roundup/admin.py:809
 msgid ""
 "Usage: find classname propname=value ...\n"
 "        Find the nodes of the given class with a given link property value.\n"
@@ -383,14 +383,14 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:847
+#: ../roundup/admin.py:858
 msgid ""
 "Usage: genconfig filename\n"
 "        Create a new tracker config file with default values in filename.\n"
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:864
+#: ../roundup/admin.py:875
 #, python-format
 msgid ""
 "Changing option\n"
@@ -398,20 +398,20 @@ msgid ""
 "from old default of %(old_number)s to new default of %(new_number)s."
 msgstr ""
 
-#: ../roundup/admin.py:875
+#: ../roundup/admin.py:886
 #, python-format
 msgid ""
 "Update 'password_pbkdf2_default_rounds' to a number equal to or larger\n"
 "  than %s.\n"
 msgstr ""
 
-#: ../roundup/admin.py:882
+#: ../roundup/admin.py:893
 msgid ""
 "Check the rdbms mysql_* settings. Your charset and collations may need\n"
 "  to be changed. See upgrading instructions.\n"
 msgstr ""
 
-#: ../roundup/admin.py:892
+#: ../roundup/admin.py:903
 msgid ""
 "Usage: get property designator[,designator]*\n"
 "        Get the given property of one or more designator(s).\n"
@@ -424,23 +424,23 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:925
+#: ../roundup/admin.py:936
 #, python-format
 msgid "property %s is not of type Multilink or Link so -d flag does not apply."
 msgstr ""
 
-#: ../roundup/admin.py:942 ../roundup/admin.py:1190 ../roundup/admin.py:1864
-#: ../roundup/admin.py:1892 ../roundup/admin.py:942:1190 :1864:1892
+#: ../roundup/admin.py:953 ../roundup/admin.py:1201 ../roundup/admin.py:1875
+#: ../roundup/admin.py:1903 ../roundup/admin.py:953:1201 :1875:1903
 #, python-format
 msgid "no such %(classname)s node \"%(nodeid)s\""
 msgstr ""
 
-#: ../roundup/admin.py:945
+#: ../roundup/admin.py:956
 #, python-format
 msgid "no such %(classname)s property \"%(propname)s\""
 msgstr ""
 
-#: ../roundup/admin.py:950
+#: ../roundup/admin.py:961
 msgid ""
 "Usage: help topic\n"
 "        Give help about topic.\n"
@@ -452,12 +452,12 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:969
+#: ../roundup/admin.py:980
 #, python-format
 msgid "Sorry, no help for \"%(topic)s\""
 msgstr ""
 
-#: ../roundup/admin.py:986
+#: ../roundup/admin.py:997
 msgid ""
 "Usage: history designator [skipquiet] [raw]\n"
 "        Show the history entries of a designator.\n"
@@ -472,26 +472,26 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1011
+#: ../roundup/admin.py:1022
 #, python-format
 msgid "Unexpected argument(s): %s. Expected 'skipquiet' or 'raw'."
 msgstr ""
 
-#: ../roundup/admin.py:1062
+#: ../roundup/admin.py:1073
 msgid "removed"
 msgstr ""
 
-#: ../roundup/admin.py:1064
+#: ../roundup/admin.py:1075
 msgid "added"
 msgstr ""
 
-#: ../roundup/admin.py:1066
+#: ../roundup/admin.py:1077
 #, python-format
 msgid "Unknown history set operation '%s'. Expected +/-."
 msgstr ""
 
 #. .Hint added issue23 to superseder
-#: ../roundup/admin.py:1091
+#: ../roundup/admin.py:1102
 #, python-format
 msgid "added %(class)s%(item_id)s to %(propname)s"
 msgstr ""
@@ -499,29 +499,29 @@ msgstr ""
 #. .Hint read as: assignedto was admin(1)
 #. where assignedto is the property
 #. admin is the key name for value 1
-#: ../roundup/admin.py:1112
+#: ../roundup/admin.py:1123
 #, python-format
 msgid "%(prop)s was %(name)s(%(value)s)"
 msgstr ""
 
-#: ../roundup/admin.py:1118 ../roundup/admin.py:1147
-#: ../roundup/admin.py:1118:1147
+#: ../roundup/admin.py:1129 ../roundup/admin.py:1158
+#: ../roundup/admin.py:1129:1158
 #, python-format
 msgid "%(prop)s was %(value)s"
 msgstr ""
 
-#: ../roundup/admin.py:1137
+#: ../roundup/admin.py:1148
 #, python-format
 msgid "%(prop)s was [%(value_list)s]"
 msgstr ""
 
 #. .Hint modified nosy: added demo(3)
-#: ../roundup/admin.py:1144
+#: ../roundup/admin.py:1155
 #, python-format
 msgid "modified %(prop)s: %(how)s"
 msgstr ""
 
-#: ../roundup/admin.py:1195
+#: ../roundup/admin.py:1206
 msgid ""
 "Usage: import import_dir\n"
 "        Import a database and file contents from the directory.\n"
@@ -545,7 +545,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1306
+#: ../roundup/admin.py:1317
 msgid ""
 "Usage: importtables export_dir\n"
 "        This imports the database tables exported using exporttables.\n"
@@ -555,7 +555,7 @@ msgid ""
 msgstr ""
 
 #. password
-#: ../roundup/admin.py:1314
+#: ../roundup/admin.py:1325
 msgid ""
 "Usage: initialise [adminpw]\n"
 "        Initialise a new Roundup tracker.\n"
@@ -566,30 +566,30 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1328
+#: ../roundup/admin.py:1339
 msgid "Admin Password: "
 msgstr ""
 
-#: ../roundup/admin.py:1329
+#: ../roundup/admin.py:1340
 msgid "       Confirm: "
 msgstr ""
 
-#: ../roundup/admin.py:1333
+#: ../roundup/admin.py:1344
 msgid "Instance home does not exist"
 msgstr ""
 
-#: ../roundup/admin.py:1337
+#: ../roundup/admin.py:1348
 msgid "Instance has not been installed"
 msgstr ""
 
-#: ../roundup/admin.py:1345
+#: ../roundup/admin.py:1356
 msgid ""
 "WARNING: The database is already initialised!\n"
 "If you re-initialise it, you will lose all the data!\n"
 "Erase it? Y/N: "
 msgstr ""
 
-#: ../roundup/admin.py:1365
+#: ../roundup/admin.py:1376
 msgid ""
 "Usage: install [template [backend [key=val[,key=val]]]]\n"
 "        Install a new Roundup tracker.\n"
@@ -615,12 +615,12 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1394
+#: ../roundup/admin.py:1405
 #, python-format
 msgid "Instance home parent directory \"%(parent)s\" does not exist"
 msgstr ""
 
-#: ../roundup/admin.py:1403
+#: ../roundup/admin.py:1414
 #, python-format
 msgid ""
 "WARNING: There appears to be a tracker in \"%(tracker_home)s\"!\n"
@@ -628,20 +628,20 @@ msgid ""
 "Erase it? Y/N: "
 msgstr ""
 
-#: ../roundup/admin.py:1416
+#: ../roundup/admin.py:1427
 msgid "Select template"
 msgstr ""
 
-#: ../roundup/admin.py:1426
+#: ../roundup/admin.py:1437
 msgid "Select backend"
 msgstr ""
 
-#: ../roundup/admin.py:1437
+#: ../roundup/admin.py:1448
 #, python-format
 msgid "Error in configuration settings: \"%s\""
 msgstr ""
 
-#: ../roundup/admin.py:1470
+#: ../roundup/admin.py:1481
 #, python-format
 msgid ""
 "\n"
@@ -650,11 +650,11 @@ msgid ""
 "   %(config_file)s"
 msgstr ""
 
-#: ../roundup/admin.py:1480
+#: ../roundup/admin.py:1491
 msgid " ... at a minimum, you must set following options:"
 msgstr ""
 
-#: ../roundup/admin.py:1485
+#: ../roundup/admin.py:1496
 #, python-format
 msgid ""
 "\n"
@@ -671,7 +671,7 @@ msgid ""
 "---------------------------------------------------------------------------\n"
 msgstr ""
 
-#: ../roundup/admin.py:1501
+#: ../roundup/admin.py:1512
 msgid ""
 "Usage: list classname [property]\n"
 "        List the instances of a class.\n"
@@ -687,17 +687,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1514
+#: ../roundup/admin.py:1525
 msgid "Too many arguments supplied"
 msgstr ""
 
-#: ../roundup/admin.py:1547
+#: ../roundup/admin.py:1558
 #, python-format
 msgid "%(nodeid)4s: %(value)s"
 msgstr ""
 
 #. noqa: ARG002  - args unused
-#: ../roundup/admin.py:1554
+#: ../roundup/admin.py:1565
 msgid ""
 "Usage: migrate\n"
 "        Update a tracker's database to be compatible with the Roundup\n"
@@ -720,17 +720,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1574
+#: ../roundup/admin.py:1585
 #, python-format
 msgid "Tracker updated to schema version %s."
 msgstr ""
 
-#: ../roundup/admin.py:1578
+#: ../roundup/admin.py:1589
 #, python-format
 msgid "No migration action required. At schema version %s."
 msgstr ""
 
-#: ../roundup/admin.py:1583
+#: ../roundup/admin.py:1594
 msgid ""
 "Usage: pack period | date\n"
 "        Remove journal entries older than the date/period.\n"
@@ -750,11 +750,11 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1609
+#: ../roundup/admin.py:1620
 msgid "Invalid format"
 msgstr ""
 
-#: ../roundup/admin.py:1620
+#: ../roundup/admin.py:1631
 msgid ""
 "Usage: perftest [mode] [arguments]*\n"
 "        Time operations in Roundup.\n"
@@ -772,25 +772,25 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1657
+#: ../roundup/admin.py:1668
 msgid "Invalid 'rounds'. Must be larger than 999."
 msgstr ""
 
-#: ../roundup/admin.py:1661
+#: ../roundup/admin.py:1672
 #, python-format
 msgid "Invalid 'rounds'. It must be an integer not: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1688
+#: ../roundup/admin.py:1699
 msgid "scheme does not support rounds."
 msgstr ""
 
-#: ../roundup/admin.py:1691
+#: ../roundup/admin.py:1702
 #, python-format
 msgid "Hash time: %(time)0.9f seconds, scheme: %(scheme)s, rounds: %(rounds)s"
 msgstr ""
 
-#: ../roundup/admin.py:1697
+#: ../roundup/admin.py:1708
 msgid ""
 "Usage: pragma setting=value | 'list'\n"
 "        Set internal admin settings to a value.\n"
@@ -819,49 +819,49 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1732
+#: ../roundup/admin.py:1743
 #, python-format
 msgid "Argument must be setting=value, was given: %s."
 msgstr ""
 
-#: ../roundup/admin.py:1735
+#: ../roundup/admin.py:1746
 msgid "Current settings and values (NYI - not yet implemented):"
 msgstr ""
 
-#: ../roundup/admin.py:1746
+#: ../roundup/admin.py:1757
 msgid ""
 "      Help for this pragma is missing. Please report it to the Roundup "
 "project.\n"
 msgstr ""
 
-#: ../roundup/admin.py:1752
+#: ../roundup/admin.py:1763
 #, python-format
 msgid "Unknown setting %s. Try \"pragma list\"."
 msgstr ""
 
-#: ../roundup/admin.py:1762
+#: ../roundup/admin.py:1773
 #, python-format
 msgid "Incorrect value for boolean setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1769
+#: ../roundup/admin.py:1780
 #, python-format
 msgid "Incorrect value for integer setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1776
+#: ../roundup/admin.py:1787
 #, python-format
 msgid ""
 "Incorrect value for setting %(setting)s: %(value)s. Should be no, both, or "
 "only."
 msgstr ""
 
-#: ../roundup/admin.py:1786
+#: ../roundup/admin.py:1797
 #, python-format
 msgid "Internal error: pragma can not handle values of type: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1795
+#: ../roundup/admin.py:1806
 msgid ""
 "Usage: reindex [classname|classname:#-#|designator]*\n"
 "        Re-generate a tracker's search indexes.\n"
@@ -878,17 +878,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1817
+#: ../roundup/admin.py:1828
 #, python-format
 msgid "no such item \"%(designator)s\""
 msgstr ""
 
-#: ../roundup/admin.py:1827
+#: ../roundup/admin.py:1838
 #, python-format
 msgid "no such item \"%(class)s%(id)s\""
 msgstr ""
 
-#: ../roundup/admin.py:1839
+#: ../roundup/admin.py:1850
 msgid ""
 "Usage: restore designator[,designator]*\n"
 "        Restore the retired node specified by designator.\n"
@@ -900,7 +900,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1870
+#: ../roundup/admin.py:1881
 msgid ""
 "Usage: retire designator[,designator]*\n"
 "        Retire the node specified by designator.\n"
@@ -914,7 +914,7 @@ msgid ""
 msgstr ""
 
 #. noqa: ARG002 - args unused
-#: ../roundup/admin.py:1898
+#: ../roundup/admin.py:1909
 msgid ""
 "Usage: rollback\n"
 "        Undo all changes that are pending commit to the database.\n"
@@ -926,7 +926,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1911
+#: ../roundup/admin.py:1922
 msgid ""
 "Usage: security [Role name]\n"
 "        Display the Permissions available to one or all Roles.\n"
@@ -939,46 +939,46 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1926
+#: ../roundup/admin.py:1937
 #, python-format
 msgid "No such Role \"%(role)s\"\n"
 msgstr ""
 
-#: ../roundup/admin.py:1932
+#: ../roundup/admin.py:1943
 #, python-format
 msgid "New Web users get the Roles \"%(role)s\"\n"
 msgstr ""
 
-#: ../roundup/admin.py:1935
+#: ../roundup/admin.py:1946
 #, python-format
 msgid "New Web users get the Role \"%(role)s\"\n"
 msgstr ""
 
-#: ../roundup/admin.py:1939
+#: ../roundup/admin.py:1950
 #, python-format
 msgid "New Email users get the Roles \"%(role)s\"\n"
 msgstr ""
 
-#: ../roundup/admin.py:1941
+#: ../roundup/admin.py:1952
 #, python-format
 msgid "New Email users get the Role \"%(role)s\"\n"
 msgstr ""
 
-#: ../roundup/admin.py:1944
+#: ../roundup/admin.py:1955
 #, python-format
 msgid "Role \"%(name)s\":\n"
 msgstr ""
 
-#: ../roundup/admin.py:1950
+#: ../roundup/admin.py:1961
 msgid " %(description)s (%(name)s for \"%(klass)s\""
 msgstr ""
 
-#: ../roundup/admin.py:1950
+#: ../roundup/admin.py:1961
 #, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\": %(properties)s only)\n"
 msgstr ""
 
-#: ../roundup/admin.py:1963
+#: ../roundup/admin.py:1974
 #, python-format
 msgid ""
 "\n"
@@ -986,17 +986,17 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/admin.py:1969
+#: ../roundup/admin.py:1980
 #, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\" only)\n"
 msgstr ""
 
-#: ../roundup/admin.py:1972
+#: ../roundup/admin.py:1983
 #, python-format
 msgid " %(description)s (%(name)s)\n"
 msgstr ""
 
-#: ../roundup/admin.py:1976
+#: ../roundup/admin.py:1987
 msgid ""
 "Usage: set items property=value [property=value ...]\n"
 "        Set the given properties of one or more items(s).\n"
@@ -1017,7 +1017,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2044
+#: ../roundup/admin.py:2055
 msgid ""
 "Usage: specification classname\n"
 "        Show the properties for a classname.\n"
@@ -1026,17 +1026,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2063
+#: ../roundup/admin.py:2074
 #, python-format
 msgid "%(key)s: %(value)s (key property)\n"
 msgstr ""
 
-#: ../roundup/admin.py:2066
+#: ../roundup/admin.py:2077
 #, python-format
 msgid "%(key)s: %(value)s\n"
 msgstr ""
 
-#: ../roundup/admin.py:2069
+#: ../roundup/admin.py:2080
 msgid ""
 "Usage: table classname [property[,property]*]\n"
 "        List the instances of a class in tabular form.\n"
@@ -1068,17 +1068,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2115
+#: ../roundup/admin.py:2126
 #, python-format
 msgid "\"%(spec)s\" not name:width"
 msgstr ""
 
-#: ../roundup/admin.py:2137
+#: ../roundup/admin.py:2148
 #, python-format
 msgid "\"%(spec)s\" does not have an integer width: \"%(width)s\""
 msgstr ""
 
-#: ../roundup/admin.py:2173
+#: ../roundup/admin.py:2184
 msgid ""
 "Usage: templates [trace_search]\n"
 "        List templates and their installed directories.\n"
@@ -1088,7 +1088,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2201
+#: ../roundup/admin.py:2212
 msgid ""
 "Usage: updateconfig <filename>\n"
 "        Merge existing tracker config with new settings.\n"
@@ -1098,92 +1098,92 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2210 ../roundup/cgi/actions.py:886
-#: ../roundup/cgi/actions.py:897 ../roundup/cgi/actions.py:1099
-#: ../roundup/cgi/actions.py:1113 ../roundup/cgi/actions.py:886:897 :1099:1113
+#: ../roundup/admin.py:2221 ../roundup/cgi/actions.py:891
+#: ../roundup/cgi/actions.py:902 ../roundup/cgi/actions.py:1104
+#: ../roundup/cgi/actions.py:1118 ../roundup/cgi/actions.py:891:902 :1104:1118
 #, python-format
 msgid "Error: %s"
 msgstr ""
 
-#: ../roundup/admin.py:2242
+#: ../roundup/admin.py:2253
 #, python-format
 msgid "Unknown command \"%(command)s\" (\"help commands\" for a list)"
 msgstr ""
 
-#: ../roundup/admin.py:2248
+#: ../roundup/admin.py:2259
 #, python-format
 msgid "Multiple commands match \"%(command)s\": %(list)s"
 msgstr ""
 
-#: ../roundup/admin.py:2263
+#: ../roundup/admin.py:2274
 msgid "Enter tracker home: "
 msgstr ""
 
-#: ../roundup/admin.py:2292 ../roundup/admin.py:2296
-#: ../roundup/admin.py:2292:2296
+#: ../roundup/admin.py:2303 ../roundup/admin.py:2307
+#: ../roundup/admin.py:2303:2307
 #, python-format
 msgid "Error: Couldn't open tracker: %(message)s"
 msgstr ""
 
-#: ../roundup/admin.py:2344
+#: ../roundup/admin.py:2355
 #, python-format
 msgid ""
 "Roundup %s ready for input.\n"
 "Type \"help\" for help."
 msgstr ""
 
-#: ../roundup/admin.py:2377
+#: ../roundup/admin.py:2388
 msgid "Note: command history and editing not available"
 msgstr ""
 
-#: ../roundup/admin.py:2383
+#: ../roundup/admin.py:2394
 msgid "exit..."
 msgstr ""
 
-#: ../roundup/admin.py:2396
+#: ../roundup/admin.py:2407
 msgid "There are unsaved changes. Commit them (y/N)? "
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:215
-#: ../roundup/backends/rdbms_common.py:928
+#: ../roundup/backends/back_anydbm.py:213
+#: ../roundup/backends/rdbms_common.py:926
 #, python-format
 msgid "Class \"%s\" already defined."
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:280
+#: ../roundup/backends/back_anydbm.py:278
 #: ../roundup/backends/sessions_dbm.py:61
 msgid "Couldn't identify database type"
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:314
+#: ../roundup/backends/back_anydbm.py:312
 #, python-format
 msgid ""
 "Couldn't open database - the required module '%s' (as dbm.gnu) is not "
 "available"
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:318
+#: ../roundup/backends/back_anydbm.py:316
 #, python-format
 msgid "Couldn't open database - the required module '%s' is not available"
 msgstr ""
 
 #: ../roundup/backends/back_anydbm.py:873
 #: ../roundup/backends/back_anydbm.py:886
-#: ../roundup/backends/back_anydbm.py:1160
-#: ../roundup/backends/back_anydbm.py:1195
-#: ../roundup/backends/back_anydbm.py:1424
-#: ../roundup/backends/back_anydbm.py:1442
-#: ../roundup/backends/back_anydbm.py:1489
-#: ../roundup/backends/back_anydbm.py:2135
+#: ../roundup/backends/back_anydbm.py:1162
+#: ../roundup/backends/back_anydbm.py:1197
+#: ../roundup/backends/back_anydbm.py:1426
+#: ../roundup/backends/back_anydbm.py:1444
+#: ../roundup/backends/back_anydbm.py:1492
+#: ../roundup/backends/back_anydbm.py:2138
 #: ../roundup/backends/back_anydbm.py:873:886
-#: ../roundup/backends/rdbms_common.py:1720
-#: ../roundup/backends/rdbms_common.py:1967
-#: ../roundup/backends/rdbms_common.py:2206
-#: ../roundup/backends/rdbms_common.py:2226
-#: ../roundup/backends/rdbms_common.py:2279
-#: ../roundup/backends/rdbms_common.py:3254
-#: ../roundup/backends/rdbms_common.py:1720:1967 :1160:1195 :1424:1442:1489
-#: :2135 :2206:2226 :2279:3254
+#: ../roundup/backends/rdbms_common.py:1721
+#: ../roundup/backends/rdbms_common.py:1972
+#: ../roundup/backends/rdbms_common.py:2211
+#: ../roundup/backends/rdbms_common.py:2231
+#: ../roundup/backends/rdbms_common.py:2293
+#: ../roundup/backends/rdbms_common.py:3268
+#: ../roundup/backends/rdbms_common.py:1721:1972 :1162:1197 :1426:1444:1492
+#: :2138 :2211:2231 :2293:3268
 msgid "Database open read-only"
 msgstr ""
 
@@ -1209,45 +1209,50 @@ msgstr ""
 msgid "Unable to get lock after 10 retries on %s."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:632
+#: ../roundup/backends/rdbms_common.py:630
 #, python-format
 msgid "ALTER operation disallowed: %(old)r -> %(new)r."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:867
+#: ../roundup/backends/rdbms_common.py:865
 #, python-format
 msgid "CREATE operation disallowed: \"%s\"."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:884
+#: ../roundup/backends/rdbms_common.py:882
 #, python-format
 msgid "DROP operation disallowed: \"%s\"."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:1863
+#: ../roundup/backends/rdbms_common.py:1864
 msgid "create"
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:2038
+#: ../roundup/backends/rdbms_common.py:2043
 msgid "unlink"
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:2042
+#: ../roundup/backends/rdbms_common.py:2047
 msgid "link"
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:2187
+#: ../roundup/backends/rdbms_common.py:2192
 msgid "set"
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:2216
+#: ../roundup/backends/rdbms_common.py:2221
 msgid "retired"
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:2246
+#: ../roundup/backends/rdbms_common.py:2251
 msgid "restored"
 msgstr ""
 
+#: ../roundup/backends/rdbms_common.py:2265
+#, python-format
+msgid "class %(cls)s: %(value)r is not an id"
+msgstr ""
+
 #: ../roundup/backends/sessions_redis.py:78
 #: ../roundup/backends/sessions_redis.py:97
 #: ../roundup/backends/sessions_redis.py:78:97
@@ -1330,10 +1335,10 @@ msgid "\"%(input)s\" is not an ID (%(classname)s ID required)"
 msgstr ""
 
 #: ../roundup/cgi/actions.py:228 ../roundup/cgi/actions.py:266
-#: ../roundup/cgi/actions.py:493 ../roundup/cgi/actions.py:833
-#: ../roundup/cgi/actions.py:880 ../roundup/cgi/actions.py:1084
-#: ../roundup/cgi/actions.py:1246 ../roundup/cgi/actions.py:228:266:1246
-#: :493:833 :880:1084
+#: ../roundup/cgi/actions.py:493 ../roundup/cgi/actions.py:838
+#: ../roundup/cgi/actions.py:885 ../roundup/cgi/actions.py:1089
+#: ../roundup/cgi/actions.py:1251 ../roundup/cgi/actions.py:228:266:1251
+#: :493:838 :885:1089
 msgid "Invalid request"
 msgstr ""
 
@@ -1381,8 +1386,8 @@ msgstr ""
 msgid "Invalid integer: "
 msgstr ""
 
-#: ../roundup/cgi/actions.py:531 ../roundup/cgi/actions.py:735
-#: ../roundup/cgi/actions.py:531:735
+#: ../roundup/cgi/actions.py:531 ../roundup/cgi/actions.py:740
+#: ../roundup/cgi/actions.py:531:740
 #, python-format
 msgid "You do not have permission to create %(class)s"
 msgstr ""
@@ -1392,8 +1397,8 @@ msgstr ""
 msgid "Not enough values on line %(line)s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:556 ../roundup/cgi/actions.py:723
-#: ../roundup/cgi/actions.py:556:723
+#: ../roundup/cgi/actions.py:556 ../roundup/cgi/actions.py:728
+#: ../roundup/cgi/actions.py:556:728
 #, python-format
 msgid "You do not have permission to edit %(class)s"
 msgstr ""
@@ -1402,41 +1407,41 @@ msgstr ""
 msgid "Items edited OK"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:671
+#: ../roundup/cgi/actions.py:676
 #, python-format
 msgid "%(class)s %(id)s %(properties)s edited ok"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:689
+#: ../roundup/cgi/actions.py:694
 #, python-format
 msgid "%(class)s %(id)s created"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:817
+#: ../roundup/cgi/actions.py:822
 #, python-format
 msgid ""
 "Edit Error: someone else has edited this %(klass)s (%(props)s). View <a "
 "target=\"_blank\" href=\"%(klass)s%(id)s\">their changes</a> in a new window."
 msgstr ""
 
-#: ../roundup/cgi/actions.py:850
+#: ../roundup/cgi/actions.py:855
 #, python-format
 msgid "Edit Error: %s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:931
+#: ../roundup/cgi/actions.py:936
 msgid ""
 "Invalid One Time Key!\n"
 "(a Mozilla bug may cause this message to show up erroneously, please check "
 "your email)"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:972
+#: ../roundup/cgi/actions.py:977
 #, python-format
 msgid "Password reset for %s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:973
+#: ../roundup/cgi/actions.py:978
 #, python-format
 msgid ""
 "\n"
@@ -1445,29 +1450,29 @@ msgid ""
 "Your password is now: %(password)s\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:982
+#: ../roundup/cgi/actions.py:987
 #, python-format
 msgid "Password reset and email sent to %s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:991
+#: ../roundup/cgi/actions.py:996
 msgid "Unknown username"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:999
+#: ../roundup/cgi/actions.py:1004
 msgid "Unknown email address"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1004
+#: ../roundup/cgi/actions.py:1009
 msgid "You need to specify a username or address"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1015
+#: ../roundup/cgi/actions.py:1020
 #, python-format
 msgid "Confirm reset of password for %s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1016
+#: ../roundup/cgi/actions.py:1021
 #, python-format
 msgid ""
 "\n"
@@ -1481,31 +1486,31 @@ msgid ""
 "You should then receive another email with the new password.\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1029
+#: ../roundup/cgi/actions.py:1034
 #, python-format
 msgid "Email sent to primary notification address for %s."
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1031
+#: ../roundup/cgi/actions.py:1036
 #, python-format
 msgid "Email sent to %s."
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1046
+#: ../roundup/cgi/actions.py:1051
 msgid "You are now registered, welcome!"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1139
+#: ../roundup/cgi/actions.py:1144
 #, python-format
 msgid "Username '%s' is already used."
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1163
+#: ../roundup/cgi/actions.py:1168
 #, python-format
 msgid "Complete your registration to %(tracker_name)s -- key %(key)s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1167
+#: ../roundup/cgi/actions.py:1172
 #, python-format
 msgid ""
 "To complete your registration of the user \"%(name)s\" with\n"
@@ -1521,12 +1526,12 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1181
+#: ../roundup/cgi/actions.py:1186
 #, python-format
 msgid "Complete your registration to %s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1182
+#: ../roundup/cgi/actions.py:1187
 #, python-format
 msgid ""
 "To complete your registration of the user \"%(name)s\" with\n"
@@ -1536,44 +1541,44 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1206
+#: ../roundup/cgi/actions.py:1211
 msgid "It is not permitted to supply roles at registration."
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1220
+#: ../roundup/cgi/actions.py:1225
 msgid "You are logged out"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1250
+#: ../roundup/cgi/actions.py:1255
 msgid "Username required"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1354
+#: ../roundup/cgi/actions.py:1359
 #, python-format
 msgid "Welcome %(username)s!"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1477
+#: ../roundup/cgi/actions.py:1482
 #, python-format
 msgid "Logins occurring too fast. Please wait: %s seconds."
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1515 ../roundup/cgi/actions.py:1526
-#: ../roundup/cgi/actions.py:1515:1526
+#: ../roundup/cgi/actions.py:1520 ../roundup/cgi/actions.py:1531
+#: ../roundup/cgi/actions.py:1520:1531
 msgid "Invalid login"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1532
+#: ../roundup/cgi/actions.py:1537
 msgid "You do not have permission to login"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1577 ../roundup/cgi/actions.py:1757
-#: ../roundup/cgi/actions.py:1577:1757
+#: ../roundup/cgi/actions.py:1582 ../roundup/cgi/actions.py:1762
+#: ../roundup/cgi/actions.py:1582:1762
 #, python-format
 msgid "Column \"%(column)s\" not found in %(class)s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1822
+#: ../roundup/cgi/actions.py:1827
 #, python-format
 msgid "You do not have permission to view %(class)s"
 msgstr ""
@@ -1683,8 +1688,8 @@ msgstr ""
 msgid "Unrecognized charset: %r"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1381 ../roundup/cgi/client.py:2394
-#: ../roundup/cgi/client.py:1381:2394
+#: ../roundup/cgi/client.py:1381 ../roundup/cgi/client.py:2396
+#: ../roundup/cgi/client.py:1381:2396
 msgid "broken form: multiple @action values submitted"
 msgstr ""
 
@@ -1762,57 +1767,58 @@ msgstr ""
 
 #: ../roundup/cgi/client.py:1679
 #, python-format
-msgid "csrf X-REQUESTED-WITH xmlrpc required header check failed for user%s."
+msgid ""
+"csrf X-REQUESTED-WITH xmlrpc required header check failed for user%(userid)s."
 msgstr ""
 
 #: ../roundup/cgi/client.py:1720
 #, python-format
-msgid "Required csrf field missing for user%s"
+msgid "Required csrf field missing for user%(userid)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1722 ../roundup/cgi/client.py:1749
-#: ../roundup/cgi/client.py:1766 ../roundup/cgi/client.py:1722:1749:1766
+#: ../roundup/cgi/client.py:1723 ../roundup/cgi/client.py:1751
+#: ../roundup/cgi/client.py:1768 ../roundup/cgi/client.py:1723:1751:1768
 msgid ""
 "We can't validate your session (csrf failure). Re-enter any unsaved data and "
 "try again."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1726
+#: ../roundup/cgi/client.py:1728
 #, python-format
-msgid "csrf field not supplied by user%s"
+msgid "csrf field not supplied by user%(userid)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1738
+#: ../roundup/cgi/client.py:1740
 #, python-format
 msgid ""
 "Csrf mismatch user: current user %(user)s != stored user %(stored)s, current "
 "session, stored session: %(cur_sess)s,%(stor_sess)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1756
+#: ../roundup/cgi/client.py:1758
 #, python-format
 msgid ""
 "Csrf mismatch user: current session %(curr_sess)s != stored session "
 "%(stor_sess)s, current user/stored user is: %(user)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1948
+#: ../roundup/cgi/client.py:1950
 msgid "You are not allowed to view this file."
 msgstr ""
 
-#: ../roundup/cgi/client.py:2272
+#: ../roundup/cgi/client.py:2274
 #, python-format
 msgid "%(starttag)sTime elapsed: %(seconds)fs%(endtag)s\n"
 msgstr ""
 
-#: ../roundup/cgi/client.py:2276
+#: ../roundup/cgi/client.py:2278
 #, python-format
 msgid ""
 "%(starttag)sCache hits: %(cache_hits)d, misses %(cache_misses)d. Loading "
 "items: %(get_items)f secs. Filtering: %(filtering)f secs.%(endtag)s\n"
 msgstr ""
 
-#: ../roundup/cgi/client.py:2815
+#: ../roundup/cgi/client.py:2817
 #, python-format
 msgid ""
 "Cache failure: compressed file %(compressed)s is older than its source file "
@@ -1875,136 +1881,136 @@ msgstr[1] ""
 msgid "You are not allowed to %(action)s items of class %(class)s"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:916
+#: ../roundup/cgi/templating.py:892
 msgid "(list)"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:991
+#: ../roundup/cgi/templating.py:975
 msgid "Submit New Entry"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:1013 ../roundup/cgi/templating.py:1189
-#: ../roundup/cgi/templating.py:1824 ../roundup/cgi/templating.py:1855
-#: ../roundup/cgi/templating.py:1876 ../roundup/cgi/templating.py:1914
-#: ../roundup/cgi/templating.py:1967 ../roundup/cgi/templating.py:1991
-#: ../roundup/cgi/templating.py:1998 ../roundup/cgi/templating.py:2035
-#: ../roundup/cgi/templating.py:2088 ../roundup/cgi/templating.py:2121
-#: ../roundup/cgi/templating.py:2216 ../roundup/cgi/templating.py:2237
-#: ../roundup/cgi/templating.py:2328 ../roundup/cgi/templating.py:2348
-#: ../roundup/cgi/templating.py:2370 ../roundup/cgi/templating.py:2413
-#: ../roundup/cgi/templating.py:2423 ../roundup/cgi/templating.py:2488
-#: ../roundup/cgi/templating.py:2791 ../roundup/cgi/templating.py:1013:1189
-#: :1824:1855 :1876:1914 :1967:1991 :1998:2035 :2088:2121 :2216:2237 :2328:2348
-#: :2370:2413 :2423:2488:2791
+#: ../roundup/cgi/templating.py:997 ../roundup/cgi/templating.py:1174
+#: ../roundup/cgi/templating.py:1809 ../roundup/cgi/templating.py:1840
+#: ../roundup/cgi/templating.py:1861 ../roundup/cgi/templating.py:1899
+#: ../roundup/cgi/templating.py:1952 ../roundup/cgi/templating.py:1976
+#: ../roundup/cgi/templating.py:1983 ../roundup/cgi/templating.py:2020
+#: ../roundup/cgi/templating.py:2077 ../roundup/cgi/templating.py:2115
+#: ../roundup/cgi/templating.py:2215 ../roundup/cgi/templating.py:2236
+#: ../roundup/cgi/templating.py:2357 ../roundup/cgi/templating.py:2377
+#: ../roundup/cgi/templating.py:2399 ../roundup/cgi/templating.py:2442
+#: ../roundup/cgi/templating.py:2452 ../roundup/cgi/templating.py:2517
+#: ../roundup/cgi/templating.py:2820 ../roundup/cgi/templating.py:997:1174
+#: :1809:1840 :1861:1899 :1952:1976 :1983:2020 :2077:2115 :2215:2236 :2357:2377
+#: :2399:2442 :2452:2517:2820
 msgid "[hidden]"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:1014
+#: ../roundup/cgi/templating.py:998
 msgid "New node - no history"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:1154
+#: ../roundup/cgi/templating.py:1139
 msgid "Submit Changes"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:1232
+#: ../roundup/cgi/templating.py:1217
 msgid "<em>The indicated property no longer exists</em>"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:1268
+#: ../roundup/cgi/templating.py:1253
 #, python-format
 msgid "The linked class %(classname)s no longer exists"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:1305 ../roundup/cgi/templating.py:1335
-#: ../roundup/cgi/templating.py:2497 ../roundup/cgi/templating.py:2800
-#: ../roundup/cgi/templating.py:1305:1335 :2497:2800
+#: ../roundup/cgi/templating.py:1290 ../roundup/cgi/templating.py:1320
+#: ../roundup/cgi/templating.py:2526 ../roundup/cgi/templating.py:2829
+#: ../roundup/cgi/templating.py:1290:1320 :2526:2829
 msgid "[label is missing]"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:1309 ../roundup/cgi/templating.py:1338
-#: ../roundup/cgi/templating.py:1309:1338
+#: ../roundup/cgi/templating.py:1294 ../roundup/cgi/templating.py:1323
+#: ../roundup/cgi/templating.py:1294:1323
 msgid "<strike>The linked node no longer exists</strike>"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:1400
+#: ../roundup/cgi/templating.py:1385
 #, python-format
 msgid "%s: (no value)"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:1416
+#: ../roundup/cgi/templating.py:1401
 #, python-format
 msgid ""
 "<strong><em>This event %s is not handled by the history display!</em></"
 "strong>"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:1429
+#: ../roundup/cgi/templating.py:1414
 msgid "<tr><td colspan=4><strong>Note:</strong></td></tr>"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:1438
+#: ../roundup/cgi/templating.py:1423
 msgid "History"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:1440
+#: ../roundup/cgi/templating.py:1425
 msgid "<th>Date</th>"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:1441
+#: ../roundup/cgi/templating.py:1426
 msgid "<th>User</th>"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:1442
+#: ../roundup/cgi/templating.py:1427
 msgid "<th>Action</th>"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:1443
+#: ../roundup/cgi/templating.py:1428
 msgid "<th>Args</th>"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:1494
+#: ../roundup/cgi/templating.py:1479
 #, python-format
 msgid "Copy of %(class)s %(id)s"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:2125 ../roundup/cgi/templating.py:2160
-#: ../roundup/cgi/templating.py:1382:2125:2160
+#: ../roundup/cgi/templating.py:2119 ../roundup/cgi/templating.py:2154
+#: ../roundup/cgi/templating.py:1367:2119:2154
 msgid "No"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:2125 ../roundup/cgi/templating.py:2154
-#: ../roundup/cgi/templating.py:1382:2125:2154
+#: ../roundup/cgi/templating.py:2119 ../roundup/cgi/templating.py:2148
+#: ../roundup/cgi/templating.py:1367:2119:2148
 msgid "Yes"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:2286
+#: ../roundup/cgi/templating.py:2315
 msgid ""
 "default value for DateHTMLProperty must be either DateHTMLProperty or string "
 "date representation."
 msgstr ""
 
-#: ../roundup/cgi/templating.py:2468
+#: ../roundup/cgi/templating.py:2497
 #, python-format
 msgid "Attempt to look up %(attr)s on a missing value"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:2479
+#: ../roundup/cgi/templating.py:2508
 #, python-format
 msgid "Attempt to look up %(item)s on a missing value"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:2584
+#: ../roundup/cgi/templating.py:2613
 #, python-format
 msgid "<option %svalue=\"-1\">- no selection -</option>"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:3745
+#: ../roundup/cgi/templating.py:3777
 #, python-format
 msgid "Unable to read or expand file '%(name)s' in template '%(template)s'."
 msgstr ""
 
-#: ../roundup/cgi/templating.py:3795
+#: ../roundup/cgi/templating.py:3827
 #, python-format
 msgid ""
 "Found an incorrect token when expandfile applied string subsitution on "
@@ -2168,54 +2174,54 @@ msgstr ""
 msgid "in %s"
 msgstr ""
 
-#: ../roundup/hyperdb.py:120
+#: ../roundup/hyperdb.py:126
 #, python-format
 msgid "property %(property)s: %(errormsg)s"
 msgstr ""
 
-#: ../roundup/hyperdb.py:149
+#: ../roundup/hyperdb.py:161
 #, python-format
 msgid "property %(property)s: %(value)r is an invalid date (%(errormsg)s)"
 msgstr ""
 
-#: ../roundup/hyperdb.py:172
+#: ../roundup/hyperdb.py:184
 #, python-format
 msgid ""
 "property %(property)s: %(value)r is an invalid date interval (%(errormsg)s)"
 msgstr ""
 
-#: ../roundup/hyperdb.py:434
+#: ../roundup/hyperdb.py:446
 #, python-format
 msgid "property %(property)s: %(value)r is not a number"
 msgstr ""
 
-#: ../roundup/hyperdb.py:448
+#: ../roundup/hyperdb.py:460
 #, python-format
 msgid "property %(property)s: %(value)r is not an integer"
 msgstr ""
 
-#: ../roundup/hyperdb.py:470
+#: ../roundup/hyperdb.py:482
 #, python-format
 msgid "\"%s\" not a node designator"
 msgstr ""
 
-#: ../roundup/hyperdb.py:1499 ../roundup/hyperdb.py:1507
-#: ../roundup/hyperdb.py:1499:1507
+#: ../roundup/hyperdb.py:1515 ../roundup/hyperdb.py:1523
+#: ../roundup/hyperdb.py:1515:1523
 #, python-format
 msgid "Not a property name: %s"
 msgstr ""
 
-#: ../roundup/hyperdb.py:2038
+#: ../roundup/hyperdb.py:2054
 #, python-format
 msgid "property %(property)s: %(value)r is not a %(classname)s."
 msgstr ""
 
-#: ../roundup/hyperdb.py:2044
+#: ../roundup/hyperdb.py:2060
 #, python-format
 msgid "you may only enter ID values for property %s"
 msgstr ""
 
-#: ../roundup/hyperdb.py:2079
+#: ../roundup/hyperdb.py:2095
 #, python-format
 msgid "%(property)r is not a property of %(classname)s"
 msgstr ""
@@ -2469,60 +2475,60 @@ msgid ""
 "are: %(stack)s"
 msgstr ""
 
-#: ../roundup/pygettext.py:401
+#: ../roundup/pygettext.py:400
 #, python-format
 msgid "*** %(file)s:%(lineno)s: Seen unexpected token \"%(token)s\""
 msgstr ""
 
-#: ../roundup/pygettext.py:457
+#: ../roundup/pygettext.py:456
 #, python-format
 msgid "# File: %(filename)s, line: %(lineno)d"
 msgstr ""
 
-#: ../roundup/pygettext.py:464
+#: ../roundup/pygettext.py:463
 #, python-format
 msgid " %(filename)s:%(lineno)d"
 msgstr ""
 
-#: ../roundup/pygettext.py:540
+#: ../roundup/pygettext.py:539
 #, python-format
 msgid "Invalid value for --style: %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:548
+#: ../roundup/pygettext.py:547
 #, python-format
 msgid "pygettext.py (xgettext for Python) %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:554
+#: ../roundup/pygettext.py:553
 #, python-format
 msgid "--width argument must be an integer: %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:582
+#: ../roundup/pygettext.py:581
 #, python-format
 msgid "Can't read --exclude-file: %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:601
+#: ../roundup/pygettext.py:600
 msgid "Reading standard input"
 msgstr ""
 
-#: ../roundup/pygettext.py:606
+#: ../roundup/pygettext.py:605
 #, python-format
 msgid "Working on %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:640
+#: ../roundup/pygettext.py:639
 msgid "a unicode string"
 msgstr ""
 
-#: ../roundup/pygettext.py:642
+#: ../roundup/pygettext.py:641
 #, python-format
 msgid "*** Seen unexpected token \"%(token)s\""
 msgstr ""
 
-#: ../roundup/pygettext.py:643
+#: ../roundup/pygettext.py:642
 msgid "morethanonestring"
 msgstr ""
 
@@ -2642,32 +2648,32 @@ msgstr ""
 msgid "creator"
 msgstr ""
 
-#: ../roundup/roundupdb.py:426
+#: ../roundup/roundupdb.py:447
 #, python-format
 msgid "No key for \"%(adr)s\" in keyring"
 msgstr ""
 
-#: ../roundup/roundupdb.py:504
+#: ../roundup/roundupdb.py:525
 #, python-format
 msgid "New submission from %(authname)s%(authaddr)s:"
 msgstr ""
 
-#: ../roundup/roundupdb.py:507
+#: ../roundup/roundupdb.py:528
 #, python-format
 msgid "%(authname)s%(authaddr)s added the comment:"
 msgstr ""
 
-#: ../roundup/roundupdb.py:510
+#: ../roundup/roundupdb.py:531
 #, python-format
 msgid "Change by %(authname)s%(authaddr)s:"
 msgstr ""
 
-#: ../roundup/roundupdb.py:529
+#: ../roundup/roundupdb.py:550
 #, python-format
 msgid "File '%(filename)s' not attached - you can download it from %(link)s."
 msgstr ""
 
-#: ../roundup/roundupdb.py:904
+#: ../roundup/roundupdb.py:925
 #, python-format
 msgid ""
 "\n"
@@ -2766,58 +2772,58 @@ msgid ""
 "<body><h1>Roundup trackers index</h1><ol>\n"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:598
+#: ../roundup/scripts/roundup_server.py:602
 #, python-format
 msgid "Error: %(type)s: %(value)s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:610
+#: ../roundup/scripts/roundup_server.py:614
 msgid "WARNING: ignoring \"-g\" argument, not root"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:616
+#: ../roundup/scripts/roundup_server.py:620
 msgid "Can't change groups - no grp module"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:625
+#: ../roundup/scripts/roundup_server.py:629
 #, python-format
 msgid "Group %(group)s doesn't exist"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:637
+#: ../roundup/scripts/roundup_server.py:641
 msgid "Can't run as root!"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:640
+#: ../roundup/scripts/roundup_server.py:644
 msgid "WARNING: ignoring \"-u\" argument, not root"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:646
+#: ../roundup/scripts/roundup_server.py:650
 msgid "Can't change users - no pwd module"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:655
+#: ../roundup/scripts/roundup_server.py:659
 #, python-format
 msgid "User %(user)s doesn't exist"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:867
+#: ../roundup/scripts/roundup_server.py:871
 #, python-format
 msgid "Multiprocess mode \"%s\" is not available, switching to single-process"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:895
+#: ../roundup/scripts/roundup_server.py:899
 #, python-format
 msgid "Unable to bind to port %s, port already in use."
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:899
+#: ../roundup/scripts/roundup_server.py:903
 #, python-format
 msgid ""
 "Unable to bind to port %(port)s, access not allowed, errno: %(errno)s %(msg)s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:978
+#: ../roundup/scripts/roundup_server.py:982
 msgid ""
 " -c <Command>  Windows Service options.\n"
 "               If you want to run the server as a Windows Service, you\n"
@@ -2827,7 +2833,7 @@ msgid ""
 "               specifics."
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:985
+#: ../roundup/scripts/roundup_server.py:989
 msgid ""
 " -u <UID>      runs the Roundup web server as this UID\n"
 " -g <GID>      runs the Roundup web server as this GID\n"
@@ -2837,7 +2843,7 @@ msgid ""
 " -D            run the server in the foreground even when -d is used."
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:993
+#: ../roundup/scripts/roundup_server.py:997
 #, python-format
 msgid ""
 "\n"
@@ -2910,20 +2916,24 @@ msgid ""
 "   any url-unsafe characters like spaces, as these confuse IE.\n"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:1173
+#: ../roundup/scripts/roundup_server.py:1177
 msgid "Instances must be name=home"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:1187
+#: ../roundup/scripts/roundup_server.py:1191
 #, python-format
 msgid "Configuration saved to %s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:1205
+#: ../roundup/scripts/roundup_server.py:1206
+msgid "If you specify a PID file you must use -l or -L."
+msgstr ""
+
+#: ../roundup/scripts/roundup_server.py:1212
 msgid "Sorry, you can't run the server as a daemon on this Operating System"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:1225
+#: ../roundup/scripts/roundup_server.py:1232
 #, python-format
 msgid "Roundup server started on %(HOST)s:%(PORT)s"
 msgstr ""
@@ -4177,46 +4187,46 @@ msgstr ""
 msgid "clear this message"
 msgstr ""
 
-#: ../share/roundup/templates/classic/html/page.html:257
-#: ../share/roundup/templates/classic/html/page.html:270
-#: ../share/roundup/templates/classic/html/page.html:288
-#: ../share/roundup/templates/classic/html/page.html:302
-#: ../share/roundup/templates/devel/html/page.html:316
-#: ../share/roundup/templates/devel/html/page.html:329
-#: ../share/roundup/templates/devel/html/page.html:347
-#: ../share/roundup/templates/devel/html/page.html:361
-#: ../share/roundup/templates/minimal/html/page.html:239
-#: ../share/roundup/templates/minimal/html/page.html:254
-#: ../share/roundup/templates/minimal/html/page.html:268
-#: ../share/roundup/templates/responsive/html/page.html:331
-#: ../share/roundup/templates/responsive/html/page.html:344
-#: ../share/roundup/templates/responsive/html/page.html:362
-#: ../share/roundup/templates/responsive/html/page.html:376
-msgid "don't care"
-msgstr ""
-
-#: ../share/roundup/templates/classic/html/page.html:259
-#: ../share/roundup/templates/classic/html/page.html:272
-#: ../share/roundup/templates/classic/html/page.html:290
+#: ../share/roundup/templates/classic/html/page.html:258
+#: ../share/roundup/templates/classic/html/page.html:271
+#: ../share/roundup/templates/classic/html/page.html:289
 #: ../share/roundup/templates/classic/html/page.html:303
-#: ../share/roundup/templates/devel/html/page.html:318
-#: ../share/roundup/templates/devel/html/page.html:331
-#: ../share/roundup/templates/devel/html/page.html:349
+#: ../share/roundup/templates/devel/html/page.html:317
+#: ../share/roundup/templates/devel/html/page.html:330
+#: ../share/roundup/templates/devel/html/page.html:348
 #: ../share/roundup/templates/devel/html/page.html:362
-#: ../share/roundup/templates/minimal/html/page.html:241
-#: ../share/roundup/templates/minimal/html/page.html:256
+#: ../share/roundup/templates/minimal/html/page.html:240
+#: ../share/roundup/templates/minimal/html/page.html:255
 #: ../share/roundup/templates/minimal/html/page.html:269
-#: ../share/roundup/templates/responsive/html/page.html:333
-#: ../share/roundup/templates/responsive/html/page.html:346
-#: ../share/roundup/templates/responsive/html/page.html:364
+#: ../share/roundup/templates/responsive/html/page.html:332
+#: ../share/roundup/templates/responsive/html/page.html:345
+#: ../share/roundup/templates/responsive/html/page.html:363
 #: ../share/roundup/templates/responsive/html/page.html:377
+msgid "don't care"
+msgstr ""
+
+#: ../share/roundup/templates/classic/html/page.html:260
+#: ../share/roundup/templates/classic/html/page.html:273
+#: ../share/roundup/templates/classic/html/page.html:291
+#: ../share/roundup/templates/classic/html/page.html:304
+#: ../share/roundup/templates/devel/html/page.html:319
+#: ../share/roundup/templates/devel/html/page.html:332
+#: ../share/roundup/templates/devel/html/page.html:350
+#: ../share/roundup/templates/devel/html/page.html:363
+#: ../share/roundup/templates/minimal/html/page.html:242
+#: ../share/roundup/templates/minimal/html/page.html:257
+#: ../share/roundup/templates/minimal/html/page.html:270
+#: ../share/roundup/templates/responsive/html/page.html:334
+#: ../share/roundup/templates/responsive/html/page.html:347
+#: ../share/roundup/templates/responsive/html/page.html:365
+#: ../share/roundup/templates/responsive/html/page.html:378
 msgid "------------"
 msgstr ""
 
-#: ../share/roundup/templates/classic/html/page.html:335
-#: ../share/roundup/templates/devel/html/page.html:390
-#: ../share/roundup/templates/minimal/html/page.html:297
-#: ../share/roundup/templates/responsive/html/page.html:405
+#: ../share/roundup/templates/classic/html/page.html:336
+#: ../share/roundup/templates/devel/html/page.html:391
+#: ../share/roundup/templates/minimal/html/page.html:298
+#: ../share/roundup/templates/responsive/html/page.html:406
 msgid "no value"
 msgstr ""
 
diff --git a/locale/es.po b/locale/es.po
index 975b37f23..8c428b241 100644
--- a/locale/es.po
+++ b/locale/es.po
@@ -5,9 +5,9 @@
 #
 msgid ""
 msgstr ""
-"Project-Id-Version: Roundup 2.5.0\n"
+"Project-Id-Version: Roundup 2.5.0b1\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
-"POT-Creation-Date: 2025-01-12 20:17-0500\n"
+"POT-Creation-Date: 2025-06-11 16:02-0400\n"
 "PO-Revision-Date: 2013-10-31 10:45+0100\n"
 "Last-Translator: Ramiro Morales <rm0@gmx.net>\n"
 "Language-Team: Spanish Translators <roundup-devel@lists.sourceforge.net>\n"
@@ -28,19 +28,19 @@ msgstr ""
 msgid "You may not retire the admin or anonymous user"
 msgstr "Ni el usuario admin ni el usuario anónimo pueden ser retirados"
 
-#: ../roundup/admin.py:131
+#: ../roundup/admin.py:132
 msgid ""
 "Have 'display designator[,designator*]' show header inside\n"
 "      []'s before items. Includes retired/active status.\n"
 msgstr ""
 
-#: ../roundup/admin.py:135
+#: ../roundup/admin.py:136
 msgid ""
 "Have 'display designator' and 'specification class' show\n"
 "      protected fields: creator, id etc.\n"
 msgstr ""
 
-#: ../roundup/admin.py:139
+#: ../roundup/admin.py:140
 msgid ""
 "Controls history options. It is a bitstring where setting\n"
 "      the bit disables the feature. A value of 0 (default)\n"
@@ -51,52 +51,52 @@ msgid ""
 "      history.\n"
 msgstr ""
 
-#: ../roundup/admin.py:148
+#: ../roundup/admin.py:149
 msgid ""
 "Set the number of lines of history to keep for this session.\n"
 "      -1 is infinite.\n"
 msgstr ""
 
-#: ../roundup/admin.py:152
+#: ../roundup/admin.py:153
 msgid "Set indexer to use when running 'reindex' NYI\n"
 msgstr ""
 
-#: ../roundup/admin.py:155
+#: ../roundup/admin.py:156
 msgid "Force reopening of tracker when running each command.\n"
 msgstr ""
 
-#: ../roundup/admin.py:158
+#: ../roundup/admin.py:159
 msgid ""
 "set the number of rows imported before a database commit is\n"
 "      done. Used only for imports on PostgreSQL.\n"
 msgstr ""
 
-#: ../roundup/admin.py:160
+#: ../roundup/admin.py:161
 msgid "Show retired items in table, list etc. One of 'no', 'only', 'both'\n"
 msgstr ""
 
-#: ../roundup/admin.py:162
+#: ../roundup/admin.py:163
 msgid "internal mapping for show_retired.\n"
 msgstr ""
 
-#: ../roundup/admin.py:163
+#: ../roundup/admin.py:164
 msgid "Enable verbose output: tracing, descriptions...\n"
 msgstr ""
 
 # ../roundup/admin.py:85 :955 :1004 :1026
-#: ../roundup/admin.py:175 ../roundup/admin.py:1188 ../roundup/admin.py:1858
-#: ../roundup/admin.py:1890 ../roundup/admin.py:175:1188 :1858:1890
+#: ../roundup/admin.py:176 ../roundup/admin.py:1199 ../roundup/admin.py:1869
+#: ../roundup/admin.py:1901 ../roundup/admin.py:176:1199 :1869:1901
 #, python-format
 msgid "no such class \"%(classname)s\""
 msgstr "la clase \"%(classname)s\" no existe"
 
 # ../roundup/admin.py:95 :99
-#: ../roundup/admin.py:188
+#: ../roundup/admin.py:189
 #, python-format
 msgid "argument \"%(arg)s\" not propname=value"
 msgstr "el argumento \"%(arg)s\" no es de la forma nombrepropiedad=valor"
 
-#: ../roundup/admin.py:201
+#: ../roundup/admin.py:202
 #, python-format
 msgid ""
 "Problem: %(message)s\n"
@@ -105,7 +105,7 @@ msgstr ""
 "Problema: %(message)s\n"
 "\n"
 
-#: ../roundup/admin.py:202
+#: ../roundup/admin.py:203
 #, fuzzy, python-format
 msgid ""
 "%(message)sUsage: roundup-admin [options] [<command> <arguments>]\n"
@@ -164,12 +164,12 @@ msgstr ""
 " roundup-admin help <comando>             -- ayuda específica a un comando\n"
 " roundup-admin help all                   -- toda la ayuda disponible\n"
 
-#: ../roundup/admin.py:231
+#: ../roundup/admin.py:232
 #, fuzzy
 msgid "Commands: "
 msgstr "Comandos:"
 
-#: ../roundup/admin.py:238
+#: ../roundup/admin.py:249
 msgid ""
 "Commands may be abbreviated as long as the abbreviation\n"
 "matches only one command, e.g. l == li == lis == list."
@@ -177,7 +177,7 @@ msgstr ""
 "Los comandos pueden ser abreviados siempre y cuando la abreviación\n"
 "coincida con sólo un comando, ej. l == li == lis == list."
 
-#: ../roundup/admin.py:270
+#: ../roundup/admin.py:281
 #, fuzzy
 msgid ""
 "\n"
@@ -324,25 +324,25 @@ msgstr ""
 "\n"
 "Ayuda sobre comandos:\n"
 
-#: ../roundup/admin.py:334
+#: ../roundup/admin.py:345
 #, python-format
 msgid "%s:"
 msgstr "%s:"
 
 # ../roundup/admin.py:338 :387
-#: ../roundup/admin.py:439 ../roundup/admin.py:1415
-#: ../roundup/admin.py:439:1415
+#: ../roundup/admin.py:450 ../roundup/admin.py:1426
+#: ../roundup/admin.py:450:1426
 msgid "Templates:"
 msgstr "Plantillas:"
 
 # ../roundup/admin.py:341 :398
-#: ../roundup/admin.py:442 ../roundup/admin.py:1425
-#: ../roundup/admin.py:442:1425
+#: ../roundup/admin.py:453 ../roundup/admin.py:1436
+#: ../roundup/admin.py:453:1436
 msgid "Back ends:"
 msgstr "Motor de almacenamiento"
 
 #. noqa: ARG002
-#: ../roundup/admin.py:459
+#: ../roundup/admin.py:470
 msgid ""
 "Usage: commit\n"
 "        Commit changes made to the database during an interactive session.\n"
@@ -367,7 +367,7 @@ msgstr ""
 "        son automáticamente escritos si resultan exitosos.\n"
 "        "
 
-#: ../roundup/admin.py:474
+#: ../roundup/admin.py:485
 msgid ""
 "Usage: create classname property=value ...\n"
 "        Create a new entry of a given class.\n"
@@ -388,42 +388,42 @@ msgstr ""
 
 # ../roundup/admin.py:360 :442 :503 :582 :632 :688 :709 :737 :808 :875 :946
 # :994 :1016 :1043 :1106 :1173
-#: ../roundup/admin.py:482 ../roundup/admin.py:555 ../roundup/admin.py:606
-#: ../roundup/admin.py:733 ../roundup/admin.py:806 ../roundup/admin.py:851
-#: ../roundup/admin.py:902 ../roundup/admin.py:999 ../roundup/admin.py:1216
-#: ../roundup/admin.py:1388 ../roundup/admin.py:1516 ../roundup/admin.py:1599
-#: ../roundup/admin.py:1725 ../roundup/admin.py:1848 ../roundup/admin.py:1880
-#: ../roundup/admin.py:1996 ../roundup/admin.py:2050 ../roundup/admin.py:2098
-#: ../roundup/admin.py:482:555 :1216:1388:1516 :1599:1725 :1848:1880 :1996:2050
-#: :2098 :606:733 :806:851 :902:999
+#: ../roundup/admin.py:493 ../roundup/admin.py:566 ../roundup/admin.py:617
+#: ../roundup/admin.py:744 ../roundup/admin.py:817 ../roundup/admin.py:862
+#: ../roundup/admin.py:913 ../roundup/admin.py:1010 ../roundup/admin.py:1227
+#: ../roundup/admin.py:1399 ../roundup/admin.py:1527 ../roundup/admin.py:1610
+#: ../roundup/admin.py:1736 ../roundup/admin.py:1859 ../roundup/admin.py:1891
+#: ../roundup/admin.py:2007 ../roundup/admin.py:2061 ../roundup/admin.py:2109
+#: ../roundup/admin.py:493:566 :1227:1399 :1527:1610 :1736:1859 :1891:2007
+#: :2061:2109 :617:744 :817:862 :913:1010
 msgid "Not enough arguments supplied"
 msgstr "No se proveyó una cantidad suficiente de argumentos"
 
-#: ../roundup/admin.py:502
+#: ../roundup/admin.py:513
 #, python-format
 msgid "%(propname)s (Password): "
 msgstr "%(propname)s (Contraseña): "
 
-#: ../roundup/admin.py:505
+#: ../roundup/admin.py:516
 #, python-format
 msgid "   %(propname)s (Again): "
 msgstr "   %(propname)s (Nuevamente): "
 
-#: ../roundup/admin.py:509
+#: ../roundup/admin.py:520
 msgid "Sorry, try again..."
 msgstr "Lo lamento, intente nuevamente..."
 
-#: ../roundup/admin.py:514
+#: ../roundup/admin.py:525
 #, python-format
 msgid "%(propname)s (%(proptype)s): "
 msgstr "%(propname)s (%(proptype)s): "
 
-#: ../roundup/admin.py:533
+#: ../roundup/admin.py:544
 #, python-format
 msgid "you must provide the \"%(propname)s\" property."
 msgstr "debe proveer la propiedad \"%(propname)s\"."
 
-#: ../roundup/admin.py:545
+#: ../roundup/admin.py:556
 #, fuzzy
 msgid ""
 "Usage: display designator[,designator]*\n"
@@ -443,13 +443,13 @@ msgstr ""
 "especificado.\n"
 "        "
 
-#: ../roundup/admin.py:586
+#: ../roundup/admin.py:597
 #, fuzzy, python-format
 msgid "%(protected)s%(key)s: %(value)s"
 msgstr "%(key)s: %(value)s"
 
 #. grab the directory to export to
-#: ../roundup/admin.py:589
+#: ../roundup/admin.py:600
 #, fuzzy
 msgid ""
 "Usage: export [[-]class[,class]] export_dir\n"
@@ -481,7 +481,7 @@ msgstr ""
 "        directorio de destino especificado (dir_exportación).\n"
 "        "
 
-#: ../roundup/admin.py:704
+#: ../roundup/admin.py:715
 #, fuzzy
 msgid ""
 "Usage: exporttables [[-]class[,class]] export_dir\n"
@@ -514,7 +514,7 @@ msgstr ""
 "        directorio de destino especificado.\n"
 "        "
 
-#: ../roundup/admin.py:723
+#: ../roundup/admin.py:734
 #, fuzzy
 msgid ""
 "Usage: filter classname propname=value ...\n"
@@ -539,20 +539,20 @@ msgstr ""
 "        "
 
 # ../roundup/admin.py:675 :828 :840 :894
-#: ../roundup/admin.py:764
+#: ../roundup/admin.py:775
 #, fuzzy, python-format
 msgid "Class %(curclassname)s has no property %(pn)s in %(propname)s."
 msgstr "%(classname)s no posee la propiedad \"%(propname)s\""
 
 # ../roundup/admin.py:675 :828 :840 :894
-#: ../roundup/admin.py:791 ../roundup/admin.py:840 ../roundup/admin.py:1536
-#: ../roundup/admin.py:1549 ../roundup/admin.py:2120
-#: ../roundup/admin.py:791:840 :1536:1549:2120
+#: ../roundup/admin.py:802 ../roundup/admin.py:851 ../roundup/admin.py:1547
+#: ../roundup/admin.py:1560 ../roundup/admin.py:2131
+#: ../roundup/admin.py:802:851 :1547:1560:2131
 #, python-format
 msgid "%(classname)s has no property \"%(propname)s\""
 msgstr "%(classname)s no posee la propiedad \"%(propname)s\""
 
-#: ../roundup/admin.py:798
+#: ../roundup/admin.py:809
 msgid ""
 "Usage: find classname propname=value ...\n"
 "        Find the nodes of the given class with a given link property value.\n"
@@ -573,7 +573,7 @@ msgstr ""
 "        enlazado o su valor clave.\n"
 "        "
 
-#: ../roundup/admin.py:847
+#: ../roundup/admin.py:858
 #, fuzzy
 msgid ""
 "Usage: genconfig filename\n"
@@ -586,7 +586,7 @@ msgstr ""
 "        con valores por defecto en el fichero <fichero>.\n"
 "        "
 
-#: ../roundup/admin.py:864
+#: ../roundup/admin.py:875
 #, python-format
 msgid ""
 "Changing option\n"
@@ -594,20 +594,20 @@ msgid ""
 "from old default of %(old_number)s to new default of %(new_number)s."
 msgstr ""
 
-#: ../roundup/admin.py:875
+#: ../roundup/admin.py:886
 #, python-format
 msgid ""
 "Update 'password_pbkdf2_default_rounds' to a number equal to or larger\n"
 "  than %s.\n"
 msgstr ""
 
-#: ../roundup/admin.py:882
+#: ../roundup/admin.py:893
 msgid ""
 "Check the rdbms mysql_* settings. Your charset and collations may need\n"
 "  to be changed. See upgrading instructions.\n"
 msgstr ""
 
-#: ../roundup/admin.py:892
+#: ../roundup/admin.py:903
 #, fuzzy
 msgid ""
 "Usage: get property designator[,designator]*\n"
@@ -628,7 +628,7 @@ msgstr ""
 "        "
 
 # ../roundup/admin.py:536 :551
-#: ../roundup/admin.py:925
+#: ../roundup/admin.py:936
 #, python-format
 msgid "property %s is not of type Multilink or Link so -d flag does not apply."
 msgstr ""
@@ -636,18 +636,18 @@ msgstr ""
 "no puede usarse."
 
 # ../roundup/admin.py:559 :957 :1006 :1028
-#: ../roundup/admin.py:942 ../roundup/admin.py:1190 ../roundup/admin.py:1864
-#: ../roundup/admin.py:1892 ../roundup/admin.py:942:1190 :1864:1892
+#: ../roundup/admin.py:953 ../roundup/admin.py:1201 ../roundup/admin.py:1875
+#: ../roundup/admin.py:1903 ../roundup/admin.py:953:1201 :1875:1903
 #, python-format
 msgid "no such %(classname)s node \"%(nodeid)s\""
 msgstr "no existe nodo de clase %(classname)s llamado  \"%(nodeid)s\""
 
-#: ../roundup/admin.py:945
+#: ../roundup/admin.py:956
 #, python-format
 msgid "no such %(classname)s property \"%(propname)s\""
 msgstr "no existe propiedad de clase %(classname)s llamado  \"%(propname)s\""
 
-#: ../roundup/admin.py:950
+#: ../roundup/admin.py:961
 msgid ""
 "Usage: help topic\n"
 "        Give help about topic.\n"
@@ -667,12 +667,12 @@ msgstr ""
 "        all       -- toda la ayuda disponible\n"
 "        "
 
-#: ../roundup/admin.py:969
+#: ../roundup/admin.py:980
 #, python-format
 msgid "Sorry, no help for \"%(topic)s\""
 msgstr "Lo siento, no hay ayuda para \"%(topic)s\""
 
-#: ../roundup/admin.py:986
+#: ../roundup/admin.py:997
 #, fuzzy
 msgid ""
 "Usage: history designator [skipquiet] [raw]\n"
@@ -695,27 +695,27 @@ msgstr ""
 "        reusado.\n"
 "        "
 
-#: ../roundup/admin.py:1011
+#: ../roundup/admin.py:1022
 #, python-format
 msgid "Unexpected argument(s): %s. Expected 'skipquiet' or 'raw'."
 msgstr ""
 
-#: ../roundup/admin.py:1062
+#: ../roundup/admin.py:1073
 #, fuzzy
 msgid "removed"
 msgstr "eliminar"
 
-#: ../roundup/admin.py:1064
+#: ../roundup/admin.py:1075
 msgid "added"
 msgstr ""
 
-#: ../roundup/admin.py:1066
+#: ../roundup/admin.py:1077
 #, python-format
 msgid "Unknown history set operation '%s'. Expected +/-."
 msgstr ""
 
 #. .Hint added issue23 to superseder
-#: ../roundup/admin.py:1091
+#: ../roundup/admin.py:1102
 #, fuzzy, python-format
 msgid "added %(class)s%(item_id)s to %(propname)s"
 msgstr "Edición exitosa de %(properties)s de %(class)s %(id)s"
@@ -723,29 +723,29 @@ msgstr "Edici
 #. .Hint read as: assignedto was admin(1)
 #. where assignedto is the property
 #. admin is the key name for value 1
-#: ../roundup/admin.py:1112
+#: ../roundup/admin.py:1123
 #, fuzzy, python-format
 msgid "%(prop)s was %(name)s(%(value)s)"
 msgstr "%(propname)s (%(proptype)s): "
 
-#: ../roundup/admin.py:1118 ../roundup/admin.py:1147
-#: ../roundup/admin.py:1118:1147
+#: ../roundup/admin.py:1129 ../roundup/admin.py:1158
+#: ../roundup/admin.py:1129:1158
 #, fuzzy, python-format
 msgid "%(prop)s was %(value)s"
 msgstr "%(key)s: %(value)s"
 
-#: ../roundup/admin.py:1137
+#: ../roundup/admin.py:1148
 #, python-format
 msgid "%(prop)s was [%(value_list)s]"
 msgstr ""
 
 #. .Hint modified nosy: added demo(3)
-#: ../roundup/admin.py:1144
+#: ../roundup/admin.py:1155
 #, python-format
 msgid "modified %(prop)s: %(how)s"
 msgstr ""
 
-#: ../roundup/admin.py:1195
+#: ../roundup/admin.py:1206
 #, fuzzy
 msgid ""
 "Usage: import import_dir\n"
@@ -792,7 +792,7 @@ msgstr ""
 "        tediosamente, retirar toda los datos viejos.)\n"
 "        "
 
-#: ../roundup/admin.py:1306
+#: ../roundup/admin.py:1317
 msgid ""
 "Usage: importtables export_dir\n"
 "        This imports the database tables exported using exporttables.\n"
@@ -802,7 +802,7 @@ msgid ""
 msgstr ""
 
 #. password
-#: ../roundup/admin.py:1314
+#: ../roundup/admin.py:1325
 msgid ""
 "Usage: initialise [adminpw]\n"
 "        Initialise a new Roundup tracker.\n"
@@ -821,23 +821,23 @@ msgstr ""
 "        Ejecuta la función de inicialización dbinit.init() del tracker\n"
 "        "
 
-#: ../roundup/admin.py:1328
+#: ../roundup/admin.py:1339
 msgid "Admin Password: "
 msgstr "Contraseña de administración: "
 
-#: ../roundup/admin.py:1329
+#: ../roundup/admin.py:1340
 msgid "       Confirm: "
 msgstr "       Confirmar: "
 
-#: ../roundup/admin.py:1333
+#: ../roundup/admin.py:1344
 msgid "Instance home does not exist"
 msgstr "El directorio base de la instancia no existe"
 
-#: ../roundup/admin.py:1337
+#: ../roundup/admin.py:1348
 msgid "Instance has not been installed"
 msgstr "La instancia no ha sido instalada"
 
-#: ../roundup/admin.py:1345
+#: ../roundup/admin.py:1356
 msgid ""
 "WARNING: The database is already initialised!\n"
 "If you re-initialise it, you will lose all the data!\n"
@@ -847,7 +847,7 @@ msgstr ""
 "Si la reinicializa, perderá toda la información!\n"
 "Eliminar la misma? Y/N: "
 
-#: ../roundup/admin.py:1365
+#: ../roundup/admin.py:1376
 msgid ""
 "Usage: install [template [backend [key=val[,key=val]]]]\n"
 "        Install a new Roundup tracker.\n"
@@ -903,14 +903,14 @@ msgstr ""
 "        Vea también initopts help.\n"
 "        "
 
-#: ../roundup/admin.py:1394
+#: ../roundup/admin.py:1405
 #, python-format
 msgid "Instance home parent directory \"%(parent)s\" does not exist"
 msgstr ""
 "El directorio padre \"%(parent)s\" del directorio base de la instancia no "
 "existe"
 
-#: ../roundup/admin.py:1403
+#: ../roundup/admin.py:1414
 #, python-format
 msgid ""
 "WARNING: There appears to be a tracker in \"%(tracker_home)s\"!\n"
@@ -921,22 +921,22 @@ msgstr ""
 "Si Ud. lo reinstala, perderá toda la información relacionada al mismo!\n"
 "Elimino la misma? Y/N: "
 
-#: ../roundup/admin.py:1416
+#: ../roundup/admin.py:1427
 #, fuzzy
 msgid "Select template"
 msgstr "Seleccione la plantilla [classic]: "
 
-#: ../roundup/admin.py:1426
+#: ../roundup/admin.py:1437
 #, fuzzy
 msgid "Select backend"
 msgstr "Selecccione el motor de almacenamiento [anydbm]: "
 
-#: ../roundup/admin.py:1437
+#: ../roundup/admin.py:1448
 #, python-format
 msgid "Error in configuration settings: \"%s\""
 msgstr "Error en opciones de configuración: \"%s\""
 
-#: ../roundup/admin.py:1470
+#: ../roundup/admin.py:1481
 #, python-format
 msgid ""
 "\n"
@@ -949,11 +949,11 @@ msgstr ""
 " Ud. debe ahora editar el fichero de configuración del tracker:\n"
 "   %(config_file)s"
 
-#: ../roundup/admin.py:1480
+#: ../roundup/admin.py:1491
 msgid " ... at a minimum, you must set following options:"
 msgstr " ... como mínimo, debe configurar las siguientes opciones:"
 
-#: ../roundup/admin.py:1485
+#: ../roundup/admin.py:1496
 #, python-format
 msgid ""
 "\n"
@@ -981,7 +981,7 @@ msgstr ""
 " completado los pasos arriba descriptos.\n"
 "---------------------------------------------------------------------------\n"
 
-#: ../roundup/admin.py:1501
+#: ../roundup/admin.py:1512
 msgid ""
 "Usage: list classname [property]\n"
 "        List the instances of a class.\n"
@@ -1011,17 +1011,17 @@ msgstr ""
 "clase.\n"
 "        "
 
-#: ../roundup/admin.py:1514
+#: ../roundup/admin.py:1525
 msgid "Too many arguments supplied"
 msgstr "Demasiados argumentos"
 
-#: ../roundup/admin.py:1547
+#: ../roundup/admin.py:1558
 #, python-format
 msgid "%(nodeid)4s: %(value)s"
 msgstr "%(nodeid)4s: %(value)s"
 
 #. noqa: ARG002  - args unused
-#: ../roundup/admin.py:1554
+#: ../roundup/admin.py:1565
 msgid ""
 "Usage: migrate\n"
 "        Update a tracker's database to be compatible with the Roundup\n"
@@ -1044,17 +1044,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1574
+#: ../roundup/admin.py:1585
 #, python-format
 msgid "Tracker updated to schema version %s."
 msgstr ""
 
-#: ../roundup/admin.py:1578
+#: ../roundup/admin.py:1589
 #, python-format
 msgid "No migration action required. At schema version %s."
 msgstr ""
 
-#: ../roundup/admin.py:1583
+#: ../roundup/admin.py:1594
 #, fuzzy
 msgid ""
 "Usage: pack period | date\n"
@@ -1092,11 +1092,11 @@ msgstr ""
 "\n"
 "        "
 
-#: ../roundup/admin.py:1609
+#: ../roundup/admin.py:1620
 msgid "Invalid format"
 msgstr "Formato inválido"
 
-#: ../roundup/admin.py:1620
+#: ../roundup/admin.py:1631
 msgid ""
 "Usage: perftest [mode] [arguments]*\n"
 "        Time operations in Roundup.\n"
@@ -1114,25 +1114,25 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1657
+#: ../roundup/admin.py:1668
 msgid "Invalid 'rounds'. Must be larger than 999."
 msgstr ""
 
-#: ../roundup/admin.py:1661
+#: ../roundup/admin.py:1672
 #, python-format
 msgid "Invalid 'rounds'. It must be an integer not: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1688
+#: ../roundup/admin.py:1699
 msgid "scheme does not support rounds."
 msgstr ""
 
-#: ../roundup/admin.py:1691
+#: ../roundup/admin.py:1702
 #, python-format
 msgid "Hash time: %(time)0.9f seconds, scheme: %(scheme)s, rounds: %(rounds)s"
 msgstr ""
 
-#: ../roundup/admin.py:1697
+#: ../roundup/admin.py:1708
 msgid ""
 "Usage: pragma setting=value | 'list'\n"
 "        Set internal admin settings to a value.\n"
@@ -1161,49 +1161,49 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1732
+#: ../roundup/admin.py:1743
 #, python-format
 msgid "Argument must be setting=value, was given: %s."
 msgstr ""
 
-#: ../roundup/admin.py:1735
+#: ../roundup/admin.py:1746
 msgid "Current settings and values (NYI - not yet implemented):"
 msgstr ""
 
-#: ../roundup/admin.py:1746
+#: ../roundup/admin.py:1757
 msgid ""
 "      Help for this pragma is missing. Please report it to the Roundup "
 "project.\n"
 msgstr ""
 
-#: ../roundup/admin.py:1752
+#: ../roundup/admin.py:1763
 #, fuzzy, python-format
 msgid "Unknown setting %s. Try \"pragma list\"."
 msgstr "Usuario desconocido"
 
-#: ../roundup/admin.py:1762
+#: ../roundup/admin.py:1773
 #, python-format
 msgid "Incorrect value for boolean setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1769
+#: ../roundup/admin.py:1780
 #, python-format
 msgid "Incorrect value for integer setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1776
+#: ../roundup/admin.py:1787
 #, python-format
 msgid ""
 "Incorrect value for setting %(setting)s: %(value)s. Should be no, both, or "
 "only."
 msgstr ""
 
-#: ../roundup/admin.py:1786
+#: ../roundup/admin.py:1797
 #, python-format
 msgid "Internal error: pragma can not handle values of type: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1795
+#: ../roundup/admin.py:1806
 #, fuzzy
 msgid ""
 "Usage: reindex [classname|classname:#-#|designator]*\n"
@@ -1227,17 +1227,17 @@ msgstr ""
 "        Es un comando que por lo general se ejecuta automáticamente.\n"
 "        "
 
-#: ../roundup/admin.py:1817
+#: ../roundup/admin.py:1828
 #, python-format
 msgid "no such item \"%(designator)s\""
 msgstr "no existe un ítem llamado \"%(designator)s\""
 
-#: ../roundup/admin.py:1827
+#: ../roundup/admin.py:1838
 #, fuzzy, python-format
 msgid "no such item \"%(class)s%(id)s\""
 msgstr "no existe un ítem llamado \"%(designator)s\""
 
-#: ../roundup/admin.py:1839
+#: ../roundup/admin.py:1850
 #, fuzzy
 msgid ""
 "Usage: restore designator[,designator]*\n"
@@ -1256,7 +1256,7 @@ msgstr ""
 "        para los usuarios.\n"
 "        "
 
-#: ../roundup/admin.py:1870
+#: ../roundup/admin.py:1881
 #, fuzzy
 msgid ""
 "Usage: retire designator[,designator]*\n"
@@ -1278,7 +1278,7 @@ msgstr ""
 "        "
 
 #. noqa: ARG002 - args unused
-#: ../roundup/admin.py:1898
+#: ../roundup/admin.py:1909
 msgid ""
 "Usage: rollback\n"
 "        Undo all changes that are pending commit to the database.\n"
@@ -1300,7 +1300,7 @@ msgstr ""
 "        no introduciría cambios en la base de datos.\n"
 "        "
 
-#: ../roundup/admin.py:1911
+#: ../roundup/admin.py:1922
 msgid ""
 "Usage: security [Role name]\n"
 "        Display the Permissions available to one or all Roles.\n"
@@ -1313,49 +1313,49 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1926
+#: ../roundup/admin.py:1937
 #, fuzzy, python-format
 msgid "No such Role \"%(role)s\"\n"
 msgstr "No existe un Rol llamado \"%(role)s\""
 
-#: ../roundup/admin.py:1932
+#: ../roundup/admin.py:1943
 #, fuzzy, python-format
 msgid "New Web users get the Roles \"%(role)s\"\n"
 msgstr "Los nuevos usuarios creados vía Web obtiene los Roles \"%(role)s\""
 
-#: ../roundup/admin.py:1935
+#: ../roundup/admin.py:1946
 #, fuzzy, python-format
 msgid "New Web users get the Role \"%(role)s\"\n"
 msgstr "Los nuevos usuarios creados vía Web obtienen el Rol \"%(role)s\""
 
-#: ../roundup/admin.py:1939
+#: ../roundup/admin.py:1950
 #, fuzzy, python-format
 msgid "New Email users get the Roles \"%(role)s\"\n"
 msgstr ""
 "Los nuevos usuarios creados vía e-mail obtienen los Roles  \"%(role)s\""
 
-#: ../roundup/admin.py:1941
+#: ../roundup/admin.py:1952
 #, fuzzy, python-format
 msgid "New Email users get the Role \"%(role)s\"\n"
 msgstr "Los nuevos usuarios creados vía e-mail obtienen el Rol \"%(role)s\""
 
-#: ../roundup/admin.py:1944
+#: ../roundup/admin.py:1955
 #, fuzzy, python-format
 msgid "Role \"%(name)s\":\n"
 msgstr "Rol \"%(name)s\":"
 
-#: ../roundup/admin.py:1950
+#: ../roundup/admin.py:1961
 #, fuzzy
 msgid " %(description)s (%(name)s for \"%(klass)s\""
 msgstr " %(description)s (%(name)s para \"%(klass)s\" solamente)"
 
-#: ../roundup/admin.py:1950
+#: ../roundup/admin.py:1961
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\": %(properties)s only)\n"
 msgstr ""
 " %(description)s (%(name)s para \"%(klass)s\": %(properties)s solamente)"
 
-#: ../roundup/admin.py:1963
+#: ../roundup/admin.py:1974
 #, python-format
 msgid ""
 "\n"
@@ -1363,17 +1363,17 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/admin.py:1969
+#: ../roundup/admin.py:1980
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\" only)\n"
 msgstr " %(description)s (%(name)s para \"%(klass)s\" solamente)"
 
-#: ../roundup/admin.py:1972
+#: ../roundup/admin.py:1983
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s)\n"
 msgstr " %(description)s (%(name)s)"
 
-#: ../roundup/admin.py:1976
+#: ../roundup/admin.py:1987
 #, fuzzy
 msgid ""
 "Usage: set items property=value [property=value ...]\n"
@@ -1408,7 +1408,7 @@ msgstr ""
 "        asociados como números separados por comas (\"1,2,3\").\n"
 "        "
 
-#: ../roundup/admin.py:2044
+#: ../roundup/admin.py:2055
 msgid ""
 "Usage: specification classname\n"
 "        Show the properties for a classname.\n"
@@ -1422,17 +1422,17 @@ msgstr ""
 "        Visualiza las propiedades para una cierta clase.\n"
 "        "
 
-#: ../roundup/admin.py:2063
+#: ../roundup/admin.py:2074
 #, fuzzy, python-format
 msgid "%(key)s: %(value)s (key property)\n"
 msgstr "%(key)s: %(value)s (propiedad de clave)"
 
-#: ../roundup/admin.py:2066
+#: ../roundup/admin.py:2077
 #, fuzzy, python-format
 msgid "%(key)s: %(value)s\n"
 msgstr "%(key)s: %(value)s"
 
-#: ../roundup/admin.py:2069
+#: ../roundup/admin.py:2080
 msgid ""
 "Usage: table classname [property[,property]*]\n"
 "        List the instances of a class in tabular form.\n"
@@ -1496,17 +1496,17 @@ msgstr ""
 "        caracteres.\n"
 "        "
 
-#: ../roundup/admin.py:2115
+#: ../roundup/admin.py:2126
 #, python-format
 msgid "\"%(spec)s\" not name:width"
 msgstr "\"%(spec)s\" no es de la forma nombre:longitud"
 
-#: ../roundup/admin.py:2137
+#: ../roundup/admin.py:2148
 #, python-format
 msgid "\"%(spec)s\" does not have an integer width: \"%(width)s\""
 msgstr ""
 
-#: ../roundup/admin.py:2173
+#: ../roundup/admin.py:2184
 msgid ""
 "Usage: templates [trace_search]\n"
 "        List templates and their installed directories.\n"
@@ -1516,7 +1516,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2201
+#: ../roundup/admin.py:2212
 #, fuzzy
 msgid ""
 "Usage: updateconfig <filename>\n"
@@ -1533,36 +1533,36 @@ msgstr ""
 "        "
 
 # ../roundup/cgi/actions.py:579 :590 :761 :780
-#: ../roundup/admin.py:2210 ../roundup/cgi/actions.py:886
-#: ../roundup/cgi/actions.py:897 ../roundup/cgi/actions.py:1099
-#: ../roundup/cgi/actions.py:1113 ../roundup/cgi/actions.py:886:897 :1099:1113
+#: ../roundup/admin.py:2221 ../roundup/cgi/actions.py:891
+#: ../roundup/cgi/actions.py:902 ../roundup/cgi/actions.py:1104
+#: ../roundup/cgi/actions.py:1118 ../roundup/cgi/actions.py:891:902 :1104:1118
 #, python-format
 msgid "Error: %s"
 msgstr "Error: %s"
 
-#: ../roundup/admin.py:2242
+#: ../roundup/admin.py:2253
 #, python-format
 msgid "Unknown command \"%(command)s\" (\"help commands\" for a list)"
 msgstr ""
 "Comando desconocido \"%(command)s\" (tipee \"help commands\" para obtener "
 "una lista)"
 
-#: ../roundup/admin.py:2248
+#: ../roundup/admin.py:2259
 #, python-format
 msgid "Multiple commands match \"%(command)s\": %(list)s"
 msgstr "Coinciden mas de un comando \"%(command)s\": %(list)s"
 
-#: ../roundup/admin.py:2263
+#: ../roundup/admin.py:2274
 msgid "Enter tracker home: "
 msgstr "Ingrese directorio base del tracker: "
 
-#: ../roundup/admin.py:2292 ../roundup/admin.py:2296
-#: ../roundup/admin.py:2292:2296
+#: ../roundup/admin.py:2303 ../roundup/admin.py:2307
+#: ../roundup/admin.py:2303:2307
 #, python-format
 msgid "Error: Couldn't open tracker: %(message)s"
 msgstr "Error: No se pudo abrir el tracker: %(message)s"
 
-#: ../roundup/admin.py:2344
+#: ../roundup/admin.py:2355
 #, python-format
 msgid ""
 "Roundup %s ready for input.\n"
@@ -1571,58 +1571,58 @@ msgstr ""
 "Roundup %s listo para comandos.\n"
 "Tipee \"help\" para ayuda."
 
-#: ../roundup/admin.py:2377
+#: ../roundup/admin.py:2388
 msgid "Note: command history and editing not available"
 msgstr "Nota: historia y edición de comandos no disponible"
 
-#: ../roundup/admin.py:2383
+#: ../roundup/admin.py:2394
 msgid "exit..."
 msgstr "salir..."
 
-#: ../roundup/admin.py:2396
+#: ../roundup/admin.py:2407
 msgid "There are unsaved changes. Commit them (y/N)? "
 msgstr "Hay cambios sin guardar. Debo guardar los mismos (y/N)? "
 
-#: ../roundup/backends/back_anydbm.py:215
-#: ../roundup/backends/rdbms_common.py:928
+#: ../roundup/backends/back_anydbm.py:213
+#: ../roundup/backends/rdbms_common.py:926
 #, python-format
 msgid "Class \"%s\" already defined."
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:280
+#: ../roundup/backends/back_anydbm.py:278
 #: ../roundup/backends/sessions_dbm.py:61
 msgid "Couldn't identify database type"
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:314
+#: ../roundup/backends/back_anydbm.py:312
 #, python-format
 msgid ""
 "Couldn't open database - the required module '%s' (as dbm.gnu) is not "
 "available"
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:318
+#: ../roundup/backends/back_anydbm.py:316
 #, python-format
 msgid "Couldn't open database - the required module '%s' is not available"
 msgstr ""
 
 #: ../roundup/backends/back_anydbm.py:873
 #: ../roundup/backends/back_anydbm.py:886
-#: ../roundup/backends/back_anydbm.py:1160
-#: ../roundup/backends/back_anydbm.py:1195
-#: ../roundup/backends/back_anydbm.py:1424
-#: ../roundup/backends/back_anydbm.py:1442
-#: ../roundup/backends/back_anydbm.py:1489
-#: ../roundup/backends/back_anydbm.py:2135
+#: ../roundup/backends/back_anydbm.py:1162
+#: ../roundup/backends/back_anydbm.py:1197
+#: ../roundup/backends/back_anydbm.py:1426
+#: ../roundup/backends/back_anydbm.py:1444
+#: ../roundup/backends/back_anydbm.py:1492
+#: ../roundup/backends/back_anydbm.py:2138
 #: ../roundup/backends/back_anydbm.py:873:886
-#: ../roundup/backends/rdbms_common.py:1720
-#: ../roundup/backends/rdbms_common.py:1967
-#: ../roundup/backends/rdbms_common.py:2206
-#: ../roundup/backends/rdbms_common.py:2226
-#: ../roundup/backends/rdbms_common.py:2279
-#: ../roundup/backends/rdbms_common.py:3254
-#: ../roundup/backends/rdbms_common.py:1720:1967 :1160:1195 :1424:1442:1489
-#: :2135 :2206:2226 :2279:3254
+#: ../roundup/backends/rdbms_common.py:1721
+#: ../roundup/backends/rdbms_common.py:1972
+#: ../roundup/backends/rdbms_common.py:2211
+#: ../roundup/backends/rdbms_common.py:2231
+#: ../roundup/backends/rdbms_common.py:2293
+#: ../roundup/backends/rdbms_common.py:3268
+#: ../roundup/backends/rdbms_common.py:1721:1972 :1162:1197 :1426:1444:1492
+#: :2138 :2211:2231 :2293:3268
 msgid "Database open read-only"
 msgstr ""
 
@@ -1648,45 +1648,52 @@ msgstr ""
 msgid "Unable to get lock after 10 retries on %s."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:632
+#: ../roundup/backends/rdbms_common.py:630
 #, python-format
 msgid "ALTER operation disallowed: %(old)r -> %(new)r."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:867
+#: ../roundup/backends/rdbms_common.py:865
 #, python-format
 msgid "CREATE operation disallowed: \"%s\"."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:884
+#: ../roundup/backends/rdbms_common.py:882
 #, python-format
 msgid "DROP operation disallowed: \"%s\"."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:1863
+#: ../roundup/backends/rdbms_common.py:1864
 msgid "create"
 msgstr "crea"
 
-#: ../roundup/backends/rdbms_common.py:2038
+#: ../roundup/backends/rdbms_common.py:2043
 msgid "unlink"
 msgstr "desenlaza"
 
-#: ../roundup/backends/rdbms_common.py:2042
+#: ../roundup/backends/rdbms_common.py:2047
 msgid "link"
 msgstr "enlaza"
 
-#: ../roundup/backends/rdbms_common.py:2187
+#: ../roundup/backends/rdbms_common.py:2192
 msgid "set"
 msgstr "asigna"
 
-#: ../roundup/backends/rdbms_common.py:2216
+#: ../roundup/backends/rdbms_common.py:2221
 msgid "retired"
 msgstr "retira"
 
-#: ../roundup/backends/rdbms_common.py:2246
+#: ../roundup/backends/rdbms_common.py:2251
 msgid "restored"
 msgstr "restaura"
 
+#: ../roundup/backends/rdbms_common.py:2265
+#, fuzzy, python-format
+msgid "class %(cls)s: %(value)r is not an id"
+msgstr ""
+"propiedad \"%(propname)s\": \"%(value)s\" no se encuentra en este momento en "
+"la lista"
+
 #: ../roundup/backends/sessions_redis.py:78
 #: ../roundup/backends/sessions_redis.py:97
 #: ../roundup/backends/sessions_redis.py:78:97
@@ -1770,10 +1777,10 @@ msgid "\"%(input)s\" is not an ID (%(classname)s ID required)"
 msgstr "\"%(input)s\" no es un ID (se requieren IDs %(classname)s)"
 
 #: ../roundup/cgi/actions.py:228 ../roundup/cgi/actions.py:266
-#: ../roundup/cgi/actions.py:493 ../roundup/cgi/actions.py:833
-#: ../roundup/cgi/actions.py:880 ../roundup/cgi/actions.py:1084
-#: ../roundup/cgi/actions.py:1246 ../roundup/cgi/actions.py:228:266:1246
-#: :493:833 :880:1084
+#: ../roundup/cgi/actions.py:493 ../roundup/cgi/actions.py:838
+#: ../roundup/cgi/actions.py:885 ../roundup/cgi/actions.py:1089
+#: ../roundup/cgi/actions.py:1251 ../roundup/cgi/actions.py:228:266:1251
+#: :493:838 :885:1089
 #, fuzzy
 msgid "Invalid request"
 msgstr "Formato inválido"
@@ -1827,8 +1834,8 @@ msgstr "Formato inv
 msgid "Invalid integer: "
 msgstr "nombre de usuario ó contraseña inválidos"
 
-#: ../roundup/cgi/actions.py:531 ../roundup/cgi/actions.py:735
-#: ../roundup/cgi/actions.py:531:735
+#: ../roundup/cgi/actions.py:531 ../roundup/cgi/actions.py:740
+#: ../roundup/cgi/actions.py:531:740
 #, python-format
 msgid "You do not have permission to create %(class)s"
 msgstr "Ud. no posee los permisos necesarios para crear %(class)s"
@@ -1838,8 +1845,8 @@ msgstr "Ud. no posee los permisos necesarios para crear %(class)s"
 msgid "Not enough values on line %(line)s"
 msgstr "No hay valores suficientes en la línea %(line)s"
 
-#: ../roundup/cgi/actions.py:556 ../roundup/cgi/actions.py:723
-#: ../roundup/cgi/actions.py:556:723
+#: ../roundup/cgi/actions.py:556 ../roundup/cgi/actions.py:728
+#: ../roundup/cgi/actions.py:556:728
 #, python-format
 msgid "You do not have permission to edit %(class)s"
 msgstr "Ud. no posee los permisos necesarios para editar %(class)s"
@@ -1848,17 +1855,17 @@ msgstr "Ud. no posee los permisos necesarios para editar %(class)s"
 msgid "Items edited OK"
 msgstr "Items editados exitosamente"
 
-#: ../roundup/cgi/actions.py:671
+#: ../roundup/cgi/actions.py:676
 #, python-format
 msgid "%(class)s %(id)s %(properties)s edited ok"
 msgstr "Edición exitosa de %(properties)s de %(class)s %(id)s"
 
-#: ../roundup/cgi/actions.py:689
+#: ../roundup/cgi/actions.py:694
 #, python-format
 msgid "%(class)s %(id)s created"
 msgstr "%(class)s %(id)s creado"
 
-#: ../roundup/cgi/actions.py:817
+#: ../roundup/cgi/actions.py:822
 #, fuzzy, python-format
 msgid ""
 "Edit Error: someone else has edited this %(klass)s (%(props)s). View <a "
@@ -1868,12 +1875,12 @@ msgstr ""
 "<a target=\"new\" href=\"%(klass)s%(id)s\">cambios</a> que dicha persona ha "
 "realizado en una ventana aparte."
 
-#: ../roundup/cgi/actions.py:850
+#: ../roundup/cgi/actions.py:855
 #, python-format
 msgid "Edit Error: %s"
 msgstr "Error de edición: %s"
 
-#: ../roundup/cgi/actions.py:931
+#: ../roundup/cgi/actions.py:936
 msgid ""
 "Invalid One Time Key!\n"
 "(a Mozilla bug may cause this message to show up erroneously, please check "
@@ -1883,12 +1890,12 @@ msgstr ""
 "(un bug de Mozilla puede ser el causante de que se visualice este mensaje en "
 "forma errónea, por favor verifique su casilla de e-mail)"
 
-#: ../roundup/cgi/actions.py:972
+#: ../roundup/cgi/actions.py:977
 #, fuzzy, python-format
 msgid "Password reset for %s"
 msgstr "Solicitud de generación de nueva contraseña"
 
-#: ../roundup/cgi/actions.py:973
+#: ../roundup/cgi/actions.py:978
 #, python-format
 msgid ""
 "\n"
@@ -1897,29 +1904,29 @@ msgid ""
 "Your password is now: %(password)s\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:982
+#: ../roundup/cgi/actions.py:987
 #, python-format
 msgid "Password reset and email sent to %s"
 msgstr "Contraseña reinicializada y mensaje de e-mail enviado a %s"
 
-#: ../roundup/cgi/actions.py:991
+#: ../roundup/cgi/actions.py:996
 msgid "Unknown username"
 msgstr "Usuario desconocido"
 
-#: ../roundup/cgi/actions.py:999
+#: ../roundup/cgi/actions.py:1004
 msgid "Unknown email address"
 msgstr "Dirección de e-mail desconocida"
 
-#: ../roundup/cgi/actions.py:1004
+#: ../roundup/cgi/actions.py:1009
 msgid "You need to specify a username or address"
 msgstr "Debe especificar un nombre de usuario o dirección de e-mail"
 
-#: ../roundup/cgi/actions.py:1015
+#: ../roundup/cgi/actions.py:1020
 #, fuzzy, python-format
 msgid "Confirm reset of password for %s"
 msgstr "Confirmar contraseña"
 
-#: ../roundup/cgi/actions.py:1016
+#: ../roundup/cgi/actions.py:1021
 #, python-format
 msgid ""
 "\n"
@@ -1933,31 +1940,31 @@ msgid ""
 "You should then receive another email with the new password.\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1029
+#: ../roundup/cgi/actions.py:1034
 #, python-format
 msgid "Email sent to primary notification address for %s."
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1031
+#: ../roundup/cgi/actions.py:1036
 #, fuzzy, python-format
 msgid "Email sent to %s."
 msgstr "Se ha enviado un mensaje de e-mail a %s"
 
-#: ../roundup/cgi/actions.py:1046
+#: ../roundup/cgi/actions.py:1051
 msgid "You are now registered, welcome!"
 msgstr "Ud. se ha registrado exitosamente, bienvenido!"
 
-#: ../roundup/cgi/actions.py:1139
+#: ../roundup/cgi/actions.py:1144
 #, python-format
 msgid "Username '%s' is already used."
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1163
+#: ../roundup/cgi/actions.py:1168
 #, python-format
 msgid "Complete your registration to %(tracker_name)s -- key %(key)s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1167
+#: ../roundup/cgi/actions.py:1172
 #, python-format
 msgid ""
 "To complete your registration of the user \"%(name)s\" with\n"
@@ -1973,12 +1980,12 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1181
+#: ../roundup/cgi/actions.py:1186
 #, python-format
 msgid "Complete your registration to %s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1182
+#: ../roundup/cgi/actions.py:1187
 #, python-format
 msgid ""
 "To complete your registration of the user \"%(name)s\" with\n"
@@ -1988,45 +1995,45 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1206
+#: ../roundup/cgi/actions.py:1211
 msgid "It is not permitted to supply roles at registration."
 msgstr "No está permitido especificar roles en el momento del registro."
 
-#: ../roundup/cgi/actions.py:1220
+#: ../roundup/cgi/actions.py:1225
 msgid "You are logged out"
 msgstr "Ha salido del sistema exitosamente"
 
-#: ../roundup/cgi/actions.py:1250
+#: ../roundup/cgi/actions.py:1255
 msgid "Username required"
 msgstr "Se requiere el ingreso de un nombre de usuario"
 
-#: ../roundup/cgi/actions.py:1354
+#: ../roundup/cgi/actions.py:1359
 #, python-format
 msgid "Welcome %(username)s!"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1477
+#: ../roundup/cgi/actions.py:1482
 #, python-format
 msgid "Logins occurring too fast. Please wait: %s seconds."
 msgstr ""
 
 # ../roundup/cgi/actions.py:891 :895
-#: ../roundup/cgi/actions.py:1515 ../roundup/cgi/actions.py:1526
-#: ../roundup/cgi/actions.py:1515:1526
+#: ../roundup/cgi/actions.py:1520 ../roundup/cgi/actions.py:1531
+#: ../roundup/cgi/actions.py:1520:1531
 msgid "Invalid login"
 msgstr "nombre de usuario ó contraseña inválidos"
 
-#: ../roundup/cgi/actions.py:1532
+#: ../roundup/cgi/actions.py:1537
 msgid "You do not have permission to login"
 msgstr "Ud. no tiene permiso para ingresar al sistema"
 
-#: ../roundup/cgi/actions.py:1577 ../roundup/cgi/actions.py:1757
-#: ../roundup/cgi/actions.py:1577:1757
+#: ../roundup/cgi/actions.py:1582 ../roundup/cgi/actions.py:1762
+#: ../roundup/cgi/actions.py:1582:1762
 #, python-format
 msgid "Column \"%(column)s\" not found in %(class)s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1822
+#: ../roundup/cgi/actions.py:1827
 #, fuzzy, python-format
 msgid "You do not have permission to view %(class)s"
 msgstr "Ud. no posee los permisos necesarios para editar %(class)s"
@@ -2158,8 +2165,8 @@ msgstr "Error de formulario"
 msgid "Unrecognized charset: %r"
 msgstr "Conjunto de caracteres desconocido: %r"
 
-#: ../roundup/cgi/client.py:1381 ../roundup/cgi/client.py:2394
-#: ../roundup/cgi/client.py:1381:2394
+#: ../roundup/cgi/client.py:1381 ../roundup/cgi/client.py:2396
+#: ../roundup/cgi/client.py:1381:2396
 msgid "broken form: multiple @action values submitted"
 msgstr ""
 
@@ -2239,50 +2246,51 @@ msgstr ""
 
 #: ../roundup/cgi/client.py:1679
 #, python-format
-msgid "csrf X-REQUESTED-WITH xmlrpc required header check failed for user%s."
+msgid ""
+"csrf X-REQUESTED-WITH xmlrpc required header check failed for user%(userid)s."
 msgstr ""
 
 #: ../roundup/cgi/client.py:1720
 #, python-format
-msgid "Required csrf field missing for user%s"
+msgid "Required csrf field missing for user%(userid)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1722 ../roundup/cgi/client.py:1749
-#: ../roundup/cgi/client.py:1766 ../roundup/cgi/client.py:1722:1749:1766
+#: ../roundup/cgi/client.py:1723 ../roundup/cgi/client.py:1751
+#: ../roundup/cgi/client.py:1768 ../roundup/cgi/client.py:1723:1751:1768
 msgid ""
 "We can't validate your session (csrf failure). Re-enter any unsaved data and "
 "try again."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1726
+#: ../roundup/cgi/client.py:1728
 #, python-format
-msgid "csrf field not supplied by user%s"
+msgid "csrf field not supplied by user%(userid)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1738
+#: ../roundup/cgi/client.py:1740
 #, python-format
 msgid ""
 "Csrf mismatch user: current user %(user)s != stored user %(stored)s, current "
 "session, stored session: %(cur_sess)s,%(stor_sess)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1756
+#: ../roundup/cgi/client.py:1758
 #, python-format
 msgid ""
 "Csrf mismatch user: current session %(curr_sess)s != stored session "
 "%(stor_sess)s, current user/stored user is: %(user)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1948
+#: ../roundup/cgi/client.py:1950
 msgid "You are not allowed to view this file."
 msgstr "Ud. no tiene permitido ver este fichero"
 
-#: ../roundup/cgi/client.py:2272
+#: ../roundup/cgi/client.py:2274
 #, python-format
 msgid "%(starttag)sTime elapsed: %(seconds)fs%(endtag)s\n"
 msgstr "%(starttag)sTiempo transcurrido: %(seconds)fs%(endtag)s\n"
 
-#: ../roundup/cgi/client.py:2276
+#: ../roundup/cgi/client.py:2278
 #, python-format
 msgid ""
 "%(starttag)sCache hits: %(cache_hits)d, misses %(cache_misses)d. Loading "
@@ -2291,7 +2299,7 @@ msgstr ""
 "%(starttag)sAciertos Cache: %(cache_hits)d, no aciertos %(cache_misses)d. "
 "Cargando items: %(get_items)f secs. Filtrado: %(filtering)f secs.%(endtag)s\n"
 
-#: ../roundup/cgi/client.py:2815
+#: ../roundup/cgi/client.py:2817
 #, python-format
 msgid ""
 "Cache failure: compressed file %(compressed)s is older than its source file "
@@ -2366,67 +2374,67 @@ msgstr[1] ""
 msgid "You are not allowed to %(action)s items of class %(class)s"
 msgstr "Ud. no tiene permitido %(action)s items de la clase %(class)s"
 
-#: ../roundup/cgi/templating.py:916
+#: ../roundup/cgi/templating.py:892
 msgid "(list)"
 msgstr "(lista)"
 
-#: ../roundup/cgi/templating.py:991
+#: ../roundup/cgi/templating.py:975
 msgid "Submit New Entry"
 msgstr "Crear nuevo elemento"
 
 # ../roundup/cgi/templating.py:673 :792 :1166 :1187 :1231 :1253 :1287 :1326
 # :1377 :1394 :1470 :1490 :1503 :1520 :1530 :1580 :1755
-#: ../roundup/cgi/templating.py:1013 ../roundup/cgi/templating.py:1189
-#: ../roundup/cgi/templating.py:1824 ../roundup/cgi/templating.py:1855
-#: ../roundup/cgi/templating.py:1876 ../roundup/cgi/templating.py:1914
-#: ../roundup/cgi/templating.py:1967 ../roundup/cgi/templating.py:1991
-#: ../roundup/cgi/templating.py:1998 ../roundup/cgi/templating.py:2035
-#: ../roundup/cgi/templating.py:2088 ../roundup/cgi/templating.py:2121
-#: ../roundup/cgi/templating.py:2216 ../roundup/cgi/templating.py:2237
-#: ../roundup/cgi/templating.py:2328 ../roundup/cgi/templating.py:2348
-#: ../roundup/cgi/templating.py:2370 ../roundup/cgi/templating.py:2413
-#: ../roundup/cgi/templating.py:2423 ../roundup/cgi/templating.py:2488
-#: ../roundup/cgi/templating.py:2791 ../roundup/cgi/templating.py:1013:1189
-#: :1824:1855 :1876:1914 :1967:1991 :1998:2035 :2088:2121 :2216:2237 :2328:2348
-#: :2370:2413 :2423:2488:2791
+#: ../roundup/cgi/templating.py:997 ../roundup/cgi/templating.py:1174
+#: ../roundup/cgi/templating.py:1809 ../roundup/cgi/templating.py:1840
+#: ../roundup/cgi/templating.py:1861 ../roundup/cgi/templating.py:1899
+#: ../roundup/cgi/templating.py:1952 ../roundup/cgi/templating.py:1976
+#: ../roundup/cgi/templating.py:1983 ../roundup/cgi/templating.py:2020
+#: ../roundup/cgi/templating.py:2077 ../roundup/cgi/templating.py:2115
+#: ../roundup/cgi/templating.py:2215 ../roundup/cgi/templating.py:2236
+#: ../roundup/cgi/templating.py:2357 ../roundup/cgi/templating.py:2377
+#: ../roundup/cgi/templating.py:2399 ../roundup/cgi/templating.py:2442
+#: ../roundup/cgi/templating.py:2452 ../roundup/cgi/templating.py:2517
+#: ../roundup/cgi/templating.py:2820 ../roundup/cgi/templating.py:997:1174
+#: :1809:1840 :1861:1899 :1952:1976 :1983:2020 :2077:2115 :2215:2236 :2357:2377
+#: :2399:2442 :2452:2517:2820
 msgid "[hidden]"
 msgstr "[oculto]"
 
-#: ../roundup/cgi/templating.py:1014
+#: ../roundup/cgi/templating.py:998
 msgid "New node - no history"
 msgstr "Nuevo nodo - sin historia"
 
-#: ../roundup/cgi/templating.py:1154
+#: ../roundup/cgi/templating.py:1139
 msgid "Submit Changes"
 msgstr "Enviar modificaciones"
 
-#: ../roundup/cgi/templating.py:1232
+#: ../roundup/cgi/templating.py:1217
 msgid "<em>The indicated property no longer exists</em>"
 msgstr "<em>La propiedad indicada ya no existe</em>"
 
-#: ../roundup/cgi/templating.py:1268
+#: ../roundup/cgi/templating.py:1253
 #, python-format
 msgid "The linked class %(classname)s no longer exists"
 msgstr "La clase relacionada %(classname)s ya no existe"
 
-#: ../roundup/cgi/templating.py:1305 ../roundup/cgi/templating.py:1335
-#: ../roundup/cgi/templating.py:2497 ../roundup/cgi/templating.py:2800
-#: ../roundup/cgi/templating.py:1305:1335 :2497:2800
+#: ../roundup/cgi/templating.py:1290 ../roundup/cgi/templating.py:1320
+#: ../roundup/cgi/templating.py:2526 ../roundup/cgi/templating.py:2829
+#: ../roundup/cgi/templating.py:1290:1320 :2526:2829
 msgid "[label is missing]"
 msgstr ""
 
 # ../roundup/cgi/templating.py:903 :924
-#: ../roundup/cgi/templating.py:1309 ../roundup/cgi/templating.py:1338
-#: ../roundup/cgi/templating.py:1309:1338
+#: ../roundup/cgi/templating.py:1294 ../roundup/cgi/templating.py:1323
+#: ../roundup/cgi/templating.py:1294:1323
 msgid "<strike>The linked node no longer exists</strike>"
 msgstr "<strike>El nodo relacionado ya no existe</strike>"
 
-#: ../roundup/cgi/templating.py:1400
+#: ../roundup/cgi/templating.py:1385
 #, python-format
 msgid "%s: (no value)"
 msgstr "%s: (sin valor)"
 
-#: ../roundup/cgi/templating.py:1416
+#: ../roundup/cgi/templating.py:1401
 #, fuzzy, python-format
 msgid ""
 "<strong><em>This event %s is not handled by the history display!</em></"
@@ -2435,46 +2443,46 @@ msgstr ""
 "<strong><em>Este evento no es soportado por la visualización de historia!</"
 "em></strong>"
 
-#: ../roundup/cgi/templating.py:1429
+#: ../roundup/cgi/templating.py:1414
 msgid "<tr><td colspan=4><strong>Note:</strong></td></tr>"
 msgstr "<tr><td colspan=4><strong>Nota:</strong></td></tr>"
 
-#: ../roundup/cgi/templating.py:1438
+#: ../roundup/cgi/templating.py:1423
 msgid "History"
 msgstr "Historia"
 
-#: ../roundup/cgi/templating.py:1440
+#: ../roundup/cgi/templating.py:1425
 msgid "<th>Date</th>"
 msgstr "<th>Fecha</th>"
 
-#: ../roundup/cgi/templating.py:1441
+#: ../roundup/cgi/templating.py:1426
 msgid "<th>User</th>"
 msgstr "<th>Usuario</th>"
 
-#: ../roundup/cgi/templating.py:1442
+#: ../roundup/cgi/templating.py:1427
 msgid "<th>Action</th>"
 msgstr "<th>Acción</th>"
 
-#: ../roundup/cgi/templating.py:1443
+#: ../roundup/cgi/templating.py:1428
 msgid "<th>Args</th>"
 msgstr "<th>Args</th>"
 
-#: ../roundup/cgi/templating.py:1494
+#: ../roundup/cgi/templating.py:1479
 #, python-format
 msgid "Copy of %(class)s %(id)s"
 msgstr "Copia de %(class)s %(id)s"
 
-#: ../roundup/cgi/templating.py:2125 ../roundup/cgi/templating.py:2160
-#: ../roundup/cgi/templating.py:1382:2125:2160
+#: ../roundup/cgi/templating.py:2119 ../roundup/cgi/templating.py:2154
+#: ../roundup/cgi/templating.py:1367:2119:2154
 msgid "No"
 msgstr "No"
 
-#: ../roundup/cgi/templating.py:2125 ../roundup/cgi/templating.py:2154
-#: ../roundup/cgi/templating.py:1382:2125:2154
+#: ../roundup/cgi/templating.py:2119 ../roundup/cgi/templating.py:2148
+#: ../roundup/cgi/templating.py:1367:2119:2148
 msgid "Yes"
 msgstr "Si"
 
-#: ../roundup/cgi/templating.py:2286
+#: ../roundup/cgi/templating.py:2315
 msgid ""
 "default value for DateHTMLProperty must be either DateHTMLProperty or string "
 "date representation."
@@ -2482,27 +2490,27 @@ msgstr ""
 "el valor por defecto para DateHTMLProperty debe ser un DateHTMLProperty o "
 "una cadena que represente una fecha."
 
-#: ../roundup/cgi/templating.py:2468
+#: ../roundup/cgi/templating.py:2497
 #, python-format
 msgid "Attempt to look up %(attr)s on a missing value"
 msgstr "Se intentó buscar %(attr)s en un valor faltante"
 
-#: ../roundup/cgi/templating.py:2479
+#: ../roundup/cgi/templating.py:2508
 #, fuzzy, python-format
 msgid "Attempt to look up %(item)s on a missing value"
 msgstr "Se intentó buscar %(attr)s en un valor faltante"
 
-#: ../roundup/cgi/templating.py:2584
+#: ../roundup/cgi/templating.py:2613
 #, python-format
 msgid "<option %svalue=\"-1\">- no selection -</option>"
 msgstr "<option %svalue=\"-1\">- sin selección -</option>"
 
-#: ../roundup/cgi/templating.py:3745
+#: ../roundup/cgi/templating.py:3777
 #, python-format
 msgid "Unable to read or expand file '%(name)s' in template '%(template)s'."
 msgstr ""
 
-#: ../roundup/cgi/templating.py:3795
+#: ../roundup/cgi/templating.py:3827
 #, python-format
 msgid ""
 "Found an incorrect token when expandfile applied string subsitution on "
@@ -2676,60 +2684,60 @@ msgstr "hace %s"
 msgid "in %s"
 msgstr "en %s"
 
-#: ../roundup/hyperdb.py:120
+#: ../roundup/hyperdb.py:126
 #, fuzzy, python-format
 msgid "property %(property)s: %(errormsg)s"
 msgstr "Error: %s: %s"
 
-#: ../roundup/hyperdb.py:149
+#: ../roundup/hyperdb.py:161
 #, python-format
 msgid "property %(property)s: %(value)r is an invalid date (%(errormsg)s)"
 msgstr ""
 
-#: ../roundup/hyperdb.py:172
+#: ../roundup/hyperdb.py:184
 #, python-format
 msgid ""
 "property %(property)s: %(value)r is an invalid date interval (%(errormsg)s)"
 msgstr ""
 
-#: ../roundup/hyperdb.py:434
+#: ../roundup/hyperdb.py:446
 #, fuzzy, python-format
 msgid "property %(property)s: %(value)r is not a number"
 msgstr ""
 "propiedad \"%(propname)s\": \"%(value)s\" no se encuentra en este momento en "
 "la lista"
 
-#: ../roundup/hyperdb.py:448
+#: ../roundup/hyperdb.py:460
 #, fuzzy, python-format
 msgid "property %(property)s: %(value)r is not an integer"
 msgstr ""
 "propiedad \"%(propname)s\": \"%(value)s\" no se encuentra en este momento en "
 "la lista"
 
-#: ../roundup/hyperdb.py:470
+#: ../roundup/hyperdb.py:482
 #, python-format
 msgid "\"%s\" not a node designator"
 msgstr ""
 
-#: ../roundup/hyperdb.py:1499 ../roundup/hyperdb.py:1507
-#: ../roundup/hyperdb.py:1499:1507
+#: ../roundup/hyperdb.py:1515 ../roundup/hyperdb.py:1523
+#: ../roundup/hyperdb.py:1515:1523
 #, python-format
 msgid "Not a property name: %s"
 msgstr ""
 
-#: ../roundup/hyperdb.py:2038
+#: ../roundup/hyperdb.py:2054
 #, fuzzy, python-format
 msgid "property %(property)s: %(value)r is not a %(classname)s."
 msgstr ""
 "propiedad \"%(propname)s\": \"%(value)s\" no se encuentra en este momento en "
 "la lista"
 
-#: ../roundup/hyperdb.py:2044
+#: ../roundup/hyperdb.py:2060
 #, python-format
 msgid "you may only enter ID values for property %s"
 msgstr ""
 
-#: ../roundup/hyperdb.py:2079
+#: ../roundup/hyperdb.py:2095
 #, python-format
 msgid "%(property)r is not a property of %(classname)s"
 msgstr ""
@@ -3067,61 +3075,61 @@ msgid ""
 "are: %(stack)s"
 msgstr ""
 
-#: ../roundup/pygettext.py:401
+#: ../roundup/pygettext.py:400
 #, python-format
 msgid "*** %(file)s:%(lineno)s: Seen unexpected token \"%(token)s\""
 msgstr ""
 
-#: ../roundup/pygettext.py:457
+#: ../roundup/pygettext.py:456
 #, python-format
 msgid "# File: %(filename)s, line: %(lineno)d"
 msgstr ""
 
-#: ../roundup/pygettext.py:464
+#: ../roundup/pygettext.py:463
 #, python-format
 msgid " %(filename)s:%(lineno)d"
 msgstr ""
 
 # ../roundup/cgi/actions.py:891 :895
-#: ../roundup/pygettext.py:540
+#: ../roundup/pygettext.py:539
 #, fuzzy, python-format
 msgid "Invalid value for --style: %s"
 msgstr "nombre de usuario ó contraseña inválidos"
 
-#: ../roundup/pygettext.py:548
+#: ../roundup/pygettext.py:547
 #, python-format
 msgid "pygettext.py (xgettext for Python) %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:554
+#: ../roundup/pygettext.py:553
 #, python-format
 msgid "--width argument must be an integer: %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:582
+#: ../roundup/pygettext.py:581
 #, python-format
 msgid "Can't read --exclude-file: %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:601
+#: ../roundup/pygettext.py:600
 msgid "Reading standard input"
 msgstr ""
 
-#: ../roundup/pygettext.py:606
+#: ../roundup/pygettext.py:605
 #, python-format
 msgid "Working on %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:640
+#: ../roundup/pygettext.py:639
 msgid "a unicode string"
 msgstr ""
 
-#: ../roundup/pygettext.py:642
+#: ../roundup/pygettext.py:641
 #, python-format
 msgid "*** Seen unexpected token \"%(token)s\""
 msgstr ""
 
-#: ../roundup/pygettext.py:643
+#: ../roundup/pygettext.py:642
 msgid "morethanonestring"
 msgstr ""
 
@@ -3242,32 +3250,32 @@ msgstr "creaci
 msgid "creator"
 msgstr "creador"
 
-#: ../roundup/roundupdb.py:426
+#: ../roundup/roundupdb.py:447
 #, python-format
 msgid "No key for \"%(adr)s\" in keyring"
 msgstr ""
 
-#: ../roundup/roundupdb.py:504
+#: ../roundup/roundupdb.py:525
 #, python-format
 msgid "New submission from %(authname)s%(authaddr)s:"
 msgstr "Nuevo aporte de %(authname)s%(authaddr)s:"
 
-#: ../roundup/roundupdb.py:507
+#: ../roundup/roundupdb.py:528
 #, python-format
 msgid "%(authname)s%(authaddr)s added the comment:"
 msgstr "%(authname)s%(authaddr)s agregó el comentario:"
 
-#: ../roundup/roundupdb.py:510
+#: ../roundup/roundupdb.py:531
 #, python-format
 msgid "Change by %(authname)s%(authaddr)s:"
 msgstr "Modificación de %(authname)s%(authaddr)s:"
 
-#: ../roundup/roundupdb.py:529
+#: ../roundup/roundupdb.py:550
 #, python-format
 msgid "File '%(filename)s' not attached - you can download it from %(link)s."
 msgstr "Fichero '%(filename)s' no anexado - puede descargarlo de %(link)s."
 
-#: ../roundup/roundupdb.py:904
+#: ../roundup/roundupdb.py:925
 #, python-format
 msgid ""
 "\n"
@@ -3378,59 +3386,59 @@ msgstr ""
 "<html><head><title>Índice de trackers Roundup</title></head>\n"
 "<body><h1>Índice de trackers Roundup</h1><ol>\n"
 
-#: ../roundup/scripts/roundup_server.py:598
+#: ../roundup/scripts/roundup_server.py:602
 #, fuzzy, python-format
 msgid "Error: %(type)s: %(value)s"
 msgstr "%(key)s: %(value)s"
 
-#: ../roundup/scripts/roundup_server.py:610
+#: ../roundup/scripts/roundup_server.py:614
 msgid "WARNING: ignoring \"-g\" argument, not root"
 msgstr "ATENCIÓN: ignorando argumento \"-g\" , Ud. no es root"
 
-#: ../roundup/scripts/roundup_server.py:616
+#: ../roundup/scripts/roundup_server.py:620
 msgid "Can't change groups - no grp module"
 msgstr "No puede cambiar grupos - el módulo grp no está presente"
 
-#: ../roundup/scripts/roundup_server.py:625
+#: ../roundup/scripts/roundup_server.py:629
 #, python-format
 msgid "Group %(group)s doesn't exist"
 msgstr "El grupo %(group)s no existe"
 
-#: ../roundup/scripts/roundup_server.py:637
+#: ../roundup/scripts/roundup_server.py:641
 msgid "Can't run as root!"
 msgstr "No puede ejecutarse como root!"
 
-#: ../roundup/scripts/roundup_server.py:640
+#: ../roundup/scripts/roundup_server.py:644
 msgid "WARNING: ignoring \"-u\" argument, not root"
 msgstr "ATENCIÓN: ignorando argumento \"-u\", Ud. no es root"
 
-#: ../roundup/scripts/roundup_server.py:646
+#: ../roundup/scripts/roundup_server.py:650
 msgid "Can't change users - no pwd module"
 msgstr "No puedo cambiar usuarios - no existe el módulo pwd"
 
-#: ../roundup/scripts/roundup_server.py:655
+#: ../roundup/scripts/roundup_server.py:659
 #, python-format
 msgid "User %(user)s doesn't exist"
 msgstr "El usuario %(user)s no existe"
 
-#: ../roundup/scripts/roundup_server.py:867
+#: ../roundup/scripts/roundup_server.py:871
 #, python-format
 msgid "Multiprocess mode \"%s\" is not available, switching to single-process"
 msgstr ""
 "El modo multiproceso \"%s\" no está disponible, conmutado a proceso simple"
 
-#: ../roundup/scripts/roundup_server.py:895
+#: ../roundup/scripts/roundup_server.py:899
 #, python-format
 msgid "Unable to bind to port %s, port already in use."
 msgstr "Imposible asociarse al puerto %s, el mismo ya está en uso."
 
-#: ../roundup/scripts/roundup_server.py:899
+#: ../roundup/scripts/roundup_server.py:903
 #, fuzzy, python-format
 msgid ""
 "Unable to bind to port %(port)s, access not allowed, errno: %(errno)s %(msg)s"
 msgstr "Imposible asociarse al puerto %s, el mismo ya está en uso."
 
-#: ../roundup/scripts/roundup_server.py:978
+#: ../roundup/scripts/roundup_server.py:982
 msgid ""
 " -c <Command>  Windows Service options.\n"
 "               If you want to run the server as a Windows Service, you\n"
@@ -3452,7 +3460,7 @@ msgstr ""
 "para\n"
 "               Servicios Web."
 
-#: ../roundup/scripts/roundup_server.py:985
+#: ../roundup/scripts/roundup_server.py:989
 #, fuzzy
 msgid ""
 " -u <UID>      runs the Roundup web server as this UID\n"
@@ -3469,7 +3477,7 @@ msgstr ""
 "               PID del servidor en el fichero especificado por PIDfile.\n"
 "               La opción -l *debe* ser especificada si se usa la opción -d."
 
-#: ../roundup/scripts/roundup_server.py:993
+#: ../roundup/scripts/roundup_server.py:997
 #, fuzzy, python-format
 msgid ""
 "\n"
@@ -3608,22 +3616,26 @@ msgstr ""
 "   caracteres tales como espacios, dado que los mismos confunden a Internet "
 "Explorer.\n"
 
-#: ../roundup/scripts/roundup_server.py:1173
+#: ../roundup/scripts/roundup_server.py:1177
 msgid "Instances must be name=home"
 msgstr "Las Instancias debe ser de la forma nombre=directorio base"
 
-#: ../roundup/scripts/roundup_server.py:1187
+#: ../roundup/scripts/roundup_server.py:1191
 #, python-format
 msgid "Configuration saved to %s"
 msgstr "Configuración guardada en %s"
 
-#: ../roundup/scripts/roundup_server.py:1205
+#: ../roundup/scripts/roundup_server.py:1206
+msgid "If you specify a PID file you must use -l or -L."
+msgstr ""
+
+#: ../roundup/scripts/roundup_server.py:1212
 msgid "Sorry, you can't run the server as a daemon on this Operating System"
 msgstr ""
 "Lo siento, no puede ejecutar el servidor como un demonio en este Sistema "
 "Operativo"
 
-#: ../roundup/scripts/roundup_server.py:1225
+#: ../roundup/scripts/roundup_server.py:1232
 #, python-format
 msgid "Roundup server started on %(HOST)s:%(PORT)s"
 msgstr "servidor Roundup iniciado en %(HOST)s:%(PORT)s"
@@ -4906,46 +4918,46 @@ msgstr "Doc. de Roundup"
 msgid "clear this message"
 msgstr "quitar este mensaje"
 
-#: ../share/roundup/templates/classic/html/page.html:257
-#: ../share/roundup/templates/classic/html/page.html:270
-#: ../share/roundup/templates/classic/html/page.html:288
-#: ../share/roundup/templates/classic/html/page.html:302
-#: ../share/roundup/templates/devel/html/page.html:316
-#: ../share/roundup/templates/devel/html/page.html:329
-#: ../share/roundup/templates/devel/html/page.html:347
-#: ../share/roundup/templates/devel/html/page.html:361
-#: ../share/roundup/templates/minimal/html/page.html:239
-#: ../share/roundup/templates/minimal/html/page.html:254
-#: ../share/roundup/templates/minimal/html/page.html:268
-#: ../share/roundup/templates/responsive/html/page.html:331
-#: ../share/roundup/templates/responsive/html/page.html:344
-#: ../share/roundup/templates/responsive/html/page.html:362
-#: ../share/roundup/templates/responsive/html/page.html:376
-msgid "don't care"
-msgstr "cualquier(a)"
-
-#: ../share/roundup/templates/classic/html/page.html:259
-#: ../share/roundup/templates/classic/html/page.html:272
-#: ../share/roundup/templates/classic/html/page.html:290
+#: ../share/roundup/templates/classic/html/page.html:258
+#: ../share/roundup/templates/classic/html/page.html:271
+#: ../share/roundup/templates/classic/html/page.html:289
 #: ../share/roundup/templates/classic/html/page.html:303
-#: ../share/roundup/templates/devel/html/page.html:318
-#: ../share/roundup/templates/devel/html/page.html:331
-#: ../share/roundup/templates/devel/html/page.html:349
+#: ../share/roundup/templates/devel/html/page.html:317
+#: ../share/roundup/templates/devel/html/page.html:330
+#: ../share/roundup/templates/devel/html/page.html:348
 #: ../share/roundup/templates/devel/html/page.html:362
-#: ../share/roundup/templates/minimal/html/page.html:241
-#: ../share/roundup/templates/minimal/html/page.html:256
+#: ../share/roundup/templates/minimal/html/page.html:240
+#: ../share/roundup/templates/minimal/html/page.html:255
 #: ../share/roundup/templates/minimal/html/page.html:269
-#: ../share/roundup/templates/responsive/html/page.html:333
-#: ../share/roundup/templates/responsive/html/page.html:346
-#: ../share/roundup/templates/responsive/html/page.html:364
+#: ../share/roundup/templates/responsive/html/page.html:332
+#: ../share/roundup/templates/responsive/html/page.html:345
+#: ../share/roundup/templates/responsive/html/page.html:363
 #: ../share/roundup/templates/responsive/html/page.html:377
+msgid "don't care"
+msgstr "cualquier(a)"
+
+#: ../share/roundup/templates/classic/html/page.html:260
+#: ../share/roundup/templates/classic/html/page.html:273
+#: ../share/roundup/templates/classic/html/page.html:291
+#: ../share/roundup/templates/classic/html/page.html:304
+#: ../share/roundup/templates/devel/html/page.html:319
+#: ../share/roundup/templates/devel/html/page.html:332
+#: ../share/roundup/templates/devel/html/page.html:350
+#: ../share/roundup/templates/devel/html/page.html:363
+#: ../share/roundup/templates/minimal/html/page.html:242
+#: ../share/roundup/templates/minimal/html/page.html:257
+#: ../share/roundup/templates/minimal/html/page.html:270
+#: ../share/roundup/templates/responsive/html/page.html:334
+#: ../share/roundup/templates/responsive/html/page.html:347
+#: ../share/roundup/templates/responsive/html/page.html:365
+#: ../share/roundup/templates/responsive/html/page.html:378
 msgid "------------"
 msgstr "------------"
 
-#: ../share/roundup/templates/classic/html/page.html:335
-#: ../share/roundup/templates/devel/html/page.html:390
-#: ../share/roundup/templates/minimal/html/page.html:297
-#: ../share/roundup/templates/responsive/html/page.html:405
+#: ../share/roundup/templates/classic/html/page.html:336
+#: ../share/roundup/templates/devel/html/page.html:391
+#: ../share/roundup/templates/minimal/html/page.html:298
+#: ../share/roundup/templates/responsive/html/page.html:406
 msgid "no value"
 msgstr "sin valor"
 
diff --git a/locale/fr.po b/locale/fr.po
index 24af8e5a7..b6b0c25ed 100644
--- a/locale/fr.po
+++ b/locale/fr.po
@@ -8,9 +8,9 @@
 #
 msgid ""
 msgstr ""
-"Project-Id-Version: Roundup 2.5.0\n"
+"Project-Id-Version: Roundup 2.5.0b1\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
-"POT-Creation-Date: 2025-01-12 20:17-0500\n"
+"POT-Creation-Date: 2025-06-11 16:02-0400\n"
 "PO-Revision-Date: 2013-10-31 12:19+0100\n"
 "Last-Translator: Stephane Raimbault <stephane.raimbault@gmail.com>\n"
 "Language-Team: GNOME French Team <gnomefr@traduc.org>\n"
@@ -31,19 +31,19 @@ msgstr ""
 msgid "You may not retire the admin or anonymous user"
 msgstr "Vous ne pouvez pas abandonner les utilisateurs admin ou anonyme"
 
-#: ../roundup/admin.py:131
+#: ../roundup/admin.py:132
 msgid ""
 "Have 'display designator[,designator*]' show header inside\n"
 "      []'s before items. Includes retired/active status.\n"
 msgstr ""
 
-#: ../roundup/admin.py:135
+#: ../roundup/admin.py:136
 msgid ""
 "Have 'display designator' and 'specification class' show\n"
 "      protected fields: creator, id etc.\n"
 msgstr ""
 
-#: ../roundup/admin.py:139
+#: ../roundup/admin.py:140
 msgid ""
 "Controls history options. It is a bitstring where setting\n"
 "      the bit disables the feature. A value of 0 (default)\n"
@@ -54,54 +54,54 @@ msgid ""
 "      history.\n"
 msgstr ""
 
-#: ../roundup/admin.py:148
+#: ../roundup/admin.py:149
 msgid ""
 "Set the number of lines of history to keep for this session.\n"
 "      -1 is infinite.\n"
 msgstr ""
 
-#: ../roundup/admin.py:152
+#: ../roundup/admin.py:153
 msgid "Set indexer to use when running 'reindex' NYI\n"
 msgstr ""
 
-#: ../roundup/admin.py:155
+#: ../roundup/admin.py:156
 msgid "Force reopening of tracker when running each command.\n"
 msgstr ""
 
-#: ../roundup/admin.py:158
+#: ../roundup/admin.py:159
 msgid ""
 "set the number of rows imported before a database commit is\n"
 "      done. Used only for imports on PostgreSQL.\n"
 msgstr ""
 
-#: ../roundup/admin.py:160
+#: ../roundup/admin.py:161
 msgid "Show retired items in table, list etc. One of 'no', 'only', 'both'\n"
 msgstr ""
 
-#: ../roundup/admin.py:162
+#: ../roundup/admin.py:163
 msgid "internal mapping for show_retired.\n"
 msgstr ""
 
-#: ../roundup/admin.py:163
+#: ../roundup/admin.py:164
 msgid "Enable verbose output: tracing, descriptions...\n"
 msgstr ""
 
 # ../roundup/admin.py:85 :979 :1028 :1050
 # ../roundup/admin.py:1052 ../roundup/admin.py:85:981 :1030:1052
-#: ../roundup/admin.py:175 ../roundup/admin.py:1188 ../roundup/admin.py:1858
-#: ../roundup/admin.py:1890 ../roundup/admin.py:175:1188 :1858:1890
+#: ../roundup/admin.py:176 ../roundup/admin.py:1199 ../roundup/admin.py:1869
+#: ../roundup/admin.py:1901 ../roundup/admin.py:176:1199 :1869:1901
 #, python-format
 msgid "no such class \"%(classname)s\""
 msgstr "aucune classe nommée « %(classname)s »"
 
 # ../roundup/admin.py:95 :99
 # ../roundup/admin.py:95 ../roundup/admin.py:99 ../roundup/admin.py:95:99
-#: ../roundup/admin.py:188
+#: ../roundup/admin.py:189
 #, python-format
 msgid "argument \"%(arg)s\" not propname=value"
 msgstr "l'argument « %(arg)s » n'est pas au format nom-de-propriété=valeur"
 
-#: ../roundup/admin.py:201
+#: ../roundup/admin.py:202
 #, python-format
 msgid ""
 "Problem: %(message)s\n"
@@ -110,7 +110,7 @@ msgstr ""
 "Problème : %(message)s\n"
 "\n"
 
-#: ../roundup/admin.py:202
+#: ../roundup/admin.py:203
 #, fuzzy, python-format
 msgid ""
 "%(message)sUsage: roundup-admin [options] [<command> <arguments>]\n"
@@ -169,12 +169,12 @@ msgstr ""
 " roundup-admin help <commande>            -- l'aide sur une commande\n"
 " roundup-admin help all                   -- toute l'aide disponible\n"
 
-#: ../roundup/admin.py:231
+#: ../roundup/admin.py:232
 #, fuzzy
 msgid "Commands: "
 msgstr "Commandes :"
 
-#: ../roundup/admin.py:238
+#: ../roundup/admin.py:249
 msgid ""
 "Commands may be abbreviated as long as the abbreviation\n"
 "matches only one command, e.g. l == li == lis == list."
@@ -183,7 +183,7 @@ msgstr ""
 "où l'abréviation ne correspond qu'à une seule commande,\n"
 "par ex. : l == li == lis == list."
 
-#: ../roundup/admin.py:270
+#: ../roundup/admin.py:281
 #, fuzzy
 msgid ""
 "\n"
@@ -323,27 +323,27 @@ msgstr ""
 "\n"
 "Aide sur les commandes :\n"
 
-#: ../roundup/admin.py:334
+#: ../roundup/admin.py:345
 #, python-format
 msgid "%s:"
 msgstr "%s :"
 
 # ../roundup/admin.py:338 :394
 # ../roundup/admin.py:340 ../roundup/admin.py:396 ../roundup/admin.py:340:396
-#: ../roundup/admin.py:439 ../roundup/admin.py:1415
-#: ../roundup/admin.py:439:1415
+#: ../roundup/admin.py:450 ../roundup/admin.py:1426
+#: ../roundup/admin.py:450:1426
 msgid "Templates:"
 msgstr "Modèles :"
 
 # ../roundup/admin.py:341 :405
 # ../roundup/admin.py:343 ../roundup/admin.py:407 ../roundup/admin.py:343:407
-#: ../roundup/admin.py:442 ../roundup/admin.py:1425
-#: ../roundup/admin.py:442:1425
+#: ../roundup/admin.py:453 ../roundup/admin.py:1436
+#: ../roundup/admin.py:453:1436
 msgid "Back ends:"
 msgstr "Moteurs de stockage :"
 
 #. noqa: ARG002
-#: ../roundup/admin.py:459
+#: ../roundup/admin.py:470
 msgid ""
 "Usage: commit\n"
 "        Commit changes made to the database during an interactive session.\n"
@@ -368,7 +368,7 @@ msgstr ""
 "        automatiquement validées si elles réussissent.\n"
 "        "
 
-#: ../roundup/admin.py:474
+#: ../roundup/admin.py:485
 msgid ""
 "Usage: create classname property=value ...\n"
 "        Create a new entry of a given class.\n"
@@ -392,42 +392,42 @@ msgstr ""
 # :1018 :1040 :1067 :1134 :1204
 # ../roundup/admin.py:1207 ../roundup/admin.py:369:466 :1020:1042 :1069:1136
 # :1207 :527:606 :656:714 :735:763 :834:901:972
-#: ../roundup/admin.py:482 ../roundup/admin.py:555 ../roundup/admin.py:606
-#: ../roundup/admin.py:733 ../roundup/admin.py:806 ../roundup/admin.py:851
-#: ../roundup/admin.py:902 ../roundup/admin.py:999 ../roundup/admin.py:1216
-#: ../roundup/admin.py:1388 ../roundup/admin.py:1516 ../roundup/admin.py:1599
-#: ../roundup/admin.py:1725 ../roundup/admin.py:1848 ../roundup/admin.py:1880
-#: ../roundup/admin.py:1996 ../roundup/admin.py:2050 ../roundup/admin.py:2098
-#: ../roundup/admin.py:482:555 :1216:1388:1516 :1599:1725 :1848:1880 :1996:2050
-#: :2098 :606:733 :806:851 :902:999
+#: ../roundup/admin.py:493 ../roundup/admin.py:566 ../roundup/admin.py:617
+#: ../roundup/admin.py:744 ../roundup/admin.py:817 ../roundup/admin.py:862
+#: ../roundup/admin.py:913 ../roundup/admin.py:1010 ../roundup/admin.py:1227
+#: ../roundup/admin.py:1399 ../roundup/admin.py:1527 ../roundup/admin.py:1610
+#: ../roundup/admin.py:1736 ../roundup/admin.py:1859 ../roundup/admin.py:1891
+#: ../roundup/admin.py:2007 ../roundup/admin.py:2061 ../roundup/admin.py:2109
+#: ../roundup/admin.py:493:566 :1227:1399 :1527:1610 :1736:1859 :1891:2007
+#: :2061:2109 :617:744 :817:862 :913:1010
 msgid "Not enough arguments supplied"
 msgstr "Pas suffisamment d'arguments fournis"
 
-#: ../roundup/admin.py:502
+#: ../roundup/admin.py:513
 #, python-format
 msgid "%(propname)s (Password): "
 msgstr "%(propname)s (mot de passe) : "
 
-#: ../roundup/admin.py:505
+#: ../roundup/admin.py:516
 #, python-format
 msgid "   %(propname)s (Again): "
 msgstr "   %(propname)s (à nouveau) : "
 
-#: ../roundup/admin.py:509
+#: ../roundup/admin.py:520
 msgid "Sorry, try again..."
 msgstr "Désolé, essayez à nouveau..."
 
-#: ../roundup/admin.py:514
+#: ../roundup/admin.py:525
 #, python-format
 msgid "%(propname)s (%(proptype)s): "
 msgstr "%(propname)s (%(proptype)s) : "
 
-#: ../roundup/admin.py:533
+#: ../roundup/admin.py:544
 #, python-format
 msgid "you must provide the \"%(propname)s\" property."
 msgstr "vous devez renseigner la propriété « %(propname)s »."
 
-#: ../roundup/admin.py:545
+#: ../roundup/admin.py:556
 #, fuzzy
 msgid ""
 "Usage: display designator[,designator]*\n"
@@ -447,13 +447,13 @@ msgstr ""
 "        des noeuds indiqués.\n"
 "        "
 
-#: ../roundup/admin.py:586
+#: ../roundup/admin.py:597
 #, fuzzy, python-format
 msgid "%(protected)s%(key)s: %(value)s"
 msgstr "%(key)s : %(value)s"
 
 #. grab the directory to export to
-#: ../roundup/admin.py:589
+#: ../roundup/admin.py:600
 #, fuzzy
 msgid ""
 "Usage: export [[-]class[,class]] export_dir\n"
@@ -483,7 +483,7 @@ msgstr ""
 "        format aux valeurs séparées par des doubles-points.\n"
 "        "
 
-#: ../roundup/admin.py:704
+#: ../roundup/admin.py:715
 #, fuzzy
 msgid ""
 "Usage: exporttables [[-]class[,class]] export_dir\n"
@@ -514,7 +514,7 @@ msgstr ""
 "        format aux valeurs séparées par des doubles-points.\n"
 "        "
 
-#: ../roundup/admin.py:723
+#: ../roundup/admin.py:734
 #, fuzzy
 msgid ""
 "Usage: filter classname propname=value ...\n"
@@ -538,21 +538,21 @@ msgstr ""
 
 # ../roundup/admin.py:699 :852 :864 :918
 # ../roundup/admin.py:920 ../roundup/admin.py:701:854 :866:920
-#: ../roundup/admin.py:764
+#: ../roundup/admin.py:775
 #, fuzzy, python-format
 msgid "Class %(curclassname)s has no property %(pn)s in %(propname)s."
 msgstr "%(classname)s n'a pas de propriété « %(propname)s »"
 
 # ../roundup/admin.py:699 :852 :864 :918
 # ../roundup/admin.py:920 ../roundup/admin.py:701:854 :866:920
-#: ../roundup/admin.py:791 ../roundup/admin.py:840 ../roundup/admin.py:1536
-#: ../roundup/admin.py:1549 ../roundup/admin.py:2120
-#: ../roundup/admin.py:791:840 :1536:1549:2120
+#: ../roundup/admin.py:802 ../roundup/admin.py:851 ../roundup/admin.py:1547
+#: ../roundup/admin.py:1560 ../roundup/admin.py:2131
+#: ../roundup/admin.py:802:851 :1547:1560:2131
 #, python-format
 msgid "%(classname)s has no property \"%(propname)s\""
 msgstr "%(classname)s n'a pas de propriété « %(propname)s »"
 
-#: ../roundup/admin.py:798
+#: ../roundup/admin.py:809
 msgid ""
 "Usage: find classname propname=value ...\n"
 "        Find the nodes of the given class with a given link property value.\n"
@@ -571,7 +571,7 @@ msgstr ""
 "        noeud lié, ou sa valeur de clé.\n"
 "        "
 
-#: ../roundup/admin.py:847
+#: ../roundup/admin.py:858
 #, fuzzy
 msgid ""
 "Usage: genconfig filename\n"
@@ -583,7 +583,7 @@ msgstr ""
 "              (au format ini) avec des valeurs par défaut dans\n"
 "              <nomfichier>"
 
-#: ../roundup/admin.py:864
+#: ../roundup/admin.py:875
 #, python-format
 msgid ""
 "Changing option\n"
@@ -591,20 +591,20 @@ msgid ""
 "from old default of %(old_number)s to new default of %(new_number)s."
 msgstr ""
 
-#: ../roundup/admin.py:875
+#: ../roundup/admin.py:886
 #, python-format
 msgid ""
 "Update 'password_pbkdf2_default_rounds' to a number equal to or larger\n"
 "  than %s.\n"
 msgstr ""
 
-#: ../roundup/admin.py:882
+#: ../roundup/admin.py:893
 msgid ""
 "Check the rdbms mysql_* settings. Your charset and collations may need\n"
 "  to be changed. See upgrading instructions.\n"
 msgstr ""
 
-#: ../roundup/admin.py:892
+#: ../roundup/admin.py:903
 #, fuzzy
 msgid ""
 "Usage: get property designator[,designator]*\n"
@@ -626,7 +626,7 @@ msgstr ""
 
 # ../roundup/admin.py:558 :573
 # ../roundup/admin.py:560 ../roundup/admin.py:575 ../roundup/admin.py:560:575
-#: ../roundup/admin.py:925
+#: ../roundup/admin.py:936
 #, python-format
 msgid "property %s is not of type Multilink or Link so -d flag does not apply."
 msgstr ""
@@ -635,19 +635,19 @@ msgstr ""
 
 # ../roundup/admin.py:581 :981 :1030 :1052
 # ../roundup/admin.py:1054 ../roundup/admin.py:583:983 :1032:1054
-#: ../roundup/admin.py:942 ../roundup/admin.py:1190 ../roundup/admin.py:1864
-#: ../roundup/admin.py:1892 ../roundup/admin.py:942:1190 :1864:1892
+#: ../roundup/admin.py:953 ../roundup/admin.py:1201 ../roundup/admin.py:1875
+#: ../roundup/admin.py:1903 ../roundup/admin.py:953:1201 :1875:1903
 #, python-format
 msgid "no such %(classname)s node \"%(nodeid)s\""
 msgstr "le noeud « %(nodeid)s » de classe « %(classname)s » n'existe pas"
 
-#: ../roundup/admin.py:945
+#: ../roundup/admin.py:956
 #, python-format
 msgid "no such %(classname)s property \"%(propname)s\""
 msgstr ""
 "la propriété « %(propname)s » n'existe pas pour la classe « %(classname)s »"
 
-#: ../roundup/admin.py:950
+#: ../roundup/admin.py:961
 msgid ""
 "Usage: help topic\n"
 "        Give help about topic.\n"
@@ -667,12 +667,12 @@ msgstr ""
 "        all        -- toute l'aide disponible\n"
 "        "
 
-#: ../roundup/admin.py:969
+#: ../roundup/admin.py:980
 #, python-format
 msgid "Sorry, no help for \"%(topic)s\""
 msgstr "Désolé, aucune aide n'est disponible au sujet de « %(topic)s »"
 
-#: ../roundup/admin.py:986
+#: ../roundup/admin.py:997
 #, fuzzy
 msgid ""
 "Usage: history designator [skipquiet] [raw]\n"
@@ -695,27 +695,27 @@ msgstr ""
 "        valeur de clé peut être ré-utilisée.\n"
 "        "
 
-#: ../roundup/admin.py:1011
+#: ../roundup/admin.py:1022
 #, python-format
 msgid "Unexpected argument(s): %s. Expected 'skipquiet' or 'raw'."
 msgstr ""
 
-#: ../roundup/admin.py:1062
+#: ../roundup/admin.py:1073
 #, fuzzy
 msgid "removed"
 msgstr "supprimer"
 
-#: ../roundup/admin.py:1064
+#: ../roundup/admin.py:1075
 msgid "added"
 msgstr ""
 
-#: ../roundup/admin.py:1066
+#: ../roundup/admin.py:1077
 #, python-format
 msgid "Unknown history set operation '%s'. Expected +/-."
 msgstr ""
 
 #. .Hint added issue23 to superseder
-#: ../roundup/admin.py:1091
+#: ../roundup/admin.py:1102
 #, fuzzy, python-format
 msgid "added %(class)s%(item_id)s to %(propname)s"
 msgstr "%(class)s %(id)s %(properties)s modifié(s) avec succès"
@@ -723,29 +723,29 @@ msgstr "%(class)s %(id)s %(properties)s modifi
 #. .Hint read as: assignedto was admin(1)
 #. where assignedto is the property
 #. admin is the key name for value 1
-#: ../roundup/admin.py:1112
+#: ../roundup/admin.py:1123
 #, fuzzy, python-format
 msgid "%(prop)s was %(name)s(%(value)s)"
 msgstr "%(propname)s (%(proptype)s) : "
 
-#: ../roundup/admin.py:1118 ../roundup/admin.py:1147
-#: ../roundup/admin.py:1118:1147
+#: ../roundup/admin.py:1129 ../roundup/admin.py:1158
+#: ../roundup/admin.py:1129:1158
 #, fuzzy, python-format
 msgid "%(prop)s was %(value)s"
 msgstr "%(key)s : %(value)s"
 
-#: ../roundup/admin.py:1137
+#: ../roundup/admin.py:1148
 #, python-format
 msgid "%(prop)s was [%(value_list)s]"
 msgstr ""
 
 #. .Hint modified nosy: added demo(3)
-#: ../roundup/admin.py:1144
+#: ../roundup/admin.py:1155
 #, python-format
 msgid "modified %(prop)s: %(how)s"
 msgstr ""
 
-#: ../roundup/admin.py:1195
+#: ../roundup/admin.py:1206
 #, fuzzy
 msgid ""
 "Usage: import import_dir\n"
@@ -792,7 +792,7 @@ msgstr ""
 "        plus péniblement, « abandonnez » toutes les anciennes données).\n"
 "        "
 
-#: ../roundup/admin.py:1306
+#: ../roundup/admin.py:1317
 msgid ""
 "Usage: importtables export_dir\n"
 "        This imports the database tables exported using exporttables.\n"
@@ -802,7 +802,7 @@ msgid ""
 msgstr ""
 
 #. password
-#: ../roundup/admin.py:1314
+#: ../roundup/admin.py:1325
 msgid ""
 "Usage: initialise [adminpw]\n"
 "        Initialise a new Roundup tracker.\n"
@@ -821,23 +821,23 @@ msgstr ""
 "        Exécute la fonction d'initialisation dbinit.init() du pisteur.\n"
 "        "
 
-#: ../roundup/admin.py:1328
+#: ../roundup/admin.py:1339
 msgid "Admin Password: "
 msgstr "Mot de passe administrateur : "
 
-#: ../roundup/admin.py:1329
+#: ../roundup/admin.py:1340
 msgid "       Confirm: "
 msgstr "       Confirmez : "
 
-#: ../roundup/admin.py:1333
+#: ../roundup/admin.py:1344
 msgid "Instance home does not exist"
 msgstr "Le répertoire racine de l'instance n'existe pas"
 
-#: ../roundup/admin.py:1337
+#: ../roundup/admin.py:1348
 msgid "Instance has not been installed"
 msgstr "L'instance n'a pas été installée"
 
-#: ../roundup/admin.py:1345
+#: ../roundup/admin.py:1356
 msgid ""
 "WARNING: The database is already initialised!\n"
 "If you re-initialise it, you will lose all the data!\n"
@@ -847,7 +847,7 @@ msgstr ""
 "Si vous la réinitialisez, vous perdrez toutes les données !\n"
 "Supprimez la base de données (Y/N) ? "
 
-#: ../roundup/admin.py:1365
+#: ../roundup/admin.py:1376
 #, fuzzy
 msgid ""
 "Usage: install [template [backend [key=val[,key=val]]]]\n"
@@ -902,12 +902,12 @@ msgstr ""
 "        Consultez également l'aide sur « initopts ».\n"
 "        "
 
-#: ../roundup/admin.py:1394
+#: ../roundup/admin.py:1405
 #, python-format
 msgid "Instance home parent directory \"%(parent)s\" does not exist"
 msgstr "Le répertoire parent « %(parent)s » de l'instance de base n'existe pas"
 
-#: ../roundup/admin.py:1403
+#: ../roundup/admin.py:1414
 #, python-format
 msgid ""
 "WARNING: There appears to be a tracker in \"%(tracker_home)s\"!\n"
@@ -919,22 +919,22 @@ msgstr ""
 "Si vous le réinstallez, vous perdrez toutes les données !\n"
 "Supprimer le pisteur (Y/N) ? "
 
-#: ../roundup/admin.py:1416
+#: ../roundup/admin.py:1427
 #, fuzzy
 msgid "Select template"
 msgstr "Sélection du modèle [classic] : "
 
-#: ../roundup/admin.py:1426
+#: ../roundup/admin.py:1437
 #, fuzzy
 msgid "Select backend"
 msgstr "Sélection du moteur de stockage [anydbm]: "
 
-#: ../roundup/admin.py:1437
+#: ../roundup/admin.py:1448
 #, python-format
 msgid "Error in configuration settings: \"%s\""
 msgstr "Erreur dans les paramètres de la configuration : « %s »"
 
-#: ../roundup/admin.py:1470
+#: ../roundup/admin.py:1481
 #, python-format
 msgid ""
 "\n"
@@ -947,11 +947,11 @@ msgstr ""
 " Vous devez maintenant modifier le fichier de configuration du pisteur :\n"
 "    %(config_file)s"
 
-#: ../roundup/admin.py:1480
+#: ../roundup/admin.py:1491
 msgid " ... at a minimum, you must set following options:"
 msgstr " ou au minimum, vous devez définir les options suivantes :"
 
-#: ../roundup/admin.py:1485
+#: ../roundup/admin.py:1496
 #, python-format
 msgid ""
 "\n"
@@ -983,7 +983,7 @@ msgstr ""
 " que vous avez réalisé les étapes précédentes.\n"
 "---------------------------------------------------------------------------\n"
 
-#: ../roundup/admin.py:1501
+#: ../roundup/admin.py:1512
 msgid ""
 "Usage: list classname [property]\n"
 "        List the instances of a class.\n"
@@ -1013,17 +1013,17 @@ msgstr ""
 "        propriété pour chaque instance de cette classe.\n"
 "        "
 
-#: ../roundup/admin.py:1514
+#: ../roundup/admin.py:1525
 msgid "Too many arguments supplied"
 msgstr "Trop d'arguments fournis"
 
-#: ../roundup/admin.py:1547
+#: ../roundup/admin.py:1558
 #, python-format
 msgid "%(nodeid)4s: %(value)s"
 msgstr "%(nodeid)4s : %(value)s"
 
 #. noqa: ARG002  - args unused
-#: ../roundup/admin.py:1554
+#: ../roundup/admin.py:1565
 msgid ""
 "Usage: migrate\n"
 "        Update a tracker's database to be compatible with the Roundup\n"
@@ -1046,17 +1046,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1574
+#: ../roundup/admin.py:1585
 #, python-format
 msgid "Tracker updated to schema version %s."
 msgstr ""
 
-#: ../roundup/admin.py:1578
+#: ../roundup/admin.py:1589
 #, python-format
 msgid "No migration action required. At schema version %s."
 msgstr ""
 
-#: ../roundup/admin.py:1583
+#: ../roundup/admin.py:1594
 #, fuzzy
 msgid ""
 "Usage: pack period | date\n"
@@ -1097,11 +1097,11 @@ msgstr ""
 "\n"
 "        "
 
-#: ../roundup/admin.py:1609
+#: ../roundup/admin.py:1620
 msgid "Invalid format"
 msgstr "Format non valide"
 
-#: ../roundup/admin.py:1620
+#: ../roundup/admin.py:1631
 msgid ""
 "Usage: perftest [mode] [arguments]*\n"
 "        Time operations in Roundup.\n"
@@ -1119,25 +1119,25 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1657
+#: ../roundup/admin.py:1668
 msgid "Invalid 'rounds'. Must be larger than 999."
 msgstr ""
 
-#: ../roundup/admin.py:1661
+#: ../roundup/admin.py:1672
 #, python-format
 msgid "Invalid 'rounds'. It must be an integer not: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1688
+#: ../roundup/admin.py:1699
 msgid "scheme does not support rounds."
 msgstr ""
 
-#: ../roundup/admin.py:1691
+#: ../roundup/admin.py:1702
 #, python-format
 msgid "Hash time: %(time)0.9f seconds, scheme: %(scheme)s, rounds: %(rounds)s"
 msgstr ""
 
-#: ../roundup/admin.py:1697
+#: ../roundup/admin.py:1708
 msgid ""
 "Usage: pragma setting=value | 'list'\n"
 "        Set internal admin settings to a value.\n"
@@ -1166,49 +1166,49 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1732
+#: ../roundup/admin.py:1743
 #, python-format
 msgid "Argument must be setting=value, was given: %s."
 msgstr ""
 
-#: ../roundup/admin.py:1735
+#: ../roundup/admin.py:1746
 msgid "Current settings and values (NYI - not yet implemented):"
 msgstr ""
 
-#: ../roundup/admin.py:1746
+#: ../roundup/admin.py:1757
 msgid ""
 "      Help for this pragma is missing. Please report it to the Roundup "
 "project.\n"
 msgstr ""
 
-#: ../roundup/admin.py:1752
+#: ../roundup/admin.py:1763
 #, fuzzy, python-format
 msgid "Unknown setting %s. Try \"pragma list\"."
 msgstr "Nom d'utilisateur inconnu"
 
-#: ../roundup/admin.py:1762
+#: ../roundup/admin.py:1773
 #, python-format
 msgid "Incorrect value for boolean setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1769
+#: ../roundup/admin.py:1780
 #, python-format
 msgid "Incorrect value for integer setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1776
+#: ../roundup/admin.py:1787
 #, python-format
 msgid ""
 "Incorrect value for setting %(setting)s: %(value)s. Should be no, both, or "
 "only."
 msgstr ""
 
-#: ../roundup/admin.py:1786
+#: ../roundup/admin.py:1797
 #, python-format
 msgid "Internal error: pragma can not handle values of type: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1795
+#: ../roundup/admin.py:1806
 #, fuzzy
 msgid ""
 "Usage: reindex [classname|classname:#-#|designator]*\n"
@@ -1232,17 +1232,17 @@ msgstr ""
 "        Cette opération est normalement effectuer automatiquement.\n"
 "        "
 
-#: ../roundup/admin.py:1817
+#: ../roundup/admin.py:1828
 #, python-format
 msgid "no such item \"%(designator)s\""
 msgstr "pas d'élément « %(designator)s »"
 
-#: ../roundup/admin.py:1827
+#: ../roundup/admin.py:1838
 #, fuzzy, python-format
 msgid "no such item \"%(class)s%(id)s\""
 msgstr "pas d'élément « %(designator)s »"
 
-#: ../roundup/admin.py:1839
+#: ../roundup/admin.py:1850
 #, fuzzy
 msgid ""
 "Usage: restore designator[,designator]*\n"
@@ -1262,7 +1262,7 @@ msgstr ""
 "        utilisateurs.\n"
 "        "
 
-#: ../roundup/admin.py:1870
+#: ../roundup/admin.py:1881
 #, fuzzy
 msgid ""
 "Usage: retire designator[,designator]*\n"
@@ -1284,7 +1284,7 @@ msgstr ""
 "        "
 
 #. noqa: ARG002 - args unused
-#: ../roundup/admin.py:1898
+#: ../roundup/admin.py:1909
 msgid ""
 "Usage: rollback\n"
 "        Undo all changes that are pending commit to the database.\n"
@@ -1307,7 +1307,7 @@ msgstr ""
 "        base de données.\n"
 "        "
 
-#: ../roundup/admin.py:1911
+#: ../roundup/admin.py:1922
 msgid ""
 "Usage: security [Role name]\n"
 "        Display the Permissions available to one or all Roles.\n"
@@ -1320,48 +1320,48 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1926
+#: ../roundup/admin.py:1937
 #, fuzzy, python-format
 msgid "No such Role \"%(role)s\"\n"
 msgstr "Ce rôle « %(role)s » n'existe pas"
 
-#: ../roundup/admin.py:1932
+#: ../roundup/admin.py:1943
 #, fuzzy, python-format
 msgid "New Web users get the Roles \"%(role)s\"\n"
 msgstr "Les nouveaux utilisateurs Web ont les rôles « %(role)s »"
 
-#: ../roundup/admin.py:1935
+#: ../roundup/admin.py:1946
 #, fuzzy, python-format
 msgid "New Web users get the Role \"%(role)s\"\n"
 msgstr "Les nouveaux utilisateurs Web ont le rôle « %(role)s »"
 
-#: ../roundup/admin.py:1939
+#: ../roundup/admin.py:1950
 #, fuzzy, python-format
 msgid "New Email users get the Roles \"%(role)s\"\n"
 msgstr "Les nouveaux utilisateurs Courriel ont les rôles « %(role)s »"
 
-#: ../roundup/admin.py:1941
+#: ../roundup/admin.py:1952
 #, fuzzy, python-format
 msgid "New Email users get the Role \"%(role)s\"\n"
 msgstr "Les nouveaux utilisateurs Courriel ont le rôle « %(role)s »"
 
-#: ../roundup/admin.py:1944
+#: ../roundup/admin.py:1955
 #, fuzzy, python-format
 msgid "Role \"%(name)s\":\n"
 msgstr "Rôle « %(name)s » :"
 
-#: ../roundup/admin.py:1950
+#: ../roundup/admin.py:1961
 #, fuzzy
 msgid " %(description)s (%(name)s for \"%(klass)s\""
 msgstr " %(description)s (%(name)s pour « %(klass)s » uniquement)"
 
-#: ../roundup/admin.py:1950
+#: ../roundup/admin.py:1961
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\": %(properties)s only)\n"
 msgstr ""
 " %(description)s (%(name)s pour « %(klass)s » : %(properties)s uniquement)"
 
-#: ../roundup/admin.py:1963
+#: ../roundup/admin.py:1974
 #, python-format
 msgid ""
 "\n"
@@ -1369,17 +1369,17 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/admin.py:1969
+#: ../roundup/admin.py:1980
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\" only)\n"
 msgstr " %(description)s (%(name)s pour « %(klass)s » uniquement)"
 
-#: ../roundup/admin.py:1972
+#: ../roundup/admin.py:1983
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s)\n"
 msgstr " %(description)s (%(name)s)"
 
-#: ../roundup/admin.py:1976
+#: ../roundup/admin.py:1987
 #, fuzzy
 msgid ""
 "Usage: set items property=value [property=value ...]\n"
@@ -1414,7 +1414,7 @@ msgstr ""
 "        ce lien sont indiqués comme des nombres séparés par des\n"
 "        virgules (par ex. « 1,2,3 »)."
 
-#: ../roundup/admin.py:2044
+#: ../roundup/admin.py:2055
 msgid ""
 "Usage: specification classname\n"
 "        Show the properties for a classname.\n"
@@ -1428,17 +1428,17 @@ msgstr ""
 "        Cette commande énumère les propriétés de la classe nommée.\n"
 "        "
 
-#: ../roundup/admin.py:2063
+#: ../roundup/admin.py:2074
 #, fuzzy, python-format
 msgid "%(key)s: %(value)s (key property)\n"
 msgstr "%(key)s : %(value)s (propriété clé)"
 
-#: ../roundup/admin.py:2066
+#: ../roundup/admin.py:2077
 #, fuzzy, python-format
 msgid "%(key)s: %(value)s\n"
 msgstr "%(key)s : %(value)s"
 
-#: ../roundup/admin.py:2069
+#: ../roundup/admin.py:2080
 msgid ""
 "Usage: table classname [property[,property]*]\n"
 "        List the instances of a class in tabular form.\n"
@@ -1500,17 +1500,17 @@ msgstr ""
 "        donnera une colonne « Name » large de 4 caractères.\n"
 "        "
 
-#: ../roundup/admin.py:2115
+#: ../roundup/admin.py:2126
 #, python-format
 msgid "\"%(spec)s\" not name:width"
 msgstr "« %(spec)s » ne correspond pas au format « nom:largeur »"
 
-#: ../roundup/admin.py:2137
+#: ../roundup/admin.py:2148
 #, python-format
 msgid "\"%(spec)s\" does not have an integer width: \"%(width)s\""
 msgstr ""
 
-#: ../roundup/admin.py:2173
+#: ../roundup/admin.py:2184
 msgid ""
 "Usage: templates [trace_search]\n"
 "        List templates and their installed directories.\n"
@@ -1520,7 +1520,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2201
+#: ../roundup/admin.py:2212
 #, fuzzy
 msgid ""
 "Usage: updateconfig <filename>\n"
@@ -1537,34 +1537,34 @@ msgstr ""
 
 # ../roundup/cgi/actions.py:596 :607 :778 :797
 # ../roundup/cgi/actions.py:596:607 :778:797
-#: ../roundup/admin.py:2210 ../roundup/cgi/actions.py:886
-#: ../roundup/cgi/actions.py:897 ../roundup/cgi/actions.py:1099
-#: ../roundup/cgi/actions.py:1113 ../roundup/cgi/actions.py:886:897 :1099:1113
+#: ../roundup/admin.py:2221 ../roundup/cgi/actions.py:891
+#: ../roundup/cgi/actions.py:902 ../roundup/cgi/actions.py:1104
+#: ../roundup/cgi/actions.py:1118 ../roundup/cgi/actions.py:891:902 :1104:1118
 #, python-format
 msgid "Error: %s"
 msgstr "Erreur : %s"
 
-#: ../roundup/admin.py:2242
+#: ../roundup/admin.py:2253
 #, python-format
 msgid "Unknown command \"%(command)s\" (\"help commands\" for a list)"
 msgstr "Commande inconnue « %(command)s » (« help commands » pour la liste)"
 
-#: ../roundup/admin.py:2248
+#: ../roundup/admin.py:2259
 #, python-format
 msgid "Multiple commands match \"%(command)s\": %(list)s"
 msgstr "Plusieurs commandes correspondent à « %(command)s » : %(list)s"
 
-#: ../roundup/admin.py:2263
+#: ../roundup/admin.py:2274
 msgid "Enter tracker home: "
 msgstr "Saisissez le répertoire racine du pisteur : "
 
-#: ../roundup/admin.py:2292 ../roundup/admin.py:2296
-#: ../roundup/admin.py:2292:2296
+#: ../roundup/admin.py:2303 ../roundup/admin.py:2307
+#: ../roundup/admin.py:2303:2307
 #, python-format
 msgid "Error: Couldn't open tracker: %(message)s"
 msgstr "Erreur : impossible d'ouvrir le pisteur, %(message)s"
 
-#: ../roundup/admin.py:2344
+#: ../roundup/admin.py:2355
 #, python-format
 msgid ""
 "Roundup %s ready for input.\n"
@@ -1573,58 +1573,58 @@ msgstr ""
 "Roundup %s est prêt pour la saisie.\n"
 "Saisissez « help » pour l'aide."
 
-#: ../roundup/admin.py:2377
+#: ../roundup/admin.py:2388
 msgid "Note: command history and editing not available"
 msgstr "Note : l'historique et l'édition des commandes n'est pas disponible"
 
-#: ../roundup/admin.py:2383
+#: ../roundup/admin.py:2394
 msgid "exit..."
 msgstr "sortie..."
 
-#: ../roundup/admin.py:2396
+#: ../roundup/admin.py:2407
 msgid "There are unsaved changes. Commit them (y/N)? "
 msgstr "Des changements n'ont pas été enregistrés, les valider (y/N) ?"
 
-#: ../roundup/backends/back_anydbm.py:215
-#: ../roundup/backends/rdbms_common.py:928
+#: ../roundup/backends/back_anydbm.py:213
+#: ../roundup/backends/rdbms_common.py:926
 #, python-format
 msgid "Class \"%s\" already defined."
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:280
+#: ../roundup/backends/back_anydbm.py:278
 #: ../roundup/backends/sessions_dbm.py:61
 msgid "Couldn't identify database type"
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:314
+#: ../roundup/backends/back_anydbm.py:312
 #, python-format
 msgid ""
 "Couldn't open database - the required module '%s' (as dbm.gnu) is not "
 "available"
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:318
+#: ../roundup/backends/back_anydbm.py:316
 #, python-format
 msgid "Couldn't open database - the required module '%s' is not available"
 msgstr ""
 
 #: ../roundup/backends/back_anydbm.py:873
 #: ../roundup/backends/back_anydbm.py:886
-#: ../roundup/backends/back_anydbm.py:1160
-#: ../roundup/backends/back_anydbm.py:1195
-#: ../roundup/backends/back_anydbm.py:1424
-#: ../roundup/backends/back_anydbm.py:1442
-#: ../roundup/backends/back_anydbm.py:1489
-#: ../roundup/backends/back_anydbm.py:2135
+#: ../roundup/backends/back_anydbm.py:1162
+#: ../roundup/backends/back_anydbm.py:1197
+#: ../roundup/backends/back_anydbm.py:1426
+#: ../roundup/backends/back_anydbm.py:1444
+#: ../roundup/backends/back_anydbm.py:1492
+#: ../roundup/backends/back_anydbm.py:2138
 #: ../roundup/backends/back_anydbm.py:873:886
-#: ../roundup/backends/rdbms_common.py:1720
-#: ../roundup/backends/rdbms_common.py:1967
-#: ../roundup/backends/rdbms_common.py:2206
-#: ../roundup/backends/rdbms_common.py:2226
-#: ../roundup/backends/rdbms_common.py:2279
-#: ../roundup/backends/rdbms_common.py:3254
-#: ../roundup/backends/rdbms_common.py:1720:1967 :1160:1195 :1424:1442:1489
-#: :2135 :2206:2226 :2279:3254
+#: ../roundup/backends/rdbms_common.py:1721
+#: ../roundup/backends/rdbms_common.py:1972
+#: ../roundup/backends/rdbms_common.py:2211
+#: ../roundup/backends/rdbms_common.py:2231
+#: ../roundup/backends/rdbms_common.py:2293
+#: ../roundup/backends/rdbms_common.py:3268
+#: ../roundup/backends/rdbms_common.py:1721:1972 :1162:1197 :1426:1444:1492
+#: :2138 :2211:2231 :2293:3268
 msgid "Database open read-only"
 msgstr ""
 
@@ -1650,45 +1650,52 @@ msgstr ""
 msgid "Unable to get lock after 10 retries on %s."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:632
+#: ../roundup/backends/rdbms_common.py:630
 #, python-format
 msgid "ALTER operation disallowed: %(old)r -> %(new)r."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:867
+#: ../roundup/backends/rdbms_common.py:865
 #, python-format
 msgid "CREATE operation disallowed: \"%s\"."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:884
+#: ../roundup/backends/rdbms_common.py:882
 #, python-format
 msgid "DROP operation disallowed: \"%s\"."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:1863
+#: ../roundup/backends/rdbms_common.py:1864
 msgid "create"
 msgstr "créer"
 
-#: ../roundup/backends/rdbms_common.py:2038
+#: ../roundup/backends/rdbms_common.py:2043
 msgid "unlink"
 msgstr "détacher"
 
-#: ../roundup/backends/rdbms_common.py:2042
+#: ../roundup/backends/rdbms_common.py:2047
 msgid "link"
 msgstr "attacher"
 
-#: ../roundup/backends/rdbms_common.py:2187
+#: ../roundup/backends/rdbms_common.py:2192
 msgid "set"
 msgstr "assigner"
 
-#: ../roundup/backends/rdbms_common.py:2216
+#: ../roundup/backends/rdbms_common.py:2221
 msgid "retired"
 msgstr "retiré"
 
-#: ../roundup/backends/rdbms_common.py:2246
+#: ../roundup/backends/rdbms_common.py:2251
 msgid "restored"
 msgstr "restauré"
 
+#: ../roundup/backends/rdbms_common.py:2265
+#, fuzzy, python-format
+msgid "class %(cls)s: %(value)r is not an id"
+msgstr ""
+"propriété « %(propname)s » : « %(value)s » n'est pas actuellement dans la "
+"liste"
+
 #: ../roundup/backends/sessions_redis.py:78
 #: ../roundup/backends/sessions_redis.py:97
 #: ../roundup/backends/sessions_redis.py:78:97
@@ -1774,10 +1781,10 @@ msgstr ""
 "requis)"
 
 #: ../roundup/cgi/actions.py:228 ../roundup/cgi/actions.py:266
-#: ../roundup/cgi/actions.py:493 ../roundup/cgi/actions.py:833
-#: ../roundup/cgi/actions.py:880 ../roundup/cgi/actions.py:1084
-#: ../roundup/cgi/actions.py:1246 ../roundup/cgi/actions.py:228:266:1246
-#: :493:833 :880:1084
+#: ../roundup/cgi/actions.py:493 ../roundup/cgi/actions.py:838
+#: ../roundup/cgi/actions.py:885 ../roundup/cgi/actions.py:1089
+#: ../roundup/cgi/actions.py:1251 ../roundup/cgi/actions.py:228:266:1251
+#: :493:838 :885:1089
 #, fuzzy
 msgid "Invalid request"
 msgstr "Format non valide"
@@ -1834,8 +1841,8 @@ msgstr "Format non valide"
 msgid "Invalid integer: "
 msgstr "Tentative de connexion non valide"
 
-#: ../roundup/cgi/actions.py:531 ../roundup/cgi/actions.py:735
-#: ../roundup/cgi/actions.py:531:735
+#: ../roundup/cgi/actions.py:531 ../roundup/cgi/actions.py:740
+#: ../roundup/cgi/actions.py:531:740
 #, python-format
 msgid "You do not have permission to create %(class)s"
 msgstr "Vous n'avez pas la permission de créer de %(class)s"
@@ -1845,8 +1852,8 @@ msgstr "Vous n'avez pas la permission de cr
 msgid "Not enough values on line %(line)s"
 msgstr "Pas suffisament de valeurs sur la ligne %(line)s"
 
-#: ../roundup/cgi/actions.py:556 ../roundup/cgi/actions.py:723
-#: ../roundup/cgi/actions.py:556:723
+#: ../roundup/cgi/actions.py:556 ../roundup/cgi/actions.py:728
+#: ../roundup/cgi/actions.py:556:728
 #, python-format
 msgid "You do not have permission to edit %(class)s"
 msgstr "Vous n'avez pas la permission de modifier %(class)s"
@@ -1855,17 +1862,17 @@ msgstr "Vous n'avez pas la permission de modifier %(class)s"
 msgid "Items edited OK"
 msgstr "Les éléments ont été modifiés avec succès"
 
-#: ../roundup/cgi/actions.py:671
+#: ../roundup/cgi/actions.py:676
 #, python-format
 msgid "%(class)s %(id)s %(properties)s edited ok"
 msgstr "%(class)s %(id)s %(properties)s modifié(s) avec succès"
 
-#: ../roundup/cgi/actions.py:689
+#: ../roundup/cgi/actions.py:694
 #, python-format
 msgid "%(class)s %(id)s created"
 msgstr "%(class)s %(id)s créé"
 
-#: ../roundup/cgi/actions.py:817
+#: ../roundup/cgi/actions.py:822
 #, fuzzy, python-format
 msgid ""
 "Edit Error: someone else has edited this %(klass)s (%(props)s). View <a "
@@ -1875,12 +1882,12 @@ msgstr ""
 "(%(props)s). Consultez <a target=\"new\" href=\"%(klass)s%(id)s\">ses "
 "modifications</a> dans une nouvelle fenêtre."
 
-#: ../roundup/cgi/actions.py:850
+#: ../roundup/cgi/actions.py:855
 #, python-format
 msgid "Edit Error: %s"
 msgstr "Erreur de modification : %s"
 
-#: ../roundup/cgi/actions.py:931
+#: ../roundup/cgi/actions.py:936
 msgid ""
 "Invalid One Time Key!\n"
 "(a Mozilla bug may cause this message to show up erroneously, please check "
@@ -1890,12 +1897,12 @@ msgstr ""
 "Un bug dans Mozilla peut provoquer une apparition erronée de ce message, "
 "vérifiez votre courriel."
 
-#: ../roundup/cgi/actions.py:972
+#: ../roundup/cgi/actions.py:977
 #, fuzzy, python-format
 msgid "Password reset for %s"
 msgstr "Demande de r&eacute;initialisation de mot de passe"
 
-#: ../roundup/cgi/actions.py:973
+#: ../roundup/cgi/actions.py:978
 #, python-format
 msgid ""
 "\n"
@@ -1904,29 +1911,29 @@ msgid ""
 "Your password is now: %(password)s\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:982
+#: ../roundup/cgi/actions.py:987
 #, python-format
 msgid "Password reset and email sent to %s"
 msgstr "Mot de passe réinitialisé et courriel envoyé à %s"
 
-#: ../roundup/cgi/actions.py:991
+#: ../roundup/cgi/actions.py:996
 msgid "Unknown username"
 msgstr "Nom d'utilisateur inconnu"
 
-#: ../roundup/cgi/actions.py:999
+#: ../roundup/cgi/actions.py:1004
 msgid "Unknown email address"
 msgstr "Adresse électronique inconnue"
 
-#: ../roundup/cgi/actions.py:1004
+#: ../roundup/cgi/actions.py:1009
 msgid "You need to specify a username or address"
 msgstr "Vous devez indiquer un nom d'utilisateur ou une adresse électronique"
 
-#: ../roundup/cgi/actions.py:1015
+#: ../roundup/cgi/actions.py:1020
 #, fuzzy, python-format
 msgid "Confirm reset of password for %s"
 msgstr "Confirmation du mot de passe"
 
-#: ../roundup/cgi/actions.py:1016
+#: ../roundup/cgi/actions.py:1021
 #, python-format
 msgid ""
 "\n"
@@ -1940,31 +1947,31 @@ msgid ""
 "You should then receive another email with the new password.\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1029
+#: ../roundup/cgi/actions.py:1034
 #, python-format
 msgid "Email sent to primary notification address for %s."
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1031
+#: ../roundup/cgi/actions.py:1036
 #, fuzzy, python-format
 msgid "Email sent to %s."
 msgstr "Courriel envoyé à %s"
 
-#: ../roundup/cgi/actions.py:1046
+#: ../roundup/cgi/actions.py:1051
 msgid "You are now registered, welcome!"
 msgstr "Vous êtes désormais inscrit, bienvenue !"
 
-#: ../roundup/cgi/actions.py:1139
+#: ../roundup/cgi/actions.py:1144
 #, python-format
 msgid "Username '%s' is already used."
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1163
+#: ../roundup/cgi/actions.py:1168
 #, python-format
 msgid "Complete your registration to %(tracker_name)s -- key %(key)s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1167
+#: ../roundup/cgi/actions.py:1172
 #, python-format
 msgid ""
 "To complete your registration of the user \"%(name)s\" with\n"
@@ -1980,12 +1987,12 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1181
+#: ../roundup/cgi/actions.py:1186
 #, python-format
 msgid "Complete your registration to %s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1182
+#: ../roundup/cgi/actions.py:1187
 #, python-format
 msgid ""
 "To complete your registration of the user \"%(name)s\" with\n"
@@ -1995,46 +2002,46 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1206
+#: ../roundup/cgi/actions.py:1211
 msgid "It is not permitted to supply roles at registration."
 msgstr "Impossible de renseigner les rôles à l'inscription."
 
-#: ../roundup/cgi/actions.py:1220
+#: ../roundup/cgi/actions.py:1225
 msgid "You are logged out"
 msgstr "Vous êtes déconnecté"
 
-#: ../roundup/cgi/actions.py:1250
+#: ../roundup/cgi/actions.py:1255
 msgid "Username required"
 msgstr "Nom d'utilisateur requis"
 
-#: ../roundup/cgi/actions.py:1354
+#: ../roundup/cgi/actions.py:1359
 #, python-format
 msgid "Welcome %(username)s!"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1477
+#: ../roundup/cgi/actions.py:1482
 #, python-format
 msgid "Logins occurring too fast. Please wait: %s seconds."
 msgstr ""
 
 # ../roundup/cgi/actions.py:930 :934
 # ../roundup/cgi/actions.py:930:934
-#: ../roundup/cgi/actions.py:1515 ../roundup/cgi/actions.py:1526
-#: ../roundup/cgi/actions.py:1515:1526
+#: ../roundup/cgi/actions.py:1520 ../roundup/cgi/actions.py:1531
+#: ../roundup/cgi/actions.py:1520:1531
 msgid "Invalid login"
 msgstr "Tentative de connexion non valide"
 
-#: ../roundup/cgi/actions.py:1532
+#: ../roundup/cgi/actions.py:1537
 msgid "You do not have permission to login"
 msgstr "Vous n'avez la permission de vous connecter"
 
-#: ../roundup/cgi/actions.py:1577 ../roundup/cgi/actions.py:1757
-#: ../roundup/cgi/actions.py:1577:1757
+#: ../roundup/cgi/actions.py:1582 ../roundup/cgi/actions.py:1762
+#: ../roundup/cgi/actions.py:1582:1762
 #, python-format
 msgid "Column \"%(column)s\" not found in %(class)s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1822
+#: ../roundup/cgi/actions.py:1827
 #, fuzzy, python-format
 msgid "You do not have permission to view %(class)s"
 msgstr "Vous n'avez pas la permission de modifier %(class)s"
@@ -2168,8 +2175,8 @@ msgstr "Erreur de formulaire
 msgid "Unrecognized charset: %r"
 msgstr "Jeu de caractères non reconnu : %r"
 
-#: ../roundup/cgi/client.py:1381 ../roundup/cgi/client.py:2394
-#: ../roundup/cgi/client.py:1381:2394
+#: ../roundup/cgi/client.py:1381 ../roundup/cgi/client.py:2396
+#: ../roundup/cgi/client.py:1381:2396
 msgid "broken form: multiple @action values submitted"
 msgstr ""
 
@@ -2252,50 +2259,51 @@ msgstr ""
 
 #: ../roundup/cgi/client.py:1679
 #, python-format
-msgid "csrf X-REQUESTED-WITH xmlrpc required header check failed for user%s."
+msgid ""
+"csrf X-REQUESTED-WITH xmlrpc required header check failed for user%(userid)s."
 msgstr ""
 
 #: ../roundup/cgi/client.py:1720
 #, python-format
-msgid "Required csrf field missing for user%s"
+msgid "Required csrf field missing for user%(userid)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1722 ../roundup/cgi/client.py:1749
-#: ../roundup/cgi/client.py:1766 ../roundup/cgi/client.py:1722:1749:1766
+#: ../roundup/cgi/client.py:1723 ../roundup/cgi/client.py:1751
+#: ../roundup/cgi/client.py:1768 ../roundup/cgi/client.py:1723:1751:1768
 msgid ""
 "We can't validate your session (csrf failure). Re-enter any unsaved data and "
 "try again."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1726
+#: ../roundup/cgi/client.py:1728
 #, python-format
-msgid "csrf field not supplied by user%s"
+msgid "csrf field not supplied by user%(userid)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1738
+#: ../roundup/cgi/client.py:1740
 #, python-format
 msgid ""
 "Csrf mismatch user: current user %(user)s != stored user %(stored)s, current "
 "session, stored session: %(cur_sess)s,%(stor_sess)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1756
+#: ../roundup/cgi/client.py:1758
 #, python-format
 msgid ""
 "Csrf mismatch user: current session %(curr_sess)s != stored session "
 "%(stor_sess)s, current user/stored user is: %(user)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1948
+#: ../roundup/cgi/client.py:1950
 msgid "You are not allowed to view this file."
 msgstr "Vous n'êtes pas autorisé à voir ce fichier"
 
-#: ../roundup/cgi/client.py:2272
+#: ../roundup/cgi/client.py:2274
 #, python-format
 msgid "%(starttag)sTime elapsed: %(seconds)fs%(endtag)s\n"
 msgstr "%(starttag)sTemps écoulé: %(seconds)fs%(endtag)s\n"
 
-#: ../roundup/cgi/client.py:2276
+#: ../roundup/cgi/client.py:2278
 #, python-format
 msgid ""
 "%(starttag)sCache hits: %(cache_hits)d, misses %(cache_misses)d. Loading "
@@ -2305,7 +2313,7 @@ msgstr ""
 "Chargement d'éléments : %(get_items)f secondes. Filtrage : %(filtering)f "
 "secondes.%(endtag)s\n"
 
-#: ../roundup/cgi/client.py:2815
+#: ../roundup/cgi/client.py:2817
 #, python-format
 msgid ""
 "Cache failure: compressed file %(compressed)s is older than its source file "
@@ -2379,11 +2387,11 @@ msgstr[1] ""
 msgid "You are not allowed to %(action)s items of class %(class)s"
 msgstr "Vous ne pouvez pas %(action)s des éléments de classe %(class)s"
 
-#: ../roundup/cgi/templating.py:916
+#: ../roundup/cgi/templating.py:892
 msgid "(list)"
 msgstr "(liste)"
 
-#: ../roundup/cgi/templating.py:991
+#: ../roundup/cgi/templating.py:975
 msgid "Submit New Entry"
 msgstr "Soumettre un nouvelle entrée"
 
@@ -2392,58 +2400,58 @@ msgstr "Soumettre un nouvelle entr
 # ../roundup/cgi/templating.py:1875 ../roundup/cgi/templating.py:710:829
 # :1236:1257 :1304:1327 :1361:1400 :1453:1470 :1549:1569 :1587:1619
 # :1629:1683 :1875
-#: ../roundup/cgi/templating.py:1013 ../roundup/cgi/templating.py:1189
-#: ../roundup/cgi/templating.py:1824 ../roundup/cgi/templating.py:1855
-#: ../roundup/cgi/templating.py:1876 ../roundup/cgi/templating.py:1914
-#: ../roundup/cgi/templating.py:1967 ../roundup/cgi/templating.py:1991
-#: ../roundup/cgi/templating.py:1998 ../roundup/cgi/templating.py:2035
-#: ../roundup/cgi/templating.py:2088 ../roundup/cgi/templating.py:2121
-#: ../roundup/cgi/templating.py:2216 ../roundup/cgi/templating.py:2237
-#: ../roundup/cgi/templating.py:2328 ../roundup/cgi/templating.py:2348
-#: ../roundup/cgi/templating.py:2370 ../roundup/cgi/templating.py:2413
-#: ../roundup/cgi/templating.py:2423 ../roundup/cgi/templating.py:2488
-#: ../roundup/cgi/templating.py:2791 ../roundup/cgi/templating.py:1013:1189
-#: :1824:1855 :1876:1914 :1967:1991 :1998:2035 :2088:2121 :2216:2237 :2328:2348
-#: :2370:2413 :2423:2488:2791
+#: ../roundup/cgi/templating.py:997 ../roundup/cgi/templating.py:1174
+#: ../roundup/cgi/templating.py:1809 ../roundup/cgi/templating.py:1840
+#: ../roundup/cgi/templating.py:1861 ../roundup/cgi/templating.py:1899
+#: ../roundup/cgi/templating.py:1952 ../roundup/cgi/templating.py:1976
+#: ../roundup/cgi/templating.py:1983 ../roundup/cgi/templating.py:2020
+#: ../roundup/cgi/templating.py:2077 ../roundup/cgi/templating.py:2115
+#: ../roundup/cgi/templating.py:2215 ../roundup/cgi/templating.py:2236
+#: ../roundup/cgi/templating.py:2357 ../roundup/cgi/templating.py:2377
+#: ../roundup/cgi/templating.py:2399 ../roundup/cgi/templating.py:2442
+#: ../roundup/cgi/templating.py:2452 ../roundup/cgi/templating.py:2517
+#: ../roundup/cgi/templating.py:2820 ../roundup/cgi/templating.py:997:1174
+#: :1809:1840 :1861:1899 :1952:1976 :1983:2020 :2077:2115 :2215:2236 :2357:2377
+#: :2399:2442 :2452:2517:2820
 msgid "[hidden]"
 msgstr "[masqué]"
 
-#: ../roundup/cgi/templating.py:1014
+#: ../roundup/cgi/templating.py:998
 msgid "New node - no history"
 msgstr "Nouveau n~ud - pas d'historique"
 
-#: ../roundup/cgi/templating.py:1154
+#: ../roundup/cgi/templating.py:1139
 msgid "Submit Changes"
 msgstr "Soumettre les changements"
 
-#: ../roundup/cgi/templating.py:1232
+#: ../roundup/cgi/templating.py:1217
 msgid "<em>The indicated property no longer exists</em>"
 msgstr "<em>La propriété indiquée n'existe plus</em>"
 
-#: ../roundup/cgi/templating.py:1268
+#: ../roundup/cgi/templating.py:1253
 #, python-format
 msgid "The linked class %(classname)s no longer exists"
 msgstr "La classe liée %(classname)s n'existe plus"
 
-#: ../roundup/cgi/templating.py:1305 ../roundup/cgi/templating.py:1335
-#: ../roundup/cgi/templating.py:2497 ../roundup/cgi/templating.py:2800
-#: ../roundup/cgi/templating.py:1305:1335 :2497:2800
+#: ../roundup/cgi/templating.py:1290 ../roundup/cgi/templating.py:1320
+#: ../roundup/cgi/templating.py:2526 ../roundup/cgi/templating.py:2829
+#: ../roundup/cgi/templating.py:1290:1320 :2526:2829
 msgid "[label is missing]"
 msgstr ""
 
 # ../roundup/cgi/templating.py:940 :964
 # ../roundup/cgi/templating.py:940:964
-#: ../roundup/cgi/templating.py:1309 ../roundup/cgi/templating.py:1338
-#: ../roundup/cgi/templating.py:1309:1338
+#: ../roundup/cgi/templating.py:1294 ../roundup/cgi/templating.py:1323
+#: ../roundup/cgi/templating.py:1294:1323
 msgid "<strike>The linked node no longer exists</strike>"
 msgstr "<strike>Le noeud lié n'existe plus</strike>"
 
-#: ../roundup/cgi/templating.py:1400
+#: ../roundup/cgi/templating.py:1385
 #, python-format
 msgid "%s: (no value)"
 msgstr "%s : (pas de valeur)"
 
-#: ../roundup/cgi/templating.py:1416
+#: ../roundup/cgi/templating.py:1401
 #, fuzzy, python-format
 msgid ""
 "<strong><em>This event %s is not handled by the history display!</em></"
@@ -2452,31 +2460,31 @@ msgstr ""
 "<strong><em>Cet évènement n'est pas géré par l'affichage de l'historique.</"
 "em></strong>"
 
-#: ../roundup/cgi/templating.py:1429
+#: ../roundup/cgi/templating.py:1414
 msgid "<tr><td colspan=4><strong>Note:</strong></td></tr>"
 msgstr "<tr><td colspan=4><strong>Note :</strong></td></tr>"
 
-#: ../roundup/cgi/templating.py:1438
+#: ../roundup/cgi/templating.py:1423
 msgid "History"
 msgstr "Historique"
 
-#: ../roundup/cgi/templating.py:1440
+#: ../roundup/cgi/templating.py:1425
 msgid "<th>Date</th>"
 msgstr "<th>Date</th>"
 
-#: ../roundup/cgi/templating.py:1441
+#: ../roundup/cgi/templating.py:1426
 msgid "<th>User</th>"
 msgstr "<th>Utilisateur</th>"
 
-#: ../roundup/cgi/templating.py:1442
+#: ../roundup/cgi/templating.py:1427
 msgid "<th>Action</th>"
 msgstr "<th>Action</th>"
 
-#: ../roundup/cgi/templating.py:1443
+#: ../roundup/cgi/templating.py:1428
 msgid "<th>Args</th>"
 msgstr "<th>Arguments</th>"
 
-#: ../roundup/cgi/templating.py:1494
+#: ../roundup/cgi/templating.py:1479
 #, python-format
 msgid "Copy of %(class)s %(id)s"
 msgstr "Copie de %(class)s %(id)s"
@@ -2484,20 +2492,20 @@ msgstr "Copie de %(class)s %(id)s"
 # ../roundup/cgi/templating.py:1006 :1404 :1425 :1431
 # ../roundup/cgi/templating.py:1431 ../roundup/cgi/templating.py:1006:1404
 # :1425:1431
-#: ../roundup/cgi/templating.py:2125 ../roundup/cgi/templating.py:2160
-#: ../roundup/cgi/templating.py:1382:2125:2160
+#: ../roundup/cgi/templating.py:2119 ../roundup/cgi/templating.py:2154
+#: ../roundup/cgi/templating.py:1367:2119:2154
 msgid "No"
 msgstr "Non"
 
 # ../roundup/cgi/templating.py:1006 :1404 :1423 :1428
 # ../roundup/cgi/templating.py:1428 ../roundup/cgi/templating.py:1006:1404
 # :1423:1428
-#: ../roundup/cgi/templating.py:2125 ../roundup/cgi/templating.py:2154
-#: ../roundup/cgi/templating.py:1382:2125:2154
+#: ../roundup/cgi/templating.py:2119 ../roundup/cgi/templating.py:2148
+#: ../roundup/cgi/templating.py:1367:2119:2148
 msgid "Yes"
 msgstr "Oui"
 
-#: ../roundup/cgi/templating.py:2286
+#: ../roundup/cgi/templating.py:2315
 msgid ""
 "default value for DateHTMLProperty must be either DateHTMLProperty or string "
 "date representation."
@@ -2505,27 +2513,27 @@ msgstr ""
 "la valeur par défaut pour DateHTMLProperty doit être soit DateHTMLProperty "
 "soit une représentation textuelle de la date."
 
-#: ../roundup/cgi/templating.py:2468
+#: ../roundup/cgi/templating.py:2497
 #, python-format
 msgid "Attempt to look up %(attr)s on a missing value"
 msgstr "Tentative de recherche de %(attr)s sur une valeur manquante"
 
-#: ../roundup/cgi/templating.py:2479
+#: ../roundup/cgi/templating.py:2508
 #, fuzzy, python-format
 msgid "Attempt to look up %(item)s on a missing value"
 msgstr "Tentative de recherche de %(attr)s sur une valeur manquante"
 
-#: ../roundup/cgi/templating.py:2584
+#: ../roundup/cgi/templating.py:2613
 #, python-format
 msgid "<option %svalue=\"-1\">- no selection -</option>"
 msgstr "<option %svalue=\"-1\">- pas de sélection -</option>"
 
-#: ../roundup/cgi/templating.py:3745
+#: ../roundup/cgi/templating.py:3777
 #, python-format
 msgid "Unable to read or expand file '%(name)s' in template '%(template)s'."
 msgstr ""
 
-#: ../roundup/cgi/templating.py:3795
+#: ../roundup/cgi/templating.py:3827
 #, python-format
 msgid ""
 "Found an incorrect token when expandfile applied string subsitution on "
@@ -2699,60 +2707,60 @@ msgstr "Il y a %s"
 msgid "in %s"
 msgstr "dans %s"
 
-#: ../roundup/hyperdb.py:120
+#: ../roundup/hyperdb.py:126
 #, fuzzy, python-format
 msgid "property %(property)s: %(errormsg)s"
 msgstr "Erreur : %s: %s"
 
-#: ../roundup/hyperdb.py:149
+#: ../roundup/hyperdb.py:161
 #, python-format
 msgid "property %(property)s: %(value)r is an invalid date (%(errormsg)s)"
 msgstr ""
 
-#: ../roundup/hyperdb.py:172
+#: ../roundup/hyperdb.py:184
 #, python-format
 msgid ""
 "property %(property)s: %(value)r is an invalid date interval (%(errormsg)s)"
 msgstr ""
 
-#: ../roundup/hyperdb.py:434
+#: ../roundup/hyperdb.py:446
 #, fuzzy, python-format
 msgid "property %(property)s: %(value)r is not a number"
 msgstr ""
 "propriété « %(propname)s » : « %(value)s » n'est pas actuellement dans la "
 "liste"
 
-#: ../roundup/hyperdb.py:448
+#: ../roundup/hyperdb.py:460
 #, fuzzy, python-format
 msgid "property %(property)s: %(value)r is not an integer"
 msgstr ""
 "propriété « %(propname)s » : « %(value)s » n'est pas actuellement dans la "
 "liste"
 
-#: ../roundup/hyperdb.py:470
+#: ../roundup/hyperdb.py:482
 #, python-format
 msgid "\"%s\" not a node designator"
 msgstr ""
 
-#: ../roundup/hyperdb.py:1499 ../roundup/hyperdb.py:1507
-#: ../roundup/hyperdb.py:1499:1507
+#: ../roundup/hyperdb.py:1515 ../roundup/hyperdb.py:1523
+#: ../roundup/hyperdb.py:1515:1523
 #, python-format
 msgid "Not a property name: %s"
 msgstr ""
 
-#: ../roundup/hyperdb.py:2038
+#: ../roundup/hyperdb.py:2054
 #, fuzzy, python-format
 msgid "property %(property)s: %(value)r is not a %(classname)s."
 msgstr ""
 "propriété « %(propname)s » : « %(value)s » n'est pas actuellement dans la "
 "liste"
 
-#: ../roundup/hyperdb.py:2044
+#: ../roundup/hyperdb.py:2060
 #, python-format
 msgid "you may only enter ID values for property %s"
 msgstr ""
 
-#: ../roundup/hyperdb.py:2079
+#: ../roundup/hyperdb.py:2095
 #, python-format
 msgid "%(property)r is not a property of %(classname)s"
 msgstr ""
@@ -3091,62 +3099,62 @@ msgid ""
 "are: %(stack)s"
 msgstr ""
 
-#: ../roundup/pygettext.py:401
+#: ../roundup/pygettext.py:400
 #, python-format
 msgid "*** %(file)s:%(lineno)s: Seen unexpected token \"%(token)s\""
 msgstr ""
 
-#: ../roundup/pygettext.py:457
+#: ../roundup/pygettext.py:456
 #, python-format
 msgid "# File: %(filename)s, line: %(lineno)d"
 msgstr ""
 
-#: ../roundup/pygettext.py:464
+#: ../roundup/pygettext.py:463
 #, python-format
 msgid " %(filename)s:%(lineno)d"
 msgstr ""
 
 # ../roundup/cgi/actions.py:930 :934
 # ../roundup/cgi/actions.py:930:934
-#: ../roundup/pygettext.py:540
+#: ../roundup/pygettext.py:539
 #, fuzzy, python-format
 msgid "Invalid value for --style: %s"
 msgstr "Tentative de connexion non valide"
 
-#: ../roundup/pygettext.py:548
+#: ../roundup/pygettext.py:547
 #, python-format
 msgid "pygettext.py (xgettext for Python) %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:554
+#: ../roundup/pygettext.py:553
 #, python-format
 msgid "--width argument must be an integer: %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:582
+#: ../roundup/pygettext.py:581
 #, python-format
 msgid "Can't read --exclude-file: %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:601
+#: ../roundup/pygettext.py:600
 msgid "Reading standard input"
 msgstr ""
 
-#: ../roundup/pygettext.py:606
+#: ../roundup/pygettext.py:605
 #, python-format
 msgid "Working on %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:640
+#: ../roundup/pygettext.py:639
 msgid "a unicode string"
 msgstr ""
 
-#: ../roundup/pygettext.py:642
+#: ../roundup/pygettext.py:641
 #, python-format
 msgid "*** Seen unexpected token \"%(token)s\""
 msgstr ""
 
-#: ../roundup/pygettext.py:643
+#: ../roundup/pygettext.py:642
 msgid "morethanonestring"
 msgstr ""
 
@@ -3269,32 +3277,32 @@ msgstr "cr
 msgid "creator"
 msgstr "créateur"
 
-#: ../roundup/roundupdb.py:426
+#: ../roundup/roundupdb.py:447
 #, python-format
 msgid "No key for \"%(adr)s\" in keyring"
 msgstr ""
 
-#: ../roundup/roundupdb.py:504
+#: ../roundup/roundupdb.py:525
 #, python-format
 msgid "New submission from %(authname)s%(authaddr)s:"
 msgstr "Nouvel envoi de %(authname)s%(authaddr)s :"
 
-#: ../roundup/roundupdb.py:507
+#: ../roundup/roundupdb.py:528
 #, python-format
 msgid "%(authname)s%(authaddr)s added the comment:"
 msgstr "%(authname)s%(authaddr)s a ajouté le commentaire :"
 
-#: ../roundup/roundupdb.py:510
+#: ../roundup/roundupdb.py:531
 #, fuzzy, python-format
 msgid "Change by %(authname)s%(authaddr)s:"
 msgstr "Nouvel envoi de %(authname)s%(authaddr)s :"
 
-#: ../roundup/roundupdb.py:529
+#: ../roundup/roundupdb.py:550
 #, python-format
 msgid "File '%(filename)s' not attached - you can download it from %(link)s."
 msgstr ""
 
-#: ../roundup/roundupdb.py:904
+#: ../roundup/roundupdb.py:925
 #, python-format
 msgid ""
 "\n"
@@ -3402,64 +3410,64 @@ msgstr ""
 "<html><head><title>Index des pisteurs Roundup</title></head>\n"
 "<body><h1>Index des pisteurs Roundup</h1><ol>\n"
 
-#: ../roundup/scripts/roundup_server.py:598
+#: ../roundup/scripts/roundup_server.py:602
 #, fuzzy, python-format
 msgid "Error: %(type)s: %(value)s"
 msgstr "%(key)s : %(value)s"
 
-#: ../roundup/scripts/roundup_server.py:610
+#: ../roundup/scripts/roundup_server.py:614
 msgid "WARNING: ignoring \"-g\" argument, not root"
 msgstr ""
 "ATTENTION : le paramètre « -g » est ignoré, vous n'êtes pas superutilisateur "
 "(« root »)"
 
-#: ../roundup/scripts/roundup_server.py:616
+#: ../roundup/scripts/roundup_server.py:620
 msgid "Can't change groups - no grp module"
 msgstr "Impossible de changer les groupes - le module grp n'est pas présent"
 
-#: ../roundup/scripts/roundup_server.py:625
+#: ../roundup/scripts/roundup_server.py:629
 #, python-format
 msgid "Group %(group)s doesn't exist"
 msgstr "Le groupe %(group)s n'existe pas"
 
-#: ../roundup/scripts/roundup_server.py:637
+#: ../roundup/scripts/roundup_server.py:641
 msgid "Can't run as root!"
 msgstr "Impossible d'exécuter en tant que superutilisateur (\"root\")"
 
-#: ../roundup/scripts/roundup_server.py:640
+#: ../roundup/scripts/roundup_server.py:644
 msgid "WARNING: ignoring \"-u\" argument, not root"
 msgstr ""
 "ATTENTION: le paramètre \"-u\" est ignoré, vous n'êtes pas superutilisateur "
 "(\"root\")"
 
-#: ../roundup/scripts/roundup_server.py:646
+#: ../roundup/scripts/roundup_server.py:650
 msgid "Can't change users - no pwd module"
 msgstr ""
 "Impossible de changer les utilisateurs - le module pwd n'est pas présent"
 
-#: ../roundup/scripts/roundup_server.py:655
+#: ../roundup/scripts/roundup_server.py:659
 #, python-format
 msgid "User %(user)s doesn't exist"
 msgstr "L'utilisateur %(user)s n'existe pas"
 
-#: ../roundup/scripts/roundup_server.py:867
+#: ../roundup/scripts/roundup_server.py:871
 #, python-format
 msgid "Multiprocess mode \"%s\" is not available, switching to single-process"
 msgstr ""
 "Le mode multiprocessus \"%s\" n'existe pas, passage en mode processus unique"
 
-#: ../roundup/scripts/roundup_server.py:895
+#: ../roundup/scripts/roundup_server.py:899
 #, python-format
 msgid "Unable to bind to port %s, port already in use."
 msgstr "Impossible de s'attacher au port %s, le port est déjà utilisé"
 
-#: ../roundup/scripts/roundup_server.py:899
+#: ../roundup/scripts/roundup_server.py:903
 #, fuzzy, python-format
 msgid ""
 "Unable to bind to port %(port)s, access not allowed, errno: %(errno)s %(msg)s"
 msgstr "Impossible de s'attacher au port %s, le port est déjà utilisé"
 
-#: ../roundup/scripts/roundup_server.py:978
+#: ../roundup/scripts/roundup_server.py:982
 msgid ""
 " -c <Command>  Windows Service options.\n"
 "               If you want to run the server as a Windows Service, you\n"
@@ -3478,7 +3486,7 @@ msgstr ""
 "               La commande « roundup-server -c help » donne les\n"
 "               spécificités du service Windows."
 
-#: ../roundup/scripts/roundup_server.py:985
+#: ../roundup/scripts/roundup_server.py:989
 #, fuzzy
 msgid ""
 " -u <UID>      runs the Roundup web server as this UID\n"
@@ -3499,7 +3507,7 @@ msgstr ""
 "PID\n"
 "               L'option -l option *doit* être spécifiée si -d est utilisé."
 
-#: ../roundup/scripts/roundup_server.py:993
+#: ../roundup/scripts/roundup_server.py:997
 #, fuzzy, python-format
 msgid ""
 "\n"
@@ -3626,22 +3634,26 @@ msgstr ""
 "    souhaité. Assurez-vous que « name » ne contienne pas de caractères\n"
 "    inappropriés pour une URL, comme les espaces qui perturbe IE.\n"
 
-#: ../roundup/scripts/roundup_server.py:1173
+#: ../roundup/scripts/roundup_server.py:1177
 msgid "Instances must be name=home"
 msgstr "Les instances doivent être nom=base-du-pisteur"
 
-#: ../roundup/scripts/roundup_server.py:1187
+#: ../roundup/scripts/roundup_server.py:1191
 #, python-format
 msgid "Configuration saved to %s"
 msgstr "Configuration sauvegardée dans %s"
 
-#: ../roundup/scripts/roundup_server.py:1205
+#: ../roundup/scripts/roundup_server.py:1206
+msgid "If you specify a PID file you must use -l or -L."
+msgstr ""
+
+#: ../roundup/scripts/roundup_server.py:1212
 msgid "Sorry, you can't run the server as a daemon on this Operating System"
 msgstr ""
 "Désolé, vous ne pouvez pas démarrer le serveur en tâche de fond avec ce "
 "système d'exploitation"
 
-#: ../roundup/scripts/roundup_server.py:1225
+#: ../roundup/scripts/roundup_server.py:1232
 #, python-format
 msgid "Roundup server started on %(HOST)s:%(PORT)s"
 msgstr "Le serveur Roundup est démarré sur %(HOST)s:%(PORT)s"
@@ -4929,46 +4941,46 @@ msgstr "Documentation de Roundup"
 msgid "clear this message"
 msgstr "Supprimer ce message"
 
-#: ../share/roundup/templates/classic/html/page.html:257
-#: ../share/roundup/templates/classic/html/page.html:270
-#: ../share/roundup/templates/classic/html/page.html:288
-#: ../share/roundup/templates/classic/html/page.html:302
-#: ../share/roundup/templates/devel/html/page.html:316
-#: ../share/roundup/templates/devel/html/page.html:329
-#: ../share/roundup/templates/devel/html/page.html:347
-#: ../share/roundup/templates/devel/html/page.html:361
-#: ../share/roundup/templates/minimal/html/page.html:239
-#: ../share/roundup/templates/minimal/html/page.html:254
-#: ../share/roundup/templates/minimal/html/page.html:268
-#: ../share/roundup/templates/responsive/html/page.html:331
-#: ../share/roundup/templates/responsive/html/page.html:344
-#: ../share/roundup/templates/responsive/html/page.html:362
-#: ../share/roundup/templates/responsive/html/page.html:376
-msgid "don't care"
-msgstr "aucune importance"
-
-#: ../share/roundup/templates/classic/html/page.html:259
-#: ../share/roundup/templates/classic/html/page.html:272
-#: ../share/roundup/templates/classic/html/page.html:290
+#: ../share/roundup/templates/classic/html/page.html:258
+#: ../share/roundup/templates/classic/html/page.html:271
+#: ../share/roundup/templates/classic/html/page.html:289
 #: ../share/roundup/templates/classic/html/page.html:303
-#: ../share/roundup/templates/devel/html/page.html:318
-#: ../share/roundup/templates/devel/html/page.html:331
-#: ../share/roundup/templates/devel/html/page.html:349
+#: ../share/roundup/templates/devel/html/page.html:317
+#: ../share/roundup/templates/devel/html/page.html:330
+#: ../share/roundup/templates/devel/html/page.html:348
 #: ../share/roundup/templates/devel/html/page.html:362
-#: ../share/roundup/templates/minimal/html/page.html:241
-#: ../share/roundup/templates/minimal/html/page.html:256
+#: ../share/roundup/templates/minimal/html/page.html:240
+#: ../share/roundup/templates/minimal/html/page.html:255
 #: ../share/roundup/templates/minimal/html/page.html:269
-#: ../share/roundup/templates/responsive/html/page.html:333
-#: ../share/roundup/templates/responsive/html/page.html:346
-#: ../share/roundup/templates/responsive/html/page.html:364
+#: ../share/roundup/templates/responsive/html/page.html:332
+#: ../share/roundup/templates/responsive/html/page.html:345
+#: ../share/roundup/templates/responsive/html/page.html:363
 #: ../share/roundup/templates/responsive/html/page.html:377
+msgid "don't care"
+msgstr "aucune importance"
+
+#: ../share/roundup/templates/classic/html/page.html:260
+#: ../share/roundup/templates/classic/html/page.html:273
+#: ../share/roundup/templates/classic/html/page.html:291
+#: ../share/roundup/templates/classic/html/page.html:304
+#: ../share/roundup/templates/devel/html/page.html:319
+#: ../share/roundup/templates/devel/html/page.html:332
+#: ../share/roundup/templates/devel/html/page.html:350
+#: ../share/roundup/templates/devel/html/page.html:363
+#: ../share/roundup/templates/minimal/html/page.html:242
+#: ../share/roundup/templates/minimal/html/page.html:257
+#: ../share/roundup/templates/minimal/html/page.html:270
+#: ../share/roundup/templates/responsive/html/page.html:334
+#: ../share/roundup/templates/responsive/html/page.html:347
+#: ../share/roundup/templates/responsive/html/page.html:365
+#: ../share/roundup/templates/responsive/html/page.html:378
 msgid "------------"
 msgstr "------------"
 
-#: ../share/roundup/templates/classic/html/page.html:335
-#: ../share/roundup/templates/devel/html/page.html:390
-#: ../share/roundup/templates/minimal/html/page.html:297
-#: ../share/roundup/templates/responsive/html/page.html:405
+#: ../share/roundup/templates/classic/html/page.html:336
+#: ../share/roundup/templates/devel/html/page.html:391
+#: ../share/roundup/templates/minimal/html/page.html:298
+#: ../share/roundup/templates/responsive/html/page.html:406
 msgid "no value"
 msgstr "pas de valeur"
 
diff --git a/locale/hu.po b/locale/hu.po
index 78fb8e654..91f2ebe4b 100644
--- a/locale/hu.po
+++ b/locale/hu.po
@@ -6,9 +6,9 @@
 # kilo aka Gabor Kmetyko <kg_kilo@freemail.hu>, 2007.
 msgid ""
 msgstr ""
-"Project-Id-Version: Roundup 2.5.0\n"
+"Project-Id-Version: Roundup 2.5.0b1\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
-"POT-Creation-Date: 2025-01-12 20:17-0500\n"
+"POT-Creation-Date: 2025-06-11 16:02-0400\n"
 "PO-Revision-Date: 2013-10-31 12:19+0100\n"
 "Last-Translator: kilo aka Gabor Kmetyko <kg_kilo@freemail.hu>\n"
 "Language-Team: Hungarian\n"
@@ -28,19 +28,19 @@ msgstr "Nincs jogosultsÃ¡ga %(action)s mÅ±veletre a(z) %(classname)s osztÃ¡lyon.
 msgid "You may not retire the admin or anonymous user"
 msgstr "Az admin Ã©s anonymous felhasznÃ¡lÃ³kat nem lehet visszavonultatni"
 
-#: ../roundup/admin.py:131
+#: ../roundup/admin.py:132
 msgid ""
 "Have 'display designator[,designator*]' show header inside\n"
 "      []'s before items. Includes retired/active status.\n"
 msgstr ""
 
-#: ../roundup/admin.py:135
+#: ../roundup/admin.py:136
 msgid ""
 "Have 'display designator' and 'specification class' show\n"
 "      protected fields: creator, id etc.\n"
 msgstr ""
 
-#: ../roundup/admin.py:139
+#: ../roundup/admin.py:140
 msgid ""
 "Controls history options. It is a bitstring where setting\n"
 "      the bit disables the feature. A value of 0 (default)\n"
@@ -51,59 +51,59 @@ msgid ""
 "      history.\n"
 msgstr ""
 
-#: ../roundup/admin.py:148
+#: ../roundup/admin.py:149
 msgid ""
 "Set the number of lines of history to keep for this session.\n"
 "      -1 is infinite.\n"
 msgstr ""
 
-#: ../roundup/admin.py:152
+#: ../roundup/admin.py:153
 msgid "Set indexer to use when running 'reindex' NYI\n"
 msgstr ""
 
-#: ../roundup/admin.py:155
+#: ../roundup/admin.py:156
 msgid "Force reopening of tracker when running each command.\n"
 msgstr ""
 
-#: ../roundup/admin.py:158
+#: ../roundup/admin.py:159
 msgid ""
 "set the number of rows imported before a database commit is\n"
 "      done. Used only for imports on PostgreSQL.\n"
 msgstr ""
 
-#: ../roundup/admin.py:160
+#: ../roundup/admin.py:161
 msgid "Show retired items in table, list etc. One of 'no', 'only', 'both'\n"
 msgstr ""
 
-#: ../roundup/admin.py:162
+#: ../roundup/admin.py:163
 msgid "internal mapping for show_retired.\n"
 msgstr ""
 
-#: ../roundup/admin.py:163
+#: ../roundup/admin.py:164
 msgid "Enable verbose output: tracing, descriptions...\n"
 msgstr ""
 
 # ../roundup/admin.py:85 :981 :1030 :1052
-#: ../roundup/admin.py:175 ../roundup/admin.py:1188 ../roundup/admin.py:1858
-#: ../roundup/admin.py:1890 ../roundup/admin.py:175:1188 :1858:1890
+#: ../roundup/admin.py:176 ../roundup/admin.py:1199 ../roundup/admin.py:1869
+#: ../roundup/admin.py:1901 ../roundup/admin.py:176:1199 :1869:1901
 #, python-format
 msgid "no such class \"%(classname)s\""
 msgstr "nincs \"%(classname)s\" osztÃ¡ly"
 
 # ../roundup/admin.py:95 :99
-#: ../roundup/admin.py:188
+#: ../roundup/admin.py:189
 #, python-format
 msgid "argument \"%(arg)s\" not propname=value"
 msgstr "A(z) \"%(arg)s\" argumentum nem nÃ©v=Ã©rtÃ©k alakÃº"
 
-#: ../roundup/admin.py:201
+#: ../roundup/admin.py:202
 #, python-format
 msgid ""
 "Problem: %(message)s\n"
 "\n"
 msgstr "ProblÃ©ma: %(message)s\n"
 
-#: ../roundup/admin.py:202
+#: ../roundup/admin.py:203
 #, fuzzy, python-format
 msgid ""
 "%(message)sUsage: roundup-admin [options] [<command> <arguments>]\n"
@@ -158,12 +158,12 @@ msgstr ""
 " roundup-admin help <command>             -- parancs-specifikus segÃ­tsÃ©g\n"
 " roundup-admin help all                   -- minden elÃ©rhetÅ‘ segÃ­tsÃ©g\n"
 
-#: ../roundup/admin.py:231
+#: ../roundup/admin.py:232
 #, fuzzy
 msgid "Commands: "
 msgstr "Parancsok:"
 
-#: ../roundup/admin.py:238
+#: ../roundup/admin.py:249
 msgid ""
 "Commands may be abbreviated as long as the abbreviation\n"
 "matches only one command, e.g. l == li == lis == list."
@@ -171,7 +171,7 @@ msgstr ""
 "A parancsok rÃ¶vidÃ­thetÅ‘k mindaddig, amÃ­g csak egy parancsra illenek, pl. l "
 "== li == lis == list."
 
-#: ../roundup/admin.py:270
+#: ../roundup/admin.py:281
 msgid ""
 "\n"
 "All commands (except help) require a tracker specifier. This is just\n"
@@ -239,25 +239,25 @@ msgid ""
 "Command help:\n"
 msgstr ""
 
-#: ../roundup/admin.py:334
+#: ../roundup/admin.py:345
 #, python-format
 msgid "%s:"
 msgstr "%s:"
 
 # ../roundup/admin.py:340 :396
-#: ../roundup/admin.py:439 ../roundup/admin.py:1415
-#: ../roundup/admin.py:439:1415
+#: ../roundup/admin.py:450 ../roundup/admin.py:1426
+#: ../roundup/admin.py:450:1426
 msgid "Templates:"
 msgstr "Sablonok:"
 
 # ../roundup/admin.py:343 :407
-#: ../roundup/admin.py:442 ../roundup/admin.py:1425
-#: ../roundup/admin.py:442:1425
+#: ../roundup/admin.py:453 ../roundup/admin.py:1436
+#: ../roundup/admin.py:453:1436
 msgid "Back ends:"
 msgstr "AdatbÃ¡zis hÃ¡tterek:"
 
 #. noqa: ARG002
-#: ../roundup/admin.py:459
+#: ../roundup/admin.py:470
 msgid ""
 "Usage: commit\n"
 "        Commit changes made to the database during an interactive session.\n"
@@ -271,7 +271,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:474
+#: ../roundup/admin.py:485
 msgid ""
 "Usage: create classname property=value ...\n"
 "        Create a new entry of a given class.\n"
@@ -285,42 +285,42 @@ msgstr ""
 
 # ../roundup/admin.py:369 :466 :527 :606 :656 :714 :735 :763 :834 :901 :972
 # :1020 :1042 :1069 :1136 :1207
-#: ../roundup/admin.py:482 ../roundup/admin.py:555 ../roundup/admin.py:606
-#: ../roundup/admin.py:733 ../roundup/admin.py:806 ../roundup/admin.py:851
-#: ../roundup/admin.py:902 ../roundup/admin.py:999 ../roundup/admin.py:1216
-#: ../roundup/admin.py:1388 ../roundup/admin.py:1516 ../roundup/admin.py:1599
-#: ../roundup/admin.py:1725 ../roundup/admin.py:1848 ../roundup/admin.py:1880
-#: ../roundup/admin.py:1996 ../roundup/admin.py:2050 ../roundup/admin.py:2098
-#: ../roundup/admin.py:482:555 :1216:1388:1516 :1599:1725 :1848:1880 :1996:2050
-#: :2098 :606:733 :806:851 :902:999
+#: ../roundup/admin.py:493 ../roundup/admin.py:566 ../roundup/admin.py:617
+#: ../roundup/admin.py:744 ../roundup/admin.py:817 ../roundup/admin.py:862
+#: ../roundup/admin.py:913 ../roundup/admin.py:1010 ../roundup/admin.py:1227
+#: ../roundup/admin.py:1399 ../roundup/admin.py:1527 ../roundup/admin.py:1610
+#: ../roundup/admin.py:1736 ../roundup/admin.py:1859 ../roundup/admin.py:1891
+#: ../roundup/admin.py:2007 ../roundup/admin.py:2061 ../roundup/admin.py:2109
+#: ../roundup/admin.py:493:566 :1227:1399 :1527:1610 :1736:1859 :1891:2007
+#: :2061:2109 :617:744 :817:862 :913:1010
 msgid "Not enough arguments supplied"
 msgstr "Nincs megadva elÃ©g argumentum"
 
-#: ../roundup/admin.py:502
+#: ../roundup/admin.py:513
 #, python-format
 msgid "%(propname)s (Password): "
 msgstr "%(propname)s (JelszÃ³): "
 
-#: ../roundup/admin.py:505
+#: ../roundup/admin.py:516
 #, python-format
 msgid "   %(propname)s (Again): "
 msgstr "   %(propname)s (IsmÃ©t): "
 
-#: ../roundup/admin.py:509
+#: ../roundup/admin.py:520
 msgid "Sorry, try again..."
 msgstr "SajnÃ¡lom, prÃ³bÃ¡lja Ãºjra..."
 
-#: ../roundup/admin.py:514
+#: ../roundup/admin.py:525
 #, python-format
 msgid "%(propname)s (%(proptype)s): "
 msgstr "%(propname)s (%(proptype)s): "
 
-#: ../roundup/admin.py:533
+#: ../roundup/admin.py:544
 #, python-format
 msgid "you must provide the \"%(propname)s\" property."
 msgstr "meg kell adni a(z) \"%(propname)s\" tulajdonsÃ¡got."
 
-#: ../roundup/admin.py:545
+#: ../roundup/admin.py:556
 #, fuzzy
 msgid ""
 "Usage: display designator[,designator]*\n"
@@ -340,13 +340,13 @@ msgstr ""
 "        csomÃ³pont Ã©rtÃ©kÃ©t.\n"
 "        "
 
-#: ../roundup/admin.py:586
+#: ../roundup/admin.py:597
 #, fuzzy, python-format
 msgid "%(protected)s%(key)s: %(value)s"
 msgstr "%(key)s: %(value)s"
 
 #. grab the directory to export to
-#: ../roundup/admin.py:589
+#: ../roundup/admin.py:600
 msgid ""
 "Usage: export [[-]class[,class]] export_dir\n"
 "        Export the database and file content.\n"
@@ -365,7 +365,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:704
+#: ../roundup/admin.py:715
 msgid ""
 "Usage: exporttables [[-]class[,class]] export_dir\n"
 "        Export only the database to files, no file content.\n"
@@ -385,7 +385,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:723
+#: ../roundup/admin.py:734
 msgid ""
 "Usage: filter classname propname=value ...\n"
 "        Find the nodes of the given class with a given property value.\n"
@@ -399,20 +399,20 @@ msgid ""
 msgstr ""
 
 # ../roundup/admin.py:701 :854 :866 :920
-#: ../roundup/admin.py:764
+#: ../roundup/admin.py:775
 #, fuzzy, python-format
 msgid "Class %(curclassname)s has no property %(pn)s in %(propname)s."
 msgstr "%(classname)s-nek nincs \"%(propname)s\" tulajdonsÃ¡ga"
 
 # ../roundup/admin.py:701 :854 :866 :920
-#: ../roundup/admin.py:791 ../roundup/admin.py:840 ../roundup/admin.py:1536
-#: ../roundup/admin.py:1549 ../roundup/admin.py:2120
-#: ../roundup/admin.py:791:840 :1536:1549:2120
+#: ../roundup/admin.py:802 ../roundup/admin.py:851 ../roundup/admin.py:1547
+#: ../roundup/admin.py:1560 ../roundup/admin.py:2131
+#: ../roundup/admin.py:802:851 :1547:1560:2131
 #, python-format
 msgid "%(classname)s has no property \"%(propname)s\""
 msgstr "%(classname)s-nek nincs \"%(propname)s\" tulajdonsÃ¡ga"
 
-#: ../roundup/admin.py:798
+#: ../roundup/admin.py:809
 msgid ""
 "Usage: find classname propname=value ...\n"
 "        Find the nodes of the given class with a given link property value.\n"
@@ -423,7 +423,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:847
+#: ../roundup/admin.py:858
 #, fuzzy
 msgid ""
 "Usage: genconfig filename\n"
@@ -436,7 +436,7 @@ msgstr ""
 "        a <fÃ¡jlnÃ©v> fÃ¡jlba.\n"
 "        "
 
-#: ../roundup/admin.py:864
+#: ../roundup/admin.py:875
 #, python-format
 msgid ""
 "Changing option\n"
@@ -444,20 +444,20 @@ msgid ""
 "from old default of %(old_number)s to new default of %(new_number)s."
 msgstr ""
 
-#: ../roundup/admin.py:875
+#: ../roundup/admin.py:886
 #, python-format
 msgid ""
 "Update 'password_pbkdf2_default_rounds' to a number equal to or larger\n"
 "  than %s.\n"
 msgstr ""
 
-#: ../roundup/admin.py:882
+#: ../roundup/admin.py:893
 msgid ""
 "Check the rdbms mysql_* settings. Your charset and collations may need\n"
 "  to be changed. See upgrading instructions.\n"
 msgstr ""
 
-#: ../roundup/admin.py:892
+#: ../roundup/admin.py:903
 #, fuzzy
 msgid ""
 "Usage: get property designator[,designator]*\n"
@@ -478,7 +478,7 @@ msgstr ""
 "        "
 
 # ../roundup/admin.py:560 :575
-#: ../roundup/admin.py:925
+#: ../roundup/admin.py:936
 #, python-format
 msgid "property %s is not of type Multilink or Link so -d flag does not apply."
 msgstr ""
@@ -486,18 +486,18 @@ msgstr ""
 "alkalmazhatÃ³."
 
 # ../roundup/admin.py:583 :983 :1032 :1054
-#: ../roundup/admin.py:942 ../roundup/admin.py:1190 ../roundup/admin.py:1864
-#: ../roundup/admin.py:1892 ../roundup/admin.py:942:1190 :1864:1892
+#: ../roundup/admin.py:953 ../roundup/admin.py:1201 ../roundup/admin.py:1875
+#: ../roundup/admin.py:1903 ../roundup/admin.py:953:1201 :1875:1903
 #, python-format
 msgid "no such %(classname)s node \"%(nodeid)s\""
 msgstr "nincs \"%(nodeid)s\" %(classname)s csomÃ³pont"
 
-#: ../roundup/admin.py:945
+#: ../roundup/admin.py:956
 #, python-format
 msgid "no such %(classname)s property \"%(propname)s\""
 msgstr "nincs \"%(propname)s\" %(classname)s tulajdonsÃ¡g"
 
-#: ../roundup/admin.py:950
+#: ../roundup/admin.py:961
 msgid ""
 "Usage: help topic\n"
 "        Give help about topic.\n"
@@ -517,12 +517,12 @@ msgstr ""
 "        all       -- minden elÃ©rhetÅ‘ segÃ­tsÃ©g\n"
 "        "
 
-#: ../roundup/admin.py:969
+#: ../roundup/admin.py:980
 #, python-format
 msgid "Sorry, no help for \"%(topic)s\""
 msgstr "ElnÃ©zÃ©st, \"%(topic)s\" tÃ©mÃ¡hoz nincs sÃºgÃ³"
 
-#: ../roundup/admin.py:986
+#: ../roundup/admin.py:997
 #, fuzzy
 msgid ""
 "Usage: history designator [skipquiet] [raw]\n"
@@ -544,27 +544,27 @@ msgstr ""
 "        csomÃ³pont Ã©rtÃ©kÃ©t.\n"
 "        "
 
-#: ../roundup/admin.py:1011
+#: ../roundup/admin.py:1022
 #, python-format
 msgid "Unexpected argument(s): %s. Expected 'skipquiet' or 'raw'."
 msgstr ""
 
-#: ../roundup/admin.py:1062
+#: ../roundup/admin.py:1073
 #, fuzzy
 msgid "removed"
 msgstr "TÃ¶rlÃ©s"
 
-#: ../roundup/admin.py:1064
+#: ../roundup/admin.py:1075
 msgid "added"
 msgstr ""
 
-#: ../roundup/admin.py:1066
+#: ../roundup/admin.py:1077
 #, python-format
 msgid "Unknown history set operation '%s'. Expected +/-."
 msgstr ""
 
 #. .Hint added issue23 to superseder
-#: ../roundup/admin.py:1091
+#: ../roundup/admin.py:1102
 #, fuzzy, python-format
 msgid "added %(class)s%(item_id)s to %(propname)s"
 msgstr "%(class)s %(id)s %(properties)s sikeresen szerkesztve"
@@ -572,29 +572,29 @@ msgstr "%(class)s %(id)s %(properties)s sikeresen szerkesztve"
 #. .Hint read as: assignedto was admin(1)
 #. where assignedto is the property
 #. admin is the key name for value 1
-#: ../roundup/admin.py:1112
+#: ../roundup/admin.py:1123
 #, fuzzy, python-format
 msgid "%(prop)s was %(name)s(%(value)s)"
 msgstr "%(propname)s (%(proptype)s): "
 
-#: ../roundup/admin.py:1118 ../roundup/admin.py:1147
-#: ../roundup/admin.py:1118:1147
+#: ../roundup/admin.py:1129 ../roundup/admin.py:1158
+#: ../roundup/admin.py:1129:1158
 #, fuzzy, python-format
 msgid "%(prop)s was %(value)s"
 msgstr "%(key)s: %(value)s"
 
-#: ../roundup/admin.py:1137
+#: ../roundup/admin.py:1148
 #, python-format
 msgid "%(prop)s was [%(value_list)s]"
 msgstr ""
 
 #. .Hint modified nosy: added demo(3)
-#: ../roundup/admin.py:1144
+#: ../roundup/admin.py:1155
 #, python-format
 msgid "modified %(prop)s: %(how)s"
 msgstr ""
 
-#: ../roundup/admin.py:1195
+#: ../roundup/admin.py:1206
 msgid ""
 "Usage: import import_dir\n"
 "        Import a database and file contents from the directory.\n"
@@ -618,7 +618,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1306
+#: ../roundup/admin.py:1317
 msgid ""
 "Usage: importtables export_dir\n"
 "        This imports the database tables exported using exporttables.\n"
@@ -628,7 +628,7 @@ msgid ""
 msgstr ""
 
 #. password
-#: ../roundup/admin.py:1314
+#: ../roundup/admin.py:1325
 msgid ""
 "Usage: initialise [adminpw]\n"
 "        Initialise a new Roundup tracker.\n"
@@ -646,23 +646,23 @@ msgstr ""
 "        VÃ©grehajtja az adatbÃ¡zist inicializÃ¡lÃ³ dbinit.init() rutint\n"
 "        "
 
-#: ../roundup/admin.py:1328
+#: ../roundup/admin.py:1339
 msgid "Admin Password: "
 msgstr "AdminisztrÃ¡tori jelszÃ³: "
 
-#: ../roundup/admin.py:1329
+#: ../roundup/admin.py:1340
 msgid "       Confirm: "
 msgstr "       MegerÅ‘sÃ­tÃ©s "
 
-#: ../roundup/admin.py:1333
+#: ../roundup/admin.py:1344
 msgid "Instance home does not exist"
 msgstr "A pÃ©ldÃ¡ny kÃ¶nyvtÃ¡ra nem lÃ©tezik"
 
-#: ../roundup/admin.py:1337
+#: ../roundup/admin.py:1348
 msgid "Instance has not been installed"
 msgstr "A pÃ©ldÃ¡ny nem lett installÃ¡lva"
 
-#: ../roundup/admin.py:1345
+#: ../roundup/admin.py:1356
 msgid ""
 "WARNING: The database is already initialised!\n"
 "If you re-initialise it, you will lose all the data!\n"
@@ -672,7 +672,7 @@ msgstr ""
 "ÃšjrainicializÃ¡lÃ¡s esetÃ©n minden adat elvÃ©sz!\n"
 "TÃ¶rli? Y/N: "
 
-#: ../roundup/admin.py:1365
+#: ../roundup/admin.py:1376
 msgid ""
 "Usage: install [template [backend [key=val[,key=val]]]]\n"
 "        Install a new Roundup tracker.\n"
@@ -698,12 +698,12 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1394
+#: ../roundup/admin.py:1405
 #, python-format
 msgid "Instance home parent directory \"%(parent)s\" does not exist"
 msgstr "PÃ©ldÃ¡ny kÃ¶nyvtÃ¡r szÃ¼lÅ‘je (\"%(parent)s\") nem lÃ©tezik"
 
-#: ../roundup/admin.py:1403
+#: ../roundup/admin.py:1414
 #, python-format
 msgid ""
 "WARNING: There appears to be a tracker in \"%(tracker_home)s\"!\n"
@@ -715,22 +715,22 @@ msgstr ""
 "Ha Ãºjra installÃ¡lod, minden adat elveszik!\n"
 "TÃ¶rÃ¶ljem? Y/N: "
 
-#: ../roundup/admin.py:1416
+#: ../roundup/admin.py:1427
 #, fuzzy
 msgid "Select template"
 msgstr "Sablon vÃ¡lasztÃ¡sa [classic]: "
 
-#: ../roundup/admin.py:1426
+#: ../roundup/admin.py:1437
 #, fuzzy
 msgid "Select backend"
 msgstr "AdatbÃ¡zis hÃ¡ttÃ©r vÃ¡lasztÃ¡sa [anydbm]: "
 
-#: ../roundup/admin.py:1437
+#: ../roundup/admin.py:1448
 #, python-format
 msgid "Error in configuration settings: \"%s\""
 msgstr "Hiba a konfigurÃ¡ciÃ³s beÃ¡llÃ­tÃ¡sokban: \"%s\""
 
-#: ../roundup/admin.py:1470
+#: ../roundup/admin.py:1481
 #, python-format
 msgid ""
 "\n"
@@ -743,11 +743,11 @@ msgstr ""
 " Most kell szerkesztened a konfigurÃ¡ciÃ³s fÃ¡jlt:\n"
 "   %(config_file)s"
 
-#: ../roundup/admin.py:1480
+#: ../roundup/admin.py:1491
 msgid " ... at a minimum, you must set following options:"
 msgstr " ... legalÃ¡bb a kÃ¶vetkezÅ‘ opciÃ³kat kell beÃ¡llÃ­tani:"
 
-#: ../roundup/admin.py:1485
+#: ../roundup/admin.py:1496
 #, python-format
 msgid ""
 "\n"
@@ -764,7 +764,7 @@ msgid ""
 "---------------------------------------------------------------------------\n"
 msgstr ""
 
-#: ../roundup/admin.py:1501
+#: ../roundup/admin.py:1512
 msgid ""
 "Usage: list classname [property]\n"
 "        List the instances of a class.\n"
@@ -780,17 +780,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1514
+#: ../roundup/admin.py:1525
 msgid "Too many arguments supplied"
 msgstr "TÃºl sok argumentum kerÃ¼lt megadÃ¡sra"
 
-#: ../roundup/admin.py:1547
+#: ../roundup/admin.py:1558
 #, python-format
 msgid "%(nodeid)4s: %(value)s"
 msgstr "%(nodeid)4s: %(value)s"
 
 #. noqa: ARG002  - args unused
-#: ../roundup/admin.py:1554
+#: ../roundup/admin.py:1565
 msgid ""
 "Usage: migrate\n"
 "        Update a tracker's database to be compatible with the Roundup\n"
@@ -813,17 +813,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1574
+#: ../roundup/admin.py:1585
 #, python-format
 msgid "Tracker updated to schema version %s."
 msgstr ""
 
-#: ../roundup/admin.py:1578
+#: ../roundup/admin.py:1589
 #, python-format
 msgid "No migration action required. At schema version %s."
 msgstr ""
 
-#: ../roundup/admin.py:1583
+#: ../roundup/admin.py:1594
 msgid ""
 "Usage: pack period | date\n"
 "        Remove journal entries older than the date/period.\n"
@@ -843,11 +843,11 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1609
+#: ../roundup/admin.py:1620
 msgid "Invalid format"
 msgstr "HibÃ¡s formÃ¡tum"
 
-#: ../roundup/admin.py:1620
+#: ../roundup/admin.py:1631
 msgid ""
 "Usage: perftest [mode] [arguments]*\n"
 "        Time operations in Roundup.\n"
@@ -865,25 +865,25 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1657
+#: ../roundup/admin.py:1668
 msgid "Invalid 'rounds'. Must be larger than 999."
 msgstr ""
 
-#: ../roundup/admin.py:1661
+#: ../roundup/admin.py:1672
 #, python-format
 msgid "Invalid 'rounds'. It must be an integer not: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1688
+#: ../roundup/admin.py:1699
 msgid "scheme does not support rounds."
 msgstr ""
 
-#: ../roundup/admin.py:1691
+#: ../roundup/admin.py:1702
 #, python-format
 msgid "Hash time: %(time)0.9f seconds, scheme: %(scheme)s, rounds: %(rounds)s"
 msgstr ""
 
-#: ../roundup/admin.py:1697
+#: ../roundup/admin.py:1708
 msgid ""
 "Usage: pragma setting=value | 'list'\n"
 "        Set internal admin settings to a value.\n"
@@ -912,49 +912,49 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1732
+#: ../roundup/admin.py:1743
 #, python-format
 msgid "Argument must be setting=value, was given: %s."
 msgstr ""
 
-#: ../roundup/admin.py:1735
+#: ../roundup/admin.py:1746
 msgid "Current settings and values (NYI - not yet implemented):"
 msgstr ""
 
-#: ../roundup/admin.py:1746
+#: ../roundup/admin.py:1757
 msgid ""
 "      Help for this pragma is missing. Please report it to the Roundup "
 "project.\n"
 msgstr ""
 
-#: ../roundup/admin.py:1752
+#: ../roundup/admin.py:1763
 #, fuzzy, python-format
 msgid "Unknown setting %s. Try \"pragma list\"."
 msgstr "Ismeretlen felhasznÃ¡lÃ³nÃ©v"
 
-#: ../roundup/admin.py:1762
+#: ../roundup/admin.py:1773
 #, python-format
 msgid "Incorrect value for boolean setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1769
+#: ../roundup/admin.py:1780
 #, python-format
 msgid "Incorrect value for integer setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1776
+#: ../roundup/admin.py:1787
 #, python-format
 msgid ""
 "Incorrect value for setting %(setting)s: %(value)s. Should be no, both, or "
 "only."
 msgstr ""
 
-#: ../roundup/admin.py:1786
+#: ../roundup/admin.py:1797
 #, python-format
 msgid "Internal error: pragma can not handle values of type: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1795
+#: ../roundup/admin.py:1806
 msgid ""
 "Usage: reindex [classname|classname:#-#|designator]*\n"
 "        Re-generate a tracker's search indexes.\n"
@@ -971,17 +971,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1817
+#: ../roundup/admin.py:1828
 #, python-format
 msgid "no such item \"%(designator)s\""
 msgstr "nincs ilyen elem: \"%(designator)s\""
 
-#: ../roundup/admin.py:1827
+#: ../roundup/admin.py:1838
 #, fuzzy, python-format
 msgid "no such item \"%(class)s%(id)s\""
 msgstr "nincs ilyen elem: \"%(designator)s\""
 
-#: ../roundup/admin.py:1839
+#: ../roundup/admin.py:1850
 msgid ""
 "Usage: restore designator[,designator]*\n"
 "        Restore the retired node specified by designator.\n"
@@ -993,7 +993,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1870
+#: ../roundup/admin.py:1881
 msgid ""
 "Usage: retire designator[,designator]*\n"
 "        Retire the node specified by designator.\n"
@@ -1007,7 +1007,7 @@ msgid ""
 msgstr ""
 
 #. noqa: ARG002 - args unused
-#: ../roundup/admin.py:1898
+#: ../roundup/admin.py:1909
 msgid ""
 "Usage: rollback\n"
 "        Undo all changes that are pending commit to the database.\n"
@@ -1019,7 +1019,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1911
+#: ../roundup/admin.py:1922
 msgid ""
 "Usage: security [Role name]\n"
 "        Display the Permissions available to one or all Roles.\n"
@@ -1032,47 +1032,47 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1926
+#: ../roundup/admin.py:1937
 #, fuzzy, python-format
 msgid "No such Role \"%(role)s\"\n"
 msgstr "Nincs ilyen szerepkÃ¶r: \"%(role)s\""
 
-#: ../roundup/admin.py:1932
+#: ../roundup/admin.py:1943
 #, fuzzy, python-format
 msgid "New Web users get the Roles \"%(role)s\"\n"
 msgstr "Ãšj web felhasznÃ¡lÃ³k ezeket a szerepkÃ¶rÃ¶ket kapjÃ¡k: \"%(role)s\""
 
-#: ../roundup/admin.py:1935
+#: ../roundup/admin.py:1946
 #, fuzzy, python-format
 msgid "New Web users get the Role \"%(role)s\"\n"
 msgstr "Ãšj web felhasznÃ¡lÃ³k ezt a szerepkÃ¶rt kapjÃ¡k \"%(role)s\""
 
-#: ../roundup/admin.py:1939
+#: ../roundup/admin.py:1950
 #, fuzzy, python-format
 msgid "New Email users get the Roles \"%(role)s\"\n"
 msgstr "Ãšj e-mail felhasznÃ¡lÃ³k ezeket a szerepkÃ¶rÃ¶ket kapjÃ¡k: \"%(role)s\""
 
-#: ../roundup/admin.py:1941
+#: ../roundup/admin.py:1952
 #, fuzzy, python-format
 msgid "New Email users get the Role \"%(role)s\"\n"
 msgstr "Ãšj e-mail felhasznÃ¡lÃ³k ezt a szerepkÃ¶rt kapjÃ¡k: \"%(role)s\""
 
-#: ../roundup/admin.py:1944
+#: ../roundup/admin.py:1955
 #, fuzzy, python-format
 msgid "Role \"%(name)s\":\n"
 msgstr "\"%(name)s\" szerepkÃ¶r:"
 
-#: ../roundup/admin.py:1950
+#: ../roundup/admin.py:1961
 #, fuzzy
 msgid " %(description)s (%(name)s for \"%(klass)s\""
 msgstr " %(description)s (%(name)s)"
 
-#: ../roundup/admin.py:1950
+#: ../roundup/admin.py:1961
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\": %(properties)s only)\n"
 msgstr " %(description)s (%(name)s)"
 
-#: ../roundup/admin.py:1963
+#: ../roundup/admin.py:1974
 #, python-format
 msgid ""
 "\n"
@@ -1080,17 +1080,17 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/admin.py:1969
+#: ../roundup/admin.py:1980
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\" only)\n"
 msgstr " %(description)s (%(name)s)"
 
-#: ../roundup/admin.py:1972
+#: ../roundup/admin.py:1983
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s)\n"
 msgstr " %(description)s (%(name)s)"
 
-#: ../roundup/admin.py:1976
+#: ../roundup/admin.py:1987
 msgid ""
 "Usage: set items property=value [property=value ...]\n"
 "        Set the given properties of one or more items(s).\n"
@@ -1111,7 +1111,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2044
+#: ../roundup/admin.py:2055
 msgid ""
 "Usage: specification classname\n"
 "        Show the properties for a classname.\n"
@@ -1125,17 +1125,17 @@ msgstr ""
 "        ListÃ¡zza az adott osztÃ¡ly tulajdonsÃ¡gait.\n"
 "        "
 
-#: ../roundup/admin.py:2063
+#: ../roundup/admin.py:2074
 #, fuzzy, python-format
 msgid "%(key)s: %(value)s (key property)\n"
 msgstr "%(key)s: %(value)s (kulcs tulajdonsÃ¡g)"
 
-#: ../roundup/admin.py:2066
+#: ../roundup/admin.py:2077
 #, fuzzy, python-format
 msgid "%(key)s: %(value)s\n"
 msgstr "%(key)s: %(value)s"
 
-#: ../roundup/admin.py:2069
+#: ../roundup/admin.py:2080
 msgid ""
 "Usage: table classname [property[,property]*]\n"
 "        List the instances of a class in tabular form.\n"
@@ -1167,17 +1167,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2115
+#: ../roundup/admin.py:2126
 #, python-format
 msgid "\"%(spec)s\" not name:width"
 msgstr "\"%(spec)s\" nem nÃ©v:hossz formÃ¡tumÃº"
 
-#: ../roundup/admin.py:2137
+#: ../roundup/admin.py:2148
 #, python-format
 msgid "\"%(spec)s\" does not have an integer width: \"%(width)s\""
 msgstr ""
 
-#: ../roundup/admin.py:2173
+#: ../roundup/admin.py:2184
 msgid ""
 "Usage: templates [trace_search]\n"
 "        List templates and their installed directories.\n"
@@ -1187,7 +1187,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2201
+#: ../roundup/admin.py:2212
 #, fuzzy
 msgid ""
 "Usage: updateconfig <filename>\n"
@@ -1204,37 +1204,37 @@ msgstr ""
 "        "
 
 # ../roundup/cgi/actions.py:596 :607 :778 :797
-#: ../roundup/admin.py:2210 ../roundup/cgi/actions.py:886
-#: ../roundup/cgi/actions.py:897 ../roundup/cgi/actions.py:1099
-#: ../roundup/cgi/actions.py:1113 ../roundup/cgi/actions.py:886:897 :1099:1113
+#: ../roundup/admin.py:2221 ../roundup/cgi/actions.py:891
+#: ../roundup/cgi/actions.py:902 ../roundup/cgi/actions.py:1104
+#: ../roundup/cgi/actions.py:1118 ../roundup/cgi/actions.py:891:902 :1104:1118
 #, python-format
 msgid "Error: %s"
 msgstr "Hiba: %s"
 
-#: ../roundup/admin.py:2242
+#: ../roundup/admin.py:2253
 #, python-format
 msgid "Unknown command \"%(command)s\" (\"help commands\" for a list)"
 msgstr ""
 "\"%(command)s\": ismeretlen parancs (\"help commands\" parancsok "
 "listÃ¡zÃ¡sÃ¡hoz)"
 
-#: ../roundup/admin.py:2248
+#: ../roundup/admin.py:2259
 #, python-format
 msgid "Multiple commands match \"%(command)s\": %(list)s"
 msgstr ""
 "TÃ¶bb parancs is illeszkedik a megadott \"%(command)s\" parancsra: %(list)s"
 
-#: ../roundup/admin.py:2263
+#: ../roundup/admin.py:2274
 msgid "Enter tracker home: "
 msgstr "Adja meg a hibakÃ¶vetÅ‘ kÃ¶nyvtÃ¡rÃ¡t: "
 
-#: ../roundup/admin.py:2292 ../roundup/admin.py:2296
-#: ../roundup/admin.py:2292:2296
+#: ../roundup/admin.py:2303 ../roundup/admin.py:2307
+#: ../roundup/admin.py:2303:2307
 #, python-format
 msgid "Error: Couldn't open tracker: %(message)s"
 msgstr "Hiba: HibakÃ¶vetÅ‘ megnyitÃ¡sa sikertelen: %(message)s"
 
-#: ../roundup/admin.py:2344
+#: ../roundup/admin.py:2355
 #, python-format
 msgid ""
 "Roundup %s ready for input.\n"
@@ -1243,37 +1243,37 @@ msgstr ""
 "A Roundup %s fogadÃ³kÃ©sz.\n"
 "SegÃ­tsÃ©gÃ©rt gÃ©peljen \"help\"-et."
 
-#: ../roundup/admin.py:2377
+#: ../roundup/admin.py:2388
 msgid "Note: command history and editing not available"
 msgstr "MegjegyzÃ©s: a parancsok tÃ¶rtÃ©nete Ã©s szerkesztÃ©se nem elÃ©rhetÅ‘"
 
-#: ../roundup/admin.py:2383
+#: ../roundup/admin.py:2394
 msgid "exit..."
 msgstr "kilÃ©pÃ©s..."
 
-#: ../roundup/admin.py:2396
+#: ../roundup/admin.py:2407
 msgid "There are unsaved changes. Commit them (y/N)? "
 msgstr "Vannak nem mentett vÃ¡ltoztatÃ¡sok. Elmenti Å‘ket (y/N)? "
 
-#: ../roundup/backends/back_anydbm.py:215
-#: ../roundup/backends/rdbms_common.py:928
+#: ../roundup/backends/back_anydbm.py:213
+#: ../roundup/backends/rdbms_common.py:926
 #, python-format
 msgid "Class \"%s\" already defined."
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:280
+#: ../roundup/backends/back_anydbm.py:278
 #: ../roundup/backends/sessions_dbm.py:61
 msgid "Couldn't identify database type"
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:314
+#: ../roundup/backends/back_anydbm.py:312
 #, python-format
 msgid ""
 "Couldn't open database - the required module '%s' (as dbm.gnu) is not "
 "available"
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:318
+#: ../roundup/backends/back_anydbm.py:316
 #, python-format
 msgid "Couldn't open database - the required module '%s' is not available"
 msgstr ""
@@ -1284,21 +1284,21 @@ msgstr ""
 # :1755:1775 :1828:2436 :866:1601
 #: ../roundup/backends/back_anydbm.py:873
 #: ../roundup/backends/back_anydbm.py:886
-#: ../roundup/backends/back_anydbm.py:1160
-#: ../roundup/backends/back_anydbm.py:1195
-#: ../roundup/backends/back_anydbm.py:1424
-#: ../roundup/backends/back_anydbm.py:1442
-#: ../roundup/backends/back_anydbm.py:1489
-#: ../roundup/backends/back_anydbm.py:2135
+#: ../roundup/backends/back_anydbm.py:1162
+#: ../roundup/backends/back_anydbm.py:1197
+#: ../roundup/backends/back_anydbm.py:1426
+#: ../roundup/backends/back_anydbm.py:1444
+#: ../roundup/backends/back_anydbm.py:1492
+#: ../roundup/backends/back_anydbm.py:2138
 #: ../roundup/backends/back_anydbm.py:873:886
-#: ../roundup/backends/rdbms_common.py:1720
-#: ../roundup/backends/rdbms_common.py:1967
-#: ../roundup/backends/rdbms_common.py:2206
-#: ../roundup/backends/rdbms_common.py:2226
-#: ../roundup/backends/rdbms_common.py:2279
-#: ../roundup/backends/rdbms_common.py:3254
-#: ../roundup/backends/rdbms_common.py:1720:1967 :1160:1195 :1424:1442:1489
-#: :2135 :2206:2226 :2279:3254
+#: ../roundup/backends/rdbms_common.py:1721
+#: ../roundup/backends/rdbms_common.py:1972
+#: ../roundup/backends/rdbms_common.py:2211
+#: ../roundup/backends/rdbms_common.py:2231
+#: ../roundup/backends/rdbms_common.py:2293
+#: ../roundup/backends/rdbms_common.py:3268
+#: ../roundup/backends/rdbms_common.py:1721:1972 :1162:1197 :1426:1444:1492
+#: :2138 :2211:2231 :2293:3268
 msgid "Database open read-only"
 msgstr ""
 
@@ -1324,45 +1324,50 @@ msgstr ""
 msgid "Unable to get lock after 10 retries on %s."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:632
+#: ../roundup/backends/rdbms_common.py:630
 #, python-format
 msgid "ALTER operation disallowed: %(old)r -> %(new)r."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:867
+#: ../roundup/backends/rdbms_common.py:865
 #, python-format
 msgid "CREATE operation disallowed: \"%s\"."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:884
+#: ../roundup/backends/rdbms_common.py:882
 #, python-format
 msgid "DROP operation disallowed: \"%s\"."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:1863
+#: ../roundup/backends/rdbms_common.py:1864
 msgid "create"
 msgstr "lÃ©trehozÃ¡s"
 
-#: ../roundup/backends/rdbms_common.py:2038
+#: ../roundup/backends/rdbms_common.py:2043
 msgid "unlink"
 msgstr "tÃ¶rlÃ©s"
 
-#: ../roundup/backends/rdbms_common.py:2042
+#: ../roundup/backends/rdbms_common.py:2047
 msgid "link"
 msgstr "kapcsolÃ¡s"
 
-#: ../roundup/backends/rdbms_common.py:2187
+#: ../roundup/backends/rdbms_common.py:2192
 msgid "set"
 msgstr "beÃ¡llÃ­tÃ¡s"
 
-#: ../roundup/backends/rdbms_common.py:2216
+#: ../roundup/backends/rdbms_common.py:2221
 msgid "retired"
 msgstr "visszavonult"
 
-#: ../roundup/backends/rdbms_common.py:2246
+#: ../roundup/backends/rdbms_common.py:2251
 msgid "restored"
 msgstr "visszaÃ¡llÃ­tott"
 
+#: ../roundup/backends/rdbms_common.py:2265
+#, fuzzy, python-format
+msgid "class %(cls)s: %(value)r is not an id"
+msgstr "\"%(propname)s\" tulajdonsÃ¡g: \"%(value)s\" jelenleg nincs a listÃ¡ban"
+
 #: ../roundup/backends/sessions_redis.py:78
 #: ../roundup/backends/sessions_redis.py:97
 #: ../roundup/backends/sessions_redis.py:78:97
@@ -1445,10 +1450,10 @@ msgid "\"%(input)s\" is not an ID (%(classname)s ID required)"
 msgstr "\"%(input)s\" nem azonosÃ­tÃ³ (%(classname)s azonosÃ­tÃ³ szÃ¼ksÃ©ges)"
 
 #: ../roundup/cgi/actions.py:228 ../roundup/cgi/actions.py:266
-#: ../roundup/cgi/actions.py:493 ../roundup/cgi/actions.py:833
-#: ../roundup/cgi/actions.py:880 ../roundup/cgi/actions.py:1084
-#: ../roundup/cgi/actions.py:1246 ../roundup/cgi/actions.py:228:266:1246
-#: :493:833 :880:1084
+#: ../roundup/cgi/actions.py:493 ../roundup/cgi/actions.py:838
+#: ../roundup/cgi/actions.py:885 ../roundup/cgi/actions.py:1089
+#: ../roundup/cgi/actions.py:1251 ../roundup/cgi/actions.py:228:266:1251
+#: :493:838 :885:1089
 #, fuzzy
 msgid "Invalid request"
 msgstr "HibÃ¡s formÃ¡tum"
@@ -1502,8 +1507,8 @@ msgstr "HibÃ¡s formÃ¡tum"
 msgid "Invalid integer: "
 msgstr "HibÃ¡s bejelentkezÃ©s"
 
-#: ../roundup/cgi/actions.py:531 ../roundup/cgi/actions.py:735
-#: ../roundup/cgi/actions.py:531:735
+#: ../roundup/cgi/actions.py:531 ../roundup/cgi/actions.py:740
+#: ../roundup/cgi/actions.py:531:740
 #, python-format
 msgid "You do not have permission to create %(class)s"
 msgstr "Nincs jogosultsÃ¡ga lÃ©trehozni %(class)s-t"
@@ -1513,8 +1518,8 @@ msgstr "Nincs jogosultsÃ¡ga lÃ©trehozni %(class)s-t"
 msgid "Not enough values on line %(line)s"
 msgstr "Nincs elÃ©g Ã©rtÃ©k a(z) %(line)s soron"
 
-#: ../roundup/cgi/actions.py:556 ../roundup/cgi/actions.py:723
-#: ../roundup/cgi/actions.py:556:723
+#: ../roundup/cgi/actions.py:556 ../roundup/cgi/actions.py:728
+#: ../roundup/cgi/actions.py:556:728
 #, python-format
 msgid "You do not have permission to edit %(class)s"
 msgstr "Nincs jogosultsÃ¡ga szerkeszteni %(class)s-t"
@@ -1523,17 +1528,17 @@ msgstr "Nincs jogosultsÃ¡ga szerkeszteni %(class)s-t"
 msgid "Items edited OK"
 msgstr "Az elemek sikeresen szerkesztve"
 
-#: ../roundup/cgi/actions.py:671
+#: ../roundup/cgi/actions.py:676
 #, python-format
 msgid "%(class)s %(id)s %(properties)s edited ok"
 msgstr "%(class)s %(id)s %(properties)s sikeresen szerkesztve"
 
-#: ../roundup/cgi/actions.py:689
+#: ../roundup/cgi/actions.py:694
 #, python-format
 msgid "%(class)s %(id)s created"
 msgstr "%(class)s %(id)s lÃ©trehozva"
 
-#: ../roundup/cgi/actions.py:817
+#: ../roundup/cgi/actions.py:822
 #, fuzzy, python-format
 msgid ""
 "Edit Error: someone else has edited this %(klass)s (%(props)s). View <a "
@@ -1543,24 +1548,24 @@ msgstr ""
 "a <a target=\"new\" href=\"%(klass)s%(id)s\">vÃ¡ltoztatÃ¡sait</a> egy Ãºj "
 "ablakban."
 
-#: ../roundup/cgi/actions.py:850
+#: ../roundup/cgi/actions.py:855
 #, python-format
 msgid "Edit Error: %s"
 msgstr "SzerkesztÃ©si hiba: %s"
 
-#: ../roundup/cgi/actions.py:931
+#: ../roundup/cgi/actions.py:936
 msgid ""
 "Invalid One Time Key!\n"
 "(a Mozilla bug may cause this message to show up erroneously, please check "
 "your email)"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:972
+#: ../roundup/cgi/actions.py:977
 #, fuzzy, python-format
 msgid "Password reset for %s"
 msgstr "JelszÃ³ tÃ¶rlÃ©s kÃ©rÃ©se"
 
-#: ../roundup/cgi/actions.py:973
+#: ../roundup/cgi/actions.py:978
 #, python-format
 msgid ""
 "\n"
@@ -1569,29 +1574,29 @@ msgid ""
 "Your password is now: %(password)s\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:982
+#: ../roundup/cgi/actions.py:987
 #, python-format
 msgid "Password reset and email sent to %s"
 msgstr "A jelszÃ³ tÃ¶rlÃ©sre kerÃ¼lt Ã©s e-mailt kÃ¼ldtÃ¼nk %s-nek"
 
-#: ../roundup/cgi/actions.py:991
+#: ../roundup/cgi/actions.py:996
 msgid "Unknown username"
 msgstr "Ismeretlen felhasznÃ¡lÃ³nÃ©v"
 
-#: ../roundup/cgi/actions.py:999
+#: ../roundup/cgi/actions.py:1004
 msgid "Unknown email address"
 msgstr "Ismeretlen e-mail cÃ­m"
 
-#: ../roundup/cgi/actions.py:1004
+#: ../roundup/cgi/actions.py:1009
 msgid "You need to specify a username or address"
 msgstr "Meg kell adni egy felhasznÃ¡lÃ³nevet vagy cÃ­met"
 
-#: ../roundup/cgi/actions.py:1015
+#: ../roundup/cgi/actions.py:1020
 #, fuzzy, python-format
 msgid "Confirm reset of password for %s"
 msgstr "JelszÃ³ megerÅ‘sÃ­tÃ©se"
 
-#: ../roundup/cgi/actions.py:1016
+#: ../roundup/cgi/actions.py:1021
 #, python-format
 msgid ""
 "\n"
@@ -1605,31 +1610,31 @@ msgid ""
 "You should then receive another email with the new password.\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1029
+#: ../roundup/cgi/actions.py:1034
 #, python-format
 msgid "Email sent to primary notification address for %s."
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1031
+#: ../roundup/cgi/actions.py:1036
 #, fuzzy, python-format
 msgid "Email sent to %s."
 msgstr "E-mail elkÃ¼ldve %s-nek"
 
-#: ../roundup/cgi/actions.py:1046
+#: ../roundup/cgi/actions.py:1051
 msgid "You are now registered, welcome!"
 msgstr "RegisztrÃ¡lÃ¡s sikeres, isten hozott!"
 
-#: ../roundup/cgi/actions.py:1139
+#: ../roundup/cgi/actions.py:1144
 #, python-format
 msgid "Username '%s' is already used."
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1163
+#: ../roundup/cgi/actions.py:1168
 #, python-format
 msgid "Complete your registration to %(tracker_name)s -- key %(key)s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1167
+#: ../roundup/cgi/actions.py:1172
 #, python-format
 msgid ""
 "To complete your registration of the user \"%(name)s\" with\n"
@@ -1645,12 +1650,12 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1181
+#: ../roundup/cgi/actions.py:1186
 #, python-format
 msgid "Complete your registration to %s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1182
+#: ../roundup/cgi/actions.py:1187
 #, python-format
 msgid ""
 "To complete your registration of the user \"%(name)s\" with\n"
@@ -1660,45 +1665,45 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1206
+#: ../roundup/cgi/actions.py:1211
 msgid "It is not permitted to supply roles at registration."
 msgstr "RegisztrÃ¡lÃ¡skor nem adhatÃ³k meg szerepkÃ¶rÃ¶k."
 
-#: ../roundup/cgi/actions.py:1220
+#: ../roundup/cgi/actions.py:1225
 msgid "You are logged out"
 msgstr "Kijelentkezett"
 
-#: ../roundup/cgi/actions.py:1250
+#: ../roundup/cgi/actions.py:1255
 msgid "Username required"
 msgstr "A felhasznÃ¡lÃ³nÃ©v szÃ¼ksÃ©ges"
 
-#: ../roundup/cgi/actions.py:1354
+#: ../roundup/cgi/actions.py:1359
 #, python-format
 msgid "Welcome %(username)s!"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1477
+#: ../roundup/cgi/actions.py:1482
 #, python-format
 msgid "Logins occurring too fast. Please wait: %s seconds."
 msgstr ""
 
 # ../roundup/cgi/actions.py:930 :934
-#: ../roundup/cgi/actions.py:1515 ../roundup/cgi/actions.py:1526
-#: ../roundup/cgi/actions.py:1515:1526
+#: ../roundup/cgi/actions.py:1520 ../roundup/cgi/actions.py:1531
+#: ../roundup/cgi/actions.py:1520:1531
 msgid "Invalid login"
 msgstr "HibÃ¡s bejelentkezÃ©s"
 
-#: ../roundup/cgi/actions.py:1532
+#: ../roundup/cgi/actions.py:1537
 msgid "You do not have permission to login"
 msgstr "Nincs jogosultsÃ¡ga bejelentkezni"
 
-#: ../roundup/cgi/actions.py:1577 ../roundup/cgi/actions.py:1757
-#: ../roundup/cgi/actions.py:1577:1757
+#: ../roundup/cgi/actions.py:1582 ../roundup/cgi/actions.py:1762
+#: ../roundup/cgi/actions.py:1582:1762
 #, python-format
 msgid "Column \"%(column)s\" not found in %(class)s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1822
+#: ../roundup/cgi/actions.py:1827
 #, fuzzy, python-format
 msgid "You do not have permission to view %(class)s"
 msgstr "Nincs jogosultsÃ¡ga szerkeszteni %(class)s-t"
@@ -1823,8 +1828,8 @@ msgstr "Å°rlap hiba: "
 msgid "Unrecognized charset: %r"
 msgstr "Ismeretlen karakterkÃ©szlet: %r"
 
-#: ../roundup/cgi/client.py:1381 ../roundup/cgi/client.py:2394
-#: ../roundup/cgi/client.py:1381:2394
+#: ../roundup/cgi/client.py:1381 ../roundup/cgi/client.py:2396
+#: ../roundup/cgi/client.py:1381:2396
 msgid "broken form: multiple @action values submitted"
 msgstr ""
 
@@ -1904,50 +1909,51 @@ msgstr ""
 
 #: ../roundup/cgi/client.py:1679
 #, python-format
-msgid "csrf X-REQUESTED-WITH xmlrpc required header check failed for user%s."
+msgid ""
+"csrf X-REQUESTED-WITH xmlrpc required header check failed for user%(userid)s."
 msgstr ""
 
 #: ../roundup/cgi/client.py:1720
 #, python-format
-msgid "Required csrf field missing for user%s"
+msgid "Required csrf field missing for user%(userid)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1722 ../roundup/cgi/client.py:1749
-#: ../roundup/cgi/client.py:1766 ../roundup/cgi/client.py:1722:1749:1766
+#: ../roundup/cgi/client.py:1723 ../roundup/cgi/client.py:1751
+#: ../roundup/cgi/client.py:1768 ../roundup/cgi/client.py:1723:1751:1768
 msgid ""
 "We can't validate your session (csrf failure). Re-enter any unsaved data and "
 "try again."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1726
+#: ../roundup/cgi/client.py:1728
 #, python-format
-msgid "csrf field not supplied by user%s"
+msgid "csrf field not supplied by user%(userid)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1738
+#: ../roundup/cgi/client.py:1740
 #, python-format
 msgid ""
 "Csrf mismatch user: current user %(user)s != stored user %(stored)s, current "
 "session, stored session: %(cur_sess)s,%(stor_sess)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1756
+#: ../roundup/cgi/client.py:1758
 #, python-format
 msgid ""
 "Csrf mismatch user: current session %(curr_sess)s != stored session "
 "%(stor_sess)s, current user/stored user is: %(user)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1948
+#: ../roundup/cgi/client.py:1950
 msgid "You are not allowed to view this file."
 msgstr "Nem nÃ©zheti meg ezt a fÃ¡jlt."
 
-#: ../roundup/cgi/client.py:2272
+#: ../roundup/cgi/client.py:2274
 #, python-format
 msgid "%(starttag)sTime elapsed: %(seconds)fs%(endtag)s\n"
 msgstr "%(starttag)sEltelt idÅ‘: %(seconds)fs%(endtag)s\n"
 
-#: ../roundup/cgi/client.py:2276
+#: ../roundup/cgi/client.py:2278
 #, python-format
 msgid ""
 "%(starttag)sCache hits: %(cache_hits)d, misses %(cache_misses)d. Loading "
@@ -1956,7 +1962,7 @@ msgstr ""
 "%(starttag)sCache talÃ¡latok: %(cache_hits)d, tÃ©vedÃ©s %(cache_misses)d. "
 "Elemek betÃ¶ltÃ©se: %(get_items)f mp. SzÅ±rÃ©s: %(filtering)f mp.%(endtag)s\n"
 
-#: ../roundup/cgi/client.py:2815
+#: ../roundup/cgi/client.py:2817
 #, python-format
 msgid ""
 "Cache failure: compressed file %(compressed)s is older than its source file "
@@ -2028,67 +2034,67 @@ msgstr ""
 "Nincs jogosultsÃ¡ga a(z) %(class)s osztÃ¡ly elemein %(action)s mÅ±veletet "
 "vÃ©grehajtani"
 
-#: ../roundup/cgi/templating.py:916
+#: ../roundup/cgi/templating.py:892
 msgid "(list)"
 msgstr "(lista)"
 
-#: ../roundup/cgi/templating.py:991
+#: ../roundup/cgi/templating.py:975
 msgid "Submit New Entry"
 msgstr "LÃ©trehozÃ¡s"
 
 # ../roundup/cgi/templating.py:710 :829 :1236 :1257 :1304 :1327 :1361 :1400
 # :1453 :1470 :1549 :1569 :1587 :1619 :1629 :1683 :1875
-#: ../roundup/cgi/templating.py:1013 ../roundup/cgi/templating.py:1189
-#: ../roundup/cgi/templating.py:1824 ../roundup/cgi/templating.py:1855
-#: ../roundup/cgi/templating.py:1876 ../roundup/cgi/templating.py:1914
-#: ../roundup/cgi/templating.py:1967 ../roundup/cgi/templating.py:1991
-#: ../roundup/cgi/templating.py:1998 ../roundup/cgi/templating.py:2035
-#: ../roundup/cgi/templating.py:2088 ../roundup/cgi/templating.py:2121
-#: ../roundup/cgi/templating.py:2216 ../roundup/cgi/templating.py:2237
-#: ../roundup/cgi/templating.py:2328 ../roundup/cgi/templating.py:2348
-#: ../roundup/cgi/templating.py:2370 ../roundup/cgi/templating.py:2413
-#: ../roundup/cgi/templating.py:2423 ../roundup/cgi/templating.py:2488
-#: ../roundup/cgi/templating.py:2791 ../roundup/cgi/templating.py:1013:1189
-#: :1824:1855 :1876:1914 :1967:1991 :1998:2035 :2088:2121 :2216:2237 :2328:2348
-#: :2370:2413 :2423:2488:2791
+#: ../roundup/cgi/templating.py:997 ../roundup/cgi/templating.py:1174
+#: ../roundup/cgi/templating.py:1809 ../roundup/cgi/templating.py:1840
+#: ../roundup/cgi/templating.py:1861 ../roundup/cgi/templating.py:1899
+#: ../roundup/cgi/templating.py:1952 ../roundup/cgi/templating.py:1976
+#: ../roundup/cgi/templating.py:1983 ../roundup/cgi/templating.py:2020
+#: ../roundup/cgi/templating.py:2077 ../roundup/cgi/templating.py:2115
+#: ../roundup/cgi/templating.py:2215 ../roundup/cgi/templating.py:2236
+#: ../roundup/cgi/templating.py:2357 ../roundup/cgi/templating.py:2377
+#: ../roundup/cgi/templating.py:2399 ../roundup/cgi/templating.py:2442
+#: ../roundup/cgi/templating.py:2452 ../roundup/cgi/templating.py:2517
+#: ../roundup/cgi/templating.py:2820 ../roundup/cgi/templating.py:997:1174
+#: :1809:1840 :1861:1899 :1952:1976 :1983:2020 :2077:2115 :2215:2236 :2357:2377
+#: :2399:2442 :2452:2517:2820
 msgid "[hidden]"
 msgstr "[rejtett]"
 
-#: ../roundup/cgi/templating.py:1014
+#: ../roundup/cgi/templating.py:998
 msgid "New node - no history"
 msgstr "Ãšj bejegyzÃ©s - nincs tÃ¶rtÃ©net"
 
-#: ../roundup/cgi/templating.py:1154
+#: ../roundup/cgi/templating.py:1139
 msgid "Submit Changes"
 msgstr "VÃ¡ltozÃ¡sok mentÃ©se"
 
-#: ../roundup/cgi/templating.py:1232
+#: ../roundup/cgi/templating.py:1217
 msgid "<em>The indicated property no longer exists</em>"
 msgstr "<em>A jelzett tulajdonsÃ¡g mÃ¡r nem lÃ©tezik</em>"
 
-#: ../roundup/cgi/templating.py:1268
+#: ../roundup/cgi/templating.py:1253
 #, python-format
 msgid "The linked class %(classname)s no longer exists"
 msgstr "A csatolt %(classname)s osztÃ¡ly mÃ¡r nem lÃ©tezik"
 
-#: ../roundup/cgi/templating.py:1305 ../roundup/cgi/templating.py:1335
-#: ../roundup/cgi/templating.py:2497 ../roundup/cgi/templating.py:2800
-#: ../roundup/cgi/templating.py:1305:1335 :2497:2800
+#: ../roundup/cgi/templating.py:1290 ../roundup/cgi/templating.py:1320
+#: ../roundup/cgi/templating.py:2526 ../roundup/cgi/templating.py:2829
+#: ../roundup/cgi/templating.py:1290:1320 :2526:2829
 msgid "[label is missing]"
 msgstr ""
 
 # ../roundup/cgi/templating.py:940 :964
-#: ../roundup/cgi/templating.py:1309 ../roundup/cgi/templating.py:1338
-#: ../roundup/cgi/templating.py:1309:1338
+#: ../roundup/cgi/templating.py:1294 ../roundup/cgi/templating.py:1323
+#: ../roundup/cgi/templating.py:1294:1323
 msgid "<strike>The linked node no longer exists</strike>"
 msgstr "<strike>A csatolt bejegyzÃ©s mÃ¡r nem lÃ©tezik</strike>"
 
-#: ../roundup/cgi/templating.py:1400
+#: ../roundup/cgi/templating.py:1385
 #, python-format
 msgid "%s: (no value)"
 msgstr "%s: (nincs Ã©rtÃ©k)"
 
-#: ../roundup/cgi/templating.py:1416
+#: ../roundup/cgi/templating.py:1401
 #, fuzzy, python-format
 msgid ""
 "<strong><em>This event %s is not handled by the history display!</em></"
@@ -2096,48 +2102,48 @@ msgid ""
 msgstr ""
 "<strong><em>Az elÅ‘zmÃ©nyek kÃ©pernyÅ‘ nem kezeli ezt az esemÃ©nyt!</em></strong>"
 
-#: ../roundup/cgi/templating.py:1429
+#: ../roundup/cgi/templating.py:1414
 msgid "<tr><td colspan=4><strong>Note:</strong></td></tr>"
 msgstr "<tr><td colspan=4><strong>MegjegyzÃ©s:</strong></td></tr>"
 
-#: ../roundup/cgi/templating.py:1438
+#: ../roundup/cgi/templating.py:1423
 msgid "History"
 msgstr "ElÅ‘zmÃ©nyek"
 
-#: ../roundup/cgi/templating.py:1440
+#: ../roundup/cgi/templating.py:1425
 msgid "<th>Date</th>"
 msgstr "<th>DÃ¡tum</th>"
 
-#: ../roundup/cgi/templating.py:1441
+#: ../roundup/cgi/templating.py:1426
 msgid "<th>User</th>"
 msgstr "<th>SzerzÅ‘</th>"
 
-#: ../roundup/cgi/templating.py:1442
+#: ../roundup/cgi/templating.py:1427
 msgid "<th>Action</th>"
 msgstr "<th>MÅ±velet</th>"
 
-#: ../roundup/cgi/templating.py:1443
+#: ../roundup/cgi/templating.py:1428
 msgid "<th>Args</th>"
 msgstr "<th>TulajdonsÃ¡gok</th>"
 
-#: ../roundup/cgi/templating.py:1494
+#: ../roundup/cgi/templating.py:1479
 #, python-format
 msgid "Copy of %(class)s %(id)s"
 msgstr "A(z) %(class)s %(id)s mÃ¡solata"
 
 # ../roundup/cgi/templating.py:1006 :1404 :1425 :1431
-#: ../roundup/cgi/templating.py:2125 ../roundup/cgi/templating.py:2160
-#: ../roundup/cgi/templating.py:1382:2125:2160
+#: ../roundup/cgi/templating.py:2119 ../roundup/cgi/templating.py:2154
+#: ../roundup/cgi/templating.py:1367:2119:2154
 msgid "No"
 msgstr "Nem"
 
 # ../roundup/cgi/templating.py:1006 :1404 :1423 :1428
-#: ../roundup/cgi/templating.py:2125 ../roundup/cgi/templating.py:2154
-#: ../roundup/cgi/templating.py:1382:2125:2154
+#: ../roundup/cgi/templating.py:2119 ../roundup/cgi/templating.py:2148
+#: ../roundup/cgi/templating.py:1367:2119:2148
 msgid "Yes"
 msgstr "Igen"
 
-#: ../roundup/cgi/templating.py:2286
+#: ../roundup/cgi/templating.py:2315
 msgid ""
 "default value for DateHTMLProperty must be either DateHTMLProperty or string "
 "date representation."
@@ -2145,27 +2151,27 @@ msgstr ""
 "a DateHTMLProperty alapÃ©rtÃ©ke DateHTMLProperty vagy szÃ¶veges dÃ¡tumleÃ­rÃ¡s "
 "tÃ­pusÃº kell legyen."
 
-#: ../roundup/cgi/templating.py:2468
+#: ../roundup/cgi/templating.py:2497
 #, python-format
 msgid "Attempt to look up %(attr)s on a missing value"
 msgstr "KÃ­sÃ©rlet %(attr)s keresÃ©sÃ©re egy hiÃ¡nyzÃ³ Ã©rtÃ©ken"
 
-#: ../roundup/cgi/templating.py:2479
+#: ../roundup/cgi/templating.py:2508
 #, fuzzy, python-format
 msgid "Attempt to look up %(item)s on a missing value"
 msgstr "KÃ­sÃ©rlet %(attr)s keresÃ©sÃ©re egy hiÃ¡nyzÃ³ Ã©rtÃ©ken"
 
-#: ../roundup/cgi/templating.py:2584
+#: ../roundup/cgi/templating.py:2613
 #, python-format
 msgid "<option %svalue=\"-1\">- no selection -</option>"
 msgstr "<option %svalue=\"-1\">- nincs kivÃ¡lasztÃ¡s -</option>"
 
-#: ../roundup/cgi/templating.py:3745
+#: ../roundup/cgi/templating.py:3777
 #, python-format
 msgid "Unable to read or expand file '%(name)s' in template '%(template)s'."
 msgstr ""
 
-#: ../roundup/cgi/templating.py:3795
+#: ../roundup/cgi/templating.py:3827
 #, python-format
 msgid ""
 "Found an incorrect token when expandfile applied string subsitution on "
@@ -2337,55 +2343,55 @@ msgstr "%s"
 msgid "in %s"
 msgstr "%s-ban"
 
-#: ../roundup/hyperdb.py:120
+#: ../roundup/hyperdb.py:126
 #, fuzzy, python-format
 msgid "property %(property)s: %(errormsg)s"
 msgstr "Hiba: %s: %s"
 
-#: ../roundup/hyperdb.py:149
+#: ../roundup/hyperdb.py:161
 #, python-format
 msgid "property %(property)s: %(value)r is an invalid date (%(errormsg)s)"
 msgstr ""
 
-#: ../roundup/hyperdb.py:172
+#: ../roundup/hyperdb.py:184
 #, python-format
 msgid ""
 "property %(property)s: %(value)r is an invalid date interval (%(errormsg)s)"
 msgstr ""
 
-#: ../roundup/hyperdb.py:434
+#: ../roundup/hyperdb.py:446
 #, fuzzy, python-format
 msgid "property %(property)s: %(value)r is not a number"
 msgstr "\"%(propname)s\" tulajdonsÃ¡g: \"%(value)s\" jelenleg nincs a listÃ¡ban"
 
-#: ../roundup/hyperdb.py:448
+#: ../roundup/hyperdb.py:460
 #, fuzzy, python-format
 msgid "property %(property)s: %(value)r is not an integer"
 msgstr "\"%(propname)s\" tulajdonsÃ¡g: \"%(value)s\" jelenleg nincs a listÃ¡ban"
 
-#: ../roundup/hyperdb.py:470
+#: ../roundup/hyperdb.py:482
 #, python-format
 msgid "\"%s\" not a node designator"
 msgstr ""
 
 # ../roundup/hyperdb.py:949:957
-#: ../roundup/hyperdb.py:1499 ../roundup/hyperdb.py:1507
-#: ../roundup/hyperdb.py:1499:1507
+#: ../roundup/hyperdb.py:1515 ../roundup/hyperdb.py:1523
+#: ../roundup/hyperdb.py:1515:1523
 #, python-format
 msgid "Not a property name: %s"
 msgstr ""
 
-#: ../roundup/hyperdb.py:2038
+#: ../roundup/hyperdb.py:2054
 #, fuzzy, python-format
 msgid "property %(property)s: %(value)r is not a %(classname)s."
 msgstr "\"%(propname)s\" tulajdonsÃ¡g: \"%(value)s\" jelenleg nincs a listÃ¡ban"
 
-#: ../roundup/hyperdb.py:2044
+#: ../roundup/hyperdb.py:2060
 #, python-format
 msgid "you may only enter ID values for property %s"
 msgstr ""
 
-#: ../roundup/hyperdb.py:2079
+#: ../roundup/hyperdb.py:2095
 #, python-format
 msgid "%(property)r is not a property of %(classname)s"
 msgstr ""
@@ -2692,61 +2698,61 @@ msgid ""
 "are: %(stack)s"
 msgstr ""
 
-#: ../roundup/pygettext.py:401
+#: ../roundup/pygettext.py:400
 #, python-format
 msgid "*** %(file)s:%(lineno)s: Seen unexpected token \"%(token)s\""
 msgstr ""
 
-#: ../roundup/pygettext.py:457
+#: ../roundup/pygettext.py:456
 #, python-format
 msgid "# File: %(filename)s, line: %(lineno)d"
 msgstr ""
 
-#: ../roundup/pygettext.py:464
+#: ../roundup/pygettext.py:463
 #, python-format
 msgid " %(filename)s:%(lineno)d"
 msgstr ""
 
 # ../roundup/cgi/actions.py:930 :934
-#: ../roundup/pygettext.py:540
+#: ../roundup/pygettext.py:539
 #, fuzzy, python-format
 msgid "Invalid value for --style: %s"
 msgstr "HibÃ¡s bejelentkezÃ©s"
 
-#: ../roundup/pygettext.py:548
+#: ../roundup/pygettext.py:547
 #, python-format
 msgid "pygettext.py (xgettext for Python) %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:554
+#: ../roundup/pygettext.py:553
 #, python-format
 msgid "--width argument must be an integer: %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:582
+#: ../roundup/pygettext.py:581
 #, python-format
 msgid "Can't read --exclude-file: %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:601
+#: ../roundup/pygettext.py:600
 msgid "Reading standard input"
 msgstr ""
 
-#: ../roundup/pygettext.py:606
+#: ../roundup/pygettext.py:605
 #, python-format
 msgid "Working on %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:640
+#: ../roundup/pygettext.py:639
 msgid "a unicode string"
 msgstr ""
 
-#: ../roundup/pygettext.py:642
+#: ../roundup/pygettext.py:641
 #, python-format
 msgid "*** Seen unexpected token \"%(token)s\""
 msgstr ""
 
-#: ../roundup/pygettext.py:643
+#: ../roundup/pygettext.py:642
 msgid "morethanonestring"
 msgstr ""
 
@@ -2868,32 +2874,32 @@ msgstr "lÃ©trehozÃ¡s"
 msgid "creator"
 msgstr "lÃ©trehozÃ³"
 
-#: ../roundup/roundupdb.py:426
+#: ../roundup/roundupdb.py:447
 #, python-format
 msgid "No key for \"%(adr)s\" in keyring"
 msgstr ""
 
-#: ../roundup/roundupdb.py:504
+#: ../roundup/roundupdb.py:525
 #, python-format
 msgid "New submission from %(authname)s%(authaddr)s:"
 msgstr "Ãšj beadvÃ¡ny %(authname)s%(authaddr)s rÃ©szÃ©rÅ‘l:"
 
-#: ../roundup/roundupdb.py:507
+#: ../roundup/roundupdb.py:528
 #, python-format
 msgid "%(authname)s%(authaddr)s added the comment:"
 msgstr "%(authname)s%(authaddr)s ezt a megjegyzÃ©st Ã­rta:"
 
-#: ../roundup/roundupdb.py:510
+#: ../roundup/roundupdb.py:531
 #, fuzzy, python-format
 msgid "Change by %(authname)s%(authaddr)s:"
 msgstr "Ãšj beadvÃ¡ny %(authname)s%(authaddr)s rÃ©szÃ©rÅ‘l:"
 
-#: ../roundup/roundupdb.py:529
+#: ../roundup/roundupdb.py:550
 #, python-format
 msgid "File '%(filename)s' not attached - you can download it from %(link)s."
 msgstr ""
 
-#: ../roundup/roundupdb.py:904
+#: ../roundup/roundupdb.py:925
 #, python-format
 msgid ""
 "\n"
@@ -2998,58 +3004,58 @@ msgstr ""
 "<html><head><title>Roundup hibakÃ¶vetÅ‘k listÃ¡ja</title></head>\n"
 "<body><h1>Roundup hibakÃ¶vetÅ‘k listÃ¡ja</h1><ol>\n"
 
-#: ../roundup/scripts/roundup_server.py:598
+#: ../roundup/scripts/roundup_server.py:602
 #, fuzzy, python-format
 msgid "Error: %(type)s: %(value)s"
 msgstr "%(key)s: %(value)s"
 
-#: ../roundup/scripts/roundup_server.py:610
+#: ../roundup/scripts/roundup_server.py:614
 msgid "WARNING: ignoring \"-g\" argument, not root"
 msgstr "FIGYELEM: \"-g\" opciÃ³ figyelmen kÃ­vÃ¼l hagyÃ¡sra kerÃ¼lt, nem root"
 
-#: ../roundup/scripts/roundup_server.py:616
+#: ../roundup/scripts/roundup_server.py:620
 msgid "Can't change groups - no grp module"
 msgstr "Nem lehet csoportot vÃ¡ltani - nincs meg a grp modul"
 
-#: ../roundup/scripts/roundup_server.py:625
+#: ../roundup/scripts/roundup_server.py:629
 #, python-format
 msgid "Group %(group)s doesn't exist"
 msgstr "%(group)s csoport nem lÃ©tezik"
 
-#: ../roundup/scripts/roundup_server.py:637
+#: ../roundup/scripts/roundup_server.py:641
 msgid "Can't run as root!"
 msgstr "Nem futhat root-kÃ©nt!"
 
-#: ../roundup/scripts/roundup_server.py:640
+#: ../roundup/scripts/roundup_server.py:644
 msgid "WARNING: ignoring \"-u\" argument, not root"
 msgstr "FIGYELEM: \"-u\" opciÃ³ figyelmen kÃ­vÃ¼l hagyÃ¡sra kerÃ¼lt, nem root"
 
-#: ../roundup/scripts/roundup_server.py:646
+#: ../roundup/scripts/roundup_server.py:650
 msgid "Can't change users - no pwd module"
 msgstr "FelhasznÃ¡lÃ³vÃ¡ltÃ¡s nem sikerÃ¼lt - nincs pwd modul"
 
-#: ../roundup/scripts/roundup_server.py:655
+#: ../roundup/scripts/roundup_server.py:659
 #, python-format
 msgid "User %(user)s doesn't exist"
 msgstr "A(z) %(user)s felhasznÃ¡lÃ³ nem lÃ©tezik"
 
-#: ../roundup/scripts/roundup_server.py:867
+#: ../roundup/scripts/roundup_server.py:871
 #, python-format
 msgid "Multiprocess mode \"%s\" is not available, switching to single-process"
 msgstr "\"%s\" tÃ¶bbszÃ¡lÃº mÃ³d nem Ã©rhetÅ‘ el, Ã¡ttÃ©rÃ©s egyszÃ¡lÃº mÃ³dra"
 
-#: ../roundup/scripts/roundup_server.py:895
+#: ../roundup/scripts/roundup_server.py:899
 #, python-format
 msgid "Unable to bind to port %s, port already in use."
 msgstr "Nem sikerÃ¼lt a(z) %s portra csatlakozni, a port mÃ¡r hasznÃ¡latban van."
 
-#: ../roundup/scripts/roundup_server.py:899
+#: ../roundup/scripts/roundup_server.py:903
 #, fuzzy, python-format
 msgid ""
 "Unable to bind to port %(port)s, access not allowed, errno: %(errno)s %(msg)s"
 msgstr "Nem sikerÃ¼lt a(z) %s portra csatlakozni, a port mÃ¡r hasznÃ¡latban van."
 
-#: ../roundup/scripts/roundup_server.py:978
+#: ../roundup/scripts/roundup_server.py:982
 msgid ""
 " -c <Command>  Windows Service options.\n"
 "               If you want to run the server as a Windows Service, you\n"
@@ -3059,7 +3065,7 @@ msgid ""
 "               specifics."
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:985
+#: ../roundup/scripts/roundup_server.py:989
 msgid ""
 " -u <UID>      runs the Roundup web server as this UID\n"
 " -g <GID>      runs the Roundup web server as this GID\n"
@@ -3069,7 +3075,7 @@ msgid ""
 " -D            run the server in the foreground even when -d is used."
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:993
+#: ../roundup/scripts/roundup_server.py:997
 #, python-format
 msgid ""
 "\n"
@@ -3142,21 +3148,25 @@ msgid ""
 "   any url-unsafe characters like spaces, as these confuse IE.\n"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:1173
+#: ../roundup/scripts/roundup_server.py:1177
 msgid "Instances must be name=home"
 msgstr "A pÃ©ldÃ¡nyoknak nÃ©v=home formÃ¡ban kell lenniÃ¼k"
 
-#: ../roundup/scripts/roundup_server.py:1187
+#: ../roundup/scripts/roundup_server.py:1191
 #, python-format
 msgid "Configuration saved to %s"
 msgstr "BeÃ¡llÃ­tÃ¡sok elmentve ide: %s"
 
-#: ../roundup/scripts/roundup_server.py:1205
+#: ../roundup/scripts/roundup_server.py:1206
+msgid "If you specify a PID file you must use -l or -L."
+msgstr ""
+
+#: ../roundup/scripts/roundup_server.py:1212
 msgid "Sorry, you can't run the server as a daemon on this Operating System"
 msgstr ""
 "ElnÃ©zÃ©st, ezen az operÃ¡ciÃ³s rendszeren a szerver nem indÃ­thatÃ³ dÃ©monkÃ©nt"
 
-#: ../roundup/scripts/roundup_server.py:1225
+#: ../roundup/scripts/roundup_server.py:1232
 #, python-format
 msgid "Roundup server started on %(HOST)s:%(PORT)s"
 msgstr "Roundup server elindÃ­tva a(z) %(HOST)s:%(PORT)s gÃ©pen"
@@ -4426,46 +4436,46 @@ msgstr "Roundup dokumentÃ¡ciÃ³"
 msgid "clear this message"
 msgstr "Ã¼zenet tÃ¶rlÃ©se"
 
-#: ../share/roundup/templates/classic/html/page.html:257
-#: ../share/roundup/templates/classic/html/page.html:270
-#: ../share/roundup/templates/classic/html/page.html:288
-#: ../share/roundup/templates/classic/html/page.html:302
-#: ../share/roundup/templates/devel/html/page.html:316
-#: ../share/roundup/templates/devel/html/page.html:329
-#: ../share/roundup/templates/devel/html/page.html:347
-#: ../share/roundup/templates/devel/html/page.html:361
-#: ../share/roundup/templates/minimal/html/page.html:239
-#: ../share/roundup/templates/minimal/html/page.html:254
-#: ../share/roundup/templates/minimal/html/page.html:268
-#: ../share/roundup/templates/responsive/html/page.html:331
-#: ../share/roundup/templates/responsive/html/page.html:344
-#: ../share/roundup/templates/responsive/html/page.html:362
-#: ../share/roundup/templates/responsive/html/page.html:376
-msgid "don't care"
-msgstr "mindegy"
-
-#: ../share/roundup/templates/classic/html/page.html:259
-#: ../share/roundup/templates/classic/html/page.html:272
-#: ../share/roundup/templates/classic/html/page.html:290
+#: ../share/roundup/templates/classic/html/page.html:258
+#: ../share/roundup/templates/classic/html/page.html:271
+#: ../share/roundup/templates/classic/html/page.html:289
 #: ../share/roundup/templates/classic/html/page.html:303
-#: ../share/roundup/templates/devel/html/page.html:318
-#: ../share/roundup/templates/devel/html/page.html:331
-#: ../share/roundup/templates/devel/html/page.html:349
+#: ../share/roundup/templates/devel/html/page.html:317
+#: ../share/roundup/templates/devel/html/page.html:330
+#: ../share/roundup/templates/devel/html/page.html:348
 #: ../share/roundup/templates/devel/html/page.html:362
-#: ../share/roundup/templates/minimal/html/page.html:241
-#: ../share/roundup/templates/minimal/html/page.html:256
+#: ../share/roundup/templates/minimal/html/page.html:240
+#: ../share/roundup/templates/minimal/html/page.html:255
 #: ../share/roundup/templates/minimal/html/page.html:269
-#: ../share/roundup/templates/responsive/html/page.html:333
-#: ../share/roundup/templates/responsive/html/page.html:346
-#: ../share/roundup/templates/responsive/html/page.html:364
+#: ../share/roundup/templates/responsive/html/page.html:332
+#: ../share/roundup/templates/responsive/html/page.html:345
+#: ../share/roundup/templates/responsive/html/page.html:363
 #: ../share/roundup/templates/responsive/html/page.html:377
+msgid "don't care"
+msgstr "mindegy"
+
+#: ../share/roundup/templates/classic/html/page.html:260
+#: ../share/roundup/templates/classic/html/page.html:273
+#: ../share/roundup/templates/classic/html/page.html:291
+#: ../share/roundup/templates/classic/html/page.html:304
+#: ../share/roundup/templates/devel/html/page.html:319
+#: ../share/roundup/templates/devel/html/page.html:332
+#: ../share/roundup/templates/devel/html/page.html:350
+#: ../share/roundup/templates/devel/html/page.html:363
+#: ../share/roundup/templates/minimal/html/page.html:242
+#: ../share/roundup/templates/minimal/html/page.html:257
+#: ../share/roundup/templates/minimal/html/page.html:270
+#: ../share/roundup/templates/responsive/html/page.html:334
+#: ../share/roundup/templates/responsive/html/page.html:347
+#: ../share/roundup/templates/responsive/html/page.html:365
+#: ../share/roundup/templates/responsive/html/page.html:378
 msgid "------------"
 msgstr "------------"
 
-#: ../share/roundup/templates/classic/html/page.html:335
-#: ../share/roundup/templates/devel/html/page.html:390
-#: ../share/roundup/templates/minimal/html/page.html:297
-#: ../share/roundup/templates/responsive/html/page.html:405
+#: ../share/roundup/templates/classic/html/page.html:336
+#: ../share/roundup/templates/devel/html/page.html:391
+#: ../share/roundup/templates/minimal/html/page.html:298
+#: ../share/roundup/templates/responsive/html/page.html:406
 msgid "no value"
 msgstr "nincs Ã©rtÃ©k"
 
diff --git a/locale/it.po b/locale/it.po
index 8b4d54795..eb8e85bb5 100644
--- a/locale/it.po
+++ b/locale/it.po
@@ -5,9 +5,9 @@
 #
 msgid ""
 msgstr ""
-"Project-Id-Version: Roundup 2.5.0\n"
+"Project-Id-Version: Roundup 2.5.0b1\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
-"POT-Creation-Date: 2025-01-12 20:17-0500\n"
+"POT-Creation-Date: 2025-06-11 16:02-0400\n"
 "PO-Revision-Date: 2013-10-31 12:20+0100\n"
 "Last-Translator: Marco Ghidinelli <marco.ghidinelli@ing.unibs.it>\n"
 "Language-Team: italian <it@li.org>\n"
@@ -27,19 +27,19 @@ msgstr "Non hai i permessi per %(action)s la classe %(classname)s."
 msgid "You may not retire the admin or anonymous user"
 msgstr "Non Ã¨ possibile ritirare l'utente amministratore o l'utente anonimo"
 
-#: ../roundup/admin.py:131
+#: ../roundup/admin.py:132
 msgid ""
 "Have 'display designator[,designator*]' show header inside\n"
 "      []'s before items. Includes retired/active status.\n"
 msgstr ""
 
-#: ../roundup/admin.py:135
+#: ../roundup/admin.py:136
 msgid ""
 "Have 'display designator' and 'specification class' show\n"
 "      protected fields: creator, id etc.\n"
 msgstr ""
 
-#: ../roundup/admin.py:139
+#: ../roundup/admin.py:140
 msgid ""
 "Controls history options. It is a bitstring where setting\n"
 "      the bit disables the feature. A value of 0 (default)\n"
@@ -50,52 +50,52 @@ msgid ""
 "      history.\n"
 msgstr ""
 
-#: ../roundup/admin.py:148
+#: ../roundup/admin.py:149
 msgid ""
 "Set the number of lines of history to keep for this session.\n"
 "      -1 is infinite.\n"
 msgstr ""
 
-#: ../roundup/admin.py:152
+#: ../roundup/admin.py:153
 msgid "Set indexer to use when running 'reindex' NYI\n"
 msgstr ""
 
-#: ../roundup/admin.py:155
+#: ../roundup/admin.py:156
 msgid "Force reopening of tracker when running each command.\n"
 msgstr ""
 
-#: ../roundup/admin.py:158
+#: ../roundup/admin.py:159
 msgid ""
 "set the number of rows imported before a database commit is\n"
 "      done. Used only for imports on PostgreSQL.\n"
 msgstr ""
 
-#: ../roundup/admin.py:160
+#: ../roundup/admin.py:161
 msgid "Show retired items in table, list etc. One of 'no', 'only', 'both'\n"
 msgstr ""
 
-#: ../roundup/admin.py:162
+#: ../roundup/admin.py:163
 msgid "internal mapping for show_retired.\n"
 msgstr ""
 
-#: ../roundup/admin.py:163
+#: ../roundup/admin.py:164
 msgid "Enable verbose output: tracing, descriptions...\n"
 msgstr ""
 
 # ../roundup/admin.py:1052 ../roundup/admin.py:85:981 :1030:1052
-#: ../roundup/admin.py:175 ../roundup/admin.py:1188 ../roundup/admin.py:1858
-#: ../roundup/admin.py:1890 ../roundup/admin.py:175:1188 :1858:1890
+#: ../roundup/admin.py:176 ../roundup/admin.py:1199 ../roundup/admin.py:1869
+#: ../roundup/admin.py:1901 ../roundup/admin.py:176:1199 :1869:1901
 #, python-format
 msgid "no such class \"%(classname)s\""
 msgstr "classe \"%(classname)s\" mancante"
 
 # ../roundup/admin.py:95 ../roundup/admin.py:99 ../roundup/admin.py:95:99
-#: ../roundup/admin.py:188
+#: ../roundup/admin.py:189
 #, python-format
 msgid "argument \"%(arg)s\" not propname=value"
 msgstr "argomento \"%(arg)s\" non nel formato nome=valore"
 
-#: ../roundup/admin.py:201
+#: ../roundup/admin.py:202
 #, python-format
 msgid ""
 "Problem: %(message)s\n"
@@ -104,7 +104,7 @@ msgstr ""
 "Problema: %(message)s\n"
 "\n"
 
-#: ../roundup/admin.py:202
+#: ../roundup/admin.py:203
 #, python-format
 msgid ""
 "%(message)sUsage: roundup-admin [options] [<command> <arguments>]\n"
@@ -135,12 +135,12 @@ msgid ""
 " roundup-admin help all                   -- all available help\n"
 msgstr ""
 
-#: ../roundup/admin.py:231
+#: ../roundup/admin.py:232
 #, fuzzy
 msgid "Commands: "
 msgstr "Comandi:"
 
-#: ../roundup/admin.py:238
+#: ../roundup/admin.py:249
 msgid ""
 "Commands may be abbreviated as long as the abbreviation\n"
 "matches only one command, e.g. l == li == lis == list."
@@ -148,7 +148,7 @@ msgstr ""
 "I comandi possono essere abbreviati finchÃ¨ l'abbreviazione rimane univoca\n"
 "es: l == li == lis == list."
 
-#: ../roundup/admin.py:270
+#: ../roundup/admin.py:281
 msgid ""
 "\n"
 "All commands (except help) require a tracker specifier. This is just\n"
@@ -216,25 +216,25 @@ msgid ""
 "Command help:\n"
 msgstr ""
 
-#: ../roundup/admin.py:334
+#: ../roundup/admin.py:345
 #, python-format
 msgid "%s:"
 msgstr "%s:"
 
 # ../roundup/admin.py:340 ../roundup/admin.py:396 ../roundup/admin.py:340:396
-#: ../roundup/admin.py:439 ../roundup/admin.py:1415
-#: ../roundup/admin.py:439:1415
+#: ../roundup/admin.py:450 ../roundup/admin.py:1426
+#: ../roundup/admin.py:450:1426
 msgid "Templates:"
 msgstr "Modelli predefiniti:"
 
 # ../roundup/admin.py:343 ../roundup/admin.py:407 ../roundup/admin.py:343:407
-#: ../roundup/admin.py:442 ../roundup/admin.py:1425
-#: ../roundup/admin.py:442:1425
+#: ../roundup/admin.py:453 ../roundup/admin.py:1436
+#: ../roundup/admin.py:453:1436
 msgid "Back ends:"
 msgstr "Back ends:"
 
 #. noqa: ARG002
-#: ../roundup/admin.py:459
+#: ../roundup/admin.py:470
 msgid ""
 "Usage: commit\n"
 "        Commit changes made to the database during an interactive session.\n"
@@ -248,7 +248,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:474
+#: ../roundup/admin.py:485
 msgid ""
 "Usage: create classname property=value ...\n"
 "        Create a new entry of a given class.\n"
@@ -262,42 +262,42 @@ msgstr ""
 
 # ../roundup/admin.py:1243 ../roundup/admin.py:369:466 :1020:1042 :1072:1171
 # :1243 :527:606 :656:714 :735:763 :834:901 :972
-#: ../roundup/admin.py:482 ../roundup/admin.py:555 ../roundup/admin.py:606
-#: ../roundup/admin.py:733 ../roundup/admin.py:806 ../roundup/admin.py:851
-#: ../roundup/admin.py:902 ../roundup/admin.py:999 ../roundup/admin.py:1216
-#: ../roundup/admin.py:1388 ../roundup/admin.py:1516 ../roundup/admin.py:1599
-#: ../roundup/admin.py:1725 ../roundup/admin.py:1848 ../roundup/admin.py:1880
-#: ../roundup/admin.py:1996 ../roundup/admin.py:2050 ../roundup/admin.py:2098
-#: ../roundup/admin.py:482:555 :1216:1388:1516 :1599:1725 :1848:1880 :1996:2050
-#: :2098 :606:733 :806:851 :902:999
+#: ../roundup/admin.py:493 ../roundup/admin.py:566 ../roundup/admin.py:617
+#: ../roundup/admin.py:744 ../roundup/admin.py:817 ../roundup/admin.py:862
+#: ../roundup/admin.py:913 ../roundup/admin.py:1010 ../roundup/admin.py:1227
+#: ../roundup/admin.py:1399 ../roundup/admin.py:1527 ../roundup/admin.py:1610
+#: ../roundup/admin.py:1736 ../roundup/admin.py:1859 ../roundup/admin.py:1891
+#: ../roundup/admin.py:2007 ../roundup/admin.py:2061 ../roundup/admin.py:2109
+#: ../roundup/admin.py:493:566 :1227:1399 :1527:1610 :1736:1859 :1891:2007
+#: :2061:2109 :617:744 :817:862 :913:1010
 msgid "Not enough arguments supplied"
 msgstr "Non sono stati forniti abbastanza argomenti"
 
-#: ../roundup/admin.py:502
+#: ../roundup/admin.py:513
 #, python-format
 msgid "%(propname)s (Password): "
 msgstr "%(propname)sÂ·(Password):Â·"
 
-#: ../roundup/admin.py:505
+#: ../roundup/admin.py:516
 #, python-format
 msgid "   %(propname)s (Again): "
 msgstr "   %(propname)s (Ripeti password): "
 
-#: ../roundup/admin.py:509
+#: ../roundup/admin.py:520
 msgid "Sorry, try again..."
 msgstr "Mi dispiace, riprova..."
 
-#: ../roundup/admin.py:514
+#: ../roundup/admin.py:525
 #, python-format
 msgid "%(propname)s (%(proptype)s): "
 msgstr "%(propname)s (%(proptype)s): "
 
-#: ../roundup/admin.py:533
+#: ../roundup/admin.py:544
 #, python-format
 msgid "you must provide the \"%(propname)s\" property."
 msgstr "deve essere fornita la proprietÃ  \"%(propname)s\"."
 
-#: ../roundup/admin.py:545
+#: ../roundup/admin.py:556
 msgid ""
 "Usage: display designator[,designator]*\n"
 "        Show the property values for the given node(s).\n"
@@ -310,13 +310,13 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:586
+#: ../roundup/admin.py:597
 #, fuzzy, python-format
 msgid "%(protected)s%(key)s: %(value)s"
 msgstr "%(key)s:Â·%(value)s"
 
 #. grab the directory to export to
-#: ../roundup/admin.py:589
+#: ../roundup/admin.py:600
 msgid ""
 "Usage: export [[-]class[,class]] export_dir\n"
 "        Export the database and file content.\n"
@@ -335,7 +335,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:704
+#: ../roundup/admin.py:715
 msgid ""
 "Usage: exporttables [[-]class[,class]] export_dir\n"
 "        Export only the database to files, no file content.\n"
@@ -355,7 +355,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:723
+#: ../roundup/admin.py:734
 msgid ""
 "Usage: filter classname propname=value ...\n"
 "        Find the nodes of the given class with a given property value.\n"
@@ -369,20 +369,20 @@ msgid ""
 msgstr ""
 
 # ../roundup/admin.py:920 ../roundup/admin.py:701:854 :866:920
-#: ../roundup/admin.py:764
+#: ../roundup/admin.py:775
 #, fuzzy, python-format
 msgid "Class %(curclassname)s has no property %(pn)s in %(propname)s."
 msgstr "la classe %(classname)s non ha la proprietÃ  \"%(propname)s\""
 
 # ../roundup/admin.py:920 ../roundup/admin.py:701:854 :866:920
-#: ../roundup/admin.py:791 ../roundup/admin.py:840 ../roundup/admin.py:1536
-#: ../roundup/admin.py:1549 ../roundup/admin.py:2120
-#: ../roundup/admin.py:791:840 :1536:1549:2120
+#: ../roundup/admin.py:802 ../roundup/admin.py:851 ../roundup/admin.py:1547
+#: ../roundup/admin.py:1560 ../roundup/admin.py:2131
+#: ../roundup/admin.py:802:851 :1547:1560:2131
 #, python-format
 msgid "%(classname)s has no property \"%(propname)s\""
 msgstr "la classe %(classname)s non ha la proprietÃ  \"%(propname)s\""
 
-#: ../roundup/admin.py:798
+#: ../roundup/admin.py:809
 msgid ""
 "Usage: find classname propname=value ...\n"
 "        Find the nodes of the given class with a given link property value.\n"
@@ -393,14 +393,14 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:847
+#: ../roundup/admin.py:858
 msgid ""
 "Usage: genconfig filename\n"
 "        Create a new tracker config file with default values in filename.\n"
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:864
+#: ../roundup/admin.py:875
 #, python-format
 msgid ""
 "Changing option\n"
@@ -408,20 +408,20 @@ msgid ""
 "from old default of %(old_number)s to new default of %(new_number)s."
 msgstr ""
 
-#: ../roundup/admin.py:875
+#: ../roundup/admin.py:886
 #, python-format
 msgid ""
 "Update 'password_pbkdf2_default_rounds' to a number equal to or larger\n"
 "  than %s.\n"
 msgstr ""
 
-#: ../roundup/admin.py:882
+#: ../roundup/admin.py:893
 msgid ""
 "Check the rdbms mysql_* settings. Your charset and collations may need\n"
 "  to be changed. See upgrading instructions.\n"
 msgstr ""
 
-#: ../roundup/admin.py:892
+#: ../roundup/admin.py:903
 msgid ""
 "Usage: get property designator[,designator]*\n"
 "        Get the given property of one or more designator(s).\n"
@@ -435,24 +435,24 @@ msgid ""
 msgstr ""
 
 # ../roundup/admin.py:560 ../roundup/admin.py:575 ../roundup/admin.py:560:575
-#: ../roundup/admin.py:925
+#: ../roundup/admin.py:936
 #, python-format
 msgid "property %s is not of type Multilink or Link so -d flag does not apply."
 msgstr ""
 
 # ../roundup/admin.py:1054 ../roundup/admin.py:583:983 :1032:1054
-#: ../roundup/admin.py:942 ../roundup/admin.py:1190 ../roundup/admin.py:1864
-#: ../roundup/admin.py:1892 ../roundup/admin.py:942:1190 :1864:1892
+#: ../roundup/admin.py:953 ../roundup/admin.py:1201 ../roundup/admin.py:1875
+#: ../roundup/admin.py:1903 ../roundup/admin.py:953:1201 :1875:1903
 #, python-format
 msgid "no such %(classname)s node \"%(nodeid)s\""
 msgstr ""
 
-#: ../roundup/admin.py:945
+#: ../roundup/admin.py:956
 #, python-format
 msgid "no such %(classname)s property \"%(propname)s\""
 msgstr ""
 
-#: ../roundup/admin.py:950
+#: ../roundup/admin.py:961
 msgid ""
 "Usage: help topic\n"
 "        Give help about topic.\n"
@@ -464,12 +464,12 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:969
+#: ../roundup/admin.py:980
 #, python-format
 msgid "Sorry, no help for \"%(topic)s\""
 msgstr "Nessun aiuto per \"%(topic)s\""
 
-#: ../roundup/admin.py:986
+#: ../roundup/admin.py:997
 msgid ""
 "Usage: history designator [skipquiet] [raw]\n"
 "        Show the history entries of a designator.\n"
@@ -484,27 +484,27 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1011
+#: ../roundup/admin.py:1022
 #, python-format
 msgid "Unexpected argument(s): %s. Expected 'skipquiet' or 'raw'."
 msgstr ""
 
-#: ../roundup/admin.py:1062
+#: ../roundup/admin.py:1073
 #, fuzzy
 msgid "removed"
 msgstr "rimuovi"
 
-#: ../roundup/admin.py:1064
+#: ../roundup/admin.py:1075
 msgid "added"
 msgstr ""
 
-#: ../roundup/admin.py:1066
+#: ../roundup/admin.py:1077
 #, python-format
 msgid "Unknown history set operation '%s'. Expected +/-."
 msgstr ""
 
 #. .Hint added issue23 to superseder
-#: ../roundup/admin.py:1091
+#: ../roundup/admin.py:1102
 #, fuzzy, python-format
 msgid "added %(class)s%(item_id)s to %(propname)s"
 msgstr "%(class)s %(id)s %(properties)s modificata correttamente"
@@ -512,29 +512,29 @@ msgstr "%(class)s %(id)s %(properties)s modificata correttamente"
 #. .Hint read as: assignedto was admin(1)
 #. where assignedto is the property
 #. admin is the key name for value 1
-#: ../roundup/admin.py:1112
+#: ../roundup/admin.py:1123
 #, fuzzy, python-format
 msgid "%(prop)s was %(name)s(%(value)s)"
 msgstr "%(propname)s (%(proptype)s): "
 
-#: ../roundup/admin.py:1118 ../roundup/admin.py:1147
-#: ../roundup/admin.py:1118:1147
+#: ../roundup/admin.py:1129 ../roundup/admin.py:1158
+#: ../roundup/admin.py:1129:1158
 #, fuzzy, python-format
 msgid "%(prop)s was %(value)s"
 msgstr "%(key)s:Â·%(value)s"
 
-#: ../roundup/admin.py:1137
+#: ../roundup/admin.py:1148
 #, python-format
 msgid "%(prop)s was [%(value_list)s]"
 msgstr ""
 
 #. .Hint modified nosy: added demo(3)
-#: ../roundup/admin.py:1144
+#: ../roundup/admin.py:1155
 #, python-format
 msgid "modified %(prop)s: %(how)s"
 msgstr ""
 
-#: ../roundup/admin.py:1195
+#: ../roundup/admin.py:1206
 msgid ""
 "Usage: import import_dir\n"
 "        Import a database and file contents from the directory.\n"
@@ -558,7 +558,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1306
+#: ../roundup/admin.py:1317
 msgid ""
 "Usage: importtables export_dir\n"
 "        This imports the database tables exported using exporttables.\n"
@@ -568,7 +568,7 @@ msgid ""
 msgstr ""
 
 #. password
-#: ../roundup/admin.py:1314
+#: ../roundup/admin.py:1325
 msgid ""
 "Usage: initialise [adminpw]\n"
 "        Initialise a new Roundup tracker.\n"
@@ -579,30 +579,30 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1328
+#: ../roundup/admin.py:1339
 msgid "Admin Password: "
 msgstr "Password dell'amministratore"
 
-#: ../roundup/admin.py:1329
+#: ../roundup/admin.py:1340
 msgid "       Confirm: "
 msgstr "       Conferma: "
 
-#: ../roundup/admin.py:1333
+#: ../roundup/admin.py:1344
 msgid "Instance home does not exist"
 msgstr "La home dell'istanza non esiste"
 
-#: ../roundup/admin.py:1337
+#: ../roundup/admin.py:1348
 msgid "Instance has not been installed"
 msgstr "L'istanza non Ã¨ stata installata"
 
-#: ../roundup/admin.py:1345
+#: ../roundup/admin.py:1356
 msgid ""
 "WARNING: The database is already initialised!\n"
 "If you re-initialise it, you will lose all the data!\n"
 "Erase it? Y/N: "
 msgstr ""
 
-#: ../roundup/admin.py:1365
+#: ../roundup/admin.py:1376
 msgid ""
 "Usage: install [template [backend [key=val[,key=val]]]]\n"
 "        Install a new Roundup tracker.\n"
@@ -628,12 +628,12 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1394
+#: ../roundup/admin.py:1405
 #, python-format
 msgid "Instance home parent directory \"%(parent)s\" does not exist"
 msgstr "la directory radice dell'istanza \"%(parent)s\" non esiste"
 
-#: ../roundup/admin.py:1403
+#: ../roundup/admin.py:1414
 #, python-format
 msgid ""
 "WARNING: There appears to be a tracker in \"%(tracker_home)s\"!\n"
@@ -644,22 +644,22 @@ msgstr ""
 "Se verrÃ  reinstallata, tutti i dati precedentemente salvati andranno persi\n"
 "Cancellare la directory specificata? Y/N: "
 
-#: ../roundup/admin.py:1416
+#: ../roundup/admin.py:1427
 #, fuzzy
 msgid "Select template"
 msgstr "Seleziona il modello predefinito [classic]: "
 
-#: ../roundup/admin.py:1426
+#: ../roundup/admin.py:1437
 #, fuzzy
 msgid "Select backend"
 msgstr "Seleziona il backend [anydbm]: "
 
-#: ../roundup/admin.py:1437
+#: ../roundup/admin.py:1448
 #, python-format
 msgid "Error in configuration settings: \"%s\""
 msgstr "Erorre nei settaggi di configurazione: \"%s\""
 
-#: ../roundup/admin.py:1470
+#: ../roundup/admin.py:1481
 #, python-format
 msgid ""
 "\n"
@@ -668,11 +668,11 @@ msgid ""
 "   %(config_file)s"
 msgstr ""
 
-#: ../roundup/admin.py:1480
+#: ../roundup/admin.py:1491
 msgid " ... at a minimum, you must set following options:"
 msgstr " ... devono essere configurate almeno le seguenti opzioni:"
 
-#: ../roundup/admin.py:1485
+#: ../roundup/admin.py:1496
 #, python-format
 msgid ""
 "\n"
@@ -689,7 +689,7 @@ msgid ""
 "---------------------------------------------------------------------------\n"
 msgstr ""
 
-#: ../roundup/admin.py:1501
+#: ../roundup/admin.py:1512
 msgid ""
 "Usage: list classname [property]\n"
 "        List the instances of a class.\n"
@@ -705,17 +705,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1514
+#: ../roundup/admin.py:1525
 msgid "Too many arguments supplied"
 msgstr ""
 
-#: ../roundup/admin.py:1547
+#: ../roundup/admin.py:1558
 #, python-format
 msgid "%(nodeid)4s: %(value)s"
 msgstr ""
 
 #. noqa: ARG002  - args unused
-#: ../roundup/admin.py:1554
+#: ../roundup/admin.py:1565
 msgid ""
 "Usage: migrate\n"
 "        Update a tracker's database to be compatible with the Roundup\n"
@@ -738,17 +738,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1574
+#: ../roundup/admin.py:1585
 #, python-format
 msgid "Tracker updated to schema version %s."
 msgstr ""
 
-#: ../roundup/admin.py:1578
+#: ../roundup/admin.py:1589
 #, python-format
 msgid "No migration action required. At schema version %s."
 msgstr ""
 
-#: ../roundup/admin.py:1583
+#: ../roundup/admin.py:1594
 msgid ""
 "Usage: pack period | date\n"
 "        Remove journal entries older than the date/period.\n"
@@ -768,11 +768,11 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1609
+#: ../roundup/admin.py:1620
 msgid "Invalid format"
 msgstr ""
 
-#: ../roundup/admin.py:1620
+#: ../roundup/admin.py:1631
 msgid ""
 "Usage: perftest [mode] [arguments]*\n"
 "        Time operations in Roundup.\n"
@@ -790,25 +790,25 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1657
+#: ../roundup/admin.py:1668
 msgid "Invalid 'rounds'. Must be larger than 999."
 msgstr ""
 
-#: ../roundup/admin.py:1661
+#: ../roundup/admin.py:1672
 #, python-format
 msgid "Invalid 'rounds'. It must be an integer not: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1688
+#: ../roundup/admin.py:1699
 msgid "scheme does not support rounds."
 msgstr ""
 
-#: ../roundup/admin.py:1691
+#: ../roundup/admin.py:1702
 #, python-format
 msgid "Hash time: %(time)0.9f seconds, scheme: %(scheme)s, rounds: %(rounds)s"
 msgstr ""
 
-#: ../roundup/admin.py:1697
+#: ../roundup/admin.py:1708
 msgid ""
 "Usage: pragma setting=value | 'list'\n"
 "        Set internal admin settings to a value.\n"
@@ -837,49 +837,49 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1732
+#: ../roundup/admin.py:1743
 #, python-format
 msgid "Argument must be setting=value, was given: %s."
 msgstr ""
 
-#: ../roundup/admin.py:1735
+#: ../roundup/admin.py:1746
 msgid "Current settings and values (NYI - not yet implemented):"
 msgstr ""
 
-#: ../roundup/admin.py:1746
+#: ../roundup/admin.py:1757
 msgid ""
 "      Help for this pragma is missing. Please report it to the Roundup "
 "project.\n"
 msgstr ""
 
-#: ../roundup/admin.py:1752
+#: ../roundup/admin.py:1763
 #, fuzzy, python-format
 msgid "Unknown setting %s. Try \"pragma list\"."
 msgstr "Nome Utente sconosciuto"
 
-#: ../roundup/admin.py:1762
+#: ../roundup/admin.py:1773
 #, python-format
 msgid "Incorrect value for boolean setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1769
+#: ../roundup/admin.py:1780
 #, python-format
 msgid "Incorrect value for integer setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1776
+#: ../roundup/admin.py:1787
 #, python-format
 msgid ""
 "Incorrect value for setting %(setting)s: %(value)s. Should be no, both, or "
 "only."
 msgstr ""
 
-#: ../roundup/admin.py:1786
+#: ../roundup/admin.py:1797
 #, python-format
 msgid "Internal error: pragma can not handle values of type: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1795
+#: ../roundup/admin.py:1806
 msgid ""
 "Usage: reindex [classname|classname:#-#|designator]*\n"
 "        Re-generate a tracker's search indexes.\n"
@@ -896,18 +896,18 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1817
+#: ../roundup/admin.py:1828
 #, python-format
 msgid "no such item \"%(designator)s\""
 msgstr ""
 
 # ../roundup/admin.py:1052 ../roundup/admin.py:85:981 :1030:1052
-#: ../roundup/admin.py:1827
+#: ../roundup/admin.py:1838
 #, fuzzy, python-format
 msgid "no such item \"%(class)s%(id)s\""
 msgstr "classe \"%(classname)s\" mancante"
 
-#: ../roundup/admin.py:1839
+#: ../roundup/admin.py:1850
 msgid ""
 "Usage: restore designator[,designator]*\n"
 "        Restore the retired node specified by designator.\n"
@@ -919,7 +919,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1870
+#: ../roundup/admin.py:1881
 msgid ""
 "Usage: retire designator[,designator]*\n"
 "        Retire the node specified by designator.\n"
@@ -933,7 +933,7 @@ msgid ""
 msgstr ""
 
 #. noqa: ARG002 - args unused
-#: ../roundup/admin.py:1898
+#: ../roundup/admin.py:1909
 msgid ""
 "Usage: rollback\n"
 "        Undo all changes that are pending commit to the database.\n"
@@ -945,7 +945,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1911
+#: ../roundup/admin.py:1922
 msgid ""
 "Usage: security [Role name]\n"
 "        Display the Permissions available to one or all Roles.\n"
@@ -958,46 +958,46 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1926
+#: ../roundup/admin.py:1937
 #, fuzzy, python-format
 msgid "No such Role \"%(role)s\"\n"
 msgstr "Non Ã¨ presente il ruolo \"%(role)s\""
 
-#: ../roundup/admin.py:1932
+#: ../roundup/admin.py:1943
 #, fuzzy, python-format
 msgid "New Web users get the Roles \"%(role)s\"\n"
 msgstr "I nuovi utenti Web otterranno i ruoli \"%(role)s\""
 
-#: ../roundup/admin.py:1935
+#: ../roundup/admin.py:1946
 #, fuzzy, python-format
 msgid "New Web users get the Role \"%(role)s\"\n"
 msgstr "I nuovi utenti Web otterranno il ruolo \"%(role)s)\""
 
-#: ../roundup/admin.py:1939
+#: ../roundup/admin.py:1950
 #, fuzzy, python-format
 msgid "New Email users get the Roles \"%(role)s\"\n"
 msgstr "I nuovi utenti Email otterranno i ruoli \"%(role)s)\""
 
-#: ../roundup/admin.py:1941
+#: ../roundup/admin.py:1952
 #, fuzzy, python-format
 msgid "New Email users get the Role \"%(role)s\"\n"
 msgstr "I nuovi utenti Email otterranno il ruolo \"%(role)s\""
 
-#: ../roundup/admin.py:1944
+#: ../roundup/admin.py:1955
 #, fuzzy, python-format
 msgid "Role \"%(name)s\":\n"
 msgstr "Ruolo \"%(name)s\":"
 
-#: ../roundup/admin.py:1950
+#: ../roundup/admin.py:1961
 msgid " %(description)s (%(name)s for \"%(klass)s\""
 msgstr ""
 
-#: ../roundup/admin.py:1950
+#: ../roundup/admin.py:1961
 #, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\": %(properties)s only)\n"
 msgstr ""
 
-#: ../roundup/admin.py:1963
+#: ../roundup/admin.py:1974
 #, python-format
 msgid ""
 "\n"
@@ -1005,17 +1005,17 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/admin.py:1969
+#: ../roundup/admin.py:1980
 #, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\" only)\n"
 msgstr ""
 
-#: ../roundup/admin.py:1972
+#: ../roundup/admin.py:1983
 #, python-format
 msgid " %(description)s (%(name)s)\n"
 msgstr ""
 
-#: ../roundup/admin.py:1976
+#: ../roundup/admin.py:1987
 msgid ""
 "Usage: set items property=value [property=value ...]\n"
 "        Set the given properties of one or more items(s).\n"
@@ -1036,7 +1036,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2044
+#: ../roundup/admin.py:2055
 msgid ""
 "Usage: specification classname\n"
 "        Show the properties for a classname.\n"
@@ -1045,17 +1045,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2063
+#: ../roundup/admin.py:2074
 #, fuzzy, python-format
 msgid "%(key)s: %(value)s (key property)\n"
 msgstr "%(key)s %(value)s (chiave)"
 
-#: ../roundup/admin.py:2066
+#: ../roundup/admin.py:2077
 #, fuzzy, python-format
 msgid "%(key)s: %(value)s\n"
 msgstr "%(key)s:Â·%(value)s"
 
-#: ../roundup/admin.py:2069
+#: ../roundup/admin.py:2080
 msgid ""
 "Usage: table classname [property[,property]*]\n"
 "        List the instances of a class in tabular form.\n"
@@ -1087,17 +1087,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2115
+#: ../roundup/admin.py:2126
 #, python-format
 msgid "\"%(spec)s\" not name:width"
 msgstr ""
 
-#: ../roundup/admin.py:2137
+#: ../roundup/admin.py:2148
 #, python-format
 msgid "\"%(spec)s\" does not have an integer width: \"%(width)s\""
 msgstr ""
 
-#: ../roundup/admin.py:2173
+#: ../roundup/admin.py:2184
 msgid ""
 "Usage: templates [trace_search]\n"
 "        List templates and their installed directories.\n"
@@ -1107,7 +1107,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2201
+#: ../roundup/admin.py:2212
 msgid ""
 "Usage: updateconfig <filename>\n"
 "        Merge existing tracker config with new settings.\n"
@@ -1118,92 +1118,92 @@ msgid ""
 msgstr ""
 
 # ../roundup/cgi/actions.py:597:608 :779:798
-#: ../roundup/admin.py:2210 ../roundup/cgi/actions.py:886
-#: ../roundup/cgi/actions.py:897 ../roundup/cgi/actions.py:1099
-#: ../roundup/cgi/actions.py:1113 ../roundup/cgi/actions.py:886:897 :1099:1113
+#: ../roundup/admin.py:2221 ../roundup/cgi/actions.py:891
+#: ../roundup/cgi/actions.py:902 ../roundup/cgi/actions.py:1104
+#: ../roundup/cgi/actions.py:1118 ../roundup/cgi/actions.py:891:902 :1104:1118
 #, python-format
 msgid "Error: %s"
 msgstr "Errore: %s"
 
-#: ../roundup/admin.py:2242
+#: ../roundup/admin.py:2253
 #, python-format
 msgid "Unknown command \"%(command)s\" (\"help commands\" for a list)"
 msgstr ""
 
-#: ../roundup/admin.py:2248
+#: ../roundup/admin.py:2259
 #, python-format
 msgid "Multiple commands match \"%(command)s\": %(list)s"
 msgstr ""
 
-#: ../roundup/admin.py:2263
+#: ../roundup/admin.py:2274
 msgid "Enter tracker home: "
 msgstr ""
 
-#: ../roundup/admin.py:2292 ../roundup/admin.py:2296
-#: ../roundup/admin.py:2292:2296
+#: ../roundup/admin.py:2303 ../roundup/admin.py:2307
+#: ../roundup/admin.py:2303:2307
 #, python-format
 msgid "Error: Couldn't open tracker: %(message)s"
 msgstr ""
 
-#: ../roundup/admin.py:2344
+#: ../roundup/admin.py:2355
 #, python-format
 msgid ""
 "Roundup %s ready for input.\n"
 "Type \"help\" for help."
 msgstr ""
 
-#: ../roundup/admin.py:2377
+#: ../roundup/admin.py:2388
 msgid "Note: command history and editing not available"
 msgstr ""
 
-#: ../roundup/admin.py:2383
+#: ../roundup/admin.py:2394
 msgid "exit..."
 msgstr ""
 
-#: ../roundup/admin.py:2396
+#: ../roundup/admin.py:2407
 msgid "There are unsaved changes. Commit them (y/N)? "
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:215
-#: ../roundup/backends/rdbms_common.py:928
+#: ../roundup/backends/back_anydbm.py:213
+#: ../roundup/backends/rdbms_common.py:926
 #, python-format
 msgid "Class \"%s\" already defined."
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:280
+#: ../roundup/backends/back_anydbm.py:278
 #: ../roundup/backends/sessions_dbm.py:61
 msgid "Couldn't identify database type"
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:314
+#: ../roundup/backends/back_anydbm.py:312
 #, python-format
 msgid ""
 "Couldn't open database - the required module '%s' (as dbm.gnu) is not "
 "available"
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:318
+#: ../roundup/backends/back_anydbm.py:316
 #, python-format
 msgid "Couldn't open database - the required module '%s' is not available"
 msgstr ""
 
 #: ../roundup/backends/back_anydbm.py:873
 #: ../roundup/backends/back_anydbm.py:886
-#: ../roundup/backends/back_anydbm.py:1160
-#: ../roundup/backends/back_anydbm.py:1195
-#: ../roundup/backends/back_anydbm.py:1424
-#: ../roundup/backends/back_anydbm.py:1442
-#: ../roundup/backends/back_anydbm.py:1489
-#: ../roundup/backends/back_anydbm.py:2135
+#: ../roundup/backends/back_anydbm.py:1162
+#: ../roundup/backends/back_anydbm.py:1197
+#: ../roundup/backends/back_anydbm.py:1426
+#: ../roundup/backends/back_anydbm.py:1444
+#: ../roundup/backends/back_anydbm.py:1492
+#: ../roundup/backends/back_anydbm.py:2138
 #: ../roundup/backends/back_anydbm.py:873:886
-#: ../roundup/backends/rdbms_common.py:1720
-#: ../roundup/backends/rdbms_common.py:1967
-#: ../roundup/backends/rdbms_common.py:2206
-#: ../roundup/backends/rdbms_common.py:2226
-#: ../roundup/backends/rdbms_common.py:2279
-#: ../roundup/backends/rdbms_common.py:3254
-#: ../roundup/backends/rdbms_common.py:1720:1967 :1160:1195 :1424:1442:1489
-#: :2135 :2206:2226 :2279:3254
+#: ../roundup/backends/rdbms_common.py:1721
+#: ../roundup/backends/rdbms_common.py:1972
+#: ../roundup/backends/rdbms_common.py:2211
+#: ../roundup/backends/rdbms_common.py:2231
+#: ../roundup/backends/rdbms_common.py:2293
+#: ../roundup/backends/rdbms_common.py:3268
+#: ../roundup/backends/rdbms_common.py:1721:1972 :1162:1197 :1426:1444:1492
+#: :2138 :2211:2231 :2293:3268
 msgid "Database open read-only"
 msgstr ""
 
@@ -1229,45 +1229,51 @@ msgstr ""
 msgid "Unable to get lock after 10 retries on %s."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:632
+#: ../roundup/backends/rdbms_common.py:630
 #, python-format
 msgid "ALTER operation disallowed: %(old)r -> %(new)r."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:867
+#: ../roundup/backends/rdbms_common.py:865
 #, python-format
 msgid "CREATE operation disallowed: \"%s\"."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:884
+#: ../roundup/backends/rdbms_common.py:882
 #, python-format
 msgid "DROP operation disallowed: \"%s\"."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:1863
+#: ../roundup/backends/rdbms_common.py:1864
 msgid "create"
 msgstr "crea"
 
-#: ../roundup/backends/rdbms_common.py:2038
+#: ../roundup/backends/rdbms_common.py:2043
 msgid "unlink"
 msgstr "collega"
 
-#: ../roundup/backends/rdbms_common.py:2042
+#: ../roundup/backends/rdbms_common.py:2047
 msgid "link"
 msgstr "scollega"
 
-#: ../roundup/backends/rdbms_common.py:2187
+#: ../roundup/backends/rdbms_common.py:2192
 msgid "set"
 msgstr "assegna"
 
-#: ../roundup/backends/rdbms_common.py:2216
+#: ../roundup/backends/rdbms_common.py:2221
 msgid "retired"
 msgstr "ritira"
 
-#: ../roundup/backends/rdbms_common.py:2246
+#: ../roundup/backends/rdbms_common.py:2251
 msgid "restored"
 msgstr "ripristina"
 
+#: ../roundup/backends/rdbms_common.py:2265
+#, fuzzy, python-format
+msgid "class %(cls)s: %(value)r is not an id"
+msgstr ""
+"la proprietÃ  \"%(propname)s\": \"%(value)s\" non Ã¨ al momento nella lista"
+
 #: ../roundup/backends/sessions_redis.py:78
 #: ../roundup/backends/sessions_redis.py:97
 #: ../roundup/backends/sessions_redis.py:78:97
@@ -1350,10 +1356,10 @@ msgid "\"%(input)s\" is not an ID (%(classname)s ID required)"
 msgstr "\"%(input)s\" non Ã¨ un ID (ID della %(classname)s Ã¨ obbligatorio)"
 
 #: ../roundup/cgi/actions.py:228 ../roundup/cgi/actions.py:266
-#: ../roundup/cgi/actions.py:493 ../roundup/cgi/actions.py:833
-#: ../roundup/cgi/actions.py:880 ../roundup/cgi/actions.py:1084
-#: ../roundup/cgi/actions.py:1246 ../roundup/cgi/actions.py:228:266:1246
-#: :493:833 :880:1084
+#: ../roundup/cgi/actions.py:493 ../roundup/cgi/actions.py:838
+#: ../roundup/cgi/actions.py:885 ../roundup/cgi/actions.py:1089
+#: ../roundup/cgi/actions.py:1251 ../roundup/cgi/actions.py:228:266:1251
+#: :493:838 :885:1089
 msgid "Invalid request"
 msgstr ""
 
@@ -1407,8 +1413,8 @@ msgstr "Login invalida"
 msgid "Invalid integer: "
 msgstr "Login invalida"
 
-#: ../roundup/cgi/actions.py:531 ../roundup/cgi/actions.py:735
-#: ../roundup/cgi/actions.py:531:735
+#: ../roundup/cgi/actions.py:531 ../roundup/cgi/actions.py:740
+#: ../roundup/cgi/actions.py:531:740
 #, python-format
 msgid "You do not have permission to create %(class)s"
 msgstr "Non hai il permesso per creare %(class)s"
@@ -1418,8 +1424,8 @@ msgstr "Non hai il permesso per creare %(class)s"
 msgid "Not enough values on line %(line)s"
 msgstr "Non abbastanza valori alla riga %(line)s"
 
-#: ../roundup/cgi/actions.py:556 ../roundup/cgi/actions.py:723
-#: ../roundup/cgi/actions.py:556:723
+#: ../roundup/cgi/actions.py:556 ../roundup/cgi/actions.py:728
+#: ../roundup/cgi/actions.py:556:728
 #, python-format
 msgid "You do not have permission to edit %(class)s"
 msgstr "Non hai i permessi per modificare i %(class)s"
@@ -1428,17 +1434,17 @@ msgstr "Non hai i permessi per modificare i %(class)s"
 msgid "Items edited OK"
 msgstr "Item modificato correttamente"
 
-#: ../roundup/cgi/actions.py:671
+#: ../roundup/cgi/actions.py:676
 #, python-format
 msgid "%(class)s %(id)s %(properties)s edited ok"
 msgstr "%(class)s %(id)s %(properties)s modificata correttamente"
 
-#: ../roundup/cgi/actions.py:689
+#: ../roundup/cgi/actions.py:694
 #, python-format
 msgid "%(class)s %(id)s created"
 msgstr "%(class)s %(id)s creata"
 
-#: ../roundup/cgi/actions.py:817
+#: ../roundup/cgi/actions.py:822
 #, fuzzy, python-format
 msgid ""
 "Edit Error: someone else has edited this %(klass)s (%(props)s). View <a "
@@ -1448,12 +1454,12 @@ msgstr ""
 "(%(props)s). Visualizza <a target=\"new\" href=\"%(klass)s%(id)s\">le sue "
 "modifiche</a> in una nuova finestra."
 
-#: ../roundup/cgi/actions.py:850
+#: ../roundup/cgi/actions.py:855
 #, python-format
 msgid "Edit Error: %s"
 msgstr "Errore di modifica: %s"
 
-#: ../roundup/cgi/actions.py:931
+#: ../roundup/cgi/actions.py:936
 msgid ""
 "Invalid One Time Key!\n"
 "(a Mozilla bug may cause this message to show up erroneously, please check "
@@ -1463,12 +1469,12 @@ msgstr ""
 "(un bug di Mozilla puÃ² causare la erronea presenza di questo messaggio, (per "
 "favore controlla la tua email)"
 
-#: ../roundup/cgi/actions.py:972
+#: ../roundup/cgi/actions.py:977
 #, fuzzy, python-format
 msgid "Password reset for %s"
 msgstr "Richiesta nuova password"
 
-#: ../roundup/cgi/actions.py:973
+#: ../roundup/cgi/actions.py:978
 #, python-format
 msgid ""
 "\n"
@@ -1477,29 +1483,29 @@ msgid ""
 "Your password is now: %(password)s\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:982
+#: ../roundup/cgi/actions.py:987
 #, python-format
 msgid "Password reset and email sent to %s"
 msgstr "Password modificata e mandata in email a %s"
 
-#: ../roundup/cgi/actions.py:991
+#: ../roundup/cgi/actions.py:996
 msgid "Unknown username"
 msgstr "Nome Utente sconosciuto"
 
-#: ../roundup/cgi/actions.py:999
+#: ../roundup/cgi/actions.py:1004
 msgid "Unknown email address"
 msgstr "Indirizzo di email sconosciuto"
 
-#: ../roundup/cgi/actions.py:1004
+#: ../roundup/cgi/actions.py:1009
 msgid "You need to specify a username or address"
 msgstr "Ãˆ necessario specificare un Nome Utente o un indirizzo email"
 
-#: ../roundup/cgi/actions.py:1015
+#: ../roundup/cgi/actions.py:1020
 #, fuzzy, python-format
 msgid "Confirm reset of password for %s"
 msgstr "Conferma Password"
 
-#: ../roundup/cgi/actions.py:1016
+#: ../roundup/cgi/actions.py:1021
 #, python-format
 msgid ""
 "\n"
@@ -1513,31 +1519,31 @@ msgid ""
 "You should then receive another email with the new password.\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1029
+#: ../roundup/cgi/actions.py:1034
 #, python-format
 msgid "Email sent to primary notification address for %s."
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1031
+#: ../roundup/cgi/actions.py:1036
 #, fuzzy, python-format
 msgid "Email sent to %s."
 msgstr "Email inviata a %s"
 
-#: ../roundup/cgi/actions.py:1046
+#: ../roundup/cgi/actions.py:1051
 msgid "You are now registered, welcome!"
 msgstr "Ora sei un utente registrato, benvenuto!"
 
-#: ../roundup/cgi/actions.py:1139
+#: ../roundup/cgi/actions.py:1144
 #, python-format
 msgid "Username '%s' is already used."
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1163
+#: ../roundup/cgi/actions.py:1168
 #, python-format
 msgid "Complete your registration to %(tracker_name)s -- key %(key)s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1167
+#: ../roundup/cgi/actions.py:1172
 #, python-format
 msgid ""
 "To complete your registration of the user \"%(name)s\" with\n"
@@ -1553,12 +1559,12 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1181
+#: ../roundup/cgi/actions.py:1186
 #, python-format
 msgid "Complete your registration to %s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1182
+#: ../roundup/cgi/actions.py:1187
 #, python-format
 msgid ""
 "To complete your registration of the user \"%(name)s\" with\n"
@@ -1568,45 +1574,45 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1206
+#: ../roundup/cgi/actions.py:1211
 msgid "It is not permitted to supply roles at registration."
 msgstr "Non Ã¨ permesso fornire ruoli in fase di registrazione."
 
-#: ../roundup/cgi/actions.py:1220
+#: ../roundup/cgi/actions.py:1225
 msgid "You are logged out"
 msgstr "Disconnesso"
 
-#: ../roundup/cgi/actions.py:1250
+#: ../roundup/cgi/actions.py:1255
 msgid "Username required"
 msgstr "Ãˆ richiesto il Nome Utente"
 
-#: ../roundup/cgi/actions.py:1354
+#: ../roundup/cgi/actions.py:1359
 #, python-format
 msgid "Welcome %(username)s!"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1477
+#: ../roundup/cgi/actions.py:1482
 #, python-format
 msgid "Logins occurring too fast. Please wait: %s seconds."
 msgstr ""
 
 # ../roundup/cgi/actions.py:931:935
-#: ../roundup/cgi/actions.py:1515 ../roundup/cgi/actions.py:1526
-#: ../roundup/cgi/actions.py:1515:1526
+#: ../roundup/cgi/actions.py:1520 ../roundup/cgi/actions.py:1531
+#: ../roundup/cgi/actions.py:1520:1531
 msgid "Invalid login"
 msgstr "Login invalida"
 
-#: ../roundup/cgi/actions.py:1532
+#: ../roundup/cgi/actions.py:1537
 msgid "You do not have permission to login"
 msgstr "Non hai il permesso per eseguire la login"
 
-#: ../roundup/cgi/actions.py:1577 ../roundup/cgi/actions.py:1757
-#: ../roundup/cgi/actions.py:1577:1757
+#: ../roundup/cgi/actions.py:1582 ../roundup/cgi/actions.py:1762
+#: ../roundup/cgi/actions.py:1582:1762
 #, python-format
 msgid "Column \"%(column)s\" not found in %(class)s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1822
+#: ../roundup/cgi/actions.py:1827
 #, fuzzy, python-format
 msgid "You do not have permission to view %(class)s"
 msgstr "Non hai i permessi per modificare i %(class)s"
@@ -1738,8 +1744,8 @@ msgstr "Errore nella Form: "
 msgid "Unrecognized charset: %r"
 msgstr "Codice di carattere sconosciuto: %r"
 
-#: ../roundup/cgi/client.py:1381 ../roundup/cgi/client.py:2394
-#: ../roundup/cgi/client.py:1381:2394
+#: ../roundup/cgi/client.py:1381 ../roundup/cgi/client.py:2396
+#: ../roundup/cgi/client.py:1381:2396
 msgid "broken form: multiple @action values submitted"
 msgstr ""
 
@@ -1820,57 +1826,58 @@ msgstr ""
 
 #: ../roundup/cgi/client.py:1679
 #, python-format
-msgid "csrf X-REQUESTED-WITH xmlrpc required header check failed for user%s."
+msgid ""
+"csrf X-REQUESTED-WITH xmlrpc required header check failed for user%(userid)s."
 msgstr ""
 
 #: ../roundup/cgi/client.py:1720
 #, python-format
-msgid "Required csrf field missing for user%s"
+msgid "Required csrf field missing for user%(userid)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1722 ../roundup/cgi/client.py:1749
-#: ../roundup/cgi/client.py:1766 ../roundup/cgi/client.py:1722:1749:1766
+#: ../roundup/cgi/client.py:1723 ../roundup/cgi/client.py:1751
+#: ../roundup/cgi/client.py:1768 ../roundup/cgi/client.py:1723:1751:1768
 msgid ""
 "We can't validate your session (csrf failure). Re-enter any unsaved data and "
 "try again."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1726
+#: ../roundup/cgi/client.py:1728
 #, python-format
-msgid "csrf field not supplied by user%s"
+msgid "csrf field not supplied by user%(userid)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1738
+#: ../roundup/cgi/client.py:1740
 #, python-format
 msgid ""
 "Csrf mismatch user: current user %(user)s != stored user %(stored)s, current "
 "session, stored session: %(cur_sess)s,%(stor_sess)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1756
+#: ../roundup/cgi/client.py:1758
 #, python-format
 msgid ""
 "Csrf mismatch user: current session %(curr_sess)s != stored session "
 "%(stor_sess)s, current user/stored user is: %(user)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1948
+#: ../roundup/cgi/client.py:1950
 msgid "You are not allowed to view this file."
 msgstr "Non si dispone dei permessi per visualizzare questo file."
 
-#: ../roundup/cgi/client.py:2272
+#: ../roundup/cgi/client.py:2274
 #, python-format
 msgid "%(starttag)sTime elapsed: %(seconds)fs%(endtag)s\n"
 msgstr "%(starttag)sTempo trascorso: %(seconds)fs%(endtag)s\n"
 
-#: ../roundup/cgi/client.py:2276
+#: ../roundup/cgi/client.py:2278
 #, python-format
 msgid ""
 "%(starttag)sCache hits: %(cache_hits)d, misses %(cache_misses)d. Loading "
 "items: %(get_items)f secs. Filtering: %(filtering)f secs.%(endtag)s\n"
 msgstr ""
 
-#: ../roundup/cgi/client.py:2815
+#: ../roundup/cgi/client.py:2817
 #, python-format
 msgid ""
 "Cache failure: compressed file %(compressed)s is older than its source file "
@@ -1942,67 +1949,67 @@ msgstr[1] "Le proprietÃ  %(class)s %(property)s non sono state fornite"
 msgid "You are not allowed to %(action)s items of class %(class)s"
 msgstr "Non si dispone dei permessi per %(action)s item della classe %(class)s"
 
-#: ../roundup/cgi/templating.py:916
+#: ../roundup/cgi/templating.py:892
 msgid "(list)"
 msgstr "(elenco)"
 
-#: ../roundup/cgi/templating.py:991
+#: ../roundup/cgi/templating.py:975
 msgid "Submit New Entry"
 msgstr "Crea Nuovo"
 
 # ../roundup/cgi/templating.py:728:862 :1269:1298 :1318:1364 :1387:1423
 # :1460:1513 :1530:1614 :1634:1652 :1684:1694 :1746:1935
-#: ../roundup/cgi/templating.py:1013 ../roundup/cgi/templating.py:1189
-#: ../roundup/cgi/templating.py:1824 ../roundup/cgi/templating.py:1855
-#: ../roundup/cgi/templating.py:1876 ../roundup/cgi/templating.py:1914
-#: ../roundup/cgi/templating.py:1967 ../roundup/cgi/templating.py:1991
-#: ../roundup/cgi/templating.py:1998 ../roundup/cgi/templating.py:2035
-#: ../roundup/cgi/templating.py:2088 ../roundup/cgi/templating.py:2121
-#: ../roundup/cgi/templating.py:2216 ../roundup/cgi/templating.py:2237
-#: ../roundup/cgi/templating.py:2328 ../roundup/cgi/templating.py:2348
-#: ../roundup/cgi/templating.py:2370 ../roundup/cgi/templating.py:2413
-#: ../roundup/cgi/templating.py:2423 ../roundup/cgi/templating.py:2488
-#: ../roundup/cgi/templating.py:2791 ../roundup/cgi/templating.py:1013:1189
-#: :1824:1855 :1876:1914 :1967:1991 :1998:2035 :2088:2121 :2216:2237 :2328:2348
-#: :2370:2413 :2423:2488:2791
+#: ../roundup/cgi/templating.py:997 ../roundup/cgi/templating.py:1174
+#: ../roundup/cgi/templating.py:1809 ../roundup/cgi/templating.py:1840
+#: ../roundup/cgi/templating.py:1861 ../roundup/cgi/templating.py:1899
+#: ../roundup/cgi/templating.py:1952 ../roundup/cgi/templating.py:1976
+#: ../roundup/cgi/templating.py:1983 ../roundup/cgi/templating.py:2020
+#: ../roundup/cgi/templating.py:2077 ../roundup/cgi/templating.py:2115
+#: ../roundup/cgi/templating.py:2215 ../roundup/cgi/templating.py:2236
+#: ../roundup/cgi/templating.py:2357 ../roundup/cgi/templating.py:2377
+#: ../roundup/cgi/templating.py:2399 ../roundup/cgi/templating.py:2442
+#: ../roundup/cgi/templating.py:2452 ../roundup/cgi/templating.py:2517
+#: ../roundup/cgi/templating.py:2820 ../roundup/cgi/templating.py:997:1174
+#: :1809:1840 :1861:1899 :1952:1976 :1983:2020 :2077:2115 :2215:2236 :2357:2377
+#: :2399:2442 :2452:2517:2820
 msgid "[hidden]"
 msgstr "[nascosto]"
 
-#: ../roundup/cgi/templating.py:1014
+#: ../roundup/cgi/templating.py:998
 msgid "New node - no history"
 msgstr "Nuovo nodo - nessuno storico"
 
-#: ../roundup/cgi/templating.py:1154
+#: ../roundup/cgi/templating.py:1139
 msgid "Submit Changes"
 msgstr "Inserisci Modifiche"
 
-#: ../roundup/cgi/templating.py:1232
+#: ../roundup/cgi/templating.py:1217
 msgid "<em>The indicated property no longer exists</em>"
 msgstr "<em>La caratteristica indicata non esiste</em>"
 
-#: ../roundup/cgi/templating.py:1268
+#: ../roundup/cgi/templating.py:1253
 #, python-format
 msgid "The linked class %(classname)s no longer exists"
 msgstr "La classe collegata %(classname)s non esiste piÃ¹"
 
-#: ../roundup/cgi/templating.py:1305 ../roundup/cgi/templating.py:1335
-#: ../roundup/cgi/templating.py:2497 ../roundup/cgi/templating.py:2800
-#: ../roundup/cgi/templating.py:1305:1335 :2497:2800
+#: ../roundup/cgi/templating.py:1290 ../roundup/cgi/templating.py:1320
+#: ../roundup/cgi/templating.py:2526 ../roundup/cgi/templating.py:2829
+#: ../roundup/cgi/templating.py:1290:1320 :2526:2829
 msgid "[label is missing]"
 msgstr ""
 
 # ../roundup/cgi/templating.py:973:997
-#: ../roundup/cgi/templating.py:1309 ../roundup/cgi/templating.py:1338
-#: ../roundup/cgi/templating.py:1309:1338
+#: ../roundup/cgi/templating.py:1294 ../roundup/cgi/templating.py:1323
+#: ../roundup/cgi/templating.py:1294:1323
 msgid "<strike>The linked node no longer exists</strike>"
 msgstr "<strike>Il Nodo collegato non esiste piÃ¹</strike>"
 
-#: ../roundup/cgi/templating.py:1400
+#: ../roundup/cgi/templating.py:1385
 #, python-format
 msgid "%s: (no value)"
 msgstr "%s: (nessun valore)"
 
-#: ../roundup/cgi/templating.py:1416
+#: ../roundup/cgi/templating.py:1401
 #, fuzzy, python-format
 msgid ""
 "<strong><em>This event %s is not handled by the history display!</em></"
@@ -2011,50 +2018,50 @@ msgstr ""
 "<strong><em>Questo evento non Ã¨ gestito dal visualizzatore dello storico!</"
 "em></strong>"
 
-#: ../roundup/cgi/templating.py:1429
+#: ../roundup/cgi/templating.py:1414
 msgid "<tr><td colspan=4><strong>Note:</strong></td></tr>"
 msgstr "<tr><td colspan=4><strong>Note:</strong></td></tr>"
 
-#: ../roundup/cgi/templating.py:1438
+#: ../roundup/cgi/templating.py:1423
 msgid "History"
 msgstr "Storico"
 
-#: ../roundup/cgi/templating.py:1440
+#: ../roundup/cgi/templating.py:1425
 msgid "<th>Date</th>"
 msgstr "<th>Data</th>"
 
-#: ../roundup/cgi/templating.py:1441
+#: ../roundup/cgi/templating.py:1426
 msgid "<th>User</th>"
 msgstr "<th>Utente</th>"
 
-#: ../roundup/cgi/templating.py:1442
+#: ../roundup/cgi/templating.py:1427
 msgid "<th>Action</th>"
 msgstr "<th>Azione</th>"
 
-#: ../roundup/cgi/templating.py:1443
+#: ../roundup/cgi/templating.py:1428
 msgid "<th>Args</th>"
 msgstr "<th>Argomenti</th>"
 
-#: ../roundup/cgi/templating.py:1494
+#: ../roundup/cgi/templating.py:1479
 #, python-format
 msgid "Copy of %(class)s %(id)s"
 msgstr "Copia di %(class)s %(id)s"
 
 # ../roundup/cgi/templating.py:1491 ../roundup/cgi/templating.py:1039:1464
 # :1485:1491
-#: ../roundup/cgi/templating.py:2125 ../roundup/cgi/templating.py:2160
-#: ../roundup/cgi/templating.py:1382:2125:2160
+#: ../roundup/cgi/templating.py:2119 ../roundup/cgi/templating.py:2154
+#: ../roundup/cgi/templating.py:1367:2119:2154
 msgid "No"
 msgstr "No"
 
 # ../roundup/cgi/templating.py:1488 ../roundup/cgi/templating.py:1039:1464
 # :1483:1488
-#: ../roundup/cgi/templating.py:2125 ../roundup/cgi/templating.py:2154
-#: ../roundup/cgi/templating.py:1382:2125:2154
+#: ../roundup/cgi/templating.py:2119 ../roundup/cgi/templating.py:2148
+#: ../roundup/cgi/templating.py:1367:2119:2148
 msgid "Yes"
 msgstr "SÃ¬"
 
-#: ../roundup/cgi/templating.py:2286
+#: ../roundup/cgi/templating.py:2315
 msgid ""
 "default value for DateHTMLProperty must be either DateHTMLProperty or string "
 "date representation."
@@ -2062,27 +2069,27 @@ msgstr ""
 "Il valore predefinito per DateHTMLProperty deve essere  DateHTMLProperty "
 "oppure una stringa rappresentante una data."
 
-#: ../roundup/cgi/templating.py:2468
+#: ../roundup/cgi/templating.py:2497
 #, python-format
 msgid "Attempt to look up %(attr)s on a missing value"
 msgstr "Tentativo di visualizzare %(attr)s con un valore mancante"
 
-#: ../roundup/cgi/templating.py:2479
+#: ../roundup/cgi/templating.py:2508
 #, fuzzy, python-format
 msgid "Attempt to look up %(item)s on a missing value"
 msgstr "Tentativo di visualizzare %(attr)s con un valore mancante"
 
-#: ../roundup/cgi/templating.py:2584
+#: ../roundup/cgi/templating.py:2613
 #, python-format
 msgid "<option %svalue=\"-1\">- no selection -</option>"
 msgstr "<option %svalue=\"-1\">- nessuna selezione -</option>"
 
-#: ../roundup/cgi/templating.py:3745
+#: ../roundup/cgi/templating.py:3777
 #, python-format
 msgid "Unable to read or expand file '%(name)s' in template '%(template)s'."
 msgstr ""
 
-#: ../roundup/cgi/templating.py:3795
+#: ../roundup/cgi/templating.py:3827
 #, python-format
 msgid ""
 "Found an incorrect token when expandfile applied string subsitution on "
@@ -2256,57 +2263,57 @@ msgstr "%s fa"
 msgid "in %s"
 msgstr "in %s"
 
-#: ../roundup/hyperdb.py:120
+#: ../roundup/hyperdb.py:126
 #, fuzzy, python-format
 msgid "property %(property)s: %(errormsg)s"
 msgstr "Errore: %s: %s"
 
-#: ../roundup/hyperdb.py:149
+#: ../roundup/hyperdb.py:161
 #, python-format
 msgid "property %(property)s: %(value)r is an invalid date (%(errormsg)s)"
 msgstr ""
 
-#: ../roundup/hyperdb.py:172
+#: ../roundup/hyperdb.py:184
 #, python-format
 msgid ""
 "property %(property)s: %(value)r is an invalid date interval (%(errormsg)s)"
 msgstr ""
 
-#: ../roundup/hyperdb.py:434
+#: ../roundup/hyperdb.py:446
 #, fuzzy, python-format
 msgid "property %(property)s: %(value)r is not a number"
 msgstr ""
 "la proprietÃ  \"%(propname)s\": \"%(value)s\" non Ã¨ al momento nella lista"
 
-#: ../roundup/hyperdb.py:448
+#: ../roundup/hyperdb.py:460
 #, fuzzy, python-format
 msgid "property %(property)s: %(value)r is not an integer"
 msgstr ""
 "la proprietÃ  \"%(propname)s\": \"%(value)s\" non Ã¨ al momento nella lista"
 
-#: ../roundup/hyperdb.py:470
+#: ../roundup/hyperdb.py:482
 #, python-format
 msgid "\"%s\" not a node designator"
 msgstr ""
 
-#: ../roundup/hyperdb.py:1499 ../roundup/hyperdb.py:1507
-#: ../roundup/hyperdb.py:1499:1507
+#: ../roundup/hyperdb.py:1515 ../roundup/hyperdb.py:1523
+#: ../roundup/hyperdb.py:1515:1523
 #, python-format
 msgid "Not a property name: %s"
 msgstr ""
 
-#: ../roundup/hyperdb.py:2038
+#: ../roundup/hyperdb.py:2054
 #, fuzzy, python-format
 msgid "property %(property)s: %(value)r is not a %(classname)s."
 msgstr ""
 "la proprietÃ  \"%(propname)s\": \"%(value)s\" non Ã¨ al momento nella lista"
 
-#: ../roundup/hyperdb.py:2044
+#: ../roundup/hyperdb.py:2060
 #, python-format
 msgid "you may only enter ID values for property %s"
 msgstr ""
 
-#: ../roundup/hyperdb.py:2079
+#: ../roundup/hyperdb.py:2095
 #, python-format
 msgid "%(property)r is not a property of %(classname)s"
 msgstr ""
@@ -2633,61 +2640,61 @@ msgid ""
 "are: %(stack)s"
 msgstr ""
 
-#: ../roundup/pygettext.py:401
+#: ../roundup/pygettext.py:400
 #, python-format
 msgid "*** %(file)s:%(lineno)s: Seen unexpected token \"%(token)s\""
 msgstr ""
 
-#: ../roundup/pygettext.py:457
+#: ../roundup/pygettext.py:456
 #, python-format
 msgid "# File: %(filename)s, line: %(lineno)d"
 msgstr ""
 
-#: ../roundup/pygettext.py:464
+#: ../roundup/pygettext.py:463
 #, python-format
 msgid " %(filename)s:%(lineno)d"
 msgstr ""
 
 # ../roundup/cgi/actions.py:931:935
-#: ../roundup/pygettext.py:540
+#: ../roundup/pygettext.py:539
 #, fuzzy, python-format
 msgid "Invalid value for --style: %s"
 msgstr "Login invalida"
 
-#: ../roundup/pygettext.py:548
+#: ../roundup/pygettext.py:547
 #, python-format
 msgid "pygettext.py (xgettext for Python) %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:554
+#: ../roundup/pygettext.py:553
 #, python-format
 msgid "--width argument must be an integer: %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:582
+#: ../roundup/pygettext.py:581
 #, python-format
 msgid "Can't read --exclude-file: %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:601
+#: ../roundup/pygettext.py:600
 msgid "Reading standard input"
 msgstr ""
 
-#: ../roundup/pygettext.py:606
+#: ../roundup/pygettext.py:605
 #, python-format
 msgid "Working on %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:640
+#: ../roundup/pygettext.py:639
 msgid "a unicode string"
 msgstr ""
 
-#: ../roundup/pygettext.py:642
+#: ../roundup/pygettext.py:641
 #, python-format
 msgid "*** Seen unexpected token \"%(token)s\""
 msgstr ""
 
-#: ../roundup/pygettext.py:643
+#: ../roundup/pygettext.py:642
 msgid "morethanonestring"
 msgstr ""
 
@@ -2809,12 +2816,12 @@ msgstr "creazione"
 msgid "creator"
 msgstr "creatore"
 
-#: ../roundup/roundupdb.py:426
+#: ../roundup/roundupdb.py:447
 #, python-format
 msgid "No key for \"%(adr)s\" in keyring"
 msgstr ""
 
-#: ../roundup/roundupdb.py:504
+#: ../roundup/roundupdb.py:525
 #, python-format
 msgid "New submission from %(authname)s%(authaddr)s:"
 msgstr ""
@@ -2822,7 +2829,7 @@ msgstr ""
 "%(authname)s%(authaddr)s.\n"
 "Il testo della nuova richiesta Ã¨ il seguente:"
 
-#: ../roundup/roundupdb.py:507
+#: ../roundup/roundupdb.py:528
 #, python-format
 msgid "%(authname)s%(authaddr)s added the comment:"
 msgstr ""
@@ -2830,7 +2837,7 @@ msgstr ""
 "%(authname)s%(authaddr)s.\n"
 "Il testo del messaggio Ã¨ il seguente:"
 
-#: ../roundup/roundupdb.py:510
+#: ../roundup/roundupdb.py:531
 #, fuzzy, python-format
 msgid "Change by %(authname)s%(authaddr)s:"
 msgstr ""
@@ -2838,12 +2845,12 @@ msgstr ""
 "%(authname)s%(authaddr)s.\n"
 "Il testo della nuova richiesta Ã¨ il seguente:"
 
-#: ../roundup/roundupdb.py:529
+#: ../roundup/roundupdb.py:550
 #, python-format
 msgid "File '%(filename)s' not attached - you can download it from %(link)s."
 msgstr ""
 
-#: ../roundup/roundupdb.py:904
+#: ../roundup/roundupdb.py:925
 #, python-format
 msgid ""
 "\n"
@@ -2948,60 +2955,60 @@ msgstr ""
 "<html><head><title>indice dei ticket Roundup</title></head>\n"
 "<body><h1>indice dei ticket Roundup</h1><ol>\n"
 
-#: ../roundup/scripts/roundup_server.py:598
+#: ../roundup/scripts/roundup_server.py:602
 #, fuzzy, python-format
 msgid "Error: %(type)s: %(value)s"
 msgstr "%(key)s:Â·%(value)s"
 
-#: ../roundup/scripts/roundup_server.py:610
+#: ../roundup/scripts/roundup_server.py:614
 msgid "WARNING: ignoring \"-g\" argument, not root"
 msgstr "ATTENZIONE: ignoro il parametro \"-g\", non sei root"
 
-#: ../roundup/scripts/roundup_server.py:616
+#: ../roundup/scripts/roundup_server.py:620
 msgid "Can't change groups - no grp module"
 msgstr "Non Ã¨ possibile cambiare gruppo - nessun modulo grp"
 
-#: ../roundup/scripts/roundup_server.py:625
+#: ../roundup/scripts/roundup_server.py:629
 #, python-format
 msgid "Group %(group)s doesn't exist"
 msgstr "Il gruppo %(group)s non esiste"
 
-#: ../roundup/scripts/roundup_server.py:637
+#: ../roundup/scripts/roundup_server.py:641
 msgid "Can't run as root!"
 msgstr "Non puÃ² essere eseguito come root!"
 
-#: ../roundup/scripts/roundup_server.py:640
+#: ../roundup/scripts/roundup_server.py:644
 msgid "WARNING: ignoring \"-u\" argument, not root"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:646
+#: ../roundup/scripts/roundup_server.py:650
 msgid "Can't change users - no pwd module"
 msgstr "Non Ã¨ possibile cambiare utente - nessun modulo pwd"
 
-#: ../roundup/scripts/roundup_server.py:655
+#: ../roundup/scripts/roundup_server.py:659
 #, python-format
 msgid "User %(user)s doesn't exist"
 msgstr "L'utente %(user)s non esiste"
 
-#: ../roundup/scripts/roundup_server.py:867
+#: ../roundup/scripts/roundup_server.py:871
 #, python-format
 msgid "Multiprocess mode \"%s\" is not available, switching to single-process"
 msgstr ""
 "La modalitÃ  multiprocesso \"%s\" non Ã¨ disponibile, viene utilizzata quella "
 "a singolo processo"
 
-#: ../roundup/scripts/roundup_server.py:895
+#: ../roundup/scripts/roundup_server.py:899
 #, python-format
 msgid "Unable to bind to port %s, port already in use."
 msgstr "Impossibile bindare alla porta %s, la porta risulta giÃ  in uso."
 
-#: ../roundup/scripts/roundup_server.py:899
+#: ../roundup/scripts/roundup_server.py:903
 #, fuzzy, python-format
 msgid ""
 "Unable to bind to port %(port)s, access not allowed, errno: %(errno)s %(msg)s"
 msgstr "Impossibile bindare alla porta %s, la porta risulta giÃ  in uso."
 
-#: ../roundup/scripts/roundup_server.py:978
+#: ../roundup/scripts/roundup_server.py:982
 msgid ""
 " -c <Command>  Windows Service options.\n"
 "               If you want to run the server as a Windows Service, you\n"
@@ -3011,7 +3018,7 @@ msgid ""
 "               specifics."
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:985
+#: ../roundup/scripts/roundup_server.py:989
 msgid ""
 " -u <UID>      runs the Roundup web server as this UID\n"
 " -g <GID>      runs the Roundup web server as this GID\n"
@@ -3021,7 +3028,7 @@ msgid ""
 " -D            run the server in the foreground even when -d is used."
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:993
+#: ../roundup/scripts/roundup_server.py:997
 #, python-format
 msgid ""
 "\n"
@@ -3094,22 +3101,26 @@ msgid ""
 "   any url-unsafe characters like spaces, as these confuse IE.\n"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:1173
+#: ../roundup/scripts/roundup_server.py:1177
 msgid "Instances must be name=home"
 msgstr "L'istanza deve essere nel formato nome=home"
 
-#: ../roundup/scripts/roundup_server.py:1187
+#: ../roundup/scripts/roundup_server.py:1191
 #, python-format
 msgid "Configuration saved to %s"
 msgstr "Configurazione salvata in %s"
 
-#: ../roundup/scripts/roundup_server.py:1205
+#: ../roundup/scripts/roundup_server.py:1206
+msgid "If you specify a PID file you must use -l or -L."
+msgstr ""
+
+#: ../roundup/scripts/roundup_server.py:1212
 msgid "Sorry, you can't run the server as a daemon on this Operating System"
 msgstr ""
 "Spiacente, non Ã¨ possibile utilizzare il server come demone su questo "
 "sistema operativo."
 
-#: ../roundup/scripts/roundup_server.py:1225
+#: ../roundup/scripts/roundup_server.py:1232
 #, python-format
 msgid "Roundup server started on %(HOST)s:%(PORT)s"
 msgstr "Il server Roundup Ã¨ stato attivato su %(HOST)s:%(PORT)s"
@@ -4389,46 +4400,46 @@ msgstr "Documentazione su Roundup"
 msgid "clear this message"
 msgstr "non visualizzare questo messaggio"
 
-#: ../share/roundup/templates/classic/html/page.html:257
-#: ../share/roundup/templates/classic/html/page.html:270
-#: ../share/roundup/templates/classic/html/page.html:288
-#: ../share/roundup/templates/classic/html/page.html:302
-#: ../share/roundup/templates/devel/html/page.html:316
-#: ../share/roundup/templates/devel/html/page.html:329
-#: ../share/roundup/templates/devel/html/page.html:347
-#: ../share/roundup/templates/devel/html/page.html:361
-#: ../share/roundup/templates/minimal/html/page.html:239
-#: ../share/roundup/templates/minimal/html/page.html:254
-#: ../share/roundup/templates/minimal/html/page.html:268
-#: ../share/roundup/templates/responsive/html/page.html:331
-#: ../share/roundup/templates/responsive/html/page.html:344
-#: ../share/roundup/templates/responsive/html/page.html:362
-#: ../share/roundup/templates/responsive/html/page.html:376
-msgid "don't care"
-msgstr "non importa"
-
-#: ../share/roundup/templates/classic/html/page.html:259
-#: ../share/roundup/templates/classic/html/page.html:272
-#: ../share/roundup/templates/classic/html/page.html:290
+#: ../share/roundup/templates/classic/html/page.html:258
+#: ../share/roundup/templates/classic/html/page.html:271
+#: ../share/roundup/templates/classic/html/page.html:289
 #: ../share/roundup/templates/classic/html/page.html:303
-#: ../share/roundup/templates/devel/html/page.html:318
-#: ../share/roundup/templates/devel/html/page.html:331
-#: ../share/roundup/templates/devel/html/page.html:349
+#: ../share/roundup/templates/devel/html/page.html:317
+#: ../share/roundup/templates/devel/html/page.html:330
+#: ../share/roundup/templates/devel/html/page.html:348
 #: ../share/roundup/templates/devel/html/page.html:362
-#: ../share/roundup/templates/minimal/html/page.html:241
-#: ../share/roundup/templates/minimal/html/page.html:256
+#: ../share/roundup/templates/minimal/html/page.html:240
+#: ../share/roundup/templates/minimal/html/page.html:255
 #: ../share/roundup/templates/minimal/html/page.html:269
-#: ../share/roundup/templates/responsive/html/page.html:333
-#: ../share/roundup/templates/responsive/html/page.html:346
-#: ../share/roundup/templates/responsive/html/page.html:364
+#: ../share/roundup/templates/responsive/html/page.html:332
+#: ../share/roundup/templates/responsive/html/page.html:345
+#: ../share/roundup/templates/responsive/html/page.html:363
 #: ../share/roundup/templates/responsive/html/page.html:377
+msgid "don't care"
+msgstr "non importa"
+
+#: ../share/roundup/templates/classic/html/page.html:260
+#: ../share/roundup/templates/classic/html/page.html:273
+#: ../share/roundup/templates/classic/html/page.html:291
+#: ../share/roundup/templates/classic/html/page.html:304
+#: ../share/roundup/templates/devel/html/page.html:319
+#: ../share/roundup/templates/devel/html/page.html:332
+#: ../share/roundup/templates/devel/html/page.html:350
+#: ../share/roundup/templates/devel/html/page.html:363
+#: ../share/roundup/templates/minimal/html/page.html:242
+#: ../share/roundup/templates/minimal/html/page.html:257
+#: ../share/roundup/templates/minimal/html/page.html:270
+#: ../share/roundup/templates/responsive/html/page.html:334
+#: ../share/roundup/templates/responsive/html/page.html:347
+#: ../share/roundup/templates/responsive/html/page.html:365
+#: ../share/roundup/templates/responsive/html/page.html:378
 msgid "------------"
 msgstr "------------"
 
-#: ../share/roundup/templates/classic/html/page.html:335
-#: ../share/roundup/templates/devel/html/page.html:390
-#: ../share/roundup/templates/minimal/html/page.html:297
-#: ../share/roundup/templates/responsive/html/page.html:405
+#: ../share/roundup/templates/classic/html/page.html:336
+#: ../share/roundup/templates/devel/html/page.html:391
+#: ../share/roundup/templates/minimal/html/page.html:298
+#: ../share/roundup/templates/responsive/html/page.html:406
 msgid "no value"
 msgstr "nessun valore"
 
diff --git a/locale/ja.po b/locale/ja.po
index 603a69588..43d38610e 100644
--- a/locale/ja.po
+++ b/locale/ja.po
@@ -5,9 +5,9 @@
 #
 msgid ""
 msgstr ""
-"Project-Id-Version: Roundup 2.5.0\n"
+"Project-Id-Version: Roundup 2.5.0b1\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
-"POT-Creation-Date: 2025-01-12 20:17-0500\n"
+"POT-Creation-Date: 2025-06-11 16:02-0400\n"
 "PO-Revision-Date: 2013-10-31 12:20+0100\n"
 "Last-Translator: Yasushi Iwata <iwata@know-net.co.jp>\n"
 "Language-Team: Yasushi Iwata <iwata@know-net.co.jp>\n"
@@ -27,19 +27,19 @@ msgstr "%(classname)s ã® %(action)s ã‚’å®Ÿè¡Œã™ã‚‹æ¨©é™ãŒã‚ã‚Šã¾ã›ã‚“ã€‚"
 msgid "You may not retire the admin or anonymous user"
 msgstr "ãƒ¦ãƒ¼ã‚¶ãƒ¼ admin ã¨ anonymous ã‚’ç„¡åŠ¹ã«ã™ã‚‹ã“ã¨ã¯ã§ãã¾ã›ã‚“"
 
-#: ../roundup/admin.py:131
+#: ../roundup/admin.py:132
 msgid ""
 "Have 'display designator[,designator*]' show header inside\n"
 "      []'s before items. Includes retired/active status.\n"
 msgstr ""
 
-#: ../roundup/admin.py:135
+#: ../roundup/admin.py:136
 msgid ""
 "Have 'display designator' and 'specification class' show\n"
 "      protected fields: creator, id etc.\n"
 msgstr ""
 
-#: ../roundup/admin.py:139
+#: ../roundup/admin.py:140
 msgid ""
 "Controls history options. It is a bitstring where setting\n"
 "      the bit disables the feature. A value of 0 (default)\n"
@@ -50,57 +50,57 @@ msgid ""
 "      history.\n"
 msgstr ""
 
-#: ../roundup/admin.py:148
+#: ../roundup/admin.py:149
 msgid ""
 "Set the number of lines of history to keep for this session.\n"
 "      -1 is infinite.\n"
 msgstr ""
 
-#: ../roundup/admin.py:152
+#: ../roundup/admin.py:153
 msgid "Set indexer to use when running 'reindex' NYI\n"
 msgstr ""
 
-#: ../roundup/admin.py:155
+#: ../roundup/admin.py:156
 msgid "Force reopening of tracker when running each command.\n"
 msgstr ""
 
-#: ../roundup/admin.py:158
+#: ../roundup/admin.py:159
 msgid ""
 "set the number of rows imported before a database commit is\n"
 "      done. Used only for imports on PostgreSQL.\n"
 msgstr ""
 
-#: ../roundup/admin.py:160
+#: ../roundup/admin.py:161
 msgid "Show retired items in table, list etc. One of 'no', 'only', 'both'\n"
 msgstr ""
 
-#: ../roundup/admin.py:162
+#: ../roundup/admin.py:163
 msgid "internal mapping for show_retired.\n"
 msgstr ""
 
-#: ../roundup/admin.py:163
+#: ../roundup/admin.py:164
 msgid "Enable verbose output: tracing, descriptions...\n"
 msgstr ""
 
-#: ../roundup/admin.py:175 ../roundup/admin.py:1188 ../roundup/admin.py:1858
-#: ../roundup/admin.py:1890 ../roundup/admin.py:175:1188 :1858:1890
+#: ../roundup/admin.py:176 ../roundup/admin.py:1199 ../roundup/admin.py:1869
+#: ../roundup/admin.py:1901 ../roundup/admin.py:176:1199 :1869:1901
 #, python-format
 msgid "no such class \"%(classname)s\""
 msgstr ""
 
-#: ../roundup/admin.py:188
+#: ../roundup/admin.py:189
 #, python-format
 msgid "argument \"%(arg)s\" not propname=value"
 msgstr ""
 
-#: ../roundup/admin.py:201
+#: ../roundup/admin.py:202
 #, python-format
 msgid ""
 "Problem: %(message)s\n"
 "\n"
 msgstr ""
 
-#: ../roundup/admin.py:202
+#: ../roundup/admin.py:203
 #, python-format
 msgid ""
 "%(message)sUsage: roundup-admin [options] [<command> <arguments>]\n"
@@ -131,17 +131,17 @@ msgid ""
 " roundup-admin help all                   -- all available help\n"
 msgstr ""
 
-#: ../roundup/admin.py:231
+#: ../roundup/admin.py:232
 msgid "Commands: "
 msgstr ""
 
-#: ../roundup/admin.py:238
+#: ../roundup/admin.py:249
 msgid ""
 "Commands may be abbreviated as long as the abbreviation\n"
 "matches only one command, e.g. l == li == lis == list."
 msgstr ""
 
-#: ../roundup/admin.py:270
+#: ../roundup/admin.py:281
 msgid ""
 "\n"
 "All commands (except help) require a tracker specifier. This is just\n"
@@ -209,23 +209,23 @@ msgid ""
 "Command help:\n"
 msgstr ""
 
-#: ../roundup/admin.py:334
+#: ../roundup/admin.py:345
 #, python-format
 msgid "%s:"
 msgstr ""
 
-#: ../roundup/admin.py:439 ../roundup/admin.py:1415
-#: ../roundup/admin.py:439:1415
+#: ../roundup/admin.py:450 ../roundup/admin.py:1426
+#: ../roundup/admin.py:450:1426
 msgid "Templates:"
 msgstr ""
 
-#: ../roundup/admin.py:442 ../roundup/admin.py:1425
-#: ../roundup/admin.py:442:1425
+#: ../roundup/admin.py:453 ../roundup/admin.py:1436
+#: ../roundup/admin.py:453:1436
 msgid "Back ends:"
 msgstr ""
 
 #. noqa: ARG002
-#: ../roundup/admin.py:459
+#: ../roundup/admin.py:470
 msgid ""
 "Usage: commit\n"
 "        Commit changes made to the database during an interactive session.\n"
@@ -239,7 +239,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:474
+#: ../roundup/admin.py:485
 msgid ""
 "Usage: create classname property=value ...\n"
 "        Create a new entry of a given class.\n"
@@ -251,42 +251,42 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:482 ../roundup/admin.py:555 ../roundup/admin.py:606
-#: ../roundup/admin.py:733 ../roundup/admin.py:806 ../roundup/admin.py:851
-#: ../roundup/admin.py:902 ../roundup/admin.py:999 ../roundup/admin.py:1216
-#: ../roundup/admin.py:1388 ../roundup/admin.py:1516 ../roundup/admin.py:1599
-#: ../roundup/admin.py:1725 ../roundup/admin.py:1848 ../roundup/admin.py:1880
-#: ../roundup/admin.py:1996 ../roundup/admin.py:2050 ../roundup/admin.py:2098
-#: ../roundup/admin.py:482:555 :1216:1388:1516 :1599:1725 :1848:1880 :1996:2050
-#: :2098 :606:733 :806:851 :902:999
+#: ../roundup/admin.py:493 ../roundup/admin.py:566 ../roundup/admin.py:617
+#: ../roundup/admin.py:744 ../roundup/admin.py:817 ../roundup/admin.py:862
+#: ../roundup/admin.py:913 ../roundup/admin.py:1010 ../roundup/admin.py:1227
+#: ../roundup/admin.py:1399 ../roundup/admin.py:1527 ../roundup/admin.py:1610
+#: ../roundup/admin.py:1736 ../roundup/admin.py:1859 ../roundup/admin.py:1891
+#: ../roundup/admin.py:2007 ../roundup/admin.py:2061 ../roundup/admin.py:2109
+#: ../roundup/admin.py:493:566 :1227:1399 :1527:1610 :1736:1859 :1891:2007
+#: :2061:2109 :617:744 :817:862 :913:1010
 msgid "Not enough arguments supplied"
 msgstr ""
 
-#: ../roundup/admin.py:502
+#: ../roundup/admin.py:513
 #, python-format
 msgid "%(propname)s (Password): "
 msgstr ""
 
-#: ../roundup/admin.py:505
+#: ../roundup/admin.py:516
 #, python-format
 msgid "   %(propname)s (Again): "
 msgstr ""
 
-#: ../roundup/admin.py:509
+#: ../roundup/admin.py:520
 msgid "Sorry, try again..."
 msgstr ""
 
-#: ../roundup/admin.py:514
+#: ../roundup/admin.py:525
 #, python-format
 msgid "%(propname)s (%(proptype)s): "
 msgstr ""
 
-#: ../roundup/admin.py:533
+#: ../roundup/admin.py:544
 #, python-format
 msgid "you must provide the \"%(propname)s\" property."
 msgstr ""
 
-#: ../roundup/admin.py:545
+#: ../roundup/admin.py:556
 msgid ""
 "Usage: display designator[,designator]*\n"
 "        Show the property values for the given node(s).\n"
@@ -299,13 +299,13 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:586
+#: ../roundup/admin.py:597
 #, python-format
 msgid "%(protected)s%(key)s: %(value)s"
 msgstr ""
 
 #. grab the directory to export to
-#: ../roundup/admin.py:589
+#: ../roundup/admin.py:600
 msgid ""
 "Usage: export [[-]class[,class]] export_dir\n"
 "        Export the database and file content.\n"
@@ -324,7 +324,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:704
+#: ../roundup/admin.py:715
 msgid ""
 "Usage: exporttables [[-]class[,class]] export_dir\n"
 "        Export only the database to files, no file content.\n"
@@ -344,7 +344,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:723
+#: ../roundup/admin.py:734
 msgid ""
 "Usage: filter classname propname=value ...\n"
 "        Find the nodes of the given class with a given property value.\n"
@@ -357,19 +357,19 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:764
+#: ../roundup/admin.py:775
 #, python-format
 msgid "Class %(curclassname)s has no property %(pn)s in %(propname)s."
 msgstr ""
 
-#: ../roundup/admin.py:791 ../roundup/admin.py:840 ../roundup/admin.py:1536
-#: ../roundup/admin.py:1549 ../roundup/admin.py:2120
-#: ../roundup/admin.py:791:840 :1536:1549:2120
+#: ../roundup/admin.py:802 ../roundup/admin.py:851 ../roundup/admin.py:1547
+#: ../roundup/admin.py:1560 ../roundup/admin.py:2131
+#: ../roundup/admin.py:802:851 :1547:1560:2131
 #, python-format
 msgid "%(classname)s has no property \"%(propname)s\""
 msgstr ""
 
-#: ../roundup/admin.py:798
+#: ../roundup/admin.py:809
 msgid ""
 "Usage: find classname propname=value ...\n"
 "        Find the nodes of the given class with a given link property value.\n"
@@ -380,14 +380,14 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:847
+#: ../roundup/admin.py:858
 msgid ""
 "Usage: genconfig filename\n"
 "        Create a new tracker config file with default values in filename.\n"
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:864
+#: ../roundup/admin.py:875
 #, python-format
 msgid ""
 "Changing option\n"
@@ -395,20 +395,20 @@ msgid ""
 "from old default of %(old_number)s to new default of %(new_number)s."
 msgstr ""
 
-#: ../roundup/admin.py:875
+#: ../roundup/admin.py:886
 #, python-format
 msgid ""
 "Update 'password_pbkdf2_default_rounds' to a number equal to or larger\n"
 "  than %s.\n"
 msgstr ""
 
-#: ../roundup/admin.py:882
+#: ../roundup/admin.py:893
 msgid ""
 "Check the rdbms mysql_* settings. Your charset and collations may need\n"
 "  to be changed. See upgrading instructions.\n"
 msgstr ""
 
-#: ../roundup/admin.py:892
+#: ../roundup/admin.py:903
 msgid ""
 "Usage: get property designator[,designator]*\n"
 "        Get the given property of one or more designator(s).\n"
@@ -421,23 +421,23 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:925
+#: ../roundup/admin.py:936
 #, python-format
 msgid "property %s is not of type Multilink or Link so -d flag does not apply."
 msgstr ""
 
-#: ../roundup/admin.py:942 ../roundup/admin.py:1190 ../roundup/admin.py:1864
-#: ../roundup/admin.py:1892 ../roundup/admin.py:942:1190 :1864:1892
+#: ../roundup/admin.py:953 ../roundup/admin.py:1201 ../roundup/admin.py:1875
+#: ../roundup/admin.py:1903 ../roundup/admin.py:953:1201 :1875:1903
 #, python-format
 msgid "no such %(classname)s node \"%(nodeid)s\""
 msgstr ""
 
-#: ../roundup/admin.py:945
+#: ../roundup/admin.py:956
 #, python-format
 msgid "no such %(classname)s property \"%(propname)s\""
 msgstr ""
 
-#: ../roundup/admin.py:950
+#: ../roundup/admin.py:961
 msgid ""
 "Usage: help topic\n"
 "        Give help about topic.\n"
@@ -449,12 +449,12 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:969
+#: ../roundup/admin.py:980
 #, python-format
 msgid "Sorry, no help for \"%(topic)s\""
 msgstr ""
 
-#: ../roundup/admin.py:986
+#: ../roundup/admin.py:997
 msgid ""
 "Usage: history designator [skipquiet] [raw]\n"
 "        Show the history entries of a designator.\n"
@@ -469,27 +469,27 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1011
+#: ../roundup/admin.py:1022
 #, python-format
 msgid "Unexpected argument(s): %s. Expected 'skipquiet' or 'raw'."
 msgstr ""
 
-#: ../roundup/admin.py:1062
+#: ../roundup/admin.py:1073
 #, fuzzy
 msgid "removed"
 msgstr "å‰Šé™¤"
 
-#: ../roundup/admin.py:1064
+#: ../roundup/admin.py:1075
 msgid "added"
 msgstr ""
 
-#: ../roundup/admin.py:1066
+#: ../roundup/admin.py:1077
 #, python-format
 msgid "Unknown history set operation '%s'. Expected +/-."
 msgstr ""
 
 #. .Hint added issue23 to superseder
-#: ../roundup/admin.py:1091
+#: ../roundup/admin.py:1102
 #, fuzzy, python-format
 msgid "added %(class)s%(item_id)s to %(propname)s"
 msgstr "%(class)s %(id)s %(properties)s æ›´æ–°å®Œäº†"
@@ -497,29 +497,29 @@ msgstr "%(class)s %(id)s %(properties)s æ›´æ–°å®Œäº†"
 #. .Hint read as: assignedto was admin(1)
 #. where assignedto is the property
 #. admin is the key name for value 1
-#: ../roundup/admin.py:1112
+#: ../roundup/admin.py:1123
 #, python-format
 msgid "%(prop)s was %(name)s(%(value)s)"
 msgstr ""
 
-#: ../roundup/admin.py:1118 ../roundup/admin.py:1147
-#: ../roundup/admin.py:1118:1147
+#: ../roundup/admin.py:1129 ../roundup/admin.py:1158
+#: ../roundup/admin.py:1129:1158
 #, python-format
 msgid "%(prop)s was %(value)s"
 msgstr ""
 
-#: ../roundup/admin.py:1137
+#: ../roundup/admin.py:1148
 #, python-format
 msgid "%(prop)s was [%(value_list)s]"
 msgstr ""
 
 #. .Hint modified nosy: added demo(3)
-#: ../roundup/admin.py:1144
+#: ../roundup/admin.py:1155
 #, python-format
 msgid "modified %(prop)s: %(how)s"
 msgstr ""
 
-#: ../roundup/admin.py:1195
+#: ../roundup/admin.py:1206
 msgid ""
 "Usage: import import_dir\n"
 "        Import a database and file contents from the directory.\n"
@@ -543,7 +543,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1306
+#: ../roundup/admin.py:1317
 msgid ""
 "Usage: importtables export_dir\n"
 "        This imports the database tables exported using exporttables.\n"
@@ -553,7 +553,7 @@ msgid ""
 msgstr ""
 
 #. password
-#: ../roundup/admin.py:1314
+#: ../roundup/admin.py:1325
 msgid ""
 "Usage: initialise [adminpw]\n"
 "        Initialise a new Roundup tracker.\n"
@@ -564,30 +564,30 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1328
+#: ../roundup/admin.py:1339
 msgid "Admin Password: "
 msgstr ""
 
-#: ../roundup/admin.py:1329
+#: ../roundup/admin.py:1340
 msgid "       Confirm: "
 msgstr ""
 
-#: ../roundup/admin.py:1333
+#: ../roundup/admin.py:1344
 msgid "Instance home does not exist"
 msgstr ""
 
-#: ../roundup/admin.py:1337
+#: ../roundup/admin.py:1348
 msgid "Instance has not been installed"
 msgstr ""
 
-#: ../roundup/admin.py:1345
+#: ../roundup/admin.py:1356
 msgid ""
 "WARNING: The database is already initialised!\n"
 "If you re-initialise it, you will lose all the data!\n"
 "Erase it? Y/N: "
 msgstr ""
 
-#: ../roundup/admin.py:1365
+#: ../roundup/admin.py:1376
 msgid ""
 "Usage: install [template [backend [key=val[,key=val]]]]\n"
 "        Install a new Roundup tracker.\n"
@@ -613,12 +613,12 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1394
+#: ../roundup/admin.py:1405
 #, python-format
 msgid "Instance home parent directory \"%(parent)s\" does not exist"
 msgstr ""
 
-#: ../roundup/admin.py:1403
+#: ../roundup/admin.py:1414
 #, python-format
 msgid ""
 "WARNING: There appears to be a tracker in \"%(tracker_home)s\"!\n"
@@ -626,20 +626,20 @@ msgid ""
 "Erase it? Y/N: "
 msgstr ""
 
-#: ../roundup/admin.py:1416
+#: ../roundup/admin.py:1427
 msgid "Select template"
 msgstr ""
 
-#: ../roundup/admin.py:1426
+#: ../roundup/admin.py:1437
 msgid "Select backend"
 msgstr ""
 
-#: ../roundup/admin.py:1437
+#: ../roundup/admin.py:1448
 #, python-format
 msgid "Error in configuration settings: \"%s\""
 msgstr ""
 
-#: ../roundup/admin.py:1470
+#: ../roundup/admin.py:1481
 #, python-format
 msgid ""
 "\n"
@@ -648,11 +648,11 @@ msgid ""
 "   %(config_file)s"
 msgstr ""
 
-#: ../roundup/admin.py:1480
+#: ../roundup/admin.py:1491
 msgid " ... at a minimum, you must set following options:"
 msgstr ""
 
-#: ../roundup/admin.py:1485
+#: ../roundup/admin.py:1496
 #, python-format
 msgid ""
 "\n"
@@ -669,7 +669,7 @@ msgid ""
 "---------------------------------------------------------------------------\n"
 msgstr ""
 
-#: ../roundup/admin.py:1501
+#: ../roundup/admin.py:1512
 msgid ""
 "Usage: list classname [property]\n"
 "        List the instances of a class.\n"
@@ -685,17 +685,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1514
+#: ../roundup/admin.py:1525
 msgid "Too many arguments supplied"
 msgstr ""
 
-#: ../roundup/admin.py:1547
+#: ../roundup/admin.py:1558
 #, python-format
 msgid "%(nodeid)4s: %(value)s"
 msgstr ""
 
 #. noqa: ARG002  - args unused
-#: ../roundup/admin.py:1554
+#: ../roundup/admin.py:1565
 msgid ""
 "Usage: migrate\n"
 "        Update a tracker's database to be compatible with the Roundup\n"
@@ -718,17 +718,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1574
+#: ../roundup/admin.py:1585
 #, python-format
 msgid "Tracker updated to schema version %s."
 msgstr ""
 
-#: ../roundup/admin.py:1578
+#: ../roundup/admin.py:1589
 #, python-format
 msgid "No migration action required. At schema version %s."
 msgstr ""
 
-#: ../roundup/admin.py:1583
+#: ../roundup/admin.py:1594
 msgid ""
 "Usage: pack period | date\n"
 "        Remove journal entries older than the date/period.\n"
@@ -748,11 +748,11 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1609
+#: ../roundup/admin.py:1620
 msgid "Invalid format"
 msgstr ""
 
-#: ../roundup/admin.py:1620
+#: ../roundup/admin.py:1631
 msgid ""
 "Usage: perftest [mode] [arguments]*\n"
 "        Time operations in Roundup.\n"
@@ -770,25 +770,25 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1657
+#: ../roundup/admin.py:1668
 msgid "Invalid 'rounds'. Must be larger than 999."
 msgstr ""
 
-#: ../roundup/admin.py:1661
+#: ../roundup/admin.py:1672
 #, python-format
 msgid "Invalid 'rounds'. It must be an integer not: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1688
+#: ../roundup/admin.py:1699
 msgid "scheme does not support rounds."
 msgstr ""
 
-#: ../roundup/admin.py:1691
+#: ../roundup/admin.py:1702
 #, python-format
 msgid "Hash time: %(time)0.9f seconds, scheme: %(scheme)s, rounds: %(rounds)s"
 msgstr ""
 
-#: ../roundup/admin.py:1697
+#: ../roundup/admin.py:1708
 msgid ""
 "Usage: pragma setting=value | 'list'\n"
 "        Set internal admin settings to a value.\n"
@@ -817,49 +817,49 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1732
+#: ../roundup/admin.py:1743
 #, python-format
 msgid "Argument must be setting=value, was given: %s."
 msgstr ""
 
-#: ../roundup/admin.py:1735
+#: ../roundup/admin.py:1746
 msgid "Current settings and values (NYI - not yet implemented):"
 msgstr ""
 
-#: ../roundup/admin.py:1746
+#: ../roundup/admin.py:1757
 msgid ""
 "      Help for this pragma is missing. Please report it to the Roundup "
 "project.\n"
 msgstr ""
 
-#: ../roundup/admin.py:1752
+#: ../roundup/admin.py:1763
 #, fuzzy, python-format
 msgid "Unknown setting %s. Try \"pragma list\"."
 msgstr "ç™»éŒ²ã•ã‚Œã¦ã„ãªã„ãƒ¦ãƒ¼ã‚¶ãƒ¼åã§ã™"
 
-#: ../roundup/admin.py:1762
+#: ../roundup/admin.py:1773
 #, python-format
 msgid "Incorrect value for boolean setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1769
+#: ../roundup/admin.py:1780
 #, python-format
 msgid "Incorrect value for integer setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1776
+#: ../roundup/admin.py:1787
 #, python-format
 msgid ""
 "Incorrect value for setting %(setting)s: %(value)s. Should be no, both, or "
 "only."
 msgstr ""
 
-#: ../roundup/admin.py:1786
+#: ../roundup/admin.py:1797
 #, python-format
 msgid "Internal error: pragma can not handle values of type: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1795
+#: ../roundup/admin.py:1806
 msgid ""
 "Usage: reindex [classname|classname:#-#|designator]*\n"
 "        Re-generate a tracker's search indexes.\n"
@@ -876,17 +876,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1817
+#: ../roundup/admin.py:1828
 #, python-format
 msgid "no such item \"%(designator)s\""
 msgstr ""
 
-#: ../roundup/admin.py:1827
+#: ../roundup/admin.py:1838
 #, fuzzy, python-format
 msgid "no such item \"%(class)s%(id)s\""
 msgstr "%(class)s %(id)s ã®ã‚³ãƒ”ãƒ¼"
 
-#: ../roundup/admin.py:1839
+#: ../roundup/admin.py:1850
 msgid ""
 "Usage: restore designator[,designator]*\n"
 "        Restore the retired node specified by designator.\n"
@@ -898,7 +898,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1870
+#: ../roundup/admin.py:1881
 msgid ""
 "Usage: retire designator[,designator]*\n"
 "        Retire the node specified by designator.\n"
@@ -912,7 +912,7 @@ msgid ""
 msgstr ""
 
 #. noqa: ARG002 - args unused
-#: ../roundup/admin.py:1898
+#: ../roundup/admin.py:1909
 msgid ""
 "Usage: rollback\n"
 "        Undo all changes that are pending commit to the database.\n"
@@ -924,7 +924,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1911
+#: ../roundup/admin.py:1922
 msgid ""
 "Usage: security [Role name]\n"
 "        Display the Permissions available to one or all Roles.\n"
@@ -937,46 +937,46 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1926
+#: ../roundup/admin.py:1937
 #, python-format
 msgid "No such Role \"%(role)s\"\n"
 msgstr ""
 
-#: ../roundup/admin.py:1932
+#: ../roundup/admin.py:1943
 #, python-format
 msgid "New Web users get the Roles \"%(role)s\"\n"
 msgstr ""
 
-#: ../roundup/admin.py:1935
+#: ../roundup/admin.py:1946
 #, python-format
 msgid "New Web users get the Role \"%(role)s\"\n"
 msgstr ""
 
-#: ../roundup/admin.py:1939
+#: ../roundup/admin.py:1950
 #, python-format
 msgid "New Email users get the Roles \"%(role)s\"\n"
 msgstr ""
 
-#: ../roundup/admin.py:1941
+#: ../roundup/admin.py:1952
 #, python-format
 msgid "New Email users get the Role \"%(role)s\"\n"
 msgstr ""
 
-#: ../roundup/admin.py:1944
+#: ../roundup/admin.py:1955
 #, python-format
 msgid "Role \"%(name)s\":\n"
 msgstr ""
 
-#: ../roundup/admin.py:1950
+#: ../roundup/admin.py:1961
 msgid " %(description)s (%(name)s for \"%(klass)s\""
 msgstr ""
 
-#: ../roundup/admin.py:1950
+#: ../roundup/admin.py:1961
 #, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\": %(properties)s only)\n"
 msgstr ""
 
-#: ../roundup/admin.py:1963
+#: ../roundup/admin.py:1974
 #, python-format
 msgid ""
 "\n"
@@ -984,17 +984,17 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/admin.py:1969
+#: ../roundup/admin.py:1980
 #, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\" only)\n"
 msgstr ""
 
-#: ../roundup/admin.py:1972
+#: ../roundup/admin.py:1983
 #, python-format
 msgid " %(description)s (%(name)s)\n"
 msgstr ""
 
-#: ../roundup/admin.py:1976
+#: ../roundup/admin.py:1987
 msgid ""
 "Usage: set items property=value [property=value ...]\n"
 "        Set the given properties of one or more items(s).\n"
@@ -1015,7 +1015,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2044
+#: ../roundup/admin.py:2055
 msgid ""
 "Usage: specification classname\n"
 "        Show the properties for a classname.\n"
@@ -1024,17 +1024,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2063
+#: ../roundup/admin.py:2074
 #, python-format
 msgid "%(key)s: %(value)s (key property)\n"
 msgstr ""
 
-#: ../roundup/admin.py:2066
+#: ../roundup/admin.py:2077
 #, python-format
 msgid "%(key)s: %(value)s\n"
 msgstr ""
 
-#: ../roundup/admin.py:2069
+#: ../roundup/admin.py:2080
 msgid ""
 "Usage: table classname [property[,property]*]\n"
 "        List the instances of a class in tabular form.\n"
@@ -1066,17 +1066,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2115
+#: ../roundup/admin.py:2126
 #, python-format
 msgid "\"%(spec)s\" not name:width"
 msgstr ""
 
-#: ../roundup/admin.py:2137
+#: ../roundup/admin.py:2148
 #, python-format
 msgid "\"%(spec)s\" does not have an integer width: \"%(width)s\""
 msgstr ""
 
-#: ../roundup/admin.py:2173
+#: ../roundup/admin.py:2184
 msgid ""
 "Usage: templates [trace_search]\n"
 "        List templates and their installed directories.\n"
@@ -1086,7 +1086,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2201
+#: ../roundup/admin.py:2212
 msgid ""
 "Usage: updateconfig <filename>\n"
 "        Merge existing tracker config with new settings.\n"
@@ -1096,92 +1096,92 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2210 ../roundup/cgi/actions.py:886
-#: ../roundup/cgi/actions.py:897 ../roundup/cgi/actions.py:1099
-#: ../roundup/cgi/actions.py:1113 ../roundup/cgi/actions.py:886:897 :1099:1113
+#: ../roundup/admin.py:2221 ../roundup/cgi/actions.py:891
+#: ../roundup/cgi/actions.py:902 ../roundup/cgi/actions.py:1104
+#: ../roundup/cgi/actions.py:1118 ../roundup/cgi/actions.py:891:902 :1104:1118
 #, python-format
 msgid "Error: %s"
 msgstr "ã‚¨ãƒ©ãƒ¼: %s"
 
-#: ../roundup/admin.py:2242
+#: ../roundup/admin.py:2253
 #, python-format
 msgid "Unknown command \"%(command)s\" (\"help commands\" for a list)"
 msgstr ""
 
-#: ../roundup/admin.py:2248
+#: ../roundup/admin.py:2259
 #, python-format
 msgid "Multiple commands match \"%(command)s\": %(list)s"
 msgstr ""
 
-#: ../roundup/admin.py:2263
+#: ../roundup/admin.py:2274
 msgid "Enter tracker home: "
 msgstr ""
 
-#: ../roundup/admin.py:2292 ../roundup/admin.py:2296
-#: ../roundup/admin.py:2292:2296
+#: ../roundup/admin.py:2303 ../roundup/admin.py:2307
+#: ../roundup/admin.py:2303:2307
 #, python-format
 msgid "Error: Couldn't open tracker: %(message)s"
 msgstr ""
 
-#: ../roundup/admin.py:2344
+#: ../roundup/admin.py:2355
 #, python-format
 msgid ""
 "Roundup %s ready for input.\n"
 "Type \"help\" for help."
 msgstr ""
 
-#: ../roundup/admin.py:2377
+#: ../roundup/admin.py:2388
 msgid "Note: command history and editing not available"
 msgstr ""
 
-#: ../roundup/admin.py:2383
+#: ../roundup/admin.py:2394
 msgid "exit..."
 msgstr ""
 
-#: ../roundup/admin.py:2396
+#: ../roundup/admin.py:2407
 msgid "There are unsaved changes. Commit them (y/N)? "
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:215
-#: ../roundup/backends/rdbms_common.py:928
+#: ../roundup/backends/back_anydbm.py:213
+#: ../roundup/backends/rdbms_common.py:926
 #, python-format
 msgid "Class \"%s\" already defined."
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:280
+#: ../roundup/backends/back_anydbm.py:278
 #: ../roundup/backends/sessions_dbm.py:61
 msgid "Couldn't identify database type"
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:314
+#: ../roundup/backends/back_anydbm.py:312
 #, python-format
 msgid ""
 "Couldn't open database - the required module '%s' (as dbm.gnu) is not "
 "available"
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:318
+#: ../roundup/backends/back_anydbm.py:316
 #, python-format
 msgid "Couldn't open database - the required module '%s' is not available"
 msgstr ""
 
 #: ../roundup/backends/back_anydbm.py:873
 #: ../roundup/backends/back_anydbm.py:886
-#: ../roundup/backends/back_anydbm.py:1160
-#: ../roundup/backends/back_anydbm.py:1195
-#: ../roundup/backends/back_anydbm.py:1424
-#: ../roundup/backends/back_anydbm.py:1442
-#: ../roundup/backends/back_anydbm.py:1489
-#: ../roundup/backends/back_anydbm.py:2135
+#: ../roundup/backends/back_anydbm.py:1162
+#: ../roundup/backends/back_anydbm.py:1197
+#: ../roundup/backends/back_anydbm.py:1426
+#: ../roundup/backends/back_anydbm.py:1444
+#: ../roundup/backends/back_anydbm.py:1492
+#: ../roundup/backends/back_anydbm.py:2138
 #: ../roundup/backends/back_anydbm.py:873:886
-#: ../roundup/backends/rdbms_common.py:1720
-#: ../roundup/backends/rdbms_common.py:1967
-#: ../roundup/backends/rdbms_common.py:2206
-#: ../roundup/backends/rdbms_common.py:2226
-#: ../roundup/backends/rdbms_common.py:2279
-#: ../roundup/backends/rdbms_common.py:3254
-#: ../roundup/backends/rdbms_common.py:1720:1967 :1160:1195 :1424:1442:1489
-#: :2135 :2206:2226 :2279:3254
+#: ../roundup/backends/rdbms_common.py:1721
+#: ../roundup/backends/rdbms_common.py:1972
+#: ../roundup/backends/rdbms_common.py:2211
+#: ../roundup/backends/rdbms_common.py:2231
+#: ../roundup/backends/rdbms_common.py:2293
+#: ../roundup/backends/rdbms_common.py:3268
+#: ../roundup/backends/rdbms_common.py:1721:1972 :1162:1197 :1426:1444:1492
+#: :2138 :2211:2231 :2293:3268
 msgid "Database open read-only"
 msgstr ""
 
@@ -1207,45 +1207,50 @@ msgstr ""
 msgid "Unable to get lock after 10 retries on %s."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:632
+#: ../roundup/backends/rdbms_common.py:630
 #, python-format
 msgid "ALTER operation disallowed: %(old)r -> %(new)r."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:867
+#: ../roundup/backends/rdbms_common.py:865
 #, python-format
 msgid "CREATE operation disallowed: \"%s\"."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:884
+#: ../roundup/backends/rdbms_common.py:882
 #, python-format
 msgid "DROP operation disallowed: \"%s\"."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:1863
+#: ../roundup/backends/rdbms_common.py:1864
 msgid "create"
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:2038
+#: ../roundup/backends/rdbms_common.py:2043
 msgid "unlink"
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:2042
+#: ../roundup/backends/rdbms_common.py:2047
 msgid "link"
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:2187
+#: ../roundup/backends/rdbms_common.py:2192
 msgid "set"
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:2216
+#: ../roundup/backends/rdbms_common.py:2221
 msgid "retired"
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:2246
+#: ../roundup/backends/rdbms_common.py:2251
 msgid "restored"
 msgstr ""
 
+#: ../roundup/backends/rdbms_common.py:2265
+#, fuzzy, python-format
+msgid "class %(cls)s: %(value)r is not an id"
+msgstr "ãƒ—ãƒ­ãƒ‘ãƒ†ã‚£ \"%(propname)s\": \"%(value)s\" ãŒãƒªã‚¹ãƒˆã®ä¸­ã«ã‚ã‚Šã¾ã›ã‚“"
+
 #: ../roundup/backends/sessions_redis.py:78
 #: ../roundup/backends/sessions_redis.py:97
 #: ../roundup/backends/sessions_redis.py:78:97
@@ -1328,10 +1333,10 @@ msgid "\"%(input)s\" is not an ID (%(classname)s ID required)"
 msgstr "\"%(input)s\" ã¯IDã§ã¯ã‚ã‚Šã¾ã›ã‚“(%(classname)s ID ã‚’å…¥åŠ›ã—ã¦ãã ã•ã„)"
 
 #: ../roundup/cgi/actions.py:228 ../roundup/cgi/actions.py:266
-#: ../roundup/cgi/actions.py:493 ../roundup/cgi/actions.py:833
-#: ../roundup/cgi/actions.py:880 ../roundup/cgi/actions.py:1084
-#: ../roundup/cgi/actions.py:1246 ../roundup/cgi/actions.py:228:266:1246
-#: :493:833 :880:1084
+#: ../roundup/cgi/actions.py:493 ../roundup/cgi/actions.py:838
+#: ../roundup/cgi/actions.py:885 ../roundup/cgi/actions.py:1089
+#: ../roundup/cgi/actions.py:1251 ../roundup/cgi/actions.py:228:266:1251
+#: :493:838 :885:1089
 msgid "Invalid request"
 msgstr "ä¸æ­£ãªãƒªã‚¯ã‚¨ã‚¹ãƒˆ"
 
@@ -1381,8 +1386,8 @@ msgstr "ä¸æ­£ãªãƒªã‚¯ã‚¨ã‚¹ãƒˆ"
 msgid "Invalid integer: "
 msgstr "ä¸æ­£ãªãƒªã‚¯ã‚¨ã‚¹ãƒˆ"
 
-#: ../roundup/cgi/actions.py:531 ../roundup/cgi/actions.py:735
-#: ../roundup/cgi/actions.py:531:735
+#: ../roundup/cgi/actions.py:531 ../roundup/cgi/actions.py:740
+#: ../roundup/cgi/actions.py:531:740
 #, python-format
 msgid "You do not have permission to create %(class)s"
 msgstr "%(class)sã‚’ç™»éŒ²ã™ã‚‹æ¨©é™ãŒã‚ã‚Šã¾ã›ã‚“"
@@ -1392,8 +1397,8 @@ msgstr "%(class)sã‚’ç™»éŒ²ã™ã‚‹æ¨©é™ãŒã‚ã‚Šã¾ã›ã‚“"
 msgid "Not enough values on line %(line)s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:556 ../roundup/cgi/actions.py:723
-#: ../roundup/cgi/actions.py:556:723
+#: ../roundup/cgi/actions.py:556 ../roundup/cgi/actions.py:728
+#: ../roundup/cgi/actions.py:556:728
 #, python-format
 msgid "You do not have permission to edit %(class)s"
 msgstr "%(class)sã‚’ç·¨é›†ã™ã‚‹æ¨©é™ãŒã‚ã‚Šã¾ã›ã‚“"
@@ -1402,17 +1407,17 @@ msgstr "%(class)sã‚’ç·¨é›†ã™ã‚‹æ¨©é™ãŒã‚ã‚Šã¾ã›ã‚“"
 msgid "Items edited OK"
 msgstr "ã‚¢ã‚¤ãƒ†ãƒ ã®ç·¨é›†å®Œäº†"
 
-#: ../roundup/cgi/actions.py:671
+#: ../roundup/cgi/actions.py:676
 #, python-format
 msgid "%(class)s %(id)s %(properties)s edited ok"
 msgstr "%(class)s %(id)s %(properties)s æ›´æ–°å®Œäº†"
 
-#: ../roundup/cgi/actions.py:689
+#: ../roundup/cgi/actions.py:694
 #, python-format
 msgid "%(class)s %(id)s created"
 msgstr "%(class)s %(id)s ç™»éŒ²å®Œäº†"
 
-#: ../roundup/cgi/actions.py:817
+#: ../roundup/cgi/actions.py:822
 #, fuzzy, python-format
 msgid ""
 "Edit Error: someone else has edited this %(klass)s (%(props)s). View <a "
@@ -1421,24 +1426,24 @@ msgstr ""
 "ç·¨é›†ã‚¨ãƒ©ãƒ¼: ä»–ã®ãƒ¦ãƒ¼ã‚¶ãƒ¼ãŒ %(klass)s (%(props)s) ã‚’å¤‰æ›´ã—ã¾ã—ãŸã€‚. <a target="
 "\"new\" href=\"%(klass)s%(id)s\">å¤‰æ›´å†…å®¹ã®ç¢ºèª</a>(åˆ¥ã‚¦ã‚£ãƒ³ãƒ‰ã‚¦ã§é–‹ã)"
 
-#: ../roundup/cgi/actions.py:850
+#: ../roundup/cgi/actions.py:855
 #, python-format
 msgid "Edit Error: %s"
 msgstr "æ›´æ–°ã‚¨ãƒ©ãƒ¼: %s"
 
-#: ../roundup/cgi/actions.py:931
+#: ../roundup/cgi/actions.py:936
 msgid ""
 "Invalid One Time Key!\n"
 "(a Mozilla bug may cause this message to show up erroneously, please check "
 "your email)"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:972
+#: ../roundup/cgi/actions.py:977
 #, fuzzy, python-format
 msgid "Password reset for %s"
 msgstr "ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰å†è¨­å®š"
 
-#: ../roundup/cgi/actions.py:973
+#: ../roundup/cgi/actions.py:978
 #, python-format
 msgid ""
 "\n"
@@ -1447,29 +1452,29 @@ msgid ""
 "Your password is now: %(password)s\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:982
+#: ../roundup/cgi/actions.py:987
 #, python-format
 msgid "Password reset and email sent to %s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:991
+#: ../roundup/cgi/actions.py:996
 msgid "Unknown username"
 msgstr "ç™»éŒ²ã•ã‚Œã¦ã„ãªã„ãƒ¦ãƒ¼ã‚¶ãƒ¼åã§ã™"
 
-#: ../roundup/cgi/actions.py:999
+#: ../roundup/cgi/actions.py:1004
 msgid "Unknown email address"
 msgstr "ç™»éŒ²ã•ã‚Œã¦ã„ãªã„ãƒ¡ãƒ¼ãƒ«ã‚¢ãƒ‰ãƒ¬ã‚¹ã§ã™"
 
-#: ../roundup/cgi/actions.py:1004
+#: ../roundup/cgi/actions.py:1009
 msgid "You need to specify a username or address"
 msgstr "ãƒ¦ãƒ¼ã‚¶ãƒ¼åã¾ãŸã¯ãƒ¡ãƒ¼ãƒ«ã‚¢ãƒ‰ãƒ¬ã‚¹ã‚’å…¥åŠ›ã—ã¦ãã ã•ã„"
 
-#: ../roundup/cgi/actions.py:1015
+#: ../roundup/cgi/actions.py:1020
 #, fuzzy, python-format
 msgid "Confirm reset of password for %s"
 msgstr "ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰(ç¢ºèª)"
 
-#: ../roundup/cgi/actions.py:1016
+#: ../roundup/cgi/actions.py:1021
 #, python-format
 msgid ""
 "\n"
@@ -1483,31 +1488,31 @@ msgid ""
 "You should then receive another email with the new password.\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1029
+#: ../roundup/cgi/actions.py:1034
 #, python-format
 msgid "Email sent to primary notification address for %s."
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1031
+#: ../roundup/cgi/actions.py:1036
 #, fuzzy, python-format
 msgid "Email sent to %s."
 msgstr "%sã¸ãƒ¡ãƒ¼ãƒ«ã‚’é€ä¿¡ã—ã¾ã—ãŸ"
 
-#: ../roundup/cgi/actions.py:1046
+#: ../roundup/cgi/actions.py:1051
 msgid "You are now registered, welcome!"
 msgstr "ãƒ¦ãƒ¼ã‚¶ãƒ¼ç™»éŒ²å®Œäº†!"
 
-#: ../roundup/cgi/actions.py:1139
+#: ../roundup/cgi/actions.py:1144
 #, python-format
 msgid "Username '%s' is already used."
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1163
+#: ../roundup/cgi/actions.py:1168
 #, python-format
 msgid "Complete your registration to %(tracker_name)s -- key %(key)s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1167
+#: ../roundup/cgi/actions.py:1172
 #, python-format
 msgid ""
 "To complete your registration of the user \"%(name)s\" with\n"
@@ -1523,12 +1528,12 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1181
+#: ../roundup/cgi/actions.py:1186
 #, python-format
 msgid "Complete your registration to %s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1182
+#: ../roundup/cgi/actions.py:1187
 #, python-format
 msgid ""
 "To complete your registration of the user \"%(name)s\" with\n"
@@ -1538,44 +1543,44 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1206
+#: ../roundup/cgi/actions.py:1211
 msgid "It is not permitted to supply roles at registration."
 msgstr "ç™»éŒ²æ™‚ã®ãƒ­ãƒ¼ãƒ«å‰²ã‚Šå½“ã¦ã¯è¨±å¯ã•ã‚Œã¦ã„ã¾ã›ã‚“ã€‚"
 
-#: ../roundup/cgi/actions.py:1220
+#: ../roundup/cgi/actions.py:1225
 msgid "You are logged out"
 msgstr "ãƒ­ã‚°ã‚¢ã‚¦ãƒˆå®Œäº†"
 
-#: ../roundup/cgi/actions.py:1250
+#: ../roundup/cgi/actions.py:1255
 msgid "Username required"
 msgstr "ãƒ¦ãƒ¼ã‚¶ãƒ¼åã¯å…¥åŠ›å¿…é ˆã§ã™"
 
-#: ../roundup/cgi/actions.py:1354
+#: ../roundup/cgi/actions.py:1359
 #, python-format
 msgid "Welcome %(username)s!"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1477
+#: ../roundup/cgi/actions.py:1482
 #, python-format
 msgid "Logins occurring too fast. Please wait: %s seconds."
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1515 ../roundup/cgi/actions.py:1526
-#: ../roundup/cgi/actions.py:1515:1526
+#: ../roundup/cgi/actions.py:1520 ../roundup/cgi/actions.py:1531
+#: ../roundup/cgi/actions.py:1520:1531
 msgid "Invalid login"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1532
+#: ../roundup/cgi/actions.py:1537
 msgid "You do not have permission to login"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1577 ../roundup/cgi/actions.py:1757
-#: ../roundup/cgi/actions.py:1577:1757
+#: ../roundup/cgi/actions.py:1582 ../roundup/cgi/actions.py:1762
+#: ../roundup/cgi/actions.py:1582:1762
 #, python-format
 msgid "Column \"%(column)s\" not found in %(class)s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1822
+#: ../roundup/cgi/actions.py:1827
 #, python-format
 msgid "You do not have permission to view %(class)s"
 msgstr "%(class)s ã‚’è¡¨ç¤ºã™ã‚‹æ¨©é™ãŒã‚ã‚Šã¾ã›ã‚“"
@@ -1688,8 +1693,8 @@ msgstr ""
 msgid "Unrecognized charset: %r"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1381 ../roundup/cgi/client.py:2394
-#: ../roundup/cgi/client.py:1381:2394
+#: ../roundup/cgi/client.py:1381 ../roundup/cgi/client.py:2396
+#: ../roundup/cgi/client.py:1381:2396
 msgid "broken form: multiple @action values submitted"
 msgstr ""
 
@@ -1767,57 +1772,58 @@ msgstr ""
 
 #: ../roundup/cgi/client.py:1679
 #, python-format
-msgid "csrf X-REQUESTED-WITH xmlrpc required header check failed for user%s."
+msgid ""
+"csrf X-REQUESTED-WITH xmlrpc required header check failed for user%(userid)s."
 msgstr ""
 
 #: ../roundup/cgi/client.py:1720
 #, python-format
-msgid "Required csrf field missing for user%s"
+msgid "Required csrf field missing for user%(userid)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1722 ../roundup/cgi/client.py:1749
-#: ../roundup/cgi/client.py:1766 ../roundup/cgi/client.py:1722:1749:1766
+#: ../roundup/cgi/client.py:1723 ../roundup/cgi/client.py:1751
+#: ../roundup/cgi/client.py:1768 ../roundup/cgi/client.py:1723:1751:1768
 msgid ""
 "We can't validate your session (csrf failure). Re-enter any unsaved data and "
 "try again."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1726
+#: ../roundup/cgi/client.py:1728
 #, python-format
-msgid "csrf field not supplied by user%s"
+msgid "csrf field not supplied by user%(userid)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1738
+#: ../roundup/cgi/client.py:1740
 #, python-format
 msgid ""
 "Csrf mismatch user: current user %(user)s != stored user %(stored)s, current "
 "session, stored session: %(cur_sess)s,%(stor_sess)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1756
+#: ../roundup/cgi/client.py:1758
 #, python-format
 msgid ""
 "Csrf mismatch user: current session %(curr_sess)s != stored session "
 "%(stor_sess)s, current user/stored user is: %(user)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1948
+#: ../roundup/cgi/client.py:1950
 msgid "You are not allowed to view this file."
 msgstr ""
 
-#: ../roundup/cgi/client.py:2272
+#: ../roundup/cgi/client.py:2274
 #, python-format
 msgid "%(starttag)sTime elapsed: %(seconds)fs%(endtag)s\n"
 msgstr ""
 
-#: ../roundup/cgi/client.py:2276
+#: ../roundup/cgi/client.py:2278
 #, python-format
 msgid ""
 "%(starttag)sCache hits: %(cache_hits)d, misses %(cache_misses)d. Loading "
 "items: %(get_items)f secs. Filtering: %(filtering)f secs.%(endtag)s\n"
 msgstr ""
 
-#: ../roundup/cgi/client.py:2815
+#: ../roundup/cgi/client.py:2817
 #, python-format
 msgid ""
 "Cache failure: compressed file %(compressed)s is older than its source file "
@@ -1884,110 +1890,110 @@ msgstr[1] "%(class)s ã®å…¥åŠ›å¿…é ˆå±žæ€§ %(property)s ãŒå…¥åŠ›ã•ã‚Œã¦ã„ã¾
 msgid "You are not allowed to %(action)s items of class %(class)s"
 msgstr "ã‚¯ãƒ©ã‚¹ %(class)s ã®ã‚¢ã‚¤ãƒ†ãƒ ã‚’ %(action)s ã™ã‚‹æ¨©é™ãŒã‚ã‚Šã¾ã›ã‚“"
 
-#: ../roundup/cgi/templating.py:916
+#: ../roundup/cgi/templating.py:892
 msgid "(list)"
 msgstr "(ä¸€è¦§)"
 
-#: ../roundup/cgi/templating.py:991
+#: ../roundup/cgi/templating.py:975
 msgid "Submit New Entry"
 msgstr "æ–°è¦ç™»éŒ²"
 
-#: ../roundup/cgi/templating.py:1013 ../roundup/cgi/templating.py:1189
-#: ../roundup/cgi/templating.py:1824 ../roundup/cgi/templating.py:1855
-#: ../roundup/cgi/templating.py:1876 ../roundup/cgi/templating.py:1914
-#: ../roundup/cgi/templating.py:1967 ../roundup/cgi/templating.py:1991
-#: ../roundup/cgi/templating.py:1998 ../roundup/cgi/templating.py:2035
-#: ../roundup/cgi/templating.py:2088 ../roundup/cgi/templating.py:2121
-#: ../roundup/cgi/templating.py:2216 ../roundup/cgi/templating.py:2237
-#: ../roundup/cgi/templating.py:2328 ../roundup/cgi/templating.py:2348
-#: ../roundup/cgi/templating.py:2370 ../roundup/cgi/templating.py:2413
-#: ../roundup/cgi/templating.py:2423 ../roundup/cgi/templating.py:2488
-#: ../roundup/cgi/templating.py:2791 ../roundup/cgi/templating.py:1013:1189
-#: :1824:1855 :1876:1914 :1967:1991 :1998:2035 :2088:2121 :2216:2237 :2328:2348
-#: :2370:2413 :2423:2488:2791
+#: ../roundup/cgi/templating.py:997 ../roundup/cgi/templating.py:1174
+#: ../roundup/cgi/templating.py:1809 ../roundup/cgi/templating.py:1840
+#: ../roundup/cgi/templating.py:1861 ../roundup/cgi/templating.py:1899
+#: ../roundup/cgi/templating.py:1952 ../roundup/cgi/templating.py:1976
+#: ../roundup/cgi/templating.py:1983 ../roundup/cgi/templating.py:2020
+#: ../roundup/cgi/templating.py:2077 ../roundup/cgi/templating.py:2115
+#: ../roundup/cgi/templating.py:2215 ../roundup/cgi/templating.py:2236
+#: ../roundup/cgi/templating.py:2357 ../roundup/cgi/templating.py:2377
+#: ../roundup/cgi/templating.py:2399 ../roundup/cgi/templating.py:2442
+#: ../roundup/cgi/templating.py:2452 ../roundup/cgi/templating.py:2517
+#: ../roundup/cgi/templating.py:2820 ../roundup/cgi/templating.py:997:1174
+#: :1809:1840 :1861:1899 :1952:1976 :1983:2020 :2077:2115 :2215:2236 :2357:2377
+#: :2399:2442 :2452:2517:2820
 msgid "[hidden]"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:1014
+#: ../roundup/cgi/templating.py:998
 msgid "New node - no history"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:1154
+#: ../roundup/cgi/templating.py:1139
 msgid "Submit Changes"
 msgstr "æ›´æ–°"
 
-#: ../roundup/cgi/templating.py:1232
+#: ../roundup/cgi/templating.py:1217
 msgid "<em>The indicated property no longer exists</em>"
 msgstr "<em>æŒ‡å®šã•ã‚ŒãŸãƒ—ãƒ­ãƒ‘ãƒ†ã‚£ã¯å­˜åœ¨ã—ã¾ã›ã‚“<em>"
 
-#: ../roundup/cgi/templating.py:1268
+#: ../roundup/cgi/templating.py:1253
 #, python-format
 msgid "The linked class %(classname)s no longer exists"
 msgstr "ãƒªãƒ³ã‚¯å…ˆã®ã‚¯ãƒ©ã‚¹ %(classname)s ã¯å­˜åœ¨ã—ã¾ã›ã‚“"
 
-#: ../roundup/cgi/templating.py:1305 ../roundup/cgi/templating.py:1335
-#: ../roundup/cgi/templating.py:2497 ../roundup/cgi/templating.py:2800
-#: ../roundup/cgi/templating.py:1305:1335 :2497:2800
+#: ../roundup/cgi/templating.py:1290 ../roundup/cgi/templating.py:1320
+#: ../roundup/cgi/templating.py:2526 ../roundup/cgi/templating.py:2829
+#: ../roundup/cgi/templating.py:1290:1320 :2526:2829
 msgid "[label is missing]"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:1309 ../roundup/cgi/templating.py:1338
-#: ../roundup/cgi/templating.py:1309:1338
+#: ../roundup/cgi/templating.py:1294 ../roundup/cgi/templating.py:1323
+#: ../roundup/cgi/templating.py:1294:1323
 msgid "<strike>The linked node no longer exists</strike>"
 msgstr "<strike>ãƒªãƒ³ã‚¯å…ˆã®ãƒŽãƒ¼ãƒ‰ã¯å­˜åœ¨ã—ã¾ã›ã‚“</strike>"
 
-#: ../roundup/cgi/templating.py:1400
+#: ../roundup/cgi/templating.py:1385
 #, python-format
 msgid "%s: (no value)"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:1416
+#: ../roundup/cgi/templating.py:1401
 #, fuzzy, python-format
 msgid ""
 "<strong><em>This event %s is not handled by the history display!</em></"
 "strong>"
 msgstr "<strong><em>ã“ã®ã‚¤ãƒ™ãƒ³ãƒˆã¯å±¥æ­´ã®ä¸­ã«è¡¨ç¤ºã•ã‚Œã¾ã›ã‚“!</em></strong>"
 
-#: ../roundup/cgi/templating.py:1429
+#: ../roundup/cgi/templating.py:1414
 msgid "<tr><td colspan=4><strong>Note:</strong></td></tr>"
 msgstr "<tr><td colspan=4><strong>å‚™è€ƒ:</strong></td></tr>"
 
-#: ../roundup/cgi/templating.py:1438
+#: ../roundup/cgi/templating.py:1423
 msgid "History"
 msgstr "å±¥æ­´"
 
-#: ../roundup/cgi/templating.py:1440
+#: ../roundup/cgi/templating.py:1425
 msgid "<th>Date</th>"
 msgstr "<th>æ—¥æ™‚</th>"
 
-#: ../roundup/cgi/templating.py:1441
+#: ../roundup/cgi/templating.py:1426
 msgid "<th>User</th>"
 msgstr "<th>ãƒ¦ãƒ¼ã‚¶ãƒ¼</th>"
 
-#: ../roundup/cgi/templating.py:1442
+#: ../roundup/cgi/templating.py:1427
 msgid "<th>Action</th>"
 msgstr "<th>ã‚¢ã‚¯ã‚·ãƒ§ãƒ³</th>"
 
-#: ../roundup/cgi/templating.py:1443
+#: ../roundup/cgi/templating.py:1428
 msgid "<th>Args</th>"
 msgstr "<th>å¼•æ•°</th>"
 
-#: ../roundup/cgi/templating.py:1494
+#: ../roundup/cgi/templating.py:1479
 #, python-format
 msgid "Copy of %(class)s %(id)s"
 msgstr "%(class)s %(id)s ã®ã‚³ãƒ”ãƒ¼"
 
-#: ../roundup/cgi/templating.py:2125 ../roundup/cgi/templating.py:2160
-#: ../roundup/cgi/templating.py:1382:2125:2160
+#: ../roundup/cgi/templating.py:2119 ../roundup/cgi/templating.py:2154
+#: ../roundup/cgi/templating.py:1367:2119:2154
 msgid "No"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:2125 ../roundup/cgi/templating.py:2154
-#: ../roundup/cgi/templating.py:1382:2125:2154
+#: ../roundup/cgi/templating.py:2119 ../roundup/cgi/templating.py:2148
+#: ../roundup/cgi/templating.py:1367:2119:2148
 msgid "Yes"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:2286
+#: ../roundup/cgi/templating.py:2315
 msgid ""
 "default value for DateHTMLProperty must be either DateHTMLProperty or string "
 "date representation."
@@ -1995,27 +2001,27 @@ msgstr ""
 "DateHTMLProperty ã®ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆå€¤ã¯ DateHTMLProperty ã‚‚ã—ãã¯æ—¥ä»˜ã®æ–‡å­—åˆ—è¡¨ç¾ã§"
 "ãªãã¦ã¯ãªã‚Šã¾ã›ã‚“ã€‚"
 
-#: ../roundup/cgi/templating.py:2468
+#: ../roundup/cgi/templating.py:2497
 #, python-format
 msgid "Attempt to look up %(attr)s on a missing value"
 msgstr "å­˜åœ¨ã—ãªã„å€¤ã® %(attr)s æ¤œç´¢ãŒå®Ÿè¡Œã•ã‚Œã¾ã—ãŸ"
 
-#: ../roundup/cgi/templating.py:2479
+#: ../roundup/cgi/templating.py:2508
 #, fuzzy, python-format
 msgid "Attempt to look up %(item)s on a missing value"
 msgstr "å­˜åœ¨ã—ãªã„å€¤ã® %(attr)s æ¤œç´¢ãŒå®Ÿè¡Œã•ã‚Œã¾ã—ãŸ"
 
-#: ../roundup/cgi/templating.py:2584
+#: ../roundup/cgi/templating.py:2613
 #, python-format
 msgid "<option %svalue=\"-1\">- no selection -</option>"
 msgstr "<option %svalue=\"-1\">- æœªé¸æŠž -</option>"
 
-#: ../roundup/cgi/templating.py:3745
+#: ../roundup/cgi/templating.py:3777
 #, python-format
 msgid "Unable to read or expand file '%(name)s' in template '%(template)s'."
 msgstr ""
 
-#: ../roundup/cgi/templating.py:3795
+#: ../roundup/cgi/templating.py:3827
 #, python-format
 msgid ""
 "Found an incorrect token when expandfile applied string subsitution on "
@@ -2181,54 +2187,54 @@ msgstr "%så‰"
 msgid "in %s"
 msgstr "%sä»¥å†…"
 
-#: ../roundup/hyperdb.py:120
+#: ../roundup/hyperdb.py:126
 #, python-format
 msgid "property %(property)s: %(errormsg)s"
 msgstr ""
 
-#: ../roundup/hyperdb.py:149
+#: ../roundup/hyperdb.py:161
 #, python-format
 msgid "property %(property)s: %(value)r is an invalid date (%(errormsg)s)"
 msgstr ""
 
-#: ../roundup/hyperdb.py:172
+#: ../roundup/hyperdb.py:184
 #, python-format
 msgid ""
 "property %(property)s: %(value)r is an invalid date interval (%(errormsg)s)"
 msgstr ""
 
-#: ../roundup/hyperdb.py:434
+#: ../roundup/hyperdb.py:446
 #, fuzzy, python-format
 msgid "property %(property)s: %(value)r is not a number"
 msgstr "ãƒ—ãƒ­ãƒ‘ãƒ†ã‚£ \"%(propname)s\": \"%(value)s\" ãŒãƒªã‚¹ãƒˆã®ä¸­ã«ã‚ã‚Šã¾ã›ã‚“"
 
-#: ../roundup/hyperdb.py:448
+#: ../roundup/hyperdb.py:460
 #, fuzzy, python-format
 msgid "property %(property)s: %(value)r is not an integer"
 msgstr "ãƒ—ãƒ­ãƒ‘ãƒ†ã‚£ \"%(propname)s\": \"%(value)s\" ãŒãƒªã‚¹ãƒˆã®ä¸­ã«ã‚ã‚Šã¾ã›ã‚“"
 
-#: ../roundup/hyperdb.py:470
+#: ../roundup/hyperdb.py:482
 #, python-format
 msgid "\"%s\" not a node designator"
 msgstr ""
 
-#: ../roundup/hyperdb.py:1499 ../roundup/hyperdb.py:1507
-#: ../roundup/hyperdb.py:1499:1507
+#: ../roundup/hyperdb.py:1515 ../roundup/hyperdb.py:1523
+#: ../roundup/hyperdb.py:1515:1523
 #, python-format
 msgid "Not a property name: %s"
 msgstr ""
 
-#: ../roundup/hyperdb.py:2038
+#: ../roundup/hyperdb.py:2054
 #, fuzzy, python-format
 msgid "property %(property)s: %(value)r is not a %(classname)s."
 msgstr "ãƒ—ãƒ­ãƒ‘ãƒ†ã‚£ \"%(propname)s\": \"%(value)s\" ãŒãƒªã‚¹ãƒˆã®ä¸­ã«ã‚ã‚Šã¾ã›ã‚“"
 
-#: ../roundup/hyperdb.py:2044
+#: ../roundup/hyperdb.py:2060
 #, python-format
 msgid "you may only enter ID values for property %s"
 msgstr ""
 
-#: ../roundup/hyperdb.py:2079
+#: ../roundup/hyperdb.py:2095
 #, python-format
 msgid "%(property)r is not a property of %(classname)s"
 msgstr ""
@@ -2483,60 +2489,60 @@ msgid ""
 "are: %(stack)s"
 msgstr ""
 
-#: ../roundup/pygettext.py:401
+#: ../roundup/pygettext.py:400
 #, python-format
 msgid "*** %(file)s:%(lineno)s: Seen unexpected token \"%(token)s\""
 msgstr ""
 
-#: ../roundup/pygettext.py:457
+#: ../roundup/pygettext.py:456
 #, python-format
 msgid "# File: %(filename)s, line: %(lineno)d"
 msgstr ""
 
-#: ../roundup/pygettext.py:464
+#: ../roundup/pygettext.py:463
 #, python-format
 msgid " %(filename)s:%(lineno)d"
 msgstr ""
 
-#: ../roundup/pygettext.py:540
+#: ../roundup/pygettext.py:539
 #, fuzzy, python-format
 msgid "Invalid value for --style: %s"
 msgstr "ä¸æ­£ãªãƒªã‚¯ã‚¨ã‚¹ãƒˆ"
 
-#: ../roundup/pygettext.py:548
+#: ../roundup/pygettext.py:547
 #, python-format
 msgid "pygettext.py (xgettext for Python) %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:554
+#: ../roundup/pygettext.py:553
 #, python-format
 msgid "--width argument must be an integer: %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:582
+#: ../roundup/pygettext.py:581
 #, python-format
 msgid "Can't read --exclude-file: %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:601
+#: ../roundup/pygettext.py:600
 msgid "Reading standard input"
 msgstr ""
 
-#: ../roundup/pygettext.py:606
+#: ../roundup/pygettext.py:605
 #, python-format
 msgid "Working on %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:640
+#: ../roundup/pygettext.py:639
 msgid "a unicode string"
 msgstr ""
 
-#: ../roundup/pygettext.py:642
+#: ../roundup/pygettext.py:641
 #, python-format
 msgid "*** Seen unexpected token \"%(token)s\""
 msgstr ""
 
-#: ../roundup/pygettext.py:643
+#: ../roundup/pygettext.py:642
 msgid "morethanonestring"
 msgstr ""
 
@@ -2656,32 +2662,32 @@ msgstr "ç™»éŒ²æ—¥æ™‚"
 msgid "creator"
 msgstr "ç™»éŒ²è€…"
 
-#: ../roundup/roundupdb.py:426
+#: ../roundup/roundupdb.py:447
 #, python-format
 msgid "No key for \"%(adr)s\" in keyring"
 msgstr ""
 
-#: ../roundup/roundupdb.py:504
+#: ../roundup/roundupdb.py:525
 #, python-format
 msgid "New submission from %(authname)s%(authaddr)s:"
 msgstr ""
 
-#: ../roundup/roundupdb.py:507
+#: ../roundup/roundupdb.py:528
 #, python-format
 msgid "%(authname)s%(authaddr)s added the comment:"
 msgstr ""
 
-#: ../roundup/roundupdb.py:510
+#: ../roundup/roundupdb.py:531
 #, python-format
 msgid "Change by %(authname)s%(authaddr)s:"
 msgstr ""
 
-#: ../roundup/roundupdb.py:529
+#: ../roundup/roundupdb.py:550
 #, python-format
 msgid "File '%(filename)s' not attached - you can download it from %(link)s."
 msgstr ""
 
-#: ../roundup/roundupdb.py:904
+#: ../roundup/roundupdb.py:925
 #, python-format
 msgid ""
 "\n"
@@ -2780,58 +2786,58 @@ msgid ""
 "<body><h1>Roundup trackers index</h1><ol>\n"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:598
+#: ../roundup/scripts/roundup_server.py:602
 #, python-format
 msgid "Error: %(type)s: %(value)s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:610
+#: ../roundup/scripts/roundup_server.py:614
 msgid "WARNING: ignoring \"-g\" argument, not root"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:616
+#: ../roundup/scripts/roundup_server.py:620
 msgid "Can't change groups - no grp module"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:625
+#: ../roundup/scripts/roundup_server.py:629
 #, python-format
 msgid "Group %(group)s doesn't exist"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:637
+#: ../roundup/scripts/roundup_server.py:641
 msgid "Can't run as root!"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:640
+#: ../roundup/scripts/roundup_server.py:644
 msgid "WARNING: ignoring \"-u\" argument, not root"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:646
+#: ../roundup/scripts/roundup_server.py:650
 msgid "Can't change users - no pwd module"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:655
+#: ../roundup/scripts/roundup_server.py:659
 #, python-format
 msgid "User %(user)s doesn't exist"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:867
+#: ../roundup/scripts/roundup_server.py:871
 #, python-format
 msgid "Multiprocess mode \"%s\" is not available, switching to single-process"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:895
+#: ../roundup/scripts/roundup_server.py:899
 #, python-format
 msgid "Unable to bind to port %s, port already in use."
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:899
+#: ../roundup/scripts/roundup_server.py:903
 #, python-format
 msgid ""
 "Unable to bind to port %(port)s, access not allowed, errno: %(errno)s %(msg)s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:978
+#: ../roundup/scripts/roundup_server.py:982
 msgid ""
 " -c <Command>  Windows Service options.\n"
 "               If you want to run the server as a Windows Service, you\n"
@@ -2841,7 +2847,7 @@ msgid ""
 "               specifics."
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:985
+#: ../roundup/scripts/roundup_server.py:989
 msgid ""
 " -u <UID>      runs the Roundup web server as this UID\n"
 " -g <GID>      runs the Roundup web server as this GID\n"
@@ -2851,7 +2857,7 @@ msgid ""
 " -D            run the server in the foreground even when -d is used."
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:993
+#: ../roundup/scripts/roundup_server.py:997
 #, python-format
 msgid ""
 "\n"
@@ -2924,20 +2930,24 @@ msgid ""
 "   any url-unsafe characters like spaces, as these confuse IE.\n"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:1173
+#: ../roundup/scripts/roundup_server.py:1177
 msgid "Instances must be name=home"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:1187
+#: ../roundup/scripts/roundup_server.py:1191
 #, python-format
 msgid "Configuration saved to %s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:1205
+#: ../roundup/scripts/roundup_server.py:1206
+msgid "If you specify a PID file you must use -l or -L."
+msgstr ""
+
+#: ../roundup/scripts/roundup_server.py:1212
 msgid "Sorry, you can't run the server as a daemon on this Operating System"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:1225
+#: ../roundup/scripts/roundup_server.py:1232
 #, python-format
 msgid "Roundup server started on %(HOST)s:%(PORT)s"
 msgstr ""
@@ -4215,46 +4225,46 @@ msgstr "Roundupãƒ‰ã‚­ãƒ¥ãƒ¡ãƒ³ãƒˆ"
 msgid "clear this message"
 msgstr "ã“ã®ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ã‚’ã‚¯ãƒªã‚¢"
 
-#: ../share/roundup/templates/classic/html/page.html:257
-#: ../share/roundup/templates/classic/html/page.html:270
-#: ../share/roundup/templates/classic/html/page.html:288
-#: ../share/roundup/templates/classic/html/page.html:302
-#: ../share/roundup/templates/devel/html/page.html:316
-#: ../share/roundup/templates/devel/html/page.html:329
-#: ../share/roundup/templates/devel/html/page.html:347
-#: ../share/roundup/templates/devel/html/page.html:361
-#: ../share/roundup/templates/minimal/html/page.html:239
-#: ../share/roundup/templates/minimal/html/page.html:254
-#: ../share/roundup/templates/minimal/html/page.html:268
-#: ../share/roundup/templates/responsive/html/page.html:331
-#: ../share/roundup/templates/responsive/html/page.html:344
-#: ../share/roundup/templates/responsive/html/page.html:362
-#: ../share/roundup/templates/responsive/html/page.html:376
-msgid "don't care"
-msgstr "æŒ‡å®šã—ãªã„"
-
-#: ../share/roundup/templates/classic/html/page.html:259
-#: ../share/roundup/templates/classic/html/page.html:272
-#: ../share/roundup/templates/classic/html/page.html:290
+#: ../share/roundup/templates/classic/html/page.html:258
+#: ../share/roundup/templates/classic/html/page.html:271
+#: ../share/roundup/templates/classic/html/page.html:289
 #: ../share/roundup/templates/classic/html/page.html:303
-#: ../share/roundup/templates/devel/html/page.html:318
-#: ../share/roundup/templates/devel/html/page.html:331
-#: ../share/roundup/templates/devel/html/page.html:349
+#: ../share/roundup/templates/devel/html/page.html:317
+#: ../share/roundup/templates/devel/html/page.html:330
+#: ../share/roundup/templates/devel/html/page.html:348
 #: ../share/roundup/templates/devel/html/page.html:362
-#: ../share/roundup/templates/minimal/html/page.html:241
-#: ../share/roundup/templates/minimal/html/page.html:256
+#: ../share/roundup/templates/minimal/html/page.html:240
+#: ../share/roundup/templates/minimal/html/page.html:255
 #: ../share/roundup/templates/minimal/html/page.html:269
-#: ../share/roundup/templates/responsive/html/page.html:333
-#: ../share/roundup/templates/responsive/html/page.html:346
-#: ../share/roundup/templates/responsive/html/page.html:364
+#: ../share/roundup/templates/responsive/html/page.html:332
+#: ../share/roundup/templates/responsive/html/page.html:345
+#: ../share/roundup/templates/responsive/html/page.html:363
 #: ../share/roundup/templates/responsive/html/page.html:377
+msgid "don't care"
+msgstr "æŒ‡å®šã—ãªã„"
+
+#: ../share/roundup/templates/classic/html/page.html:260
+#: ../share/roundup/templates/classic/html/page.html:273
+#: ../share/roundup/templates/classic/html/page.html:291
+#: ../share/roundup/templates/classic/html/page.html:304
+#: ../share/roundup/templates/devel/html/page.html:319
+#: ../share/roundup/templates/devel/html/page.html:332
+#: ../share/roundup/templates/devel/html/page.html:350
+#: ../share/roundup/templates/devel/html/page.html:363
+#: ../share/roundup/templates/minimal/html/page.html:242
+#: ../share/roundup/templates/minimal/html/page.html:257
+#: ../share/roundup/templates/minimal/html/page.html:270
+#: ../share/roundup/templates/responsive/html/page.html:334
+#: ../share/roundup/templates/responsive/html/page.html:347
+#: ../share/roundup/templates/responsive/html/page.html:365
+#: ../share/roundup/templates/responsive/html/page.html:378
 msgid "------------"
 msgstr ""
 
-#: ../share/roundup/templates/classic/html/page.html:335
-#: ../share/roundup/templates/devel/html/page.html:390
-#: ../share/roundup/templates/minimal/html/page.html:297
-#: ../share/roundup/templates/responsive/html/page.html:405
+#: ../share/roundup/templates/classic/html/page.html:336
+#: ../share/roundup/templates/devel/html/page.html:391
+#: ../share/roundup/templates/minimal/html/page.html:298
+#: ../share/roundup/templates/responsive/html/page.html:406
 msgid "no value"
 msgstr ""
 
diff --git a/locale/lt.po b/locale/lt.po
index 3865ce239..5665ce4dd 100644
--- a/locale/lt.po
+++ b/locale/lt.po
@@ -5,9 +5,9 @@
 #
 msgid ""
 msgstr ""
-"Project-Id-Version: Roundup 2.5.0\n"
+"Project-Id-Version: Roundup 2.5.0b1\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
-"POT-Creation-Date: 2025-01-12 20:17-0500\n"
+"POT-Creation-Date: 2025-06-11 16:02-0400\n"
 "PO-Revision-Date: 2013-10-31 12:21+0100\n"
 "Last-Translator: Nerijus Baliunas <nerijus@users.sourceforge.net>\n"
 "Language-Team: \n"
@@ -28,19 +28,19 @@ msgstr "JÅ«s neturite leidimo %(action)s %(classname)s klasÄ™."
 msgid "You may not retire the admin or anonymous user"
 msgstr "Negalite deaktyvuoti administratoriaus ar anoniminio vartotojo"
 
-#: ../roundup/admin.py:131
+#: ../roundup/admin.py:132
 msgid ""
 "Have 'display designator[,designator*]' show header inside\n"
 "      []'s before items. Includes retired/active status.\n"
 msgstr ""
 
-#: ../roundup/admin.py:135
+#: ../roundup/admin.py:136
 msgid ""
 "Have 'display designator' and 'specification class' show\n"
 "      protected fields: creator, id etc.\n"
 msgstr ""
 
-#: ../roundup/admin.py:139
+#: ../roundup/admin.py:140
 msgid ""
 "Controls history options. It is a bitstring where setting\n"
 "      the bit disables the feature. A value of 0 (default)\n"
@@ -51,52 +51,52 @@ msgid ""
 "      history.\n"
 msgstr ""
 
-#: ../roundup/admin.py:148
+#: ../roundup/admin.py:149
 msgid ""
 "Set the number of lines of history to keep for this session.\n"
 "      -1 is infinite.\n"
 msgstr ""
 
-#: ../roundup/admin.py:152
+#: ../roundup/admin.py:153
 msgid "Set indexer to use when running 'reindex' NYI\n"
 msgstr ""
 
-#: ../roundup/admin.py:155
+#: ../roundup/admin.py:156
 msgid "Force reopening of tracker when running each command.\n"
 msgstr ""
 
-#: ../roundup/admin.py:158
+#: ../roundup/admin.py:159
 msgid ""
 "set the number of rows imported before a database commit is\n"
 "      done. Used only for imports on PostgreSQL.\n"
 msgstr ""
 
-#: ../roundup/admin.py:160
+#: ../roundup/admin.py:161
 msgid "Show retired items in table, list etc. One of 'no', 'only', 'both'\n"
 msgstr ""
 
-#: ../roundup/admin.py:162
+#: ../roundup/admin.py:163
 msgid "internal mapping for show_retired.\n"
 msgstr ""
 
-#: ../roundup/admin.py:163
+#: ../roundup/admin.py:164
 msgid "Enable verbose output: tracing, descriptions...\n"
 msgstr ""
 
 # ../roundup/admin.py:85 :962 :1011 :1033
-#: ../roundup/admin.py:175 ../roundup/admin.py:1188 ../roundup/admin.py:1858
-#: ../roundup/admin.py:1890 ../roundup/admin.py:175:1188 :1858:1890
+#: ../roundup/admin.py:176 ../roundup/admin.py:1199 ../roundup/admin.py:1869
+#: ../roundup/admin.py:1901 ../roundup/admin.py:176:1199 :1869:1901
 #, python-format
 msgid "no such class \"%(classname)s\""
 msgstr "nÄ—ra klasÄ—s \"%(classname)s\""
 
 # ../roundup/admin.py:95 :99
-#: ../roundup/admin.py:188
+#: ../roundup/admin.py:189
 #, python-format
 msgid "argument \"%(arg)s\" not propname=value"
 msgstr "argumentas \"%(arg)s\" nÄ—ra parinktis=reikÅ¡mÄ— formato"
 
-#: ../roundup/admin.py:201
+#: ../roundup/admin.py:202
 #, python-format
 msgid ""
 "Problem: %(message)s\n"
@@ -105,7 +105,7 @@ msgstr ""
 "Problema: %(message)s\n"
 "\n"
 
-#: ../roundup/admin.py:202
+#: ../roundup/admin.py:203
 #, fuzzy, python-format
 msgid ""
 "%(message)sUsage: roundup-admin [options] [<command> <arguments>]\n"
@@ -158,12 +158,12 @@ msgstr ""
 " roundup-admin help <komanda>             -- specifinÄ— pagalba komandoms\n"
 " roundup-admin help all                   -- visa Ä¯manoma pagalba\n"
 
-#: ../roundup/admin.py:231
+#: ../roundup/admin.py:232
 #, fuzzy
 msgid "Commands: "
 msgstr "Komandos:"
 
-#: ../roundup/admin.py:238
+#: ../roundup/admin.py:249
 msgid ""
 "Commands may be abbreviated as long as the abbreviation\n"
 "matches only one command, e.g. l == li == lis == list."
@@ -171,7 +171,7 @@ msgstr ""
 "Komandos gali bÅ«ti sutrumpintos, taÄiau sutrumpinimas turi atitikti tik\n"
 "vienÄ… komandÄ…, pvz. l == li == lis == list."
 
-#: ../roundup/admin.py:270
+#: ../roundup/admin.py:281
 #, fuzzy
 msgid ""
 "\n"
@@ -306,25 +306,25 @@ msgstr ""
 "\n"
 "KomandÅ³ pagalba:\n"
 
-#: ../roundup/admin.py:334
+#: ../roundup/admin.py:345
 #, python-format
 msgid "%s:"
 msgstr "%s:"
 
 # ../roundup/admin.py:338 :387
-#: ../roundup/admin.py:439 ../roundup/admin.py:1415
-#: ../roundup/admin.py:439:1415
+#: ../roundup/admin.py:450 ../roundup/admin.py:1426
+#: ../roundup/admin.py:450:1426
 msgid "Templates:"
 msgstr "Å ablonai:"
 
 # ../roundup/admin.py:341 :398
-#: ../roundup/admin.py:442 ../roundup/admin.py:1425
-#: ../roundup/admin.py:442:1425
+#: ../roundup/admin.py:453 ../roundup/admin.py:1436
+#: ../roundup/admin.py:453:1436
 msgid "Back ends:"
 msgstr "DuomenÅ³ saugyklos:"
 
 #. noqa: ARG002
-#: ../roundup/admin.py:459
+#: ../roundup/admin.py:470
 msgid ""
 "Usage: commit\n"
 "        Commit changes made to the database during an interactive session.\n"
@@ -349,7 +349,7 @@ msgstr ""
 "            iÅ¡saugomos, jei jos Ä¯vykdomos sÄ—kmingai.\n"
 "        "
 
-#: ../roundup/admin.py:474
+#: ../roundup/admin.py:485
 msgid ""
 "Usage: create classname property=value ...\n"
 "        Create a new entry of a given class.\n"
@@ -370,42 +370,42 @@ msgstr ""
 
 # ../roundup/admin.py:360 :447 :508 :587 :637 :695 :716 :744 :815 :882 :953
 # :1001 :1023 :1050 :1117 :1184
-#: ../roundup/admin.py:482 ../roundup/admin.py:555 ../roundup/admin.py:606
-#: ../roundup/admin.py:733 ../roundup/admin.py:806 ../roundup/admin.py:851
-#: ../roundup/admin.py:902 ../roundup/admin.py:999 ../roundup/admin.py:1216
-#: ../roundup/admin.py:1388 ../roundup/admin.py:1516 ../roundup/admin.py:1599
-#: ../roundup/admin.py:1725 ../roundup/admin.py:1848 ../roundup/admin.py:1880
-#: ../roundup/admin.py:1996 ../roundup/admin.py:2050 ../roundup/admin.py:2098
-#: ../roundup/admin.py:482:555 :1216:1388:1516 :1599:1725 :1848:1880 :1996:2050
-#: :2098 :606:733 :806:851 :902:999
+#: ../roundup/admin.py:493 ../roundup/admin.py:566 ../roundup/admin.py:617
+#: ../roundup/admin.py:744 ../roundup/admin.py:817 ../roundup/admin.py:862
+#: ../roundup/admin.py:913 ../roundup/admin.py:1010 ../roundup/admin.py:1227
+#: ../roundup/admin.py:1399 ../roundup/admin.py:1527 ../roundup/admin.py:1610
+#: ../roundup/admin.py:1736 ../roundup/admin.py:1859 ../roundup/admin.py:1891
+#: ../roundup/admin.py:2007 ../roundup/admin.py:2061 ../roundup/admin.py:2109
+#: ../roundup/admin.py:493:566 :1227:1399 :1527:1610 :1736:1859 :1891:2007
+#: :2061:2109 :617:744 :817:862 :913:1010
 msgid "Not enough arguments supplied"
 msgstr "Paduota nepakankamai argumentÅ³"
 
-#: ../roundup/admin.py:502
+#: ../roundup/admin.py:513
 #, python-format
 msgid "%(propname)s (Password): "
 msgstr "%(propname)s (SlaptaÅ¾odis): "
 
-#: ../roundup/admin.py:505
+#: ../roundup/admin.py:516
 #, python-format
 msgid "   %(propname)s (Again): "
 msgstr "   %(propname)s (Pakartoti): "
 
-#: ../roundup/admin.py:509
+#: ../roundup/admin.py:520
 msgid "Sorry, try again..."
 msgstr "Bandykite dar kartÄ…..."
 
-#: ../roundup/admin.py:514
+#: ../roundup/admin.py:525
 #, python-format
 msgid "%(propname)s (%(proptype)s): "
 msgstr "%(propname)s (%(proptype)s): "
 
-#: ../roundup/admin.py:533
+#: ../roundup/admin.py:544
 #, python-format
 msgid "you must provide the \"%(propname)s\" property."
 msgstr "turite pateikti parinktÄ¯ \"%(propname)s\"."
 
-#: ../roundup/admin.py:545
+#: ../roundup/admin.py:556
 #, fuzzy
 msgid ""
 "Usage: display designator[,designator]*\n"
@@ -424,13 +424,13 @@ msgstr ""
 "            Å i komanda iÅ¡vardina parinktis ir jÅ³ reikÅ¡mes duotam elementui.\n"
 "        "
 
-#: ../roundup/admin.py:586
+#: ../roundup/admin.py:597
 #, fuzzy, python-format
 msgid "%(protected)s%(key)s: %(value)s"
 msgstr "%(key)s: %(value)s"
 
 #. grab the directory to export to
-#: ../roundup/admin.py:589
+#: ../roundup/admin.py:600
 #, fuzzy
 msgid ""
 "Usage: export [[-]class[,class]] export_dir\n"
@@ -462,7 +462,7 @@ msgstr ""
 "        direktorijoje.\n"
 "        "
 
-#: ../roundup/admin.py:704
+#: ../roundup/admin.py:715
 #, fuzzy
 msgid ""
 "Usage: exporttables [[-]class[,class]] export_dir\n"
@@ -496,7 +496,7 @@ msgstr ""
 "        direktorijoje.\n"
 "        "
 
-#: ../roundup/admin.py:723
+#: ../roundup/admin.py:734
 #, fuzzy
 msgid ""
 "Usage: filter classname propname=value ...\n"
@@ -519,20 +519,20 @@ msgstr ""
 "        "
 
 # ../roundup/admin.py:682 :835 :847 :901
-#: ../roundup/admin.py:764
+#: ../roundup/admin.py:775
 #, fuzzy, python-format
 msgid "Class %(curclassname)s has no property %(pn)s in %(propname)s."
 msgstr "%(classname)s neturi parinkties \"%(propname)s\""
 
 # ../roundup/admin.py:682 :835 :847 :901
-#: ../roundup/admin.py:791 ../roundup/admin.py:840 ../roundup/admin.py:1536
-#: ../roundup/admin.py:1549 ../roundup/admin.py:2120
-#: ../roundup/admin.py:791:840 :1536:1549:2120
+#: ../roundup/admin.py:802 ../roundup/admin.py:851 ../roundup/admin.py:1547
+#: ../roundup/admin.py:1560 ../roundup/admin.py:2131
+#: ../roundup/admin.py:802:851 :1547:1560:2131
 #, python-format
 msgid "%(classname)s has no property \"%(propname)s\""
 msgstr "%(classname)s neturi parinkties \"%(propname)s\""
 
-#: ../roundup/admin.py:798
+#: ../roundup/admin.py:809
 msgid ""
 "Usage: find classname propname=value ...\n"
 "        Find the nodes of the given class with a given link property value.\n"
@@ -551,7 +551,7 @@ msgstr ""
 "            arba jo raktinÄ— reikÅ¡mÄ—.\n"
 "        "
 
-#: ../roundup/admin.py:847
+#: ../roundup/admin.py:858
 #, fuzzy
 msgid ""
 "Usage: genconfig filename\n"
@@ -563,7 +563,7 @@ msgstr ""
 "            Ä¯prastomis reikÅ¡mÄ—mis faile <failovardas>.\n"
 "        "
 
-#: ../roundup/admin.py:864
+#: ../roundup/admin.py:875
 #, python-format
 msgid ""
 "Changing option\n"
@@ -571,20 +571,20 @@ msgid ""
 "from old default of %(old_number)s to new default of %(new_number)s."
 msgstr ""
 
-#: ../roundup/admin.py:875
+#: ../roundup/admin.py:886
 #, python-format
 msgid ""
 "Update 'password_pbkdf2_default_rounds' to a number equal to or larger\n"
 "  than %s.\n"
 msgstr ""
 
-#: ../roundup/admin.py:882
+#: ../roundup/admin.py:893
 msgid ""
 "Check the rdbms mysql_* settings. Your charset and collations may need\n"
 "  to be changed. See upgrading instructions.\n"
 msgstr ""
 
-#: ../roundup/admin.py:892
+#: ../roundup/admin.py:903
 #, fuzzy
 msgid ""
 "Usage: get property designator[,designator]*\n"
@@ -604,7 +604,7 @@ msgstr ""
 "            "
 
 # ../roundup/admin.py:541 :556
-#: ../roundup/admin.py:925
+#: ../roundup/admin.py:936
 #, python-format
 msgid "property %s is not of type Multilink or Link so -d flag does not apply."
 msgstr ""
@@ -612,18 +612,18 @@ msgstr ""
 "-d netinkamas."
 
 # ../roundup/admin.py:564 :964 :1013 :1035
-#: ../roundup/admin.py:942 ../roundup/admin.py:1190 ../roundup/admin.py:1864
-#: ../roundup/admin.py:1892 ../roundup/admin.py:942:1190 :1864:1892
+#: ../roundup/admin.py:953 ../roundup/admin.py:1201 ../roundup/admin.py:1875
+#: ../roundup/admin.py:1903 ../roundup/admin.py:953:1201 :1875:1903
 #, python-format
 msgid "no such %(classname)s node \"%(nodeid)s\""
 msgstr "nÄ—ra tokio %(classname)s elemento \"%(nodeid)s\""
 
-#: ../roundup/admin.py:945
+#: ../roundup/admin.py:956
 #, python-format
 msgid "no such %(classname)s property \"%(propname)s\""
 msgstr "nÄ—ra tokio %(classname)s parinkties \"%(propname)s\""
 
-#: ../roundup/admin.py:950
+#: ../roundup/admin.py:961
 msgid ""
 "Usage: help topic\n"
 "        Give help about topic.\n"
@@ -643,12 +643,12 @@ msgstr ""
 "        all       -- visa Ä¯manoma pagalba\n"
 "        "
 
-#: ../roundup/admin.py:969
+#: ../roundup/admin.py:980
 #, python-format
 msgid "Sorry, no help for \"%(topic)s\""
 msgstr "AtsipraÅ¡ome, pagalbos temai \"%(topic)s\" nÄ—ra"
 
-#: ../roundup/admin.py:986
+#: ../roundup/admin.py:997
 #, fuzzy
 msgid ""
 "Usage: history designator [skipquiet] [raw]\n"
@@ -671,27 +671,27 @@ msgstr ""
 "            kartÄ….\n"
 "        "
 
-#: ../roundup/admin.py:1011
+#: ../roundup/admin.py:1022
 #, python-format
 msgid "Unexpected argument(s): %s. Expected 'skipquiet' or 'raw'."
 msgstr ""
 
-#: ../roundup/admin.py:1062
+#: ../roundup/admin.py:1073
 #, fuzzy
 msgid "removed"
 msgstr "paÅ¡alinti"
 
-#: ../roundup/admin.py:1064
+#: ../roundup/admin.py:1075
 msgid "added"
 msgstr ""
 
-#: ../roundup/admin.py:1066
+#: ../roundup/admin.py:1077
 #, python-format
 msgid "Unknown history set operation '%s'. Expected +/-."
 msgstr ""
 
 #. .Hint added issue23 to superseder
-#: ../roundup/admin.py:1091
+#: ../roundup/admin.py:1102
 #, fuzzy, python-format
 msgid "added %(class)s%(item_id)s to %(propname)s"
 msgstr "%(class)s %(id)s %(properties)s pakeitimai iÅ¡saugoti"
@@ -699,29 +699,29 @@ msgstr "%(class)s %(id)s %(properties)s pakeitimai iÅ¡saugoti"
 #. .Hint read as: assignedto was admin(1)
 #. where assignedto is the property
 #. admin is the key name for value 1
-#: ../roundup/admin.py:1112
+#: ../roundup/admin.py:1123
 #, fuzzy, python-format
 msgid "%(prop)s was %(name)s(%(value)s)"
 msgstr "%(propname)s (%(proptype)s): "
 
-#: ../roundup/admin.py:1118 ../roundup/admin.py:1147
-#: ../roundup/admin.py:1118:1147
+#: ../roundup/admin.py:1129 ../roundup/admin.py:1158
+#: ../roundup/admin.py:1129:1158
 #, fuzzy, python-format
 msgid "%(prop)s was %(value)s"
 msgstr "%(key)s: %(value)s"
 
-#: ../roundup/admin.py:1137
+#: ../roundup/admin.py:1148
 #, python-format
 msgid "%(prop)s was [%(value_list)s]"
 msgstr ""
 
 #. .Hint modified nosy: added demo(3)
-#: ../roundup/admin.py:1144
+#: ../roundup/admin.py:1155
 #, python-format
 msgid "modified %(prop)s: %(how)s"
 msgstr ""
 
-#: ../roundup/admin.py:1195
+#: ../roundup/admin.py:1206
 #, fuzzy
 msgid ""
 "Usage: import import_dir\n"
@@ -768,7 +768,7 @@ msgstr ""
 "            veiksmas).\n"
 "        "
 
-#: ../roundup/admin.py:1306
+#: ../roundup/admin.py:1317
 msgid ""
 "Usage: importtables export_dir\n"
 "        This imports the database tables exported using exporttables.\n"
@@ -778,7 +778,7 @@ msgid ""
 msgstr ""
 
 #. password
-#: ../roundup/admin.py:1314
+#: ../roundup/admin.py:1325
 msgid ""
 "Usage: initialise [adminpw]\n"
 "        Initialise a new Roundup tracker.\n"
@@ -796,23 +796,23 @@ msgstr ""
 "            Vykdyti tracker'io inicializacijos funkcijÄ… dbinit.init()\n"
 "        "
 
-#: ../roundup/admin.py:1328
+#: ../roundup/admin.py:1339
 msgid "Admin Password: "
 msgstr "Administratoriaus slaptaÅ¾odis: "
 
-#: ../roundup/admin.py:1329
+#: ../roundup/admin.py:1340
 msgid "       Confirm: "
 msgstr "       Patvirtinkite: "
 
-#: ../roundup/admin.py:1333
+#: ../roundup/admin.py:1344
 msgid "Instance home does not exist"
 msgstr "NamÅ³ direktorija neegzistuoja"
 
-#: ../roundup/admin.py:1337
+#: ../roundup/admin.py:1348
 msgid "Instance has not been installed"
 msgstr "Egzempliorius nebuvo Ä¯diegtas"
 
-#: ../roundup/admin.py:1345
+#: ../roundup/admin.py:1356
 msgid ""
 "WARNING: The database is already initialised!\n"
 "If you re-initialise it, you will lose all the data!\n"
@@ -822,7 +822,7 @@ msgstr ""
 "Jei jÅ«s jÄ… inicializuosite dar kartÄ…, prarasite visus duomenis!\n"
 "IÅ¡trinti duomenÅ³ bazÄ™? Y/N: "
 
-#: ../roundup/admin.py:1365
+#: ../roundup/admin.py:1376
 msgid ""
 "Usage: install [template [backend [key=val[,key=val]]]]\n"
 "        Install a new Roundup tracker.\n"
@@ -870,12 +870,12 @@ msgstr ""
 "        Taip pat paÅ¾iÅ«rÄ—kite initopts pagalbÄ….\n"
 "        "
 
-#: ../roundup/admin.py:1394
+#: ../roundup/admin.py:1405
 #, python-format
 msgid "Instance home parent directory \"%(parent)s\" does not exist"
 msgstr "NamÅ³ direktorijos tÄ—vinÄ— direktorija \"%(parent)s\" neegzistuoja"
 
-#: ../roundup/admin.py:1403
+#: ../roundup/admin.py:1414
 #, python-format
 msgid ""
 "WARNING: There appears to be a tracker in \"%(tracker_home)s\"!\n"
@@ -886,22 +886,22 @@ msgstr ""
 "Jei jÅ«s jÄ¯ perdiegsite, prarasite visus duomenis!\n"
 "IÅ¡trinti jÄ¯? Y/N: "
 
-#: ../roundup/admin.py:1416
+#: ../roundup/admin.py:1427
 #, fuzzy
 msgid "Select template"
 msgstr "Pasirinkite Å¡ablonÄ… [klasikinis]: "
 
-#: ../roundup/admin.py:1426
+#: ../roundup/admin.py:1437
 #, fuzzy
 msgid "Select backend"
 msgstr "Pasirinkite duomenÅ³ saugyklÄ… [anydbm]: "
 
-#: ../roundup/admin.py:1437
+#: ../roundup/admin.py:1448
 #, python-format
 msgid "Error in configuration settings: \"%s\""
 msgstr "Klaida konfigÅ«racijos nustatymuose: \"%s\""
 
-#: ../roundup/admin.py:1470
+#: ../roundup/admin.py:1481
 #, python-format
 msgid ""
 "\n"
@@ -914,11 +914,11 @@ msgstr ""
 " Dabar jÅ«s turÄ—tumÄ—te pakeisti tracker'io konfigÅ«racijos failÄ…:\n"
 "   %(config_file)s"
 
-#: ../roundup/admin.py:1480
+#: ../roundup/admin.py:1491
 msgid " ... at a minimum, you must set following options:"
 msgstr " ... maÅ¾iausiai turÄ—tumÄ—te nustalyti Å¡ias parinktis:"
 
-#: ../roundup/admin.py:1485
+#: ../roundup/admin.py:1496
 #, python-format
 msgid ""
 "\n"
@@ -947,7 +947,7 @@ msgstr ""
 " aukÅ¡Äiau minÄ—tus Å¾ingsnius.\n"
 "---------------------------------------------------------------------------\n"
 
-#: ../roundup/admin.py:1501
+#: ../roundup/admin.py:1512
 msgid ""
 "Usage: list classname [property]\n"
 "        List the instances of a class.\n"
@@ -975,17 +975,17 @@ msgstr ""
 "            parinkties sÄ…raÅ¡as kiekvienam klasÄ—s egzemplioriui.\n"
 "        "
 
-#: ../roundup/admin.py:1514
+#: ../roundup/admin.py:1525
 msgid "Too many arguments supplied"
 msgstr "Pateikta per daug argumentÅ³"
 
-#: ../roundup/admin.py:1547
+#: ../roundup/admin.py:1558
 #, python-format
 msgid "%(nodeid)4s: %(value)s"
 msgstr "%(nodeid)4s: %(value)s"
 
 #. noqa: ARG002  - args unused
-#: ../roundup/admin.py:1554
+#: ../roundup/admin.py:1565
 msgid ""
 "Usage: migrate\n"
 "        Update a tracker's database to be compatible with the Roundup\n"
@@ -1008,17 +1008,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1574
+#: ../roundup/admin.py:1585
 #, python-format
 msgid "Tracker updated to schema version %s."
 msgstr ""
 
-#: ../roundup/admin.py:1578
+#: ../roundup/admin.py:1589
 #, python-format
 msgid "No migration action required. At schema version %s."
 msgstr ""
 
-#: ../roundup/admin.py:1583
+#: ../roundup/admin.py:1594
 #, fuzzy
 msgid ""
 "Usage: pack period | date\n"
@@ -1056,11 +1056,11 @@ msgstr ""
 "\n"
 "        "
 
-#: ../roundup/admin.py:1609
+#: ../roundup/admin.py:1620
 msgid "Invalid format"
 msgstr "Netinkamas formatas"
 
-#: ../roundup/admin.py:1620
+#: ../roundup/admin.py:1631
 msgid ""
 "Usage: perftest [mode] [arguments]*\n"
 "        Time operations in Roundup.\n"
@@ -1078,25 +1078,25 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1657
+#: ../roundup/admin.py:1668
 msgid "Invalid 'rounds'. Must be larger than 999."
 msgstr ""
 
-#: ../roundup/admin.py:1661
+#: ../roundup/admin.py:1672
 #, python-format
 msgid "Invalid 'rounds'. It must be an integer not: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1688
+#: ../roundup/admin.py:1699
 msgid "scheme does not support rounds."
 msgstr ""
 
-#: ../roundup/admin.py:1691
+#: ../roundup/admin.py:1702
 #, python-format
 msgid "Hash time: %(time)0.9f seconds, scheme: %(scheme)s, rounds: %(rounds)s"
 msgstr ""
 
-#: ../roundup/admin.py:1697
+#: ../roundup/admin.py:1708
 msgid ""
 "Usage: pragma setting=value | 'list'\n"
 "        Set internal admin settings to a value.\n"
@@ -1125,49 +1125,49 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1732
+#: ../roundup/admin.py:1743
 #, python-format
 msgid "Argument must be setting=value, was given: %s."
 msgstr ""
 
-#: ../roundup/admin.py:1735
+#: ../roundup/admin.py:1746
 msgid "Current settings and values (NYI - not yet implemented):"
 msgstr ""
 
-#: ../roundup/admin.py:1746
+#: ../roundup/admin.py:1757
 msgid ""
 "      Help for this pragma is missing. Please report it to the Roundup "
 "project.\n"
 msgstr ""
 
-#: ../roundup/admin.py:1752
+#: ../roundup/admin.py:1763
 #, fuzzy, python-format
 msgid "Unknown setting %s. Try \"pragma list\"."
 msgstr "NeÅ¾inomas vartotojo vardas"
 
-#: ../roundup/admin.py:1762
+#: ../roundup/admin.py:1773
 #, python-format
 msgid "Incorrect value for boolean setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1769
+#: ../roundup/admin.py:1780
 #, python-format
 msgid "Incorrect value for integer setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1776
+#: ../roundup/admin.py:1787
 #, python-format
 msgid ""
 "Incorrect value for setting %(setting)s: %(value)s. Should be no, both, or "
 "only."
 msgstr ""
 
-#: ../roundup/admin.py:1786
+#: ../roundup/admin.py:1797
 #, python-format
 msgid "Internal error: pragma can not handle values of type: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1795
+#: ../roundup/admin.py:1806
 #, fuzzy
 msgid ""
 "Usage: reindex [classname|classname:#-#|designator]*\n"
@@ -1191,17 +1191,17 @@ msgstr ""
 "            Paprastai tai Ä¯vyksta automatiÅ¡kai.\n"
 "        "
 
-#: ../roundup/admin.py:1817
+#: ../roundup/admin.py:1828
 #, python-format
 msgid "no such item \"%(designator)s\""
 msgstr "nÄ—ra elemento \"%(designator)s\""
 
-#: ../roundup/admin.py:1827
+#: ../roundup/admin.py:1838
 #, fuzzy, python-format
 msgid "no such item \"%(class)s%(id)s\""
 msgstr "nÄ—ra elemento \"%(designator)s\""
 
-#: ../roundup/admin.py:1839
+#: ../roundup/admin.py:1850
 #, fuzzy
 msgid ""
 "Usage: restore designator[,designator]*\n"
@@ -1219,7 +1219,7 @@ msgstr ""
 "            Duotas elementas vÄ—l taps prieinamas vartotojams.\n"
 "        "
 
-#: ../roundup/admin.py:1870
+#: ../roundup/admin.py:1881
 #, fuzzy
 msgid ""
 "Usage: retire designator[,designator]*\n"
@@ -1241,7 +1241,7 @@ msgstr ""
 "        "
 
 #. noqa: ARG002 - args unused
-#: ../roundup/admin.py:1898
+#: ../roundup/admin.py:1909
 msgid ""
 "Usage: rollback\n"
 "        Undo all changes that are pending commit to the database.\n"
@@ -1263,7 +1263,7 @@ msgstr ""
 "             nepadarys jokiÅ³ pakeitimÅ³ duomenÅ³ bazÄ—je.\n"
 "        "
 
-#: ../roundup/admin.py:1911
+#: ../roundup/admin.py:1922
 msgid ""
 "Usage: security [Role name]\n"
 "        Display the Permissions available to one or all Roles.\n"
@@ -1276,47 +1276,47 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1926
+#: ../roundup/admin.py:1937
 #, fuzzy, python-format
 msgid "No such Role \"%(role)s\"\n"
 msgstr "NÄ—ra tokios rolÄ—s \"%(role)s\""
 
-#: ../roundup/admin.py:1932
+#: ../roundup/admin.py:1943
 #, fuzzy, python-format
 msgid "New Web users get the Roles \"%(role)s\"\n"
 msgstr "Naujiems web vartotojams suteikiamos rolÄ—s \"%(role)s\""
 
-#: ../roundup/admin.py:1935
+#: ../roundup/admin.py:1946
 #, fuzzy, python-format
 msgid "New Web users get the Role \"%(role)s\"\n"
 msgstr "Naujiems web vartotojams suteikiama rolÄ— \"%(role)s\""
 
-#: ../roundup/admin.py:1939
+#: ../roundup/admin.py:1950
 #, fuzzy, python-format
 msgid "New Email users get the Roles \"%(role)s\"\n"
 msgstr "Naujiems vartotojams per el. paÅ¡tÄ… suteikiamos rolÄ—s \"%(role)s\""
 
-#: ../roundup/admin.py:1941
+#: ../roundup/admin.py:1952
 #, fuzzy, python-format
 msgid "New Email users get the Role \"%(role)s\"\n"
 msgstr "Naujiems vartotojams per el. paÅ¡tÄ… suteikiama rolÄ— \"%(role)s\""
 
-#: ../roundup/admin.py:1944
+#: ../roundup/admin.py:1955
 #, fuzzy, python-format
 msgid "Role \"%(name)s\":\n"
 msgstr "RolÄ— \"%(name)s\":"
 
-#: ../roundup/admin.py:1950
+#: ../roundup/admin.py:1961
 #, fuzzy
 msgid " %(description)s (%(name)s for \"%(klass)s\""
 msgstr " %(description)s (%(name)s skirta tik \"%(klass)s\")"
 
-#: ../roundup/admin.py:1950
+#: ../roundup/admin.py:1961
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\": %(properties)s only)\n"
 msgstr " %(description)s (%(name)s skirta tik \"%(klass)s\": %(properties)s)"
 
-#: ../roundup/admin.py:1963
+#: ../roundup/admin.py:1974
 #, python-format
 msgid ""
 "\n"
@@ -1324,17 +1324,17 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/admin.py:1969
+#: ../roundup/admin.py:1980
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\" only)\n"
 msgstr " %(description)s (%(name)s skirta tik \"%(klass)s\")"
 
-#: ../roundup/admin.py:1972
+#: ../roundup/admin.py:1983
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s)\n"
 msgstr " %(description)s (%(name)s)"
 
-#: ../roundup/admin.py:1976
+#: ../roundup/admin.py:1987
 #, fuzzy
 msgid ""
 "Usage: set items property=value [property=value ...]\n"
@@ -1369,7 +1369,7 @@ msgstr ""
 "            reikÅ¡mÄ—s (t.y. \"1,2,3\").\n"
 "        "
 
-#: ../roundup/admin.py:2044
+#: ../roundup/admin.py:2055
 msgid ""
 "Usage: specification classname\n"
 "        Show the properties for a classname.\n"
@@ -1383,17 +1383,17 @@ msgstr ""
 "            Å i komanda iÅ¡vardina duotos klasÄ—s parinktis.\n"
 "        "
 
-#: ../roundup/admin.py:2063
+#: ../roundup/admin.py:2074
 #, fuzzy, python-format
 msgid "%(key)s: %(value)s (key property)\n"
 msgstr "%(key)s: %(value)s (key property)"
 
-#: ../roundup/admin.py:2066
+#: ../roundup/admin.py:2077
 #, fuzzy, python-format
 msgid "%(key)s: %(value)s\n"
 msgstr "%(key)s: %(value)s"
 
-#: ../roundup/admin.py:2069
+#: ../roundup/admin.py:2080
 msgid ""
 "Usage: table classname [property[,property]*]\n"
 "        List the instances of a class in tabular form.\n"
@@ -1455,17 +1455,17 @@ msgstr ""
 "            pateiks 4 simboliÅ³ ilgio \"Name\" stulpelÄ¯.\n"
 "        "
 
-#: ../roundup/admin.py:2115
+#: ../roundup/admin.py:2126
 #, python-format
 msgid "\"%(spec)s\" not name:width"
 msgstr "\"%(spec)s\" ne vardas:plotis"
 
-#: ../roundup/admin.py:2137
+#: ../roundup/admin.py:2148
 #, python-format
 msgid "\"%(spec)s\" does not have an integer width: \"%(width)s\""
 msgstr ""
 
-#: ../roundup/admin.py:2173
+#: ../roundup/admin.py:2184
 msgid ""
 "Usage: templates [trace_search]\n"
 "        List templates and their installed directories.\n"
@@ -1475,7 +1475,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2201
+#: ../roundup/admin.py:2212
 #, fuzzy
 msgid ""
 "Usage: updateconfig <filename>\n"
@@ -1491,36 +1491,36 @@ msgstr ""
 "        "
 
 # ../roundup/cgi/actions.py:579 :590 :761 :780
-#: ../roundup/admin.py:2210 ../roundup/cgi/actions.py:886
-#: ../roundup/cgi/actions.py:897 ../roundup/cgi/actions.py:1099
-#: ../roundup/cgi/actions.py:1113 ../roundup/cgi/actions.py:886:897 :1099:1113
+#: ../roundup/admin.py:2221 ../roundup/cgi/actions.py:891
+#: ../roundup/cgi/actions.py:902 ../roundup/cgi/actions.py:1104
+#: ../roundup/cgi/actions.py:1118 ../roundup/cgi/actions.py:891:902 :1104:1118
 #, python-format
 msgid "Error: %s"
 msgstr "Klaida: %s"
 
-#: ../roundup/admin.py:2242
+#: ../roundup/admin.py:2253
 #, python-format
 msgid "Unknown command \"%(command)s\" (\"help commands\" for a list)"
 msgstr ""
 "NeÅ¾inoma komanda \"%(command)s\" (Ä¯veskite \"help commands\" komandÅ³\n"
 "sÄ…raÅ¡ui gauti)"
 
-#: ../roundup/admin.py:2248
+#: ../roundup/admin.py:2259
 #, python-format
 msgid "Multiple commands match \"%(command)s\": %(list)s"
 msgstr "Kelios komandos atitinka \"%(command)s\": %(list)s"
 
-#: ../roundup/admin.py:2263
+#: ../roundup/admin.py:2274
 msgid "Enter tracker home: "
 msgstr "Ä®veskite tracker'io namÅ³ direktorijÄ…: "
 
-#: ../roundup/admin.py:2292 ../roundup/admin.py:2296
-#: ../roundup/admin.py:2292:2296
+#: ../roundup/admin.py:2303 ../roundup/admin.py:2307
+#: ../roundup/admin.py:2303:2307
 #, python-format
 msgid "Error: Couldn't open tracker: %(message)s"
 msgstr "Klaida: Negaliu atidaryti tracker'io: %(message)s"
 
-#: ../roundup/admin.py:2344
+#: ../roundup/admin.py:2355
 #, python-format
 msgid ""
 "Roundup %s ready for input.\n"
@@ -1529,58 +1529,58 @@ msgstr ""
 "Roundup %s pasiruoÅ¡Ä™s priimti duomenis.\n"
 "NorÄ—dami iÅ¡kviesti pagalbÄ… Ä¯veskite \"help\"."
 
-#: ../roundup/admin.py:2377
+#: ../roundup/admin.py:2388
 msgid "Note: command history and editing not available"
 msgstr "Pastaba: komandÅ³ archyvas ir redagavimas neprieinami"
 
-#: ../roundup/admin.py:2383
+#: ../roundup/admin.py:2394
 msgid "exit..."
 msgstr "iÅ¡eiti..."
 
-#: ../roundup/admin.py:2396
+#: ../roundup/admin.py:2407
 msgid "There are unsaved changes. Commit them (y/N)? "
 msgstr "Yra neiÅ¡saugotÅ³ pakeitimÅ³. IÅ¡saugoti juos (y/N)? "
 
-#: ../roundup/backends/back_anydbm.py:215
-#: ../roundup/backends/rdbms_common.py:928
+#: ../roundup/backends/back_anydbm.py:213
+#: ../roundup/backends/rdbms_common.py:926
 #, python-format
 msgid "Class \"%s\" already defined."
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:280
+#: ../roundup/backends/back_anydbm.py:278
 #: ../roundup/backends/sessions_dbm.py:61
 msgid "Couldn't identify database type"
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:314
+#: ../roundup/backends/back_anydbm.py:312
 #, python-format
 msgid ""
 "Couldn't open database - the required module '%s' (as dbm.gnu) is not "
 "available"
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:318
+#: ../roundup/backends/back_anydbm.py:316
 #, python-format
 msgid "Couldn't open database - the required module '%s' is not available"
 msgstr ""
 
 #: ../roundup/backends/back_anydbm.py:873
 #: ../roundup/backends/back_anydbm.py:886
-#: ../roundup/backends/back_anydbm.py:1160
-#: ../roundup/backends/back_anydbm.py:1195
-#: ../roundup/backends/back_anydbm.py:1424
-#: ../roundup/backends/back_anydbm.py:1442
-#: ../roundup/backends/back_anydbm.py:1489
-#: ../roundup/backends/back_anydbm.py:2135
+#: ../roundup/backends/back_anydbm.py:1162
+#: ../roundup/backends/back_anydbm.py:1197
+#: ../roundup/backends/back_anydbm.py:1426
+#: ../roundup/backends/back_anydbm.py:1444
+#: ../roundup/backends/back_anydbm.py:1492
+#: ../roundup/backends/back_anydbm.py:2138
 #: ../roundup/backends/back_anydbm.py:873:886
-#: ../roundup/backends/rdbms_common.py:1720
-#: ../roundup/backends/rdbms_common.py:1967
-#: ../roundup/backends/rdbms_common.py:2206
-#: ../roundup/backends/rdbms_common.py:2226
-#: ../roundup/backends/rdbms_common.py:2279
-#: ../roundup/backends/rdbms_common.py:3254
-#: ../roundup/backends/rdbms_common.py:1720:1967 :1160:1195 :1424:1442:1489
-#: :2135 :2206:2226 :2279:3254
+#: ../roundup/backends/rdbms_common.py:1721
+#: ../roundup/backends/rdbms_common.py:1972
+#: ../roundup/backends/rdbms_common.py:2211
+#: ../roundup/backends/rdbms_common.py:2231
+#: ../roundup/backends/rdbms_common.py:2293
+#: ../roundup/backends/rdbms_common.py:3268
+#: ../roundup/backends/rdbms_common.py:1721:1972 :1162:1197 :1426:1444:1492
+#: :2138 :2211:2231 :2293:3268
 msgid "Database open read-only"
 msgstr ""
 
@@ -1606,45 +1606,50 @@ msgstr ""
 msgid "Unable to get lock after 10 retries on %s."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:632
+#: ../roundup/backends/rdbms_common.py:630
 #, python-format
 msgid "ALTER operation disallowed: %(old)r -> %(new)r."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:867
+#: ../roundup/backends/rdbms_common.py:865
 #, python-format
 msgid "CREATE operation disallowed: \"%s\"."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:884
+#: ../roundup/backends/rdbms_common.py:882
 #, python-format
 msgid "DROP operation disallowed: \"%s\"."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:1863
+#: ../roundup/backends/rdbms_common.py:1864
 msgid "create"
 msgstr "sukurti"
 
-#: ../roundup/backends/rdbms_common.py:2038
+#: ../roundup/backends/rdbms_common.py:2043
 msgid "unlink"
 msgstr "atsieti"
 
-#: ../roundup/backends/rdbms_common.py:2042
+#: ../roundup/backends/rdbms_common.py:2047
 msgid "link"
 msgstr "susieti"
 
-#: ../roundup/backends/rdbms_common.py:2187
+#: ../roundup/backends/rdbms_common.py:2192
 msgid "set"
 msgstr "nustatyti"
 
-#: ../roundup/backends/rdbms_common.py:2216
+#: ../roundup/backends/rdbms_common.py:2221
 msgid "retired"
 msgstr "deaktyvuotas"
 
-#: ../roundup/backends/rdbms_common.py:2246
+#: ../roundup/backends/rdbms_common.py:2251
 msgid "restored"
 msgstr "aktyvuotas"
 
+#: ../roundup/backends/rdbms_common.py:2265
+#, fuzzy, python-format
+msgid "class %(cls)s: %(value)r is not an id"
+msgstr "parinkties \"%(propname)s\": \"%(value)s\" nÄ—ra sÄ…raÅ¡e"
+
 #: ../roundup/backends/sessions_redis.py:78
 #: ../roundup/backends/sessions_redis.py:97
 #: ../roundup/backends/sessions_redis.py:78:97
@@ -1727,10 +1732,10 @@ msgid "\"%(input)s\" is not an ID (%(classname)s ID required)"
 msgstr "\"%(input)s\" nÄ—ra ID (reikia %(classname)s ID)"
 
 #: ../roundup/cgi/actions.py:228 ../roundup/cgi/actions.py:266
-#: ../roundup/cgi/actions.py:493 ../roundup/cgi/actions.py:833
-#: ../roundup/cgi/actions.py:880 ../roundup/cgi/actions.py:1084
-#: ../roundup/cgi/actions.py:1246 ../roundup/cgi/actions.py:228:266:1246
-#: :493:833 :880:1084
+#: ../roundup/cgi/actions.py:493 ../roundup/cgi/actions.py:838
+#: ../roundup/cgi/actions.py:885 ../roundup/cgi/actions.py:1089
+#: ../roundup/cgi/actions.py:1251 ../roundup/cgi/actions.py:228:266:1251
+#: :493:838 :885:1089
 #, fuzzy
 msgid "Invalid request"
 msgstr "Netinkamas formatas"
@@ -1784,8 +1789,8 @@ msgstr "Netinkamas formatas"
 msgid "Invalid integer: "
 msgstr "Neteisingas vartotojo vardas ar slaptaÅ¾odis"
 
-#: ../roundup/cgi/actions.py:531 ../roundup/cgi/actions.py:735
-#: ../roundup/cgi/actions.py:531:735
+#: ../roundup/cgi/actions.py:531 ../roundup/cgi/actions.py:740
+#: ../roundup/cgi/actions.py:531:740
 #, python-format
 msgid "You do not have permission to create %(class)s"
 msgstr "Neturite leidimo sukurti %(class)s"
@@ -1795,8 +1800,8 @@ msgstr "Neturite leidimo sukurti %(class)s"
 msgid "Not enough values on line %(line)s"
 msgstr "Nepakanka reikÅ¡miÅ³ eilutÄ—je %(line)s"
 
-#: ../roundup/cgi/actions.py:556 ../roundup/cgi/actions.py:723
-#: ../roundup/cgi/actions.py:556:723
+#: ../roundup/cgi/actions.py:556 ../roundup/cgi/actions.py:728
+#: ../roundup/cgi/actions.py:556:728
 #, python-format
 msgid "You do not have permission to edit %(class)s"
 msgstr "Neturite leidimo redaguoti %(class)s"
@@ -1805,17 +1810,17 @@ msgstr "Neturite leidimo redaguoti %(class)s"
 msgid "Items edited OK"
 msgstr "ElementÅ³ pakeitimai iÅ¡saugoti"
 
-#: ../roundup/cgi/actions.py:671
+#: ../roundup/cgi/actions.py:676
 #, python-format
 msgid "%(class)s %(id)s %(properties)s edited ok"
 msgstr "%(class)s %(id)s %(properties)s pakeitimai iÅ¡saugoti"
 
-#: ../roundup/cgi/actions.py:689
+#: ../roundup/cgi/actions.py:694
 #, python-format
 msgid "%(class)s %(id)s created"
 msgstr "sukurta %(class)s %(id)s"
 
-#: ../roundup/cgi/actions.py:817
+#: ../roundup/cgi/actions.py:822
 #, fuzzy, python-format
 msgid ""
 "Edit Error: someone else has edited this %(klass)s (%(props)s). View <a "
@@ -1825,12 +1830,12 @@ msgstr ""
 "PerÅ¾iÅ«rÄ—kite <a target=\"new\" href=\"%(klass)s%(id)s\">jÅ³ pakeitimus</a> "
 "naujame lange."
 
-#: ../roundup/cgi/actions.py:850
+#: ../roundup/cgi/actions.py:855
 #, python-format
 msgid "Edit Error: %s"
 msgstr "Redagavimo klaida: %s"
 
-#: ../roundup/cgi/actions.py:931
+#: ../roundup/cgi/actions.py:936
 msgid ""
 "Invalid One Time Key!\n"
 "(a Mozilla bug may cause this message to show up erroneously, please check "
@@ -1840,12 +1845,12 @@ msgstr ""
 "(Å¡Ä¯ praneÅ¡imÄ… gali neteisingai sukelti Mozilla klaida, patikrinkite savo "
 "paÅ¡tÄ….)"
 
-#: ../roundup/cgi/actions.py:972
+#: ../roundup/cgi/actions.py:977
 #, fuzzy, python-format
 msgid "Password reset for %s"
 msgstr "SlaptaÅ¾odÅ¾io atstatymo uÅ¾klausa"
 
-#: ../roundup/cgi/actions.py:973
+#: ../roundup/cgi/actions.py:978
 #, python-format
 msgid ""
 "\n"
@@ -1854,29 +1859,29 @@ msgid ""
 "Your password is now: %(password)s\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:982
+#: ../roundup/cgi/actions.py:987
 #, python-format
 msgid "Password reset and email sent to %s"
 msgstr "SlaptaÅ¾odis atstatytas ir el. laiÅ¡kas iÅ¡siÅ³stas %s"
 
-#: ../roundup/cgi/actions.py:991
+#: ../roundup/cgi/actions.py:996
 msgid "Unknown username"
 msgstr "NeÅ¾inomas vartotojo vardas"
 
-#: ../roundup/cgi/actions.py:999
+#: ../roundup/cgi/actions.py:1004
 msgid "Unknown email address"
 msgstr "NeÅ¾inomas el. paÅ¡to adresas"
 
-#: ../roundup/cgi/actions.py:1004
+#: ../roundup/cgi/actions.py:1009
 msgid "You need to specify a username or address"
 msgstr "Privalote nurodyti vartotojo vardÄ… ar el. paÅ¡to adresÄ…"
 
-#: ../roundup/cgi/actions.py:1015
+#: ../roundup/cgi/actions.py:1020
 #, fuzzy, python-format
 msgid "Confirm reset of password for %s"
 msgstr "Patvirtinti slaptaÅ¾odÄ¯"
 
-#: ../roundup/cgi/actions.py:1016
+#: ../roundup/cgi/actions.py:1021
 #, python-format
 msgid ""
 "\n"
@@ -1890,31 +1895,31 @@ msgid ""
 "You should then receive another email with the new password.\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1029
+#: ../roundup/cgi/actions.py:1034
 #, python-format
 msgid "Email sent to primary notification address for %s."
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1031
+#: ../roundup/cgi/actions.py:1036
 #, fuzzy, python-format
 msgid "Email sent to %s."
 msgstr "El. laiÅ¡kas iÅ¡siÅ³stas %s"
 
-#: ../roundup/cgi/actions.py:1046
+#: ../roundup/cgi/actions.py:1051
 msgid "You are now registered, welcome!"
 msgstr "JÅ«s esate uÅ¾registruotas, sveiki prisijungÄ™!"
 
-#: ../roundup/cgi/actions.py:1139
+#: ../roundup/cgi/actions.py:1144
 #, python-format
 msgid "Username '%s' is already used."
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1163
+#: ../roundup/cgi/actions.py:1168
 #, python-format
 msgid "Complete your registration to %(tracker_name)s -- key %(key)s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1167
+#: ../roundup/cgi/actions.py:1172
 #, python-format
 msgid ""
 "To complete your registration of the user \"%(name)s\" with\n"
@@ -1930,12 +1935,12 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1181
+#: ../roundup/cgi/actions.py:1186
 #, python-format
 msgid "Complete your registration to %s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1182
+#: ../roundup/cgi/actions.py:1187
 #, python-format
 msgid ""
 "To complete your registration of the user \"%(name)s\" with\n"
@@ -1945,45 +1950,45 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1206
+#: ../roundup/cgi/actions.py:1211
 msgid "It is not permitted to supply roles at registration."
 msgstr "Negalima pateikti roliÅ³ registracijos metu."
 
-#: ../roundup/cgi/actions.py:1220
+#: ../roundup/cgi/actions.py:1225
 msgid "You are logged out"
 msgstr "JÅ«s atsijungÄ—te"
 
-#: ../roundup/cgi/actions.py:1250
+#: ../roundup/cgi/actions.py:1255
 msgid "Username required"
 msgstr "Reikalingas vartotojo vardas"
 
-#: ../roundup/cgi/actions.py:1354
+#: ../roundup/cgi/actions.py:1359
 #, python-format
 msgid "Welcome %(username)s!"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1477
+#: ../roundup/cgi/actions.py:1482
 #, python-format
 msgid "Logins occurring too fast. Please wait: %s seconds."
 msgstr ""
 
 # ../roundup/cgi/actions.py:897 :901
-#: ../roundup/cgi/actions.py:1515 ../roundup/cgi/actions.py:1526
-#: ../roundup/cgi/actions.py:1515:1526
+#: ../roundup/cgi/actions.py:1520 ../roundup/cgi/actions.py:1531
+#: ../roundup/cgi/actions.py:1520:1531
 msgid "Invalid login"
 msgstr "Neteisingas vartotojo vardas ar slaptaÅ¾odis"
 
-#: ../roundup/cgi/actions.py:1532
+#: ../roundup/cgi/actions.py:1537
 msgid "You do not have permission to login"
 msgstr "Neturite prisijungimo teisiÅ³"
 
-#: ../roundup/cgi/actions.py:1577 ../roundup/cgi/actions.py:1757
-#: ../roundup/cgi/actions.py:1577:1757
+#: ../roundup/cgi/actions.py:1582 ../roundup/cgi/actions.py:1762
+#: ../roundup/cgi/actions.py:1582:1762
 #, python-format
 msgid "Column \"%(column)s\" not found in %(class)s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1822
+#: ../roundup/cgi/actions.py:1827
 #, fuzzy, python-format
 msgid "You do not have permission to view %(class)s"
 msgstr "Neturite leidimo redaguoti %(class)s"
@@ -2114,8 +2119,8 @@ msgstr "Formos klaida: "
 msgid "Unrecognized charset: %r"
 msgstr "NeatpaÅ¾inta koduotÄ—: %r"
 
-#: ../roundup/cgi/client.py:1381 ../roundup/cgi/client.py:2394
-#: ../roundup/cgi/client.py:1381:2394
+#: ../roundup/cgi/client.py:1381 ../roundup/cgi/client.py:2396
+#: ../roundup/cgi/client.py:1381:2396
 msgid "broken form: multiple @action values submitted"
 msgstr ""
 
@@ -2195,50 +2200,51 @@ msgstr ""
 
 #: ../roundup/cgi/client.py:1679
 #, python-format
-msgid "csrf X-REQUESTED-WITH xmlrpc required header check failed for user%s."
+msgid ""
+"csrf X-REQUESTED-WITH xmlrpc required header check failed for user%(userid)s."
 msgstr ""
 
 #: ../roundup/cgi/client.py:1720
 #, python-format
-msgid "Required csrf field missing for user%s"
+msgid "Required csrf field missing for user%(userid)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1722 ../roundup/cgi/client.py:1749
-#: ../roundup/cgi/client.py:1766 ../roundup/cgi/client.py:1722:1749:1766
+#: ../roundup/cgi/client.py:1723 ../roundup/cgi/client.py:1751
+#: ../roundup/cgi/client.py:1768 ../roundup/cgi/client.py:1723:1751:1768
 msgid ""
 "We can't validate your session (csrf failure). Re-enter any unsaved data and "
 "try again."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1726
+#: ../roundup/cgi/client.py:1728
 #, python-format
-msgid "csrf field not supplied by user%s"
+msgid "csrf field not supplied by user%(userid)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1738
+#: ../roundup/cgi/client.py:1740
 #, python-format
 msgid ""
 "Csrf mismatch user: current user %(user)s != stored user %(stored)s, current "
 "session, stored session: %(cur_sess)s,%(stor_sess)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1756
+#: ../roundup/cgi/client.py:1758
 #, python-format
 msgid ""
 "Csrf mismatch user: current session %(curr_sess)s != stored session "
 "%(stor_sess)s, current user/stored user is: %(user)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1948
+#: ../roundup/cgi/client.py:1950
 msgid "You are not allowed to view this file."
 msgstr "JÅ«s neturite teisiÅ³ Å¾iÅ«rÄ—ti Å¡Ä¯ failÄ…."
 
-#: ../roundup/cgi/client.py:2272
+#: ../roundup/cgi/client.py:2274
 #, python-format
 msgid "%(starttag)sTime elapsed: %(seconds)fs%(endtag)s\n"
 msgstr "%(starttag)sPraÄ—jÄ™s laikas: %(seconds)fs%(endtag)s\n"
 
-#: ../roundup/cgi/client.py:2276
+#: ../roundup/cgi/client.py:2278
 #, python-format
 msgid ""
 "%(starttag)sCache hits: %(cache_hits)d, misses %(cache_misses)d. Loading "
@@ -2248,7 +2254,7 @@ msgstr ""
 "%(cache_misses)d. Ä®keliami elementai: %(get_items)f sek. Filtruojama: "
 "%(filtering)f sek.%(endtag)s\n"
 
-#: ../roundup/cgi/client.py:2815
+#: ../roundup/cgi/client.py:2817
 #, python-format
 msgid ""
 "Cache failure: compressed file %(compressed)s is older than its source file "
@@ -2318,115 +2324,115 @@ msgid "You are not allowed to %(action)s items of class %(class)s"
 msgstr ""
 "JÅ«s negalite atlikti komandos %(action)s su klasÄ—s %(class)s elementais"
 
-#: ../roundup/cgi/templating.py:916
+#: ../roundup/cgi/templating.py:892
 msgid "(list)"
 msgstr "(list)"
 
-#: ../roundup/cgi/templating.py:991
+#: ../roundup/cgi/templating.py:975
 msgid "Submit New Entry"
 msgstr "Ä®vesti naujÄ… Ä¯raÅ¡Ä…"
 
 # ../roundup/cgi/templating.py:700 :819 :1193 :1214 :1258 :1280 :1314 :1353
 # :1404 :1421 :1497 :1517 :1530 :1547 :1557 :1607 :1794
-#: ../roundup/cgi/templating.py:1013 ../roundup/cgi/templating.py:1189
-#: ../roundup/cgi/templating.py:1824 ../roundup/cgi/templating.py:1855
-#: ../roundup/cgi/templating.py:1876 ../roundup/cgi/templating.py:1914
-#: ../roundup/cgi/templating.py:1967 ../roundup/cgi/templating.py:1991
-#: ../roundup/cgi/templating.py:1998 ../roundup/cgi/templating.py:2035
-#: ../roundup/cgi/templating.py:2088 ../roundup/cgi/templating.py:2121
-#: ../roundup/cgi/templating.py:2216 ../roundup/cgi/templating.py:2237
-#: ../roundup/cgi/templating.py:2328 ../roundup/cgi/templating.py:2348
-#: ../roundup/cgi/templating.py:2370 ../roundup/cgi/templating.py:2413
-#: ../roundup/cgi/templating.py:2423 ../roundup/cgi/templating.py:2488
-#: ../roundup/cgi/templating.py:2791 ../roundup/cgi/templating.py:1013:1189
-#: :1824:1855 :1876:1914 :1967:1991 :1998:2035 :2088:2121 :2216:2237 :2328:2348
-#: :2370:2413 :2423:2488:2791
+#: ../roundup/cgi/templating.py:997 ../roundup/cgi/templating.py:1174
+#: ../roundup/cgi/templating.py:1809 ../roundup/cgi/templating.py:1840
+#: ../roundup/cgi/templating.py:1861 ../roundup/cgi/templating.py:1899
+#: ../roundup/cgi/templating.py:1952 ../roundup/cgi/templating.py:1976
+#: ../roundup/cgi/templating.py:1983 ../roundup/cgi/templating.py:2020
+#: ../roundup/cgi/templating.py:2077 ../roundup/cgi/templating.py:2115
+#: ../roundup/cgi/templating.py:2215 ../roundup/cgi/templating.py:2236
+#: ../roundup/cgi/templating.py:2357 ../roundup/cgi/templating.py:2377
+#: ../roundup/cgi/templating.py:2399 ../roundup/cgi/templating.py:2442
+#: ../roundup/cgi/templating.py:2452 ../roundup/cgi/templating.py:2517
+#: ../roundup/cgi/templating.py:2820 ../roundup/cgi/templating.py:997:1174
+#: :1809:1840 :1861:1899 :1952:1976 :1983:2020 :2077:2115 :2215:2236 :2357:2377
+#: :2399:2442 :2452:2517:2820
 msgid "[hidden]"
 msgstr "[paslÄ—pta]"
 
-#: ../roundup/cgi/templating.py:1014
+#: ../roundup/cgi/templating.py:998
 msgid "New node - no history"
 msgstr "Naujas elementas -- nÄ—ra istorijos"
 
-#: ../roundup/cgi/templating.py:1154
+#: ../roundup/cgi/templating.py:1139
 msgid "Submit Changes"
 msgstr "IÅ¡saugoti pakeitimus"
 
-#: ../roundup/cgi/templating.py:1232
+#: ../roundup/cgi/templating.py:1217
 msgid "<em>The indicated property no longer exists</em>"
 msgstr "<em>Nurodytos parinkties nÄ—ra</em>"
 
-#: ../roundup/cgi/templating.py:1268
+#: ../roundup/cgi/templating.py:1253
 #, python-format
 msgid "The linked class %(classname)s no longer exists"
 msgstr "Susietos klasÄ—s %(classname)s nebÄ—ra"
 
-#: ../roundup/cgi/templating.py:1305 ../roundup/cgi/templating.py:1335
-#: ../roundup/cgi/templating.py:2497 ../roundup/cgi/templating.py:2800
-#: ../roundup/cgi/templating.py:1305:1335 :2497:2800
+#: ../roundup/cgi/templating.py:1290 ../roundup/cgi/templating.py:1320
+#: ../roundup/cgi/templating.py:2526 ../roundup/cgi/templating.py:2829
+#: ../roundup/cgi/templating.py:1290:1320 :2526:2829
 msgid "[label is missing]"
 msgstr ""
 
 # ../roundup/cgi/templating.py:930 :951
-#: ../roundup/cgi/templating.py:1309 ../roundup/cgi/templating.py:1338
-#: ../roundup/cgi/templating.py:1309:1338
+#: ../roundup/cgi/templating.py:1294 ../roundup/cgi/templating.py:1323
+#: ../roundup/cgi/templating.py:1294:1323
 msgid "<strike>The linked node no longer exists</strike>"
 msgstr "<strike>Susieto elemento nebÄ—ra</strike>"
 
-#: ../roundup/cgi/templating.py:1400
+#: ../roundup/cgi/templating.py:1385
 #, python-format
 msgid "%s: (no value)"
 msgstr "%s: (no value)"
 
-#: ../roundup/cgi/templating.py:1416
+#: ../roundup/cgi/templating.py:1401
 #, fuzzy, python-format
 msgid ""
 "<strong><em>This event %s is not handled by the history display!</em></"
 "strong>"
 msgstr "<strong><em>Å is Ä¯vykis nÄ—ra rodomas archyve!</em></strong>"
 
-#: ../roundup/cgi/templating.py:1429
+#: ../roundup/cgi/templating.py:1414
 msgid "<tr><td colspan=4><strong>Note:</strong></td></tr>"
 msgstr "<tr><td colspan=4><strong>Pastaba:</strong></td></tr>"
 
-#: ../roundup/cgi/templating.py:1438
+#: ../roundup/cgi/templating.py:1423
 msgid "History"
 msgstr "Archyvas"
 
-#: ../roundup/cgi/templating.py:1440
+#: ../roundup/cgi/templating.py:1425
 msgid "<th>Date</th>"
 msgstr "<th>Data</th>"
 
-#: ../roundup/cgi/templating.py:1441
+#: ../roundup/cgi/templating.py:1426
 msgid "<th>User</th>"
 msgstr "<th>Vartotojas</th>"
 
-#: ../roundup/cgi/templating.py:1442
+#: ../roundup/cgi/templating.py:1427
 msgid "<th>Action</th>"
 msgstr "<th>Veiksmas</th>"
 
-#: ../roundup/cgi/templating.py:1443
+#: ../roundup/cgi/templating.py:1428
 msgid "<th>Args</th>"
 msgstr "<th>Argumentai</th>"
 
-#: ../roundup/cgi/templating.py:1494
+#: ../roundup/cgi/templating.py:1479
 #, python-format
 msgid "Copy of %(class)s %(id)s"
 msgstr "%(class)s %(id)s kopija"
 
 # ../roundup/cgi/templating.py:993 :1357 :1378 :1384
-#: ../roundup/cgi/templating.py:2125 ../roundup/cgi/templating.py:2160
-#: ../roundup/cgi/templating.py:1382:2125:2160
+#: ../roundup/cgi/templating.py:2119 ../roundup/cgi/templating.py:2154
+#: ../roundup/cgi/templating.py:1367:2119:2154
 msgid "No"
 msgstr "Ne"
 
 # ../roundup/cgi/templating.py:993 :1357 :1376 :1381
-#: ../roundup/cgi/templating.py:2125 ../roundup/cgi/templating.py:2154
-#: ../roundup/cgi/templating.py:1382:2125:2154
+#: ../roundup/cgi/templating.py:2119 ../roundup/cgi/templating.py:2148
+#: ../roundup/cgi/templating.py:1367:2119:2148
 msgid "Yes"
 msgstr "Taip"
 
-#: ../roundup/cgi/templating.py:2286
+#: ../roundup/cgi/templating.py:2315
 msgid ""
 "default value for DateHTMLProperty must be either DateHTMLProperty or string "
 "date representation."
@@ -2434,27 +2440,27 @@ msgstr ""
 "standartinÄ— DateHTMLProperty reikÅ¡mÄ— turi bÅ«ti arba DateHTMLProperty arba "
 "datos reprezentacija kaip simboliÅ³ eilutÄ—s."
 
-#: ../roundup/cgi/templating.py:2468
+#: ../roundup/cgi/templating.py:2497
 #, python-format
 msgid "Attempt to look up %(attr)s on a missing value"
 msgstr "BandÄ—te paÅ¾iÅ«rÄ—ti %(attr)s neegzistuojanÄiai reikÅ¡mei"
 
-#: ../roundup/cgi/templating.py:2479
+#: ../roundup/cgi/templating.py:2508
 #, fuzzy, python-format
 msgid "Attempt to look up %(item)s on a missing value"
 msgstr "BandÄ—te paÅ¾iÅ«rÄ—ti %(attr)s neegzistuojanÄiai reikÅ¡mei"
 
-#: ../roundup/cgi/templating.py:2584
+#: ../roundup/cgi/templating.py:2613
 #, python-format
 msgid "<option %svalue=\"-1\">- no selection -</option>"
 msgstr "<option %svalue=\"-1\">- nepasirinkta -</option>"
 
-#: ../roundup/cgi/templating.py:3745
+#: ../roundup/cgi/templating.py:3777
 #, python-format
 msgid "Unable to read or expand file '%(name)s' in template '%(template)s'."
 msgstr ""
 
-#: ../roundup/cgi/templating.py:3795
+#: ../roundup/cgi/templating.py:3827
 #, python-format
 msgid ""
 "Found an incorrect token when expandfile applied string subsitution on "
@@ -2634,54 +2640,54 @@ msgstr "prieÅ¡ %s"
 msgid "in %s"
 msgstr "po %s"
 
-#: ../roundup/hyperdb.py:120
+#: ../roundup/hyperdb.py:126
 #, fuzzy, python-format
 msgid "property %(property)s: %(errormsg)s"
 msgstr "Klaida: %s: %s"
 
-#: ../roundup/hyperdb.py:149
+#: ../roundup/hyperdb.py:161
 #, python-format
 msgid "property %(property)s: %(value)r is an invalid date (%(errormsg)s)"
 msgstr ""
 
-#: ../roundup/hyperdb.py:172
+#: ../roundup/hyperdb.py:184
 #, python-format
 msgid ""
 "property %(property)s: %(value)r is an invalid date interval (%(errormsg)s)"
 msgstr ""
 
-#: ../roundup/hyperdb.py:434
+#: ../roundup/hyperdb.py:446
 #, fuzzy, python-format
 msgid "property %(property)s: %(value)r is not a number"
 msgstr "parinkties \"%(propname)s\": \"%(value)s\" nÄ—ra sÄ…raÅ¡e"
 
-#: ../roundup/hyperdb.py:448
+#: ../roundup/hyperdb.py:460
 #, fuzzy, python-format
 msgid "property %(property)s: %(value)r is not an integer"
 msgstr "parinkties \"%(propname)s\": \"%(value)s\" nÄ—ra sÄ…raÅ¡e"
 
-#: ../roundup/hyperdb.py:470
+#: ../roundup/hyperdb.py:482
 #, python-format
 msgid "\"%s\" not a node designator"
 msgstr ""
 
-#: ../roundup/hyperdb.py:1499 ../roundup/hyperdb.py:1507
-#: ../roundup/hyperdb.py:1499:1507
+#: ../roundup/hyperdb.py:1515 ../roundup/hyperdb.py:1523
+#: ../roundup/hyperdb.py:1515:1523
 #, python-format
 msgid "Not a property name: %s"
 msgstr ""
 
-#: ../roundup/hyperdb.py:2038
+#: ../roundup/hyperdb.py:2054
 #, fuzzy, python-format
 msgid "property %(property)s: %(value)r is not a %(classname)s."
 msgstr "parinkties \"%(propname)s\": \"%(value)s\" nÄ—ra sÄ…raÅ¡e"
 
-#: ../roundup/hyperdb.py:2044
+#: ../roundup/hyperdb.py:2060
 #, python-format
 msgid "you may only enter ID values for property %s"
 msgstr ""
 
-#: ../roundup/hyperdb.py:2079
+#: ../roundup/hyperdb.py:2095
 #, python-format
 msgid "%(property)r is not a property of %(classname)s"
 msgstr ""
@@ -3002,61 +3008,61 @@ msgid ""
 "are: %(stack)s"
 msgstr ""
 
-#: ../roundup/pygettext.py:401
+#: ../roundup/pygettext.py:400
 #, python-format
 msgid "*** %(file)s:%(lineno)s: Seen unexpected token \"%(token)s\""
 msgstr ""
 
-#: ../roundup/pygettext.py:457
+#: ../roundup/pygettext.py:456
 #, python-format
 msgid "# File: %(filename)s, line: %(lineno)d"
 msgstr ""
 
-#: ../roundup/pygettext.py:464
+#: ../roundup/pygettext.py:463
 #, python-format
 msgid " %(filename)s:%(lineno)d"
 msgstr ""
 
 # ../roundup/cgi/actions.py:897 :901
-#: ../roundup/pygettext.py:540
+#: ../roundup/pygettext.py:539
 #, fuzzy, python-format
 msgid "Invalid value for --style: %s"
 msgstr "Neteisingas vartotojo vardas ar slaptaÅ¾odis"
 
-#: ../roundup/pygettext.py:548
+#: ../roundup/pygettext.py:547
 #, python-format
 msgid "pygettext.py (xgettext for Python) %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:554
+#: ../roundup/pygettext.py:553
 #, python-format
 msgid "--width argument must be an integer: %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:582
+#: ../roundup/pygettext.py:581
 #, python-format
 msgid "Can't read --exclude-file: %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:601
+#: ../roundup/pygettext.py:600
 msgid "Reading standard input"
 msgstr ""
 
-#: ../roundup/pygettext.py:606
+#: ../roundup/pygettext.py:605
 #, python-format
 msgid "Working on %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:640
+#: ../roundup/pygettext.py:639
 msgid "a unicode string"
 msgstr ""
 
-#: ../roundup/pygettext.py:642
+#: ../roundup/pygettext.py:641
 #, python-format
 msgid "*** Seen unexpected token \"%(token)s\""
 msgstr ""
 
-#: ../roundup/pygettext.py:643
+#: ../roundup/pygettext.py:642
 msgid "morethanonestring"
 msgstr ""
 
@@ -3178,32 +3184,32 @@ msgstr "sukÅ«rimas"
 msgid "creator"
 msgstr "kÅ«rÄ—jas"
 
-#: ../roundup/roundupdb.py:426
+#: ../roundup/roundupdb.py:447
 #, python-format
 msgid "No key for \"%(adr)s\" in keyring"
 msgstr ""
 
-#: ../roundup/roundupdb.py:504
+#: ../roundup/roundupdb.py:525
 #, python-format
 msgid "New submission from %(authname)s%(authaddr)s:"
 msgstr "Nauja pateiktis nuo %(authname)s%(authaddr)s:"
 
-#: ../roundup/roundupdb.py:507
+#: ../roundup/roundupdb.py:528
 #, python-format
 msgid "%(authname)s%(authaddr)s added the comment:"
 msgstr "%(authname)s%(authaddr)s paraÅ¡Ä— komentarÄ…:"
 
-#: ../roundup/roundupdb.py:510
+#: ../roundup/roundupdb.py:531
 #, fuzzy, python-format
 msgid "Change by %(authname)s%(authaddr)s:"
 msgstr "Nauja pateiktis nuo %(authname)s%(authaddr)s:"
 
-#: ../roundup/roundupdb.py:529
+#: ../roundup/roundupdb.py:550
 #, python-format
 msgid "File '%(filename)s' not attached - you can download it from %(link)s."
 msgstr ""
 
-#: ../roundup/roundupdb.py:904
+#: ../roundup/roundupdb.py:925
 #, fuzzy, python-format
 msgid ""
 "\n"
@@ -3311,58 +3317,58 @@ msgstr ""
 "<html><head><title>Roundup tracker'io indeksas</title></head>\n"
 "<body><h1>Roundup tracker'io indeksas</h1><ol>\n"
 
-#: ../roundup/scripts/roundup_server.py:598
+#: ../roundup/scripts/roundup_server.py:602
 #, fuzzy, python-format
 msgid "Error: %(type)s: %(value)s"
 msgstr "%(key)s: %(value)s"
 
-#: ../roundup/scripts/roundup_server.py:610
+#: ../roundup/scripts/roundup_server.py:614
 msgid "WARNING: ignoring \"-g\" argument, not root"
 msgstr "PERSPÄ–JIMAS: \"-g\" argumentas ignoruojamas, nÄ—ra root teisiÅ³"
 
-#: ../roundup/scripts/roundup_server.py:616
+#: ../roundup/scripts/roundup_server.py:620
 msgid "Can't change groups - no grp module"
 msgstr "Negaliu pakeisti grupiÅ³ -- nÄ—ra grp modulio"
 
-#: ../roundup/scripts/roundup_server.py:625
+#: ../roundup/scripts/roundup_server.py:629
 #, python-format
 msgid "Group %(group)s doesn't exist"
 msgstr "GrupÄ—s %(group)s nÄ—ra"
 
-#: ../roundup/scripts/roundup_server.py:637
+#: ../roundup/scripts/roundup_server.py:641
 msgid "Can't run as root!"
 msgstr "Negaliu paleisti root teisÄ—mis!"
 
-#: ../roundup/scripts/roundup_server.py:640
+#: ../roundup/scripts/roundup_server.py:644
 msgid "WARNING: ignoring \"-u\" argument, not root"
 msgstr "PERSPÄ–JIMAS: \"-u\" argumentas ignoruojamas, nÄ—ra root teisiÅ³"
 
-#: ../roundup/scripts/roundup_server.py:646
+#: ../roundup/scripts/roundup_server.py:650
 msgid "Can't change users - no pwd module"
 msgstr "Negaliu pakesiti vartotojÅ³ - nÄ—ra pwd modulio"
 
-#: ../roundup/scripts/roundup_server.py:655
+#: ../roundup/scripts/roundup_server.py:659
 #, python-format
 msgid "User %(user)s doesn't exist"
 msgstr "Vartotojo %(user)s nÄ—ra"
 
-#: ../roundup/scripts/roundup_server.py:867
+#: ../roundup/scripts/roundup_server.py:871
 #, python-format
 msgid "Multiprocess mode \"%s\" is not available, switching to single-process"
 msgstr "MultiprocesinÄ— aplinka \"%s\" neprieinama, perjungiu Ä¯ vienprocesinÄ™"
 
-#: ../roundup/scripts/roundup_server.py:895
+#: ../roundup/scripts/roundup_server.py:899
 #, python-format
 msgid "Unable to bind to port %s, port already in use."
 msgstr "Negaliu prijungti prie jungties %s, jungtis jau naudojama."
 
-#: ../roundup/scripts/roundup_server.py:899
+#: ../roundup/scripts/roundup_server.py:903
 #, fuzzy, python-format
 msgid ""
 "Unable to bind to port %(port)s, access not allowed, errno: %(errno)s %(msg)s"
 msgstr "Negaliu prijungti prie jungties %s, jungtis jau naudojama."
 
-#: ../roundup/scripts/roundup_server.py:978
+#: ../roundup/scripts/roundup_server.py:982
 msgid ""
 " -c <Command>  Windows Service options.\n"
 "               If you want to run the server as a Windows Service, you\n"
@@ -3379,7 +3385,7 @@ msgstr ""
 "               Ä®vedÄ™ \"roundup-server -c help\" pamatysite Windows Services\n"
 "               specifikÄ…."
 
-#: ../roundup/scripts/roundup_server.py:985
+#: ../roundup/scripts/roundup_server.py:989
 #, fuzzy
 msgid ""
 " -u <UID>      runs the Roundup web server as this UID\n"
@@ -3395,7 +3401,7 @@ msgstr ""
 "               nurodytÄ… PIDfaile. Parinktis -l *privalo* bÅ«ti nurodyta\n"
 "               jei naudojama -d."
 
-#: ../roundup/scripts/roundup_server.py:993
+#: ../roundup/scripts/roundup_server.py:997
 #, fuzzy, python-format
 msgid ""
 "\n"
@@ -3521,21 +3527,25 @@ msgstr ""
 "   nesupras.\n"
 "\n"
 
-#: ../roundup/scripts/roundup_server.py:1173
+#: ../roundup/scripts/roundup_server.py:1177
 msgid "Instances must be name=home"
 msgstr "Egzempliorius turi bÅ«ti nurodomas taip: vardas=namÅ³_direktorija"
 
-#: ../roundup/scripts/roundup_server.py:1187
+#: ../roundup/scripts/roundup_server.py:1191
 #, python-format
 msgid "Configuration saved to %s"
 msgstr "KonfigÅ«racija iÅ¡saugota %s"
 
-#: ../roundup/scripts/roundup_server.py:1205
+#: ../roundup/scripts/roundup_server.py:1206
+msgid "If you specify a PID file you must use -l or -L."
+msgstr ""
+
+#: ../roundup/scripts/roundup_server.py:1212
 msgid "Sorry, you can't run the server as a daemon on this Operating System"
 msgstr ""
 "JÅ«s negalite paleisti serverio kaip daemon'o Å¡ioje operacinÄ—je sistemoje"
 
-#: ../roundup/scripts/roundup_server.py:1225
+#: ../roundup/scripts/roundup_server.py:1232
 #, python-format
 msgid "Roundup server started on %(HOST)s:%(PORT)s"
 msgstr "Roundup serveris paleistas ant %(HOST)s:%(PORT)s"
@@ -4817,46 +4827,46 @@ msgstr "Roundup dokumentacija"
 msgid "clear this message"
 msgstr "iÅ¡valyti Å¡Ä¯ praneÅ¡imÄ…"
 
-#: ../share/roundup/templates/classic/html/page.html:257
-#: ../share/roundup/templates/classic/html/page.html:270
-#: ../share/roundup/templates/classic/html/page.html:288
-#: ../share/roundup/templates/classic/html/page.html:302
-#: ../share/roundup/templates/devel/html/page.html:316
-#: ../share/roundup/templates/devel/html/page.html:329
-#: ../share/roundup/templates/devel/html/page.html:347
-#: ../share/roundup/templates/devel/html/page.html:361
-#: ../share/roundup/templates/minimal/html/page.html:239
-#: ../share/roundup/templates/minimal/html/page.html:254
-#: ../share/roundup/templates/minimal/html/page.html:268
-#: ../share/roundup/templates/responsive/html/page.html:331
-#: ../share/roundup/templates/responsive/html/page.html:344
-#: ../share/roundup/templates/responsive/html/page.html:362
-#: ../share/roundup/templates/responsive/html/page.html:376
-msgid "don't care"
-msgstr "nesvarbu"
-
-#: ../share/roundup/templates/classic/html/page.html:259
-#: ../share/roundup/templates/classic/html/page.html:272
-#: ../share/roundup/templates/classic/html/page.html:290
+#: ../share/roundup/templates/classic/html/page.html:258
+#: ../share/roundup/templates/classic/html/page.html:271
+#: ../share/roundup/templates/classic/html/page.html:289
 #: ../share/roundup/templates/classic/html/page.html:303
-#: ../share/roundup/templates/devel/html/page.html:318
-#: ../share/roundup/templates/devel/html/page.html:331
-#: ../share/roundup/templates/devel/html/page.html:349
+#: ../share/roundup/templates/devel/html/page.html:317
+#: ../share/roundup/templates/devel/html/page.html:330
+#: ../share/roundup/templates/devel/html/page.html:348
 #: ../share/roundup/templates/devel/html/page.html:362
-#: ../share/roundup/templates/minimal/html/page.html:241
-#: ../share/roundup/templates/minimal/html/page.html:256
+#: ../share/roundup/templates/minimal/html/page.html:240
+#: ../share/roundup/templates/minimal/html/page.html:255
 #: ../share/roundup/templates/minimal/html/page.html:269
-#: ../share/roundup/templates/responsive/html/page.html:333
-#: ../share/roundup/templates/responsive/html/page.html:346
-#: ../share/roundup/templates/responsive/html/page.html:364
+#: ../share/roundup/templates/responsive/html/page.html:332
+#: ../share/roundup/templates/responsive/html/page.html:345
+#: ../share/roundup/templates/responsive/html/page.html:363
 #: ../share/roundup/templates/responsive/html/page.html:377
+msgid "don't care"
+msgstr "nesvarbu"
+
+#: ../share/roundup/templates/classic/html/page.html:260
+#: ../share/roundup/templates/classic/html/page.html:273
+#: ../share/roundup/templates/classic/html/page.html:291
+#: ../share/roundup/templates/classic/html/page.html:304
+#: ../share/roundup/templates/devel/html/page.html:319
+#: ../share/roundup/templates/devel/html/page.html:332
+#: ../share/roundup/templates/devel/html/page.html:350
+#: ../share/roundup/templates/devel/html/page.html:363
+#: ../share/roundup/templates/minimal/html/page.html:242
+#: ../share/roundup/templates/minimal/html/page.html:257
+#: ../share/roundup/templates/minimal/html/page.html:270
+#: ../share/roundup/templates/responsive/html/page.html:334
+#: ../share/roundup/templates/responsive/html/page.html:347
+#: ../share/roundup/templates/responsive/html/page.html:365
+#: ../share/roundup/templates/responsive/html/page.html:378
 msgid "------------"
 msgstr "------------"
 
-#: ../share/roundup/templates/classic/html/page.html:335
-#: ../share/roundup/templates/devel/html/page.html:390
-#: ../share/roundup/templates/minimal/html/page.html:297
-#: ../share/roundup/templates/responsive/html/page.html:405
+#: ../share/roundup/templates/classic/html/page.html:336
+#: ../share/roundup/templates/devel/html/page.html:391
+#: ../share/roundup/templates/minimal/html/page.html:298
+#: ../share/roundup/templates/responsive/html/page.html:406
 msgid "no value"
 msgstr "nÄ—ra reikÅ¡mÄ—s"
 
diff --git a/locale/nb.po b/locale/nb.po
index d224c3596..14e26e50c 100644
--- a/locale/nb.po
+++ b/locale/nb.po
@@ -5,9 +5,9 @@
 #
 msgid ""
 msgstr ""
-"Project-Id-Version: Roundup 2.5.0\n"
+"Project-Id-Version: Roundup 2.5.0b1\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
-"POT-Creation-Date: 2025-01-12 20:17-0500\n"
+"POT-Creation-Date: 2025-06-11 16:02-0400\n"
 "PO-Revision-Date: 2013-10-31 12:21+0100\n"
 "Last-Translator: Christian Aastorp <christian.aastorp@gmail.com>\n"
 "Language-Team: Norwegian Bokmal <LL@li.org>\n"
@@ -30,19 +30,19 @@ msgstr "Du har ikke tillatelse til  %(action)s %(classname)s klassen."
 msgid "You may not retire the admin or anonymous user"
 msgstr "Du kan ikke slette admin eller anonymous brukerne"
 
-#: ../roundup/admin.py:131
+#: ../roundup/admin.py:132
 msgid ""
 "Have 'display designator[,designator*]' show header inside\n"
 "      []'s before items. Includes retired/active status.\n"
 msgstr ""
 
-#: ../roundup/admin.py:135
+#: ../roundup/admin.py:136
 msgid ""
 "Have 'display designator' and 'specification class' show\n"
 "      protected fields: creator, id etc.\n"
 msgstr ""
 
-#: ../roundup/admin.py:139
+#: ../roundup/admin.py:140
 msgid ""
 "Controls history options. It is a bitstring where setting\n"
 "      the bit disables the feature. A value of 0 (default)\n"
@@ -53,50 +53,50 @@ msgid ""
 "      history.\n"
 msgstr ""
 
-#: ../roundup/admin.py:148
+#: ../roundup/admin.py:149
 msgid ""
 "Set the number of lines of history to keep for this session.\n"
 "      -1 is infinite.\n"
 msgstr ""
 
-#: ../roundup/admin.py:152
+#: ../roundup/admin.py:153
 msgid "Set indexer to use when running 'reindex' NYI\n"
 msgstr ""
 
-#: ../roundup/admin.py:155
+#: ../roundup/admin.py:156
 msgid "Force reopening of tracker when running each command.\n"
 msgstr ""
 
-#: ../roundup/admin.py:158
+#: ../roundup/admin.py:159
 msgid ""
 "set the number of rows imported before a database commit is\n"
 "      done. Used only for imports on PostgreSQL.\n"
 msgstr ""
 
-#: ../roundup/admin.py:160
+#: ../roundup/admin.py:161
 msgid "Show retired items in table, list etc. One of 'no', 'only', 'both'\n"
 msgstr ""
 
-#: ../roundup/admin.py:162
+#: ../roundup/admin.py:163
 msgid "internal mapping for show_retired.\n"
 msgstr ""
 
-#: ../roundup/admin.py:163
+#: ../roundup/admin.py:164
 msgid "Enable verbose output: tracing, descriptions...\n"
 msgstr ""
 
-#: ../roundup/admin.py:175 ../roundup/admin.py:1188 ../roundup/admin.py:1858
-#: ../roundup/admin.py:1890 ../roundup/admin.py:175:1188 :1858:1890
+#: ../roundup/admin.py:176 ../roundup/admin.py:1199 ../roundup/admin.py:1869
+#: ../roundup/admin.py:1901 ../roundup/admin.py:176:1199 :1869:1901
 #, python-format
 msgid "no such class \"%(classname)s\""
 msgstr "ingen slik klasse \"%(classname)s\""
 
-#: ../roundup/admin.py:188
+#: ../roundup/admin.py:189
 #, python-format
 msgid "argument \"%(arg)s\" not propname=value"
 msgstr "argumentet \"%(arg)s\" ikke propname=value"
 
-#: ../roundup/admin.py:201
+#: ../roundup/admin.py:202
 #, python-format
 msgid ""
 "Problem: %(message)s\n"
@@ -105,7 +105,7 @@ msgstr ""
 "Problem: %(message)s\n"
 "\n"
 
-#: ../roundup/admin.py:202
+#: ../roundup/admin.py:203
 #, fuzzy, python-format
 msgid ""
 "%(message)sUsage: roundup-admin [options] [<command> <arguments>]\n"
@@ -158,12 +158,12 @@ msgstr ""
 " roundup-admin help <command>             -- kommandospesifikk hjelp\n"
 " roundup-admin help all                   -- all tilgjengelig hjelp\n"
 
-#: ../roundup/admin.py:231
+#: ../roundup/admin.py:232
 #, fuzzy
 msgid "Commands: "
 msgstr "Kommandoer:"
 
-#: ../roundup/admin.py:238
+#: ../roundup/admin.py:249
 msgid ""
 "Commands may be abbreviated as long as the abbreviation\n"
 "matches only one command, e.g. l == li == lis == list."
@@ -171,7 +171,7 @@ msgstr ""
 "Kommandoer kan forkortes sÃ¥ lenge som forkortelsen bare passer med en "
 "kommando, feks e.g. l == li == lis == list."
 
-#: ../roundup/admin.py:270
+#: ../roundup/admin.py:281
 #, fuzzy
 msgid ""
 "\n"
@@ -309,23 +309,23 @@ msgstr ""
 "\n"
 "Kommandohjelp:\n"
 
-#: ../roundup/admin.py:334
+#: ../roundup/admin.py:345
 #, python-format
 msgid "%s:"
 msgstr "%s:"
 
-#: ../roundup/admin.py:439 ../roundup/admin.py:1415
-#: ../roundup/admin.py:439:1415
+#: ../roundup/admin.py:450 ../roundup/admin.py:1426
+#: ../roundup/admin.py:450:1426
 msgid "Templates:"
 msgstr "Maler:"
 
-#: ../roundup/admin.py:442 ../roundup/admin.py:1425
-#: ../roundup/admin.py:442:1425
+#: ../roundup/admin.py:453 ../roundup/admin.py:1436
+#: ../roundup/admin.py:453:1436
 msgid "Back ends:"
 msgstr "Back ends:"
 
 #. noqa: ARG002
-#: ../roundup/admin.py:459
+#: ../roundup/admin.py:470
 msgid ""
 "Usage: commit\n"
 "        Commit changes made to the database during an interactive session.\n"
@@ -348,7 +348,7 @@ msgstr ""
 "         permanent, hvis de lykkes.\n"
 "        "
 
-#: ../roundup/admin.py:474
+#: ../roundup/admin.py:485
 msgid ""
 "Usage: create classname property=value ...\n"
 "        Create a new entry of a given class.\n"
@@ -366,42 +366,42 @@ msgstr ""
 "        pÃ¥ kommandolinjen ette \"create\"kommandoen.\n"
 "        "
 
-#: ../roundup/admin.py:482 ../roundup/admin.py:555 ../roundup/admin.py:606
-#: ../roundup/admin.py:733 ../roundup/admin.py:806 ../roundup/admin.py:851
-#: ../roundup/admin.py:902 ../roundup/admin.py:999 ../roundup/admin.py:1216
-#: ../roundup/admin.py:1388 ../roundup/admin.py:1516 ../roundup/admin.py:1599
-#: ../roundup/admin.py:1725 ../roundup/admin.py:1848 ../roundup/admin.py:1880
-#: ../roundup/admin.py:1996 ../roundup/admin.py:2050 ../roundup/admin.py:2098
-#: ../roundup/admin.py:482:555 :1216:1388:1516 :1599:1725 :1848:1880 :1996:2050
-#: :2098 :606:733 :806:851 :902:999
+#: ../roundup/admin.py:493 ../roundup/admin.py:566 ../roundup/admin.py:617
+#: ../roundup/admin.py:744 ../roundup/admin.py:817 ../roundup/admin.py:862
+#: ../roundup/admin.py:913 ../roundup/admin.py:1010 ../roundup/admin.py:1227
+#: ../roundup/admin.py:1399 ../roundup/admin.py:1527 ../roundup/admin.py:1610
+#: ../roundup/admin.py:1736 ../roundup/admin.py:1859 ../roundup/admin.py:1891
+#: ../roundup/admin.py:2007 ../roundup/admin.py:2061 ../roundup/admin.py:2109
+#: ../roundup/admin.py:493:566 :1227:1399 :1527:1610 :1736:1859 :1891:2007
+#: :2061:2109 :617:744 :817:862 :913:1010
 msgid "Not enough arguments supplied"
 msgstr "For fÃ¥ parametre"
 
-#: ../roundup/admin.py:502
+#: ../roundup/admin.py:513
 #, python-format
 msgid "%(propname)s (Password): "
 msgstr "%(propname)s (Password): "
 
-#: ../roundup/admin.py:505
+#: ../roundup/admin.py:516
 #, python-format
 msgid "   %(propname)s (Again): "
 msgstr "   %(propname)s (Again): "
 
-#: ../roundup/admin.py:509
+#: ../roundup/admin.py:520
 msgid "Sorry, try again..."
 msgstr "Beklager, prÃ¸v en gang til..."
 
-#: ../roundup/admin.py:514
+#: ../roundup/admin.py:525
 #, python-format
 msgid "%(propname)s (%(proptype)s): "
 msgstr "%(propname)s (%(proptype)s): "
 
-#: ../roundup/admin.py:533
+#: ../roundup/admin.py:544
 #, python-format
 msgid "you must provide the \"%(propname)s\" property."
 msgstr "du mÃ¥ oppgi \"%(propname)s\" egenskapen."
 
-#: ../roundup/admin.py:545
+#: ../roundup/admin.py:556
 #, fuzzy
 msgid ""
 "Usage: display designator[,designator]*\n"
@@ -420,13 +420,13 @@ msgstr ""
 "        Lister egenskapene og deres verdier for oppgitt node.\n"
 "        "
 
-#: ../roundup/admin.py:586
+#: ../roundup/admin.py:597
 #, fuzzy, python-format
 msgid "%(protected)s%(key)s: %(value)s"
 msgstr "%(key)s: %(value)s"
 
 #. grab the directory to export to
-#: ../roundup/admin.py:589
+#: ../roundup/admin.py:600
 #, fuzzy
 msgid ""
 "Usage: export [[-]class[,class]] export_dir\n"
@@ -457,7 +457,7 @@ msgstr ""
 "\t  kolonseparerte filer som plasseres i angitt katalog.\n"
 "        "
 
-#: ../roundup/admin.py:704
+#: ../roundup/admin.py:715
 #, fuzzy
 msgid ""
 "Usage: exporttables [[-]class[,class]] export_dir\n"
@@ -490,7 +490,7 @@ msgstr ""
 "      kolonseparerte filer som plasseres i angitt katalog.\n"
 "        "
 
-#: ../roundup/admin.py:723
+#: ../roundup/admin.py:734
 #, fuzzy
 msgid ""
 "Usage: filter classname propname=value ...\n"
@@ -510,19 +510,19 @@ msgstr ""
 "        Verdien kan enten vÃ¦re nodeid-en til den lenkede noden, eller dens "
 "nÃ¸kkelverdi.n        "
 
-#: ../roundup/admin.py:764
+#: ../roundup/admin.py:775
 #, fuzzy, python-format
 msgid "Class %(curclassname)s has no property %(pn)s in %(propname)s."
 msgstr "%(classname)s har ingen verdi \"%(propname)s\""
 
-#: ../roundup/admin.py:791 ../roundup/admin.py:840 ../roundup/admin.py:1536
-#: ../roundup/admin.py:1549 ../roundup/admin.py:2120
-#: ../roundup/admin.py:791:840 :1536:1549:2120
+#: ../roundup/admin.py:802 ../roundup/admin.py:851 ../roundup/admin.py:1547
+#: ../roundup/admin.py:1560 ../roundup/admin.py:2131
+#: ../roundup/admin.py:802:851 :1547:1560:2131
 #, python-format
 msgid "%(classname)s has no property \"%(propname)s\""
 msgstr "%(classname)s har ingen verdi \"%(propname)s\""
 
-#: ../roundup/admin.py:798
+#: ../roundup/admin.py:809
 msgid ""
 "Usage: find classname propname=value ...\n"
 "        Find the nodes of the given class with a given link property value.\n"
@@ -539,7 +539,7 @@ msgstr ""
 "        Verdien kan enten vÃ¦re nodeid-en til den lenkede noden, eller dens "
 "nÃ¸kkelverdi.n        "
 
-#: ../roundup/admin.py:847
+#: ../roundup/admin.py:858
 #, fuzzy
 msgid ""
 "Usage: genconfig filename\n"
@@ -551,7 +551,7 @@ msgstr ""
 "        i <filename>.\n"
 "        "
 
-#: ../roundup/admin.py:864
+#: ../roundup/admin.py:875
 #, python-format
 msgid ""
 "Changing option\n"
@@ -559,20 +559,20 @@ msgid ""
 "from old default of %(old_number)s to new default of %(new_number)s."
 msgstr ""
 
-#: ../roundup/admin.py:875
+#: ../roundup/admin.py:886
 #, python-format
 msgid ""
 "Update 'password_pbkdf2_default_rounds' to a number equal to or larger\n"
 "  than %s.\n"
 msgstr ""
 
-#: ../roundup/admin.py:882
+#: ../roundup/admin.py:893
 msgid ""
 "Check the rdbms mysql_* settings. Your charset and collations may need\n"
 "  to be changed. See upgrading instructions.\n"
 msgstr ""
 
-#: ../roundup/admin.py:892
+#: ../roundup/admin.py:903
 #, fuzzy
 msgid ""
 "Usage: get property designator[,designator]*\n"
@@ -593,24 +593,24 @@ msgstr ""
 "\t\tved angivelsene.\n"
 "        "
 
-#: ../roundup/admin.py:925
+#: ../roundup/admin.py:936
 #, python-format
 msgid "property %s is not of type Multilink or Link so -d flag does not apply."
 msgstr ""
 "egneskapen %s er ikke multilenke eller lenke so -d lfagget kan ikke anvendes."
 
-#: ../roundup/admin.py:942 ../roundup/admin.py:1190 ../roundup/admin.py:1864
-#: ../roundup/admin.py:1892 ../roundup/admin.py:942:1190 :1864:1892
+#: ../roundup/admin.py:953 ../roundup/admin.py:1201 ../roundup/admin.py:1875
+#: ../roundup/admin.py:1903 ../roundup/admin.py:953:1201 :1875:1903
 #, python-format
 msgid "no such %(classname)s node \"%(nodeid)s\""
 msgstr "finnes ikke %(classname)s node \"%(nodeid)s\""
 
-#: ../roundup/admin.py:945
+#: ../roundup/admin.py:956
 #, python-format
 msgid "no such %(classname)s property \"%(propname)s\""
 msgstr "finnes ikke %(classname)s property \"%(propname)s\""
 
-#: ../roundup/admin.py:950
+#: ../roundup/admin.py:961
 msgid ""
 "Usage: help topic\n"
 "        Give help about topic.\n"
@@ -630,12 +630,12 @@ msgstr ""
 "        all       -- all tilgjengeli hjelp\n"
 "        "
 
-#: ../roundup/admin.py:969
+#: ../roundup/admin.py:980
 #, python-format
 msgid "Sorry, no help for \"%(topic)s\""
 msgstr "Beklager, ingen hjelp for \"%(topic)s\""
 
-#: ../roundup/admin.py:986
+#: ../roundup/admin.py:997
 #, fuzzy
 msgid ""
 "Usage: history designator [skipquiet] [raw]\n"
@@ -657,27 +657,27 @@ msgstr ""
 "       av list eller find-kommandoene, og at dens nÃ¸kkel kan gjenbrukes.\n"
 "        "
 
-#: ../roundup/admin.py:1011
+#: ../roundup/admin.py:1022
 #, python-format
 msgid "Unexpected argument(s): %s. Expected 'skipquiet' or 'raw'."
 msgstr ""
 
-#: ../roundup/admin.py:1062
+#: ../roundup/admin.py:1073
 #, fuzzy
 msgid "removed"
 msgstr "slette"
 
-#: ../roundup/admin.py:1064
+#: ../roundup/admin.py:1075
 msgid "added"
 msgstr ""
 
-#: ../roundup/admin.py:1066
+#: ../roundup/admin.py:1077
 #, python-format
 msgid "Unknown history set operation '%s'. Expected +/-."
 msgstr ""
 
 #. .Hint added issue23 to superseder
-#: ../roundup/admin.py:1091
+#: ../roundup/admin.py:1102
 #, fuzzy, python-format
 msgid "added %(class)s%(item_id)s to %(propname)s"
 msgstr "%(class)s %(id)s %(properties)s endret ok"
@@ -685,29 +685,29 @@ msgstr "%(class)s %(id)s %(properties)s endret ok"
 #. .Hint read as: assignedto was admin(1)
 #. where assignedto is the property
 #. admin is the key name for value 1
-#: ../roundup/admin.py:1112
+#: ../roundup/admin.py:1123
 #, fuzzy, python-format
 msgid "%(prop)s was %(name)s(%(value)s)"
 msgstr "%(propname)s (%(proptype)s): "
 
-#: ../roundup/admin.py:1118 ../roundup/admin.py:1147
-#: ../roundup/admin.py:1118:1147
+#: ../roundup/admin.py:1129 ../roundup/admin.py:1158
+#: ../roundup/admin.py:1129:1158
 #, fuzzy, python-format
 msgid "%(prop)s was %(value)s"
 msgstr "%(key)s: %(value)s"
 
-#: ../roundup/admin.py:1137
+#: ../roundup/admin.py:1148
 #, python-format
 msgid "%(prop)s was [%(value_list)s]"
 msgstr ""
 
 #. .Hint modified nosy: added demo(3)
-#: ../roundup/admin.py:1144
+#: ../roundup/admin.py:1155
 #, python-format
 msgid "modified %(prop)s: %(how)s"
 msgstr ""
 
-#: ../roundup/admin.py:1195
+#: ../roundup/admin.py:1206
 #, fuzzy
 msgid ""
 "Usage: import import_dir\n"
@@ -751,7 +751,7 @@ msgstr ""
 "    (eller, mer omstendelig glem alle gamle data).\n"
 "        "
 
-#: ../roundup/admin.py:1306
+#: ../roundup/admin.py:1317
 msgid ""
 "Usage: importtables export_dir\n"
 "        This imports the database tables exported using exporttables.\n"
@@ -761,7 +761,7 @@ msgid ""
 msgstr ""
 
 #. password
-#: ../roundup/admin.py:1314
+#: ../roundup/admin.py:1325
 msgid ""
 "Usage: initialise [adminpw]\n"
 "        Initialise a new Roundup tracker.\n"
@@ -779,23 +779,23 @@ msgstr ""
 "        KjÃ¸r sporerens oppstartsfunksjon dbinit.init()\n"
 "        "
 
-#: ../roundup/admin.py:1328
+#: ../roundup/admin.py:1339
 msgid "Admin Password: "
 msgstr "Admin passord:"
 
-#: ../roundup/admin.py:1329
+#: ../roundup/admin.py:1340
 msgid "       Confirm: "
 msgstr "       Bekreft: "
 
-#: ../roundup/admin.py:1333
+#: ../roundup/admin.py:1344
 msgid "Instance home does not exist"
 msgstr "Hjemmekatalogen finnes ikke"
 
-#: ../roundup/admin.py:1337
+#: ../roundup/admin.py:1348
 msgid "Instance has not been installed"
 msgstr "Sporeren er ikke installert"
 
-#: ../roundup/admin.py:1345
+#: ../roundup/admin.py:1356
 msgid ""
 "WARNING: The database is already initialised!\n"
 "If you re-initialise it, you will lose all the data!\n"
@@ -805,7 +805,7 @@ msgstr ""
 "Hvis du reinitialiserer den vil alle data bli slettet.\n"
 "Slette den? Y/N: "
 
-#: ../roundup/admin.py:1365
+#: ../roundup/admin.py:1376
 msgid ""
 "Usage: install [template [backend [key=val[,key=val]]]]\n"
 "        Install a new Roundup tracker.\n"
@@ -852,12 +852,12 @@ msgstr ""
 "\t\tSe ogsÃ¥ hjelp for initops.\n"
 "        "
 
-#: ../roundup/admin.py:1394
+#: ../roundup/admin.py:1405
 #, python-format
 msgid "Instance home parent directory \"%(parent)s\" does not exist"
 msgstr "Overordnet katalog \"%(parent)s\" finnes ikke"
 
-#: ../roundup/admin.py:1403
+#: ../roundup/admin.py:1414
 #, python-format
 msgid ""
 "WARNING: There appears to be a tracker in \"%(tracker_home)s\"!\n"
@@ -868,22 +868,22 @@ msgstr ""
 "Du vil miste alle data hvis du reinstallerer!\n"
 "Slette den? Y/N: "
 
-#: ../roundup/admin.py:1416
+#: ../roundup/admin.py:1427
 #, fuzzy
 msgid "Select template"
 msgstr "Velg mal [classic]: "
 
-#: ../roundup/admin.py:1426
+#: ../roundup/admin.py:1437
 #, fuzzy
 msgid "Select backend"
 msgstr "Velg database backend [anydbm]: "
 
-#: ../roundup/admin.py:1437
+#: ../roundup/admin.py:1448
 #, python-format
 msgid "Error in configuration settings: \"%s\""
 msgstr "Feil i konfigurasjon \"%s\""
 
-#: ../roundup/admin.py:1470
+#: ../roundup/admin.py:1481
 #, python-format
 msgid ""
 "\n"
@@ -896,11 +896,11 @@ msgstr ""
 " Du bÃ¸r redigere konfigurasjonsfilen for sporeren nÃ¥:\n"
 "   %(config_file)s"
 
-#: ../roundup/admin.py:1480
+#: ../roundup/admin.py:1491
 msgid " ... at a minimum, you must set following options:"
 msgstr "... du mÃ¥ spesifisere fÃ¸lgende opsjoner som et minimum:"
 
-#: ../roundup/admin.py:1485
+#: ../roundup/admin.py:1496
 #, python-format
 msgid ""
 "\n"
@@ -928,7 +928,7 @@ msgstr ""
 " disse endringene.\n"
 "---------------------------------------------------------------------------\n"
 
-#: ../roundup/admin.py:1501
+#: ../roundup/admin.py:1512
 msgid ""
 "Usage: list classname [property]\n"
 "        List the instances of a class.\n"
@@ -957,17 +957,17 @@ msgstr ""
 "        for alle klasseinstanser.\n"
 "        "
 
-#: ../roundup/admin.py:1514
+#: ../roundup/admin.py:1525
 msgid "Too many arguments supplied"
 msgstr "For mange argumenter"
 
-#: ../roundup/admin.py:1547
+#: ../roundup/admin.py:1558
 #, python-format
 msgid "%(nodeid)4s: %(value)s"
 msgstr "%(nodeid)4s: %(value)s"
 
 #. noqa: ARG002  - args unused
-#: ../roundup/admin.py:1554
+#: ../roundup/admin.py:1565
 #, fuzzy
 msgid ""
 "Usage: migrate\n"
@@ -1014,17 +1014,17 @@ msgstr ""
 "    la det bli en vane.\n"
 "        "
 
-#: ../roundup/admin.py:1574
+#: ../roundup/admin.py:1585
 #, python-format
 msgid "Tracker updated to schema version %s."
 msgstr ""
 
-#: ../roundup/admin.py:1578
+#: ../roundup/admin.py:1589
 #, fuzzy, python-format
 msgid "No migration action required. At schema version %s."
 msgstr "Ingen migrasjon krevet"
 
-#: ../roundup/admin.py:1583
+#: ../roundup/admin.py:1594
 #, fuzzy
 msgid ""
 "Usage: pack period | date\n"
@@ -1062,11 +1062,11 @@ msgstr ""
 "\n"
 "        "
 
-#: ../roundup/admin.py:1609
+#: ../roundup/admin.py:1620
 msgid "Invalid format"
 msgstr "Ugyldig format"
 
-#: ../roundup/admin.py:1620
+#: ../roundup/admin.py:1631
 msgid ""
 "Usage: perftest [mode] [arguments]*\n"
 "        Time operations in Roundup.\n"
@@ -1084,25 +1084,25 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1657
+#: ../roundup/admin.py:1668
 msgid "Invalid 'rounds'. Must be larger than 999."
 msgstr ""
 
-#: ../roundup/admin.py:1661
+#: ../roundup/admin.py:1672
 #, python-format
 msgid "Invalid 'rounds'. It must be an integer not: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1688
+#: ../roundup/admin.py:1699
 msgid "scheme does not support rounds."
 msgstr ""
 
-#: ../roundup/admin.py:1691
+#: ../roundup/admin.py:1702
 #, python-format
 msgid "Hash time: %(time)0.9f seconds, scheme: %(scheme)s, rounds: %(rounds)s"
 msgstr ""
 
-#: ../roundup/admin.py:1697
+#: ../roundup/admin.py:1708
 msgid ""
 "Usage: pragma setting=value | 'list'\n"
 "        Set internal admin settings to a value.\n"
@@ -1131,49 +1131,49 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1732
+#: ../roundup/admin.py:1743
 #, python-format
 msgid "Argument must be setting=value, was given: %s."
 msgstr ""
 
-#: ../roundup/admin.py:1735
+#: ../roundup/admin.py:1746
 msgid "Current settings and values (NYI - not yet implemented):"
 msgstr ""
 
-#: ../roundup/admin.py:1746
+#: ../roundup/admin.py:1757
 msgid ""
 "      Help for this pragma is missing. Please report it to the Roundup "
 "project.\n"
 msgstr ""
 
-#: ../roundup/admin.py:1752
+#: ../roundup/admin.py:1763
 #, fuzzy, python-format
 msgid "Unknown setting %s. Try \"pragma list\"."
 msgstr "Ukjent brukernavn:"
 
-#: ../roundup/admin.py:1762
+#: ../roundup/admin.py:1773
 #, python-format
 msgid "Incorrect value for boolean setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1769
+#: ../roundup/admin.py:1780
 #, python-format
 msgid "Incorrect value for integer setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1776
+#: ../roundup/admin.py:1787
 #, python-format
 msgid ""
 "Incorrect value for setting %(setting)s: %(value)s. Should be no, both, or "
 "only."
 msgstr ""
 
-#: ../roundup/admin.py:1786
+#: ../roundup/admin.py:1797
 #, python-format
 msgid "Internal error: pragma can not handle values of type: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1795
+#: ../roundup/admin.py:1806
 #, fuzzy
 msgid ""
 "Usage: reindex [classname|classname:#-#|designator]*\n"
@@ -1197,17 +1197,17 @@ msgstr ""
 "    automatisk.\n"
 "        "
 
-#: ../roundup/admin.py:1817
+#: ../roundup/admin.py:1828
 #, python-format
 msgid "no such item \"%(designator)s\""
 msgstr "ingen slik enhet  \"%(designator)s\""
 
-#: ../roundup/admin.py:1827
+#: ../roundup/admin.py:1838
 #, fuzzy, python-format
 msgid "no such item \"%(class)s%(id)s\""
 msgstr "ingen slik enhet  \"%(designator)s\""
 
-#: ../roundup/admin.py:1839
+#: ../roundup/admin.py:1850
 #, fuzzy
 msgid ""
 "Usage: restore designator[,designator]*\n"
@@ -1225,7 +1225,7 @@ msgstr ""
 "\t   Oppgitte noder blir tilgjengelige for brukerne igjen.\n"
 "        "
 
-#: ../roundup/admin.py:1870
+#: ../roundup/admin.py:1881
 #, fuzzy
 msgid ""
 "Usage: retire designator[,designator]*\n"
@@ -1246,7 +1246,7 @@ msgstr ""
 "        "
 
 #. noqa: ARG002 - args unused
-#: ../roundup/admin.py:1898
+#: ../roundup/admin.py:1909
 msgid ""
 "Usage: rollback\n"
 "        Undo all changes that are pending commit to the database.\n"
@@ -1265,7 +1265,7 @@ msgstr ""
 "          commited. \n"
 "        "
 
-#: ../roundup/admin.py:1911
+#: ../roundup/admin.py:1922
 msgid ""
 "Usage: security [Role name]\n"
 "        Display the Permissions available to one or all Roles.\n"
@@ -1278,47 +1278,47 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1926
+#: ../roundup/admin.py:1937
 #, fuzzy, python-format
 msgid "No such Role \"%(role)s\"\n"
 msgstr "Ingen slik rolle \"%(role)s\""
 
-#: ../roundup/admin.py:1932
+#: ../roundup/admin.py:1943
 #, fuzzy, python-format
 msgid "New Web users get the Roles \"%(role)s\"\n"
 msgstr "Nye web-brukere for rollene \"%(role)s\""
 
-#: ../roundup/admin.py:1935
+#: ../roundup/admin.py:1946
 #, fuzzy, python-format
 msgid "New Web users get the Role \"%(role)s\"\n"
 msgstr "Nye web-brukere for rollen \"%(role)s\""
 
-#: ../roundup/admin.py:1939
+#: ../roundup/admin.py:1950
 #, fuzzy, python-format
 msgid "New Email users get the Roles \"%(role)s\"\n"
 msgstr "Nye epostbrukere for rollene \"%(role)s\""
 
-#: ../roundup/admin.py:1941
+#: ../roundup/admin.py:1952
 #, fuzzy, python-format
 msgid "New Email users get the Role \"%(role)s\"\n"
 msgstr "Nye epostbrukere for rollen \"%(role)s\""
 
-#: ../roundup/admin.py:1944
+#: ../roundup/admin.py:1955
 #, fuzzy, python-format
 msgid "Role \"%(name)s\":\n"
 msgstr "Rolle \"%(name)s\":"
 
-#: ../roundup/admin.py:1950
+#: ../roundup/admin.py:1961
 #, fuzzy
 msgid " %(description)s (%(name)s for \"%(klass)s\""
 msgstr " %(description)s (%(name)s bare for \"%(klass)s\")"
 
-#: ../roundup/admin.py:1950
+#: ../roundup/admin.py:1961
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\": %(properties)s only)\n"
 msgstr " %(description)s (%(name)s bare for \"%(klass)s\": %(properties)s )"
 
-#: ../roundup/admin.py:1963
+#: ../roundup/admin.py:1974
 #, python-format
 msgid ""
 "\n"
@@ -1326,17 +1326,17 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/admin.py:1969
+#: ../roundup/admin.py:1980
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\" only)\n"
 msgstr " %(description)s (%(name)s bare for \"%(klass)s\")"
 
-#: ../roundup/admin.py:1972
+#: ../roundup/admin.py:1983
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s)\n"
 msgstr " %(description)s (%(name)s)"
 
-#: ../roundup/admin.py:1976
+#: ../roundup/admin.py:1987
 #, fuzzy
 msgid ""
 "Usage: set items property=value [property=value ...]\n"
@@ -1371,7 +1371,7 @@ msgstr ""
 "som\n"
 "        en kommaseparert liste (feks \"1,2,3\")."
 
-#: ../roundup/admin.py:2044
+#: ../roundup/admin.py:2055
 msgid ""
 "Usage: specification classname\n"
 "        Show the properties for a classname.\n"
@@ -1385,17 +1385,17 @@ msgstr ""
 "        Lister egenskapene til gitt klasse.\n"
 "        "
 
-#: ../roundup/admin.py:2063
+#: ../roundup/admin.py:2074
 #, fuzzy, python-format
 msgid "%(key)s: %(value)s (key property)\n"
 msgstr "%(key)s: %(value)s (key property)"
 
-#: ../roundup/admin.py:2066
+#: ../roundup/admin.py:2077
 #, fuzzy, python-format
 msgid "%(key)s: %(value)s\n"
 msgstr "%(key)s: %(value)s"
 
-#: ../roundup/admin.py:2069
+#: ../roundup/admin.py:2080
 msgid ""
 "Usage: table classname [property[,property]*]\n"
 "        List the instances of a class in tabular form.\n"
@@ -1455,17 +1455,17 @@ msgstr ""
 "        resulterer i en fire bokstavaer bred \"Name\" kolonne.\n"
 "        "
 
-#: ../roundup/admin.py:2115
+#: ../roundup/admin.py:2126
 #, python-format
 msgid "\"%(spec)s\" not name:width"
 msgstr "\"%(spec)s\" ikke navn:bredde"
 
-#: ../roundup/admin.py:2137
+#: ../roundup/admin.py:2148
 #, python-format
 msgid "\"%(spec)s\" does not have an integer width: \"%(width)s\""
 msgstr ""
 
-#: ../roundup/admin.py:2173
+#: ../roundup/admin.py:2184
 msgid ""
 "Usage: templates [trace_search]\n"
 "        List templates and their installed directories.\n"
@@ -1475,7 +1475,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2201
+#: ../roundup/admin.py:2212
 #, fuzzy
 msgid ""
 "Usage: updateconfig <filename>\n"
@@ -1490,34 +1490,34 @@ msgstr ""
 "        i <filename>.\n"
 "        "
 
-#: ../roundup/admin.py:2210 ../roundup/cgi/actions.py:886
-#: ../roundup/cgi/actions.py:897 ../roundup/cgi/actions.py:1099
-#: ../roundup/cgi/actions.py:1113 ../roundup/cgi/actions.py:886:897 :1099:1113
+#: ../roundup/admin.py:2221 ../roundup/cgi/actions.py:891
+#: ../roundup/cgi/actions.py:902 ../roundup/cgi/actions.py:1104
+#: ../roundup/cgi/actions.py:1118 ../roundup/cgi/actions.py:891:902 :1104:1118
 #, python-format
 msgid "Error: %s"
 msgstr "Feil: %s"
 
-#: ../roundup/admin.py:2242
+#: ../roundup/admin.py:2253
 #, python-format
 msgid "Unknown command \"%(command)s\" (\"help commands\" for a list)"
 msgstr "Ukjent kommando \"%(command)s\" (\"help commands\" for liste)"
 
-#: ../roundup/admin.py:2248
+#: ../roundup/admin.py:2259
 #, python-format
 msgid "Multiple commands match \"%(command)s\": %(list)s"
 msgstr "Multiple kommandoer  matcher \"%(command)s\": %(list)s"
 
-#: ../roundup/admin.py:2263
+#: ../roundup/admin.py:2274
 msgid "Enter tracker home: "
 msgstr "Oppgi sporers plassering:"
 
-#: ../roundup/admin.py:2292 ../roundup/admin.py:2296
-#: ../roundup/admin.py:2292:2296
+#: ../roundup/admin.py:2303 ../roundup/admin.py:2307
+#: ../roundup/admin.py:2303:2307
 #, python-format
 msgid "Error: Couldn't open tracker: %(message)s"
 msgstr "Feil: Kan ikke Ã¥pne sporer: %(message)s"
 
-#: ../roundup/admin.py:2344
+#: ../roundup/admin.py:2355
 #, python-format
 msgid ""
 "Roundup %s ready for input.\n"
@@ -1526,30 +1526,30 @@ msgstr ""
 "Roundup %s er klar til bruk.\n"
 "Skriv  \"help\" for hjelp."
 
-#: ../roundup/admin.py:2377
+#: ../roundup/admin.py:2388
 msgid "Note: command history and editing not available"
 msgstr "Merk: kommandohistorikk og redigering utilgjengelig"
 
-#: ../roundup/admin.py:2383
+#: ../roundup/admin.py:2394
 msgid "exit..."
 msgstr "exit..."
 
-#: ../roundup/admin.py:2396
+#: ../roundup/admin.py:2407
 msgid "There are unsaved changes. Commit them (y/N)? "
 msgstr "Det er ikkelagrede endringer. Lagre dem (y/N)? "
 
-#: ../roundup/backends/back_anydbm.py:215
-#: ../roundup/backends/rdbms_common.py:928
+#: ../roundup/backends/back_anydbm.py:213
+#: ../roundup/backends/rdbms_common.py:926
 #, python-format
 msgid "Class \"%s\" already defined."
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:280
+#: ../roundup/backends/back_anydbm.py:278
 #: ../roundup/backends/sessions_dbm.py:61
 msgid "Couldn't identify database type"
 msgstr "Kunne ikke identifisere databsetypen"
 
-#: ../roundup/backends/back_anydbm.py:314
+#: ../roundup/backends/back_anydbm.py:312
 #, fuzzy, python-format
 msgid ""
 "Couldn't open database - the required module '%s' (as dbm.gnu) is not "
@@ -1557,7 +1557,7 @@ msgid ""
 msgstr ""
 "Kunne ikke Ã¥pne databasen - den pÃ¥krevde modulen '%s' er ikke tilgjengelig"
 
-#: ../roundup/backends/back_anydbm.py:318
+#: ../roundup/backends/back_anydbm.py:316
 #, python-format
 msgid "Couldn't open database - the required module '%s' is not available"
 msgstr ""
@@ -1565,21 +1565,21 @@ msgstr ""
 
 #: ../roundup/backends/back_anydbm.py:873
 #: ../roundup/backends/back_anydbm.py:886
-#: ../roundup/backends/back_anydbm.py:1160
-#: ../roundup/backends/back_anydbm.py:1195
-#: ../roundup/backends/back_anydbm.py:1424
-#: ../roundup/backends/back_anydbm.py:1442
-#: ../roundup/backends/back_anydbm.py:1489
-#: ../roundup/backends/back_anydbm.py:2135
+#: ../roundup/backends/back_anydbm.py:1162
+#: ../roundup/backends/back_anydbm.py:1197
+#: ../roundup/backends/back_anydbm.py:1426
+#: ../roundup/backends/back_anydbm.py:1444
+#: ../roundup/backends/back_anydbm.py:1492
+#: ../roundup/backends/back_anydbm.py:2138
 #: ../roundup/backends/back_anydbm.py:873:886
-#: ../roundup/backends/rdbms_common.py:1720
-#: ../roundup/backends/rdbms_common.py:1967
-#: ../roundup/backends/rdbms_common.py:2206
-#: ../roundup/backends/rdbms_common.py:2226
-#: ../roundup/backends/rdbms_common.py:2279
-#: ../roundup/backends/rdbms_common.py:3254
-#: ../roundup/backends/rdbms_common.py:1720:1967 :1160:1195 :1424:1442:1489
-#: :2135 :2206:2226 :2279:3254
+#: ../roundup/backends/rdbms_common.py:1721
+#: ../roundup/backends/rdbms_common.py:1972
+#: ../roundup/backends/rdbms_common.py:2211
+#: ../roundup/backends/rdbms_common.py:2231
+#: ../roundup/backends/rdbms_common.py:2293
+#: ../roundup/backends/rdbms_common.py:3268
+#: ../roundup/backends/rdbms_common.py:1721:1972 :1162:1197 :1426:1444:1492
+#: :2138 :2211:2231 :2293:3268
 msgid "Database open read-only"
 msgstr "Databsen Ã¥pnet bare for lesing"
 
@@ -1605,45 +1605,50 @@ msgstr ""
 msgid "Unable to get lock after 10 retries on %s."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:632
+#: ../roundup/backends/rdbms_common.py:630
 #, python-format
 msgid "ALTER operation disallowed: %(old)r -> %(new)r."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:867
+#: ../roundup/backends/rdbms_common.py:865
 #, python-format
 msgid "CREATE operation disallowed: \"%s\"."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:884
+#: ../roundup/backends/rdbms_common.py:882
 #, python-format
 msgid "DROP operation disallowed: \"%s\"."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:1863
+#: ../roundup/backends/rdbms_common.py:1864
 msgid "create"
 msgstr "lag"
 
-#: ../roundup/backends/rdbms_common.py:2038
+#: ../roundup/backends/rdbms_common.py:2043
 msgid "unlink"
 msgstr "fjern lenke"
 
-#: ../roundup/backends/rdbms_common.py:2042
+#: ../roundup/backends/rdbms_common.py:2047
 msgid "link"
 msgstr "lenke"
 
-#: ../roundup/backends/rdbms_common.py:2187
+#: ../roundup/backends/rdbms_common.py:2192
 msgid "set"
 msgstr "oppdater"
 
-#: ../roundup/backends/rdbms_common.py:2216
+#: ../roundup/backends/rdbms_common.py:2221
 msgid "retired"
 msgstr "glemt"
 
-#: ../roundup/backends/rdbms_common.py:2246
+#: ../roundup/backends/rdbms_common.py:2251
 msgid "restored"
 msgstr "brakt tilbake"
 
+#: ../roundup/backends/rdbms_common.py:2265
+#, fuzzy, python-format
+msgid "class %(cls)s: %(value)r is not an id"
+msgstr "egenskap %s: %r er ikke et nummer"
+
 #: ../roundup/backends/sessions_redis.py:78
 #: ../roundup/backends/sessions_redis.py:97
 #: ../roundup/backends/sessions_redis.py:78:97
@@ -1726,10 +1731,10 @@ msgid "\"%(input)s\" is not an ID (%(classname)s ID required)"
 msgstr "\"%(input)s\" er ikke en ID (%(classname)s ID pÃ¥krevet)"
 
 #: ../roundup/cgi/actions.py:228 ../roundup/cgi/actions.py:266
-#: ../roundup/cgi/actions.py:493 ../roundup/cgi/actions.py:833
-#: ../roundup/cgi/actions.py:880 ../roundup/cgi/actions.py:1084
-#: ../roundup/cgi/actions.py:1246 ../roundup/cgi/actions.py:228:266:1246
-#: :493:833 :880:1084
+#: ../roundup/cgi/actions.py:493 ../roundup/cgi/actions.py:838
+#: ../roundup/cgi/actions.py:885 ../roundup/cgi/actions.py:1089
+#: ../roundup/cgi/actions.py:1251 ../roundup/cgi/actions.py:228:266:1251
+#: :493:838 :885:1089
 msgid "Invalid request"
 msgstr "Ugyldig forespÃ¸rsel"
 
@@ -1779,8 +1784,8 @@ msgstr "Ugyldig forespÃ¸rsel"
 msgid "Invalid integer: "
 msgstr "Ugylig login"
 
-#: ../roundup/cgi/actions.py:531 ../roundup/cgi/actions.py:735
-#: ../roundup/cgi/actions.py:531:735
+#: ../roundup/cgi/actions.py:531 ../roundup/cgi/actions.py:740
+#: ../roundup/cgi/actions.py:531:740
 #, python-format
 msgid "You do not have permission to create %(class)s"
 msgstr "Du har ikke tillatelse til  Ã¥ opprette %(class)s"
@@ -1790,8 +1795,8 @@ msgstr "Du har ikke tillatelse til  Ã¥ opprette %(class)s"
 msgid "Not enough values on line %(line)s"
 msgstr "Ikke nok verdier pÃ¥ linjen %(line)s"
 
-#: ../roundup/cgi/actions.py:556 ../roundup/cgi/actions.py:723
-#: ../roundup/cgi/actions.py:556:723
+#: ../roundup/cgi/actions.py:556 ../roundup/cgi/actions.py:728
+#: ../roundup/cgi/actions.py:556:728
 #, python-format
 msgid "You do not have permission to edit %(class)s"
 msgstr "Du har ikke tillatelse til Ã¥ endre %(class)s"
@@ -1800,17 +1805,17 @@ msgstr "Du har ikke tillatelse til Ã¥ endre %(class)s"
 msgid "Items edited OK"
 msgstr "Saker endret OK"
 
-#: ../roundup/cgi/actions.py:671
+#: ../roundup/cgi/actions.py:676
 #, python-format
 msgid "%(class)s %(id)s %(properties)s edited ok"
 msgstr "%(class)s %(id)s %(properties)s endret ok"
 
-#: ../roundup/cgi/actions.py:689
+#: ../roundup/cgi/actions.py:694
 #, python-format
 msgid "%(class)s %(id)s created"
 msgstr "%(class)s %(id)s opprettet"
 
-#: ../roundup/cgi/actions.py:817
+#: ../roundup/cgi/actions.py:822
 #, fuzzy, python-format
 msgid ""
 "Edit Error: someone else has edited this %(klass)s (%(props)s). View <a "
@@ -1820,12 +1825,12 @@ msgstr ""
 "Se <a target=\"new\" href=\"%(klass)s%(id)s\">deres endringer </a> i et nytt "
 "vindu."
 
-#: ../roundup/cgi/actions.py:850
+#: ../roundup/cgi/actions.py:855
 #, python-format
 msgid "Edit Error: %s"
 msgstr "Redigeringsfeil: %s"
 
-#: ../roundup/cgi/actions.py:931
+#: ../roundup/cgi/actions.py:936
 msgid ""
 "Invalid One Time Key!\n"
 "(a Mozilla bug may cause this message to show up erroneously, please check "
@@ -1835,12 +1840,12 @@ msgstr ""
 "(En Mozilla feil kan forÃ¥rsake at denne meldingen kommer feilaktig, venligst "
 "sjekk eposten din)"
 
-#: ../roundup/cgi/actions.py:972
+#: ../roundup/cgi/actions.py:977
 #, fuzzy, python-format
 msgid "Password reset for %s"
 msgstr "Passord endringsforespÃ¸rse"
 
-#: ../roundup/cgi/actions.py:973
+#: ../roundup/cgi/actions.py:978
 #, python-format
 msgid ""
 "\n"
@@ -1849,29 +1854,29 @@ msgid ""
 "Your password is now: %(password)s\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:982
+#: ../roundup/cgi/actions.py:987
 #, python-format
 msgid "Password reset and email sent to %s"
 msgstr "En e-post med passord er nÃ¥ sendt til %s."
 
-#: ../roundup/cgi/actions.py:991
+#: ../roundup/cgi/actions.py:996
 msgid "Unknown username"
 msgstr "Ukjent brukernavn:"
 
-#: ../roundup/cgi/actions.py:999
+#: ../roundup/cgi/actions.py:1004
 msgid "Unknown email address"
 msgstr "Ukjent postadresse:"
 
-#: ../roundup/cgi/actions.py:1004
+#: ../roundup/cgi/actions.py:1009
 msgid "You need to specify a username or address"
 msgstr "Du mÃ¥ spesifisere et brukernavn eller en adresse"
 
-#: ../roundup/cgi/actions.py:1015
+#: ../roundup/cgi/actions.py:1020
 #, fuzzy, python-format
 msgid "Confirm reset of password for %s"
 msgstr "Bekreft passord"
 
-#: ../roundup/cgi/actions.py:1016
+#: ../roundup/cgi/actions.py:1021
 #, python-format
 msgid ""
 "\n"
@@ -1885,31 +1890,31 @@ msgid ""
 "You should then receive another email with the new password.\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1029
+#: ../roundup/cgi/actions.py:1034
 #, python-format
 msgid "Email sent to primary notification address for %s."
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1031
+#: ../roundup/cgi/actions.py:1036
 #, fuzzy, python-format
 msgid "Email sent to %s."
 msgstr "Epost sendt til %s"
 
-#: ../roundup/cgi/actions.py:1046
+#: ../roundup/cgi/actions.py:1051
 msgid "You are now registered, welcome!"
 msgstr "Du er registrert, velkommen!"
 
-#: ../roundup/cgi/actions.py:1139
+#: ../roundup/cgi/actions.py:1144
 #, python-format
 msgid "Username '%s' is already used."
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1163
+#: ../roundup/cgi/actions.py:1168
 #, python-format
 msgid "Complete your registration to %(tracker_name)s -- key %(key)s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1167
+#: ../roundup/cgi/actions.py:1172
 #, python-format
 msgid ""
 "To complete your registration of the user \"%(name)s\" with\n"
@@ -1925,12 +1930,12 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1181
+#: ../roundup/cgi/actions.py:1186
 #, python-format
 msgid "Complete your registration to %s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1182
+#: ../roundup/cgi/actions.py:1187
 #, python-format
 msgid ""
 "To complete your registration of the user \"%(name)s\" with\n"
@@ -1940,44 +1945,44 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1206
+#: ../roundup/cgi/actions.py:1211
 msgid "It is not permitted to supply roles at registration."
 msgstr "Du kan ikke oppgi roller ved registreringen."
 
-#: ../roundup/cgi/actions.py:1220
+#: ../roundup/cgi/actions.py:1225
 msgid "You are logged out"
 msgstr "Du er logget ut"
 
-#: ../roundup/cgi/actions.py:1250
+#: ../roundup/cgi/actions.py:1255
 msgid "Username required"
 msgstr "Brukernavn nÃ¸dvendig"
 
-#: ../roundup/cgi/actions.py:1354
+#: ../roundup/cgi/actions.py:1359
 #, python-format
 msgid "Welcome %(username)s!"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1477
+#: ../roundup/cgi/actions.py:1482
 #, python-format
 msgid "Logins occurring too fast. Please wait: %s seconds."
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1515 ../roundup/cgi/actions.py:1526
-#: ../roundup/cgi/actions.py:1515:1526
+#: ../roundup/cgi/actions.py:1520 ../roundup/cgi/actions.py:1531
+#: ../roundup/cgi/actions.py:1520:1531
 msgid "Invalid login"
 msgstr "Ugylig login"
 
-#: ../roundup/cgi/actions.py:1532
+#: ../roundup/cgi/actions.py:1537
 msgid "You do not have permission to login"
 msgstr "Du har ikke tillatelse til Ã¥ logge inn"
 
-#: ../roundup/cgi/actions.py:1577 ../roundup/cgi/actions.py:1757
-#: ../roundup/cgi/actions.py:1577:1757
+#: ../roundup/cgi/actions.py:1582 ../roundup/cgi/actions.py:1762
+#: ../roundup/cgi/actions.py:1582:1762
 #, python-format
 msgid "Column \"%(column)s\" not found in %(class)s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1822
+#: ../roundup/cgi/actions.py:1827
 #, python-format
 msgid "You do not have permission to view %(class)s"
 msgstr "Du har ikke tillatelse til  Ã¥ se pÃ¥ %(class)s"
@@ -2102,8 +2107,8 @@ msgstr "Skjema feil:"
 msgid "Unrecognized charset: %r"
 msgstr "Ukjent tegnsett: %r"
 
-#: ../roundup/cgi/client.py:1381 ../roundup/cgi/client.py:2394
-#: ../roundup/cgi/client.py:1381:2394
+#: ../roundup/cgi/client.py:1381 ../roundup/cgi/client.py:2396
+#: ../roundup/cgi/client.py:1381:2396
 msgid "broken form: multiple @action values submitted"
 msgstr ""
 
@@ -2181,50 +2186,51 @@ msgstr ""
 
 #: ../roundup/cgi/client.py:1679
 #, python-format
-msgid "csrf X-REQUESTED-WITH xmlrpc required header check failed for user%s."
+msgid ""
+"csrf X-REQUESTED-WITH xmlrpc required header check failed for user%(userid)s."
 msgstr ""
 
 #: ../roundup/cgi/client.py:1720
 #, python-format
-msgid "Required csrf field missing for user%s"
+msgid "Required csrf field missing for user%(userid)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1722 ../roundup/cgi/client.py:1749
-#: ../roundup/cgi/client.py:1766 ../roundup/cgi/client.py:1722:1749:1766
+#: ../roundup/cgi/client.py:1723 ../roundup/cgi/client.py:1751
+#: ../roundup/cgi/client.py:1768 ../roundup/cgi/client.py:1723:1751:1768
 msgid ""
 "We can't validate your session (csrf failure). Re-enter any unsaved data and "
 "try again."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1726
+#: ../roundup/cgi/client.py:1728
 #, python-format
-msgid "csrf field not supplied by user%s"
+msgid "csrf field not supplied by user%(userid)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1738
+#: ../roundup/cgi/client.py:1740
 #, python-format
 msgid ""
 "Csrf mismatch user: current user %(user)s != stored user %(stored)s, current "
 "session, stored session: %(cur_sess)s,%(stor_sess)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1756
+#: ../roundup/cgi/client.py:1758
 #, python-format
 msgid ""
 "Csrf mismatch user: current session %(curr_sess)s != stored session "
 "%(stor_sess)s, current user/stored user is: %(user)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1948
+#: ../roundup/cgi/client.py:1950
 msgid "You are not allowed to view this file."
 msgstr "Du har ikke lov Ã¥ se denne filen."
 
-#: ../roundup/cgi/client.py:2272
+#: ../roundup/cgi/client.py:2274
 #, python-format
 msgid "%(starttag)sTime elapsed: %(seconds)fs%(endtag)s\n"
 msgstr "%(starttag)sMedgÃ¥tt tid: %(seconds)fs%(endtag)s\n"
 
-#: ../roundup/cgi/client.py:2276
+#: ../roundup/cgi/client.py:2278
 #, python-format
 msgid ""
 "%(starttag)sCache hits: %(cache_hits)d, misses %(cache_misses)d. Loading "
@@ -2233,7 +2239,7 @@ msgstr ""
 "%(starttag)sCache treff: %(cache_hits)d, ikke-treff %(cache_misses)d. Laster "
 "saker: %(get_items)f secs. Filtrerer: %(filtering)f secs.%(endtag)s\n"
 
-#: ../roundup/cgi/client.py:2815
+#: ../roundup/cgi/client.py:2817
 #, python-format
 msgid ""
 "Cache failure: compressed file %(compressed)s is older than its source file "
@@ -2299,64 +2305,64 @@ msgstr[1] "Krevet %(class)s egenskap %(property)s ikke gitt."
 msgid "You are not allowed to %(action)s items of class %(class)s"
 msgstr "Du har ikke rettigheter til Ã¥ %(action)s instanser av klasse %(class)s"
 
-#: ../roundup/cgi/templating.py:916
+#: ../roundup/cgi/templating.py:892
 msgid "(list)"
 msgstr "(liste)"
 
-#: ../roundup/cgi/templating.py:991
+#: ../roundup/cgi/templating.py:975
 msgid "Submit New Entry"
 msgstr "Legg til ny oppfÃ¸ring"
 
-#: ../roundup/cgi/templating.py:1013 ../roundup/cgi/templating.py:1189
-#: ../roundup/cgi/templating.py:1824 ../roundup/cgi/templating.py:1855
-#: ../roundup/cgi/templating.py:1876 ../roundup/cgi/templating.py:1914
-#: ../roundup/cgi/templating.py:1967 ../roundup/cgi/templating.py:1991
-#: ../roundup/cgi/templating.py:1998 ../roundup/cgi/templating.py:2035
-#: ../roundup/cgi/templating.py:2088 ../roundup/cgi/templating.py:2121
-#: ../roundup/cgi/templating.py:2216 ../roundup/cgi/templating.py:2237
-#: ../roundup/cgi/templating.py:2328 ../roundup/cgi/templating.py:2348
-#: ../roundup/cgi/templating.py:2370 ../roundup/cgi/templating.py:2413
-#: ../roundup/cgi/templating.py:2423 ../roundup/cgi/templating.py:2488
-#: ../roundup/cgi/templating.py:2791 ../roundup/cgi/templating.py:1013:1189
-#: :1824:1855 :1876:1914 :1967:1991 :1998:2035 :2088:2121 :2216:2237 :2328:2348
-#: :2370:2413 :2423:2488:2791
+#: ../roundup/cgi/templating.py:997 ../roundup/cgi/templating.py:1174
+#: ../roundup/cgi/templating.py:1809 ../roundup/cgi/templating.py:1840
+#: ../roundup/cgi/templating.py:1861 ../roundup/cgi/templating.py:1899
+#: ../roundup/cgi/templating.py:1952 ../roundup/cgi/templating.py:1976
+#: ../roundup/cgi/templating.py:1983 ../roundup/cgi/templating.py:2020
+#: ../roundup/cgi/templating.py:2077 ../roundup/cgi/templating.py:2115
+#: ../roundup/cgi/templating.py:2215 ../roundup/cgi/templating.py:2236
+#: ../roundup/cgi/templating.py:2357 ../roundup/cgi/templating.py:2377
+#: ../roundup/cgi/templating.py:2399 ../roundup/cgi/templating.py:2442
+#: ../roundup/cgi/templating.py:2452 ../roundup/cgi/templating.py:2517
+#: ../roundup/cgi/templating.py:2820 ../roundup/cgi/templating.py:997:1174
+#: :1809:1840 :1861:1899 :1952:1976 :1983:2020 :2077:2115 :2215:2236 :2357:2377
+#: :2399:2442 :2452:2517:2820
 msgid "[hidden]"
 msgstr "[skjult]"
 
-#: ../roundup/cgi/templating.py:1014
+#: ../roundup/cgi/templating.py:998
 msgid "New node - no history"
 msgstr "Ny node - ingen historie"
 
-#: ../roundup/cgi/templating.py:1154
+#: ../roundup/cgi/templating.py:1139
 msgid "Submit Changes"
 msgstr "Lagre endringer"
 
-#: ../roundup/cgi/templating.py:1232
+#: ../roundup/cgi/templating.py:1217
 msgid "<em>The indicated property no longer exists</em>"
 msgstr "<em>Valgt egenskap finnes ikke lenger</em>"
 
-#: ../roundup/cgi/templating.py:1268
+#: ../roundup/cgi/templating.py:1253
 #, python-format
 msgid "The linked class %(classname)s no longer exists"
 msgstr "Den lenkede klassen %(classname)s finnes ikke lenger"
 
-#: ../roundup/cgi/templating.py:1305 ../roundup/cgi/templating.py:1335
-#: ../roundup/cgi/templating.py:2497 ../roundup/cgi/templating.py:2800
-#: ../roundup/cgi/templating.py:1305:1335 :2497:2800
+#: ../roundup/cgi/templating.py:1290 ../roundup/cgi/templating.py:1320
+#: ../roundup/cgi/templating.py:2526 ../roundup/cgi/templating.py:2829
+#: ../roundup/cgi/templating.py:1290:1320 :2526:2829
 msgid "[label is missing]"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:1309 ../roundup/cgi/templating.py:1338
-#: ../roundup/cgi/templating.py:1309:1338
+#: ../roundup/cgi/templating.py:1294 ../roundup/cgi/templating.py:1323
+#: ../roundup/cgi/templating.py:1294:1323
 msgid "<strike>The linked node no longer exists</strike>"
 msgstr "<strike>Den lenkede noden finnes ikke lenger</strike>"
 
-#: ../roundup/cgi/templating.py:1400
+#: ../roundup/cgi/templating.py:1385
 #, python-format
 msgid "%s: (no value)"
 msgstr "%s: (ingen verdi)"
 
-#: ../roundup/cgi/templating.py:1416
+#: ../roundup/cgi/templating.py:1401
 #, fuzzy, python-format
 msgid ""
 "<strong><em>This event %s is not handled by the history display!</em></"
@@ -2365,46 +2371,46 @@ msgstr ""
 "<strong><em>Denne hendelsen hÃ¥ndteres ikke av historievisningen!</em></"
 "strong>"
 
-#: ../roundup/cgi/templating.py:1429
+#: ../roundup/cgi/templating.py:1414
 msgid "<tr><td colspan=4><strong>Note:</strong></td></tr>"
 msgstr "<tr><td colspan=4><strong>Noter:</strong></td></tr>"
 
-#: ../roundup/cgi/templating.py:1438
+#: ../roundup/cgi/templating.py:1423
 msgid "History"
 msgstr "Historie"
 
-#: ../roundup/cgi/templating.py:1440
+#: ../roundup/cgi/templating.py:1425
 msgid "<th>Date</th>"
 msgstr "<th>Dato</th>"
 
-#: ../roundup/cgi/templating.py:1441
+#: ../roundup/cgi/templating.py:1426
 msgid "<th>User</th>"
 msgstr "<th>Bruker</th>"
 
-#: ../roundup/cgi/templating.py:1442
+#: ../roundup/cgi/templating.py:1427
 msgid "<th>Action</th>"
 msgstr "<th>Aksjon</th>"
 
-#: ../roundup/cgi/templating.py:1443
+#: ../roundup/cgi/templating.py:1428
 msgid "<th>Args</th>"
 msgstr "<th>Argumenter</th>"
 
-#: ../roundup/cgi/templating.py:1494
+#: ../roundup/cgi/templating.py:1479
 #, python-format
 msgid "Copy of %(class)s %(id)s"
 msgstr "Kopi av %(class)s %(id)s"
 
-#: ../roundup/cgi/templating.py:2125 ../roundup/cgi/templating.py:2160
-#: ../roundup/cgi/templating.py:1382:2125:2160
+#: ../roundup/cgi/templating.py:2119 ../roundup/cgi/templating.py:2154
+#: ../roundup/cgi/templating.py:1367:2119:2154
 msgid "No"
 msgstr "Nei"
 
-#: ../roundup/cgi/templating.py:2125 ../roundup/cgi/templating.py:2154
-#: ../roundup/cgi/templating.py:1382:2125:2154
+#: ../roundup/cgi/templating.py:2119 ../roundup/cgi/templating.py:2148
+#: ../roundup/cgi/templating.py:1367:2119:2148
 msgid "Yes"
 msgstr "Ja"
 
-#: ../roundup/cgi/templating.py:2286
+#: ../roundup/cgi/templating.py:2315
 msgid ""
 "default value for DateHTMLProperty must be either DateHTMLProperty or string "
 "date representation."
@@ -2412,27 +2418,27 @@ msgstr ""
 "standard verdi for DateHTMLProperty mÃ¥ vÃ¦re enten DateHTMLProperty eller en "
 "streng represantasjon av tidspunkt."
 
-#: ../roundup/cgi/templating.py:2468
+#: ../roundup/cgi/templating.py:2497
 #, python-format
 msgid "Attempt to look up %(attr)s on a missing value"
 msgstr "ForsÃ¸k pÃ¥ Ã¥ slÃ¥ opp  %(attr)s pÃ¥ manglende verdi"
 
-#: ../roundup/cgi/templating.py:2479
+#: ../roundup/cgi/templating.py:2508
 #, fuzzy, python-format
 msgid "Attempt to look up %(item)s on a missing value"
 msgstr "ForsÃ¸k pÃ¥ Ã¥ slÃ¥ opp  %(attr)s pÃ¥ manglende verdi"
 
-#: ../roundup/cgi/templating.py:2584
+#: ../roundup/cgi/templating.py:2613
 #, python-format
 msgid "<option %svalue=\"-1\">- no selection -</option>"
 msgstr "<option %svalue=\"-1\">- intet valg -</option>"
 
-#: ../roundup/cgi/templating.py:3745
+#: ../roundup/cgi/templating.py:3777
 #, python-format
 msgid "Unable to read or expand file '%(name)s' in template '%(template)s'."
 msgstr ""
 
-#: ../roundup/cgi/templating.py:3795
+#: ../roundup/cgi/templating.py:3827
 #, python-format
 msgid ""
 "Found an incorrect token when expandfile applied string subsitution on "
@@ -2603,54 +2609,54 @@ msgstr "%s siden"
 msgid "in %s"
 msgstr "i %s"
 
-#: ../roundup/hyperdb.py:120
+#: ../roundup/hyperdb.py:126
 #, fuzzy, python-format
 msgid "property %(property)s: %(errormsg)s"
 msgstr "egenskap %s: %s"
 
-#: ../roundup/hyperdb.py:149
+#: ../roundup/hyperdb.py:161
 #, fuzzy, python-format
 msgid "property %(property)s: %(value)r is an invalid date (%(errormsg)s)"
 msgstr "egenskap %s: %r er en ugyldig dato (%s)"
 
-#: ../roundup/hyperdb.py:172
+#: ../roundup/hyperdb.py:184
 #, fuzzy, python-format
 msgid ""
 "property %(property)s: %(value)r is an invalid date interval (%(errormsg)s)"
 msgstr "egenskap %s: %r er et ugyldig datointervalll (%s)"
 
-#: ../roundup/hyperdb.py:434
+#: ../roundup/hyperdb.py:446
 #, fuzzy, python-format
 msgid "property %(property)s: %(value)r is not a number"
 msgstr "egenskap %s: %r er ikke et nummer"
 
-#: ../roundup/hyperdb.py:448
+#: ../roundup/hyperdb.py:460
 #, fuzzy, python-format
 msgid "property %(property)s: %(value)r is not an integer"
 msgstr "egenskap %s: %r er ikke et nummer"
 
-#: ../roundup/hyperdb.py:470
+#: ../roundup/hyperdb.py:482
 #, python-format
 msgid "\"%s\" not a node designator"
 msgstr "\"%s\" ikke en node-benevnelse"
 
-#: ../roundup/hyperdb.py:1499 ../roundup/hyperdb.py:1507
-#: ../roundup/hyperdb.py:1499:1507
+#: ../roundup/hyperdb.py:1515 ../roundup/hyperdb.py:1523
+#: ../roundup/hyperdb.py:1515:1523
 #, python-format
 msgid "Not a property name: %s"
 msgstr "Ikke et navn pÃ¥ egenskap: %s"
 
-#: ../roundup/hyperdb.py:2038
+#: ../roundup/hyperdb.py:2054
 #, fuzzy, python-format
 msgid "property %(property)s: %(value)r is not a %(classname)s."
 msgstr "egenskapen \"%(propname)s\": \"%(value)s\" er ikke i listen nÃ¥"
 
-#: ../roundup/hyperdb.py:2044
+#: ../roundup/hyperdb.py:2060
 #, python-format
 msgid "you may only enter ID values for property %s"
 msgstr "du kan bare oppgi ID-verdier for egenskap %s"
 
-#: ../roundup/hyperdb.py:2079
+#: ../roundup/hyperdb.py:2095
 #, fuzzy, python-format
 msgid "%(property)r is not a property of %(classname)s"
 msgstr "%r er ikke en egenskap ved %s"
@@ -2990,60 +2996,60 @@ msgid ""
 "are: %(stack)s"
 msgstr ""
 
-#: ../roundup/pygettext.py:401
+#: ../roundup/pygettext.py:400
 #, python-format
 msgid "*** %(file)s:%(lineno)s: Seen unexpected token \"%(token)s\""
 msgstr ""
 
-#: ../roundup/pygettext.py:457
+#: ../roundup/pygettext.py:456
 #, python-format
 msgid "# File: %(filename)s, line: %(lineno)d"
 msgstr ""
 
-#: ../roundup/pygettext.py:464
+#: ../roundup/pygettext.py:463
 #, python-format
 msgid " %(filename)s:%(lineno)d"
 msgstr ""
 
-#: ../roundup/pygettext.py:540
+#: ../roundup/pygettext.py:539
 #, fuzzy, python-format
 msgid "Invalid value for --style: %s"
 msgstr "Ugylig login"
 
-#: ../roundup/pygettext.py:548
+#: ../roundup/pygettext.py:547
 #, python-format
 msgid "pygettext.py (xgettext for Python) %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:554
+#: ../roundup/pygettext.py:553
 #, python-format
 msgid "--width argument must be an integer: %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:582
+#: ../roundup/pygettext.py:581
 #, python-format
 msgid "Can't read --exclude-file: %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:601
+#: ../roundup/pygettext.py:600
 msgid "Reading standard input"
 msgstr ""
 
-#: ../roundup/pygettext.py:606
+#: ../roundup/pygettext.py:605
 #, python-format
 msgid "Working on %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:640
+#: ../roundup/pygettext.py:639
 msgid "a unicode string"
 msgstr ""
 
-#: ../roundup/pygettext.py:642
+#: ../roundup/pygettext.py:641
 #, python-format
 msgid "*** Seen unexpected token \"%(token)s\""
 msgstr ""
 
-#: ../roundup/pygettext.py:643
+#: ../roundup/pygettext.py:642
 msgid "morethanonestring"
 msgstr ""
 
@@ -3163,33 +3169,33 @@ msgstr "opprettelse"
 msgid "creator"
 msgstr "opprettet av"
 
-#: ../roundup/roundupdb.py:426
+#: ../roundup/roundupdb.py:447
 #, python-format
 msgid "No key for \"%(adr)s\" in keyring"
 msgstr ""
 
-#: ../roundup/roundupdb.py:504
+#: ../roundup/roundupdb.py:525
 #, python-format
 msgid "New submission from %(authname)s%(authaddr)s:"
 msgstr "Ny sak fra %(authname)s%(authaddr)s:"
 
-#: ../roundup/roundupdb.py:507
+#: ../roundup/roundupdb.py:528
 #, python-format
 msgid "%(authname)s%(authaddr)s added the comment:"
 msgstr "%(authname)s%(authaddr)s la inn kommentaren:"
 
-#: ../roundup/roundupdb.py:510
+#: ../roundup/roundupdb.py:531
 #, python-format
 msgid "Change by %(authname)s%(authaddr)s:"
 msgstr "Endret av %(authname)s%(authaddr)s:"
 
-#: ../roundup/roundupdb.py:529
+#: ../roundup/roundupdb.py:550
 #, python-format
 msgid "File '%(filename)s' not attached - you can download it from %(link)s."
 msgstr ""
 "Filen '%(filename)s' er ikke vedlagt - du kan laste den ned fra %(link)s."
 
-#: ../roundup/roundupdb.py:904
+#: ../roundup/roundupdb.py:925
 #, python-format
 msgid ""
 "\n"
@@ -3299,59 +3305,59 @@ msgstr ""
 "<html><head><title>Roundup saksliste</title></head>\n"
 "<body><h1>Roundup saksliste</h1><ol>\n"
 
-#: ../roundup/scripts/roundup_server.py:598
+#: ../roundup/scripts/roundup_server.py:602
 #, fuzzy, python-format
 msgid "Error: %(type)s: %(value)s"
 msgstr "%(key)s: %(value)s"
 
-#: ../roundup/scripts/roundup_server.py:610
+#: ../roundup/scripts/roundup_server.py:614
 msgid "WARNING: ignoring \"-g\" argument, not root"
 msgstr "ADVARSEL: ignorerer \"-g\" argument, ikke root"
 
-#: ../roundup/scripts/roundup_server.py:616
+#: ../roundup/scripts/roundup_server.py:620
 msgid "Can't change groups - no grp module"
 msgstr "Kan ikke skifte gruppe, ingen grp modul"
 
-#: ../roundup/scripts/roundup_server.py:625
+#: ../roundup/scripts/roundup_server.py:629
 #, python-format
 msgid "Group %(group)s doesn't exist"
 msgstr "Gruppe %(group)s finnes ikke"
 
-#: ../roundup/scripts/roundup_server.py:637
+#: ../roundup/scripts/roundup_server.py:641
 msgid "Can't run as root!"
 msgstr "Kan ikke kjÃ¸re som root"
 
-#: ../roundup/scripts/roundup_server.py:640
+#: ../roundup/scripts/roundup_server.py:644
 msgid "WARNING: ignoring \"-u\" argument, not root"
 msgstr "ADVARSEL: ignorerer \"-u\" argument, ikke root"
 
-#: ../roundup/scripts/roundup_server.py:646
+#: ../roundup/scripts/roundup_server.py:650
 msgid "Can't change users - no pwd module"
 msgstr "Kan ikke skifte bruker , ingen pwd modul"
 
-#: ../roundup/scripts/roundup_server.py:655
+#: ../roundup/scripts/roundup_server.py:659
 #, python-format
 msgid "User %(user)s doesn't exist"
 msgstr "Bruker %(user)s finnes ikke"
 
-#: ../roundup/scripts/roundup_server.py:867
+#: ../roundup/scripts/roundup_server.py:871
 #, python-format
 msgid "Multiprocess mode \"%s\" is not available, switching to single-process"
 msgstr ""
 "Multiprosess modus  \"%s\" ikke tilgjengelig, fortsetter som enkeltprosess"
 
-#: ../roundup/scripts/roundup_server.py:895
+#: ../roundup/scripts/roundup_server.py:899
 #, python-format
 msgid "Unable to bind to port %s, port already in use."
 msgstr "Ikke mulig Ã¥ binde til port %s, porten er allerede i bruk."
 
-#: ../roundup/scripts/roundup_server.py:899
+#: ../roundup/scripts/roundup_server.py:903
 #, fuzzy, python-format
 msgid ""
 "Unable to bind to port %(port)s, access not allowed, errno: %(errno)s %(msg)s"
 msgstr "Ikke mulig Ã¥ binde til port %s, porten er allerede i bruk."
 
-#: ../roundup/scripts/roundup_server.py:978
+#: ../roundup/scripts/roundup_server.py:982
 msgid ""
 " -c <Command>  Windows Service options.\n"
 "               If you want to run the server as a Windows Service, you\n"
@@ -3368,7 +3374,7 @@ msgstr ""
 "               Skriv \"roundup-server -c help\" for Ã¥ vise Windows Services\n"
 "               informasjon."
 
-#: ../roundup/scripts/roundup_server.py:985
+#: ../roundup/scripts/roundup_server.py:989
 #, fuzzy
 msgid ""
 " -u <UID>      runs the Roundup web server as this UID\n"
@@ -3384,7 +3390,7 @@ msgstr ""
 "               serverens PID til filen indikert av PIDfile.\n"
 "               -l optsjonen *mÃ¥* brukes hvis -d brukes."
 
-#: ../roundup/scripts/roundup_server.py:993
+#: ../roundup/scripts/roundup_server.py:997
 #, fuzzy, python-format
 msgid ""
 "\n"
@@ -3512,21 +3518,25 @@ msgstr ""
 "   Pass pÃ¥ at de ikke inneholder url-utrygge tegn som mellomrom, for de kan "
 "forvirre IE.\n"
 
-#: ../roundup/scripts/roundup_server.py:1173
+#: ../roundup/scripts/roundup_server.py:1177
 msgid "Instances must be name=home"
 msgstr "Instanser mÃ¥ vÃ¦re navn=home"
 
-#: ../roundup/scripts/roundup_server.py:1187
+#: ../roundup/scripts/roundup_server.py:1191
 #, python-format
 msgid "Configuration saved to %s"
 msgstr "Konfigurasjon lagret til %s"
 
-#: ../roundup/scripts/roundup_server.py:1205
+#: ../roundup/scripts/roundup_server.py:1206
+msgid "If you specify a PID file you must use -l or -L."
+msgstr ""
+
+#: ../roundup/scripts/roundup_server.py:1212
 msgid "Sorry, you can't run the server as a daemon on this Operating System"
 msgstr ""
 "Beklager, du kan ikke kjÃ¸re servern som daemon under dette operativsystemet"
 
-#: ../roundup/scripts/roundup_server.py:1225
+#: ../roundup/scripts/roundup_server.py:1232
 #, python-format
 msgid "Roundup server started on %(HOST)s:%(PORT)s"
 msgstr "Roundup server startet pÃ¥ %(HOST)s:%(PORT)s"
@@ -4803,46 +4813,46 @@ msgstr "Roundup dok"
 msgid "clear this message"
 msgstr "klarer denne meldingen"
 
-#: ../share/roundup/templates/classic/html/page.html:257
-#: ../share/roundup/templates/classic/html/page.html:270
-#: ../share/roundup/templates/classic/html/page.html:288
-#: ../share/roundup/templates/classic/html/page.html:302
-#: ../share/roundup/templates/devel/html/page.html:316
-#: ../share/roundup/templates/devel/html/page.html:329
-#: ../share/roundup/templates/devel/html/page.html:347
-#: ../share/roundup/templates/devel/html/page.html:361
-#: ../share/roundup/templates/minimal/html/page.html:239
-#: ../share/roundup/templates/minimal/html/page.html:254
-#: ../share/roundup/templates/minimal/html/page.html:268
-#: ../share/roundup/templates/responsive/html/page.html:331
-#: ../share/roundup/templates/responsive/html/page.html:344
-#: ../share/roundup/templates/responsive/html/page.html:362
-#: ../share/roundup/templates/responsive/html/page.html:376
-msgid "don't care"
-msgstr "valgfritt"
-
-#: ../share/roundup/templates/classic/html/page.html:259
-#: ../share/roundup/templates/classic/html/page.html:272
-#: ../share/roundup/templates/classic/html/page.html:290
+#: ../share/roundup/templates/classic/html/page.html:258
+#: ../share/roundup/templates/classic/html/page.html:271
+#: ../share/roundup/templates/classic/html/page.html:289
 #: ../share/roundup/templates/classic/html/page.html:303
-#: ../share/roundup/templates/devel/html/page.html:318
-#: ../share/roundup/templates/devel/html/page.html:331
-#: ../share/roundup/templates/devel/html/page.html:349
+#: ../share/roundup/templates/devel/html/page.html:317
+#: ../share/roundup/templates/devel/html/page.html:330
+#: ../share/roundup/templates/devel/html/page.html:348
 #: ../share/roundup/templates/devel/html/page.html:362
-#: ../share/roundup/templates/minimal/html/page.html:241
-#: ../share/roundup/templates/minimal/html/page.html:256
+#: ../share/roundup/templates/minimal/html/page.html:240
+#: ../share/roundup/templates/minimal/html/page.html:255
 #: ../share/roundup/templates/minimal/html/page.html:269
-#: ../share/roundup/templates/responsive/html/page.html:333
-#: ../share/roundup/templates/responsive/html/page.html:346
-#: ../share/roundup/templates/responsive/html/page.html:364
+#: ../share/roundup/templates/responsive/html/page.html:332
+#: ../share/roundup/templates/responsive/html/page.html:345
+#: ../share/roundup/templates/responsive/html/page.html:363
 #: ../share/roundup/templates/responsive/html/page.html:377
+msgid "don't care"
+msgstr "valgfritt"
+
+#: ../share/roundup/templates/classic/html/page.html:260
+#: ../share/roundup/templates/classic/html/page.html:273
+#: ../share/roundup/templates/classic/html/page.html:291
+#: ../share/roundup/templates/classic/html/page.html:304
+#: ../share/roundup/templates/devel/html/page.html:319
+#: ../share/roundup/templates/devel/html/page.html:332
+#: ../share/roundup/templates/devel/html/page.html:350
+#: ../share/roundup/templates/devel/html/page.html:363
+#: ../share/roundup/templates/minimal/html/page.html:242
+#: ../share/roundup/templates/minimal/html/page.html:257
+#: ../share/roundup/templates/minimal/html/page.html:270
+#: ../share/roundup/templates/responsive/html/page.html:334
+#: ../share/roundup/templates/responsive/html/page.html:347
+#: ../share/roundup/templates/responsive/html/page.html:365
+#: ../share/roundup/templates/responsive/html/page.html:378
 msgid "------------"
 msgstr "------------"
 
-#: ../share/roundup/templates/classic/html/page.html:335
-#: ../share/roundup/templates/devel/html/page.html:390
-#: ../share/roundup/templates/minimal/html/page.html:297
-#: ../share/roundup/templates/responsive/html/page.html:405
+#: ../share/roundup/templates/classic/html/page.html:336
+#: ../share/roundup/templates/devel/html/page.html:391
+#: ../share/roundup/templates/minimal/html/page.html:298
+#: ../share/roundup/templates/responsive/html/page.html:406
 msgid "no value"
 msgstr "ingen verdi"
 
diff --git a/locale/roundup.pot b/locale/roundup.pot
index 9307abae7..fd2af050f 100644
--- a/locale/roundup.pot
+++ b/locale/roundup.pot
@@ -6,9 +6,9 @@
 #, fuzzy
 msgid ""
 msgstr ""
-"Project-Id-Version: Roundup 2.5.0\n"
+"Project-Id-Version: Roundup 2.5.0b1\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
-"POT-Creation-Date: 2025-01-12 20:17-0500\n"
+"POT-Creation-Date: 2025-06-11 16:53-0400\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -27,19 +27,19 @@ msgstr ""
 msgid "You may not retire the admin or anonymous user"
 msgstr ""
 
-#: ../roundup/admin.py:131
+#: ../roundup/admin.py:132
 msgid ""
 "Have 'display designator[,designator*]' show header inside\n"
 "      []'s before items. Includes retired/active status.\n"
 msgstr ""
 
-#: ../roundup/admin.py:135
+#: ../roundup/admin.py:136
 msgid ""
 "Have 'display designator' and 'specification class' show\n"
 "      protected fields: creator, id etc.\n"
 msgstr ""
 
-#: ../roundup/admin.py:139
+#: ../roundup/admin.py:140
 msgid ""
 "Controls history options. It is a bitstring where setting\n"
 "      the bit disables the feature. A value of 0 (default)\n"
@@ -50,57 +50,57 @@ msgid ""
 "      history.\n"
 msgstr ""
 
-#: ../roundup/admin.py:148
+#: ../roundup/admin.py:149
 msgid ""
 "Set the number of lines of history to keep for this session.\n"
 "      -1 is infinite.\n"
 msgstr ""
 
-#: ../roundup/admin.py:152
+#: ../roundup/admin.py:153
 msgid "Set indexer to use when running 'reindex' NYI\n"
 msgstr ""
 
-#: ../roundup/admin.py:155
+#: ../roundup/admin.py:156
 msgid "Force reopening of tracker when running each command.\n"
 msgstr ""
 
-#: ../roundup/admin.py:158
+#: ../roundup/admin.py:159
 msgid ""
 "set the number of rows imported before a database commit is\n"
 "      done. Used only for imports on PostgreSQL.\n"
 msgstr ""
 
-#: ../roundup/admin.py:160
+#: ../roundup/admin.py:161
 msgid "Show retired items in table, list etc. One of 'no', 'only', 'both'\n"
 msgstr ""
 
-#: ../roundup/admin.py:162
+#: ../roundup/admin.py:163
 msgid "internal mapping for show_retired.\n"
 msgstr ""
 
-#: ../roundup/admin.py:163
+#: ../roundup/admin.py:164
 msgid "Enable verbose output: tracing, descriptions...\n"
 msgstr ""
 
-#: ../roundup/admin.py:175 ../roundup/admin.py:1188 ../roundup/admin.py:1858
-#: ../roundup/admin.py:1890 ../roundup/admin.py:175:1188 :1858:1890
+#: ../roundup/admin.py:176 ../roundup/admin.py:1199 ../roundup/admin.py:1869
+#: ../roundup/admin.py:1901 ../roundup/admin.py:176:1199 :1869:1901
 #, python-format
 msgid "no such class \"%(classname)s\""
 msgstr ""
 
-#: ../roundup/admin.py:188
+#: ../roundup/admin.py:189
 #, python-format
 msgid "argument \"%(arg)s\" not propname=value"
 msgstr ""
 
-#: ../roundup/admin.py:201
+#: ../roundup/admin.py:202
 #, python-format
 msgid ""
 "Problem: %(message)s\n"
 "\n"
 msgstr ""
 
-#: ../roundup/admin.py:202
+#: ../roundup/admin.py:203
 #, python-format
 msgid ""
 "%(message)sUsage: roundup-admin [options] [<command> <arguments>]\n"
@@ -131,17 +131,17 @@ msgid ""
 " roundup-admin help all                   -- all available help\n"
 msgstr ""
 
-#: ../roundup/admin.py:231
+#: ../roundup/admin.py:232
 msgid "Commands: "
 msgstr ""
 
-#: ../roundup/admin.py:238
+#: ../roundup/admin.py:249
 msgid ""
 "Commands may be abbreviated as long as the abbreviation\n"
 "matches only one command, e.g. l == li == lis == list."
 msgstr ""
 
-#: ../roundup/admin.py:270
+#: ../roundup/admin.py:281
 msgid ""
 "\n"
 "All commands (except help) require a tracker specifier. This is just\n"
@@ -207,21 +207,21 @@ msgid ""
 "Command help:\n"
 msgstr ""
 
-#: ../roundup/admin.py:334
+#: ../roundup/admin.py:345
 #, python-format
 msgid "%s:"
 msgstr ""
 
-#: ../roundup/admin.py:439 ../roundup/admin.py:1415 ../roundup/admin.py:439:1415
+#: ../roundup/admin.py:450 ../roundup/admin.py:1426 ../roundup/admin.py:450:1426
 msgid "Templates:"
 msgstr ""
 
-#: ../roundup/admin.py:442 ../roundup/admin.py:1425 ../roundup/admin.py:442:1425
+#: ../roundup/admin.py:453 ../roundup/admin.py:1436 ../roundup/admin.py:453:1436
 msgid "Back ends:"
 msgstr ""
 
 #. noqa: ARG002
-#: ../roundup/admin.py:459
+#: ../roundup/admin.py:470
 msgid ""
 "Usage: commit\n"
 "        Commit changes made to the database during an interactive session.\n"
@@ -235,7 +235,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:474
+#: ../roundup/admin.py:485
 msgid ""
 "Usage: create classname property=value ...\n"
 "        Create a new entry of a given class.\n"
@@ -247,42 +247,42 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:482 ../roundup/admin.py:555 ../roundup/admin.py:606
-#: ../roundup/admin.py:733 ../roundup/admin.py:806 ../roundup/admin.py:851
-#: ../roundup/admin.py:902 ../roundup/admin.py:999 ../roundup/admin.py:1216
-#: ../roundup/admin.py:1388 ../roundup/admin.py:1516 ../roundup/admin.py:1599
-#: ../roundup/admin.py:1725 ../roundup/admin.py:1848 ../roundup/admin.py:1880
-#: ../roundup/admin.py:1996 ../roundup/admin.py:2050 ../roundup/admin.py:2098
-#: ../roundup/admin.py:482:555 :1216:1388 :1516 :1599:1725 :1848:1880 :1996:2050
-#: :2098 :606:733 :806:851 :902:999
+#: ../roundup/admin.py:493 ../roundup/admin.py:566 ../roundup/admin.py:617
+#: ../roundup/admin.py:744 ../roundup/admin.py:817 ../roundup/admin.py:862
+#: ../roundup/admin.py:913 ../roundup/admin.py:1010 ../roundup/admin.py:1227
+#: ../roundup/admin.py:1399 ../roundup/admin.py:1527 ../roundup/admin.py:1610
+#: ../roundup/admin.py:1736 ../roundup/admin.py:1859 ../roundup/admin.py:1891
+#: ../roundup/admin.py:2007 ../roundup/admin.py:2061 ../roundup/admin.py:2109
+#: ../roundup/admin.py:493:566 :1227:1399 :1527:1610 :1736:1859 :1891:2007
+#: :2061:2109 :617:744 :817:862 :913:1010
 msgid "Not enough arguments supplied"
 msgstr ""
 
-#: ../roundup/admin.py:502
+#: ../roundup/admin.py:513
 #, python-format
 msgid "%(propname)s (Password): "
 msgstr ""
 
-#: ../roundup/admin.py:505
+#: ../roundup/admin.py:516
 #, python-format
 msgid "   %(propname)s (Again): "
 msgstr ""
 
-#: ../roundup/admin.py:509
+#: ../roundup/admin.py:520
 msgid "Sorry, try again..."
 msgstr ""
 
-#: ../roundup/admin.py:514
+#: ../roundup/admin.py:525
 #, python-format
 msgid "%(propname)s (%(proptype)s): "
 msgstr ""
 
-#: ../roundup/admin.py:533
+#: ../roundup/admin.py:544
 #, python-format
 msgid "you must provide the \"%(propname)s\" property."
 msgstr ""
 
-#: ../roundup/admin.py:545
+#: ../roundup/admin.py:556
 msgid ""
 "Usage: display designator[,designator]*\n"
 "        Show the property values for the given node(s).\n"
@@ -295,13 +295,13 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:586
+#: ../roundup/admin.py:597
 #, python-format
 msgid "%(protected)s%(key)s: %(value)s"
 msgstr ""
 
 #. grab the directory to export to
-#: ../roundup/admin.py:589
+#: ../roundup/admin.py:600
 msgid ""
 "Usage: export [[-]class[,class]] export_dir\n"
 "        Export the database and file content.\n"
@@ -320,7 +320,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:704
+#: ../roundup/admin.py:715
 msgid ""
 "Usage: exporttables [[-]class[,class]] export_dir\n"
 "        Export only the database to files, no file content.\n"
@@ -340,7 +340,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:723
+#: ../roundup/admin.py:734
 msgid ""
 "Usage: filter classname propname=value ...\n"
 "        Find the nodes of the given class with a given property value.\n"
@@ -353,19 +353,19 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:764
+#: ../roundup/admin.py:775
 #, python-format
 msgid "Class %(curclassname)s has no property %(pn)s in %(propname)s."
 msgstr ""
 
-#: ../roundup/admin.py:791 ../roundup/admin.py:840 ../roundup/admin.py:1536
-#: ../roundup/admin.py:1549 ../roundup/admin.py:2120 ../roundup/admin.py:791:840
-#: :1536:1549 :2120
+#: ../roundup/admin.py:802 ../roundup/admin.py:851 ../roundup/admin.py:1547
+#: ../roundup/admin.py:1560 ../roundup/admin.py:2131 ../roundup/admin.py:802:851
+#: :1547:1560 :2131
 #, python-format
 msgid "%(classname)s has no property \"%(propname)s\""
 msgstr ""
 
-#: ../roundup/admin.py:798
+#: ../roundup/admin.py:809
 msgid ""
 "Usage: find classname propname=value ...\n"
 "        Find the nodes of the given class with a given link property value.\n"
@@ -376,14 +376,14 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:847
+#: ../roundup/admin.py:858
 msgid ""
 "Usage: genconfig filename\n"
 "        Create a new tracker config file with default values in filename.\n"
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:864
+#: ../roundup/admin.py:875
 #, python-format
 msgid ""
 "Changing option\n"
@@ -391,20 +391,20 @@ msgid ""
 "from old default of %(old_number)s to new default of %(new_number)s."
 msgstr ""
 
-#: ../roundup/admin.py:875
+#: ../roundup/admin.py:886
 #, python-format
 msgid ""
 "Update 'password_pbkdf2_default_rounds' to a number equal to or larger\n"
 "  than %s.\n"
 msgstr ""
 
-#: ../roundup/admin.py:882
+#: ../roundup/admin.py:893
 msgid ""
 "Check the rdbms mysql_* settings. Your charset and collations may need\n"
 "  to be changed. See upgrading instructions.\n"
 msgstr ""
 
-#: ../roundup/admin.py:892
+#: ../roundup/admin.py:903
 msgid ""
 "Usage: get property designator[,designator]*\n"
 "        Get the given property of one or more designator(s).\n"
@@ -417,23 +417,23 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:925
+#: ../roundup/admin.py:936
 #, python-format
 msgid "property %s is not of type Multilink or Link so -d flag does not apply."
 msgstr ""
 
-#: ../roundup/admin.py:942 ../roundup/admin.py:1190 ../roundup/admin.py:1864
-#: ../roundup/admin.py:1892 ../roundup/admin.py:942:1190 :1864:1892
+#: ../roundup/admin.py:953 ../roundup/admin.py:1201 ../roundup/admin.py:1875
+#: ../roundup/admin.py:1903 ../roundup/admin.py:953:1201 :1875:1903
 #, python-format
 msgid "no such %(classname)s node \"%(nodeid)s\""
 msgstr ""
 
-#: ../roundup/admin.py:945
+#: ../roundup/admin.py:956
 #, python-format
 msgid "no such %(classname)s property \"%(propname)s\""
 msgstr ""
 
-#: ../roundup/admin.py:950
+#: ../roundup/admin.py:961
 msgid ""
 "Usage: help topic\n"
 "        Give help about topic.\n"
@@ -445,12 +445,12 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:969
+#: ../roundup/admin.py:980
 #, python-format
 msgid "Sorry, no help for \"%(topic)s\""
 msgstr ""
 
-#: ../roundup/admin.py:986
+#: ../roundup/admin.py:997
 msgid ""
 "Usage: history designator [skipquiet] [raw]\n"
 "        Show the history entries of a designator.\n"
@@ -465,26 +465,26 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1011
+#: ../roundup/admin.py:1022
 #, python-format
 msgid "Unexpected argument(s): %s. Expected 'skipquiet' or 'raw'."
 msgstr ""
 
-#: ../roundup/admin.py:1062
+#: ../roundup/admin.py:1073
 msgid "removed"
 msgstr ""
 
-#: ../roundup/admin.py:1064
+#: ../roundup/admin.py:1075
 msgid "added"
 msgstr ""
 
-#: ../roundup/admin.py:1066
+#: ../roundup/admin.py:1077
 #, python-format
 msgid "Unknown history set operation '%s'. Expected +/-."
 msgstr ""
 
 #. .Hint added issue23 to superseder
-#: ../roundup/admin.py:1091
+#: ../roundup/admin.py:1102
 #, python-format
 msgid "added %(class)s%(item_id)s to %(propname)s"
 msgstr ""
@@ -492,29 +492,29 @@ msgstr ""
 #. .Hint read as: assignedto was admin(1)
 #. where assignedto is the property
 #. admin is the key name for value 1
-#: ../roundup/admin.py:1112
+#: ../roundup/admin.py:1123
 #, python-format
 msgid "%(prop)s was %(name)s(%(value)s)"
 msgstr ""
 
-#: ../roundup/admin.py:1118 ../roundup/admin.py:1147
-#: ../roundup/admin.py:1118:1147
+#: ../roundup/admin.py:1129 ../roundup/admin.py:1158
+#: ../roundup/admin.py:1129:1158
 #, python-format
 msgid "%(prop)s was %(value)s"
 msgstr ""
 
-#: ../roundup/admin.py:1137
+#: ../roundup/admin.py:1148
 #, python-format
 msgid "%(prop)s was [%(value_list)s]"
 msgstr ""
 
 #. .Hint modified nosy: added demo(3)
-#: ../roundup/admin.py:1144
+#: ../roundup/admin.py:1155
 #, python-format
 msgid "modified %(prop)s: %(how)s"
 msgstr ""
 
-#: ../roundup/admin.py:1195
+#: ../roundup/admin.py:1206
 msgid ""
 "Usage: import import_dir\n"
 "        Import a database and file contents from the directory.\n"
@@ -538,7 +538,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1306
+#: ../roundup/admin.py:1317
 msgid ""
 "Usage: importtables export_dir\n"
 "        This imports the database tables exported using exporttables.\n"
@@ -548,7 +548,7 @@ msgid ""
 msgstr ""
 
 #. password
-#: ../roundup/admin.py:1314
+#: ../roundup/admin.py:1325
 msgid ""
 "Usage: initialise [adminpw]\n"
 "        Initialise a new Roundup tracker.\n"
@@ -559,30 +559,30 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1328
+#: ../roundup/admin.py:1339
 msgid "Admin Password: "
 msgstr ""
 
-#: ../roundup/admin.py:1329
+#: ../roundup/admin.py:1340
 msgid "       Confirm: "
 msgstr ""
 
-#: ../roundup/admin.py:1333
+#: ../roundup/admin.py:1344
 msgid "Instance home does not exist"
 msgstr ""
 
-#: ../roundup/admin.py:1337
+#: ../roundup/admin.py:1348
 msgid "Instance has not been installed"
 msgstr ""
 
-#: ../roundup/admin.py:1345
+#: ../roundup/admin.py:1356
 msgid ""
 "WARNING: The database is already initialised!\n"
 "If you re-initialise it, you will lose all the data!\n"
 "Erase it? Y/N: "
 msgstr ""
 
-#: ../roundup/admin.py:1365
+#: ../roundup/admin.py:1376
 msgid ""
 "Usage: install [template [backend [key=val[,key=val]]]]\n"
 "        Install a new Roundup tracker.\n"
@@ -608,12 +608,12 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1394
+#: ../roundup/admin.py:1405
 #, python-format
 msgid "Instance home parent directory \"%(parent)s\" does not exist"
 msgstr ""
 
-#: ../roundup/admin.py:1403
+#: ../roundup/admin.py:1414
 #, python-format
 msgid ""
 "WARNING: There appears to be a tracker in \"%(tracker_home)s\"!\n"
@@ -621,20 +621,20 @@ msgid ""
 "Erase it? Y/N: "
 msgstr ""
 
-#: ../roundup/admin.py:1416
+#: ../roundup/admin.py:1427
 msgid "Select template"
 msgstr ""
 
-#: ../roundup/admin.py:1426
+#: ../roundup/admin.py:1437
 msgid "Select backend"
 msgstr ""
 
-#: ../roundup/admin.py:1437
+#: ../roundup/admin.py:1448
 #, python-format
 msgid "Error in configuration settings: \"%s\""
 msgstr ""
 
-#: ../roundup/admin.py:1470
+#: ../roundup/admin.py:1481
 #, python-format
 msgid ""
 "\n"
@@ -643,11 +643,11 @@ msgid ""
 "   %(config_file)s"
 msgstr ""
 
-#: ../roundup/admin.py:1480
+#: ../roundup/admin.py:1491
 msgid " ... at a minimum, you must set following options:"
 msgstr ""
 
-#: ../roundup/admin.py:1485
+#: ../roundup/admin.py:1496
 #, python-format
 msgid ""
 "\n"
@@ -663,7 +663,7 @@ msgid ""
 "---------------------------------------------------------------------------\n"
 msgstr ""
 
-#: ../roundup/admin.py:1501
+#: ../roundup/admin.py:1512
 msgid ""
 "Usage: list classname [property]\n"
 "        List the instances of a class.\n"
@@ -679,17 +679,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1514
+#: ../roundup/admin.py:1525
 msgid "Too many arguments supplied"
 msgstr ""
 
-#: ../roundup/admin.py:1547
+#: ../roundup/admin.py:1558
 #, python-format
 msgid "%(nodeid)4s: %(value)s"
 msgstr ""
 
 #. noqa: ARG002  - args unused
-#: ../roundup/admin.py:1554
+#: ../roundup/admin.py:1565
 msgid ""
 "Usage: migrate\n"
 "        Update a tracker's database to be compatible with the Roundup\n"
@@ -712,17 +712,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1574
+#: ../roundup/admin.py:1585
 #, python-format
 msgid "Tracker updated to schema version %s."
 msgstr ""
 
-#: ../roundup/admin.py:1578
+#: ../roundup/admin.py:1589
 #, python-format
 msgid "No migration action required. At schema version %s."
 msgstr ""
 
-#: ../roundup/admin.py:1583
+#: ../roundup/admin.py:1594
 msgid ""
 "Usage: pack period | date\n"
 "        Remove journal entries older than the date/period.\n"
@@ -742,11 +742,11 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1609
+#: ../roundup/admin.py:1620
 msgid "Invalid format"
 msgstr ""
 
-#: ../roundup/admin.py:1620
+#: ../roundup/admin.py:1631
 msgid ""
 "Usage: perftest [mode] [arguments]*\n"
 "        Time operations in Roundup.\n"
@@ -764,25 +764,25 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1657
+#: ../roundup/admin.py:1668
 msgid "Invalid 'rounds'. Must be larger than 999."
 msgstr ""
 
-#: ../roundup/admin.py:1661
+#: ../roundup/admin.py:1672
 #, python-format
 msgid "Invalid 'rounds'. It must be an integer not: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1688
+#: ../roundup/admin.py:1699
 msgid "scheme does not support rounds."
 msgstr ""
 
-#: ../roundup/admin.py:1691
+#: ../roundup/admin.py:1702
 #, python-format
 msgid "Hash time: %(time)0.9f seconds, scheme: %(scheme)s, rounds: %(rounds)s"
 msgstr ""
 
-#: ../roundup/admin.py:1697
+#: ../roundup/admin.py:1708
 msgid ""
 "Usage: pragma setting=value | 'list'\n"
 "        Set internal admin settings to a value.\n"
@@ -811,49 +811,49 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1732
+#: ../roundup/admin.py:1743
 #, python-format
 msgid "Argument must be setting=value, was given: %s."
 msgstr ""
 
-#: ../roundup/admin.py:1735
+#: ../roundup/admin.py:1746
 msgid "Current settings and values (NYI - not yet implemented):"
 msgstr ""
 
-#: ../roundup/admin.py:1746
+#: ../roundup/admin.py:1757
 msgid ""
 "      Help for this pragma is missing. Please report it to the Roundup "
 "project.\n"
 msgstr ""
 
-#: ../roundup/admin.py:1752
+#: ../roundup/admin.py:1763
 #, python-format
 msgid "Unknown setting %s. Try \"pragma list\"."
 msgstr ""
 
-#: ../roundup/admin.py:1762
+#: ../roundup/admin.py:1773
 #, python-format
 msgid "Incorrect value for boolean setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1769
+#: ../roundup/admin.py:1780
 #, python-format
 msgid "Incorrect value for integer setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1776
+#: ../roundup/admin.py:1787
 #, python-format
 msgid ""
 "Incorrect value for setting %(setting)s: %(value)s. Should be no, both, or "
 "only."
 msgstr ""
 
-#: ../roundup/admin.py:1786
+#: ../roundup/admin.py:1797
 #, python-format
 msgid "Internal error: pragma can not handle values of type: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1795
+#: ../roundup/admin.py:1806
 msgid ""
 "Usage: reindex [classname|classname:#-#|designator]*\n"
 "        Re-generate a tracker's search indexes.\n"
@@ -870,17 +870,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1817
+#: ../roundup/admin.py:1828
 #, python-format
 msgid "no such item \"%(designator)s\""
 msgstr ""
 
-#: ../roundup/admin.py:1827
+#: ../roundup/admin.py:1838
 #, python-format
 msgid "no such item \"%(class)s%(id)s\""
 msgstr ""
 
-#: ../roundup/admin.py:1839
+#: ../roundup/admin.py:1850
 msgid ""
 "Usage: restore designator[,designator]*\n"
 "        Restore the retired node specified by designator.\n"
@@ -892,7 +892,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1870
+#: ../roundup/admin.py:1881
 msgid ""
 "Usage: retire designator[,designator]*\n"
 "        Retire the node specified by designator.\n"
@@ -906,7 +906,7 @@ msgid ""
 msgstr ""
 
 #. noqa: ARG002 - args unused
-#: ../roundup/admin.py:1898
+#: ../roundup/admin.py:1909
 msgid ""
 "Usage: rollback\n"
 "        Undo all changes that are pending commit to the database.\n"
@@ -918,7 +918,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1911
+#: ../roundup/admin.py:1922
 msgid ""
 "Usage: security [Role name]\n"
 "        Display the Permissions available to one or all Roles.\n"
@@ -931,46 +931,46 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1926
+#: ../roundup/admin.py:1937
 #, python-format
 msgid "No such Role \"%(role)s\"\n"
 msgstr ""
 
-#: ../roundup/admin.py:1932
+#: ../roundup/admin.py:1943
 #, python-format
 msgid "New Web users get the Roles \"%(role)s\"\n"
 msgstr ""
 
-#: ../roundup/admin.py:1935
+#: ../roundup/admin.py:1946
 #, python-format
 msgid "New Web users get the Role \"%(role)s\"\n"
 msgstr ""
 
-#: ../roundup/admin.py:1939
+#: ../roundup/admin.py:1950
 #, python-format
 msgid "New Email users get the Roles \"%(role)s\"\n"
 msgstr ""
 
-#: ../roundup/admin.py:1941
+#: ../roundup/admin.py:1952
 #, python-format
 msgid "New Email users get the Role \"%(role)s\"\n"
 msgstr ""
 
-#: ../roundup/admin.py:1944
+#: ../roundup/admin.py:1955
 #, python-format
 msgid "Role \"%(name)s\":\n"
 msgstr ""
 
-#: ../roundup/admin.py:1950
+#: ../roundup/admin.py:1961
 msgid " %(description)s (%(name)s for \"%(klass)s\""
 msgstr ""
 
-#: ../roundup/admin.py:1950
+#: ../roundup/admin.py:1961
 #, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\": %(properties)s only)\n"
 msgstr ""
 
-#: ../roundup/admin.py:1963
+#: ../roundup/admin.py:1974
 #, python-format
 msgid ""
 "\n"
@@ -978,17 +978,17 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/admin.py:1969
+#: ../roundup/admin.py:1980
 #, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\" only)\n"
 msgstr ""
 
-#: ../roundup/admin.py:1972
+#: ../roundup/admin.py:1983
 #, python-format
 msgid " %(description)s (%(name)s)\n"
 msgstr ""
 
-#: ../roundup/admin.py:1976
+#: ../roundup/admin.py:1987
 msgid ""
 "Usage: set items property=value [property=value ...]\n"
 "        Set the given properties of one or more items(s).\n"
@@ -1009,7 +1009,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2044
+#: ../roundup/admin.py:2055
 msgid ""
 "Usage: specification classname\n"
 "        Show the properties for a classname.\n"
@@ -1018,17 +1018,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2063
+#: ../roundup/admin.py:2074
 #, python-format
 msgid "%(key)s: %(value)s (key property)\n"
 msgstr ""
 
-#: ../roundup/admin.py:2066
+#: ../roundup/admin.py:2077
 #, python-format
 msgid "%(key)s: %(value)s\n"
 msgstr ""
 
-#: ../roundup/admin.py:2069
+#: ../roundup/admin.py:2080
 msgid ""
 "Usage: table classname [property[,property]*]\n"
 "        List the instances of a class in tabular form.\n"
@@ -1060,17 +1060,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2115
+#: ../roundup/admin.py:2126
 #, python-format
 msgid "\"%(spec)s\" not name:width"
 msgstr ""
 
-#: ../roundup/admin.py:2137
+#: ../roundup/admin.py:2148
 #, python-format
 msgid "\"%(spec)s\" does not have an integer width: \"%(width)s\""
 msgstr ""
 
-#: ../roundup/admin.py:2173
+#: ../roundup/admin.py:2184
 msgid ""
 "Usage: templates [trace_search]\n"
 "        List templates and their installed directories.\n"
@@ -1080,7 +1080,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2201
+#: ../roundup/admin.py:2212
 msgid ""
 "Usage: updateconfig <filename>\n"
 "        Merge existing tracker config with new settings.\n"
@@ -1090,90 +1090,90 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2210 ../roundup/cgi/actions.py:886
-#: ../roundup/cgi/actions.py:897 ../roundup/cgi/actions.py:1099
-#: ../roundup/cgi/actions.py:1113 ../roundup/cgi/actions.py:886:897 :1099:1113
+#: ../roundup/admin.py:2221 ../roundup/cgi/actions.py:891
+#: ../roundup/cgi/actions.py:902 ../roundup/cgi/actions.py:1104
+#: ../roundup/cgi/actions.py:1118 ../roundup/cgi/actions.py:891:902 :1104:1118
 #, python-format
 msgid "Error: %s"
 msgstr ""
 
-#: ../roundup/admin.py:2242
+#: ../roundup/admin.py:2253
 #, python-format
 msgid "Unknown command \"%(command)s\" (\"help commands\" for a list)"
 msgstr ""
 
-#: ../roundup/admin.py:2248
+#: ../roundup/admin.py:2259
 #, python-format
 msgid "Multiple commands match \"%(command)s\": %(list)s"
 msgstr ""
 
-#: ../roundup/admin.py:2263
+#: ../roundup/admin.py:2274
 msgid "Enter tracker home: "
 msgstr ""
 
-#: ../roundup/admin.py:2292 ../roundup/admin.py:2296
-#: ../roundup/admin.py:2292:2296
+#: ../roundup/admin.py:2303 ../roundup/admin.py:2307
+#: ../roundup/admin.py:2303:2307
 #, python-format
 msgid "Error: Couldn't open tracker: %(message)s"
 msgstr ""
 
-#: ../roundup/admin.py:2344
+#: ../roundup/admin.py:2355
 #, python-format
 msgid ""
 "Roundup %s ready for input.\n"
 "Type \"help\" for help."
 msgstr ""
 
-#: ../roundup/admin.py:2377
+#: ../roundup/admin.py:2388
 msgid "Note: command history and editing not available"
 msgstr ""
 
-#: ../roundup/admin.py:2383
+#: ../roundup/admin.py:2394
 msgid "exit..."
 msgstr ""
 
-#: ../roundup/admin.py:2396
+#: ../roundup/admin.py:2407
 msgid "There are unsaved changes. Commit them (y/N)? "
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:215
-#: ../roundup/backends/rdbms_common.py:928
+#: ../roundup/backends/back_anydbm.py:213
+#: ../roundup/backends/rdbms_common.py:926
 #, python-format
 msgid "Class \"%s\" already defined."
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:280 ../roundup/backends/sessions_dbm.py:61
+#: ../roundup/backends/back_anydbm.py:278 ../roundup/backends/sessions_dbm.py:61
 msgid "Couldn't identify database type"
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:314
+#: ../roundup/backends/back_anydbm.py:312
 #, python-format
 msgid ""
 "Couldn't open database - the required module '%s' (as dbm.gnu) is not "
 "available"
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:318
+#: ../roundup/backends/back_anydbm.py:316
 #, python-format
 msgid "Couldn't open database - the required module '%s' is not available"
 msgstr ""
 
 #: ../roundup/backends/back_anydbm.py:873 ../roundup/backends/back_anydbm.py:886
-#: ../roundup/backends/back_anydbm.py:1160
-#: ../roundup/backends/back_anydbm.py:1195
-#: ../roundup/backends/back_anydbm.py:1424
-#: ../roundup/backends/back_anydbm.py:1442
-#: ../roundup/backends/back_anydbm.py:1489
-#: ../roundup/backends/back_anydbm.py:2135
+#: ../roundup/backends/back_anydbm.py:1162
+#: ../roundup/backends/back_anydbm.py:1197
+#: ../roundup/backends/back_anydbm.py:1426
+#: ../roundup/backends/back_anydbm.py:1444
+#: ../roundup/backends/back_anydbm.py:1492
+#: ../roundup/backends/back_anydbm.py:2138
 #: ../roundup/backends/back_anydbm.py:873:886
-#: ../roundup/backends/rdbms_common.py:1720
-#: ../roundup/backends/rdbms_common.py:1967
-#: ../roundup/backends/rdbms_common.py:2206
-#: ../roundup/backends/rdbms_common.py:2226
-#: ../roundup/backends/rdbms_common.py:2279
-#: ../roundup/backends/rdbms_common.py:3254
-#: ../roundup/backends/rdbms_common.py:1720:1967 :1160:1195 :1424:1442 :1489
-#: :2135 :2206:2226 :2279:3254
+#: ../roundup/backends/rdbms_common.py:1721
+#: ../roundup/backends/rdbms_common.py:1972
+#: ../roundup/backends/rdbms_common.py:2211
+#: ../roundup/backends/rdbms_common.py:2231
+#: ../roundup/backends/rdbms_common.py:2293
+#: ../roundup/backends/rdbms_common.py:3268
+#: ../roundup/backends/rdbms_common.py:1721:1972 :1162:1197 :1426:1444 :1492
+#: :2138 :2211:2231 :2293:3268
 msgid "Database open read-only"
 msgstr ""
 
@@ -1199,45 +1199,50 @@ msgstr ""
 msgid "Unable to get lock after 10 retries on %s."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:632
+#: ../roundup/backends/rdbms_common.py:630
 #, python-format
 msgid "ALTER operation disallowed: %(old)r -> %(new)r."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:867
+#: ../roundup/backends/rdbms_common.py:865
 #, python-format
 msgid "CREATE operation disallowed: \"%s\"."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:884
+#: ../roundup/backends/rdbms_common.py:882
 #, python-format
 msgid "DROP operation disallowed: \"%s\"."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:1863
+#: ../roundup/backends/rdbms_common.py:1864
 msgid "create"
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:2038
+#: ../roundup/backends/rdbms_common.py:2043
 msgid "unlink"
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:2042
+#: ../roundup/backends/rdbms_common.py:2047
 msgid "link"
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:2187
+#: ../roundup/backends/rdbms_common.py:2192
 msgid "set"
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:2216
+#: ../roundup/backends/rdbms_common.py:2221
 msgid "retired"
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:2246
+#: ../roundup/backends/rdbms_common.py:2251
 msgid "restored"
 msgstr ""
 
+#: ../roundup/backends/rdbms_common.py:2265
+#, python-format
+msgid "class %(cls)s: %(value)r is not an id"
+msgstr ""
+
 #: ../roundup/backends/sessions_redis.py:78
 #: ../roundup/backends/sessions_redis.py:97
 #: ../roundup/backends/sessions_redis.py:78:97
@@ -1319,10 +1324,10 @@ msgid "\"%(input)s\" is not an ID (%(classname)s ID required)"
 msgstr ""
 
 #: ../roundup/cgi/actions.py:228 ../roundup/cgi/actions.py:266
-#: ../roundup/cgi/actions.py:493 ../roundup/cgi/actions.py:833
-#: ../roundup/cgi/actions.py:880 ../roundup/cgi/actions.py:1084
-#: ../roundup/cgi/actions.py:1246 ../roundup/cgi/actions.py:228:266 :1246
-#: :493:833 :880:1084
+#: ../roundup/cgi/actions.py:493 ../roundup/cgi/actions.py:838
+#: ../roundup/cgi/actions.py:885 ../roundup/cgi/actions.py:1089
+#: ../roundup/cgi/actions.py:1251 ../roundup/cgi/actions.py:228:266 :1251
+#: :493:838 :885:1089
 msgid "Invalid request"
 msgstr ""
 
@@ -1370,8 +1375,8 @@ msgstr ""
 msgid "Invalid integer: "
 msgstr ""
 
-#: ../roundup/cgi/actions.py:531 ../roundup/cgi/actions.py:735
-#: ../roundup/cgi/actions.py:531:735
+#: ../roundup/cgi/actions.py:531 ../roundup/cgi/actions.py:740
+#: ../roundup/cgi/actions.py:531:740
 #, python-format
 msgid "You do not have permission to create %(class)s"
 msgstr ""
@@ -1381,8 +1386,8 @@ msgstr ""
 msgid "Not enough values on line %(line)s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:556 ../roundup/cgi/actions.py:723
-#: ../roundup/cgi/actions.py:556:723
+#: ../roundup/cgi/actions.py:556 ../roundup/cgi/actions.py:728
+#: ../roundup/cgi/actions.py:556:728
 #, python-format
 msgid "You do not have permission to edit %(class)s"
 msgstr ""
@@ -1391,41 +1396,41 @@ msgstr ""
 msgid "Items edited OK"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:671
+#: ../roundup/cgi/actions.py:676
 #, python-format
 msgid "%(class)s %(id)s %(properties)s edited ok"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:689
+#: ../roundup/cgi/actions.py:694
 #, python-format
 msgid "%(class)s %(id)s created"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:817
+#: ../roundup/cgi/actions.py:822
 #, python-format
 msgid ""
 "Edit Error: someone else has edited this %(klass)s (%(props)s). View <a "
 "target=\"_blank\" href=\"%(klass)s%(id)s\">their changes</a> in a new window."
 msgstr ""
 
-#: ../roundup/cgi/actions.py:850
+#: ../roundup/cgi/actions.py:855
 #, python-format
 msgid "Edit Error: %s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:931
+#: ../roundup/cgi/actions.py:936
 msgid ""
 "Invalid One Time Key!\n"
 "(a Mozilla bug may cause this message to show up erroneously, please check "
 "your email)"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:972
+#: ../roundup/cgi/actions.py:977
 #, python-format
 msgid "Password reset for %s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:973
+#: ../roundup/cgi/actions.py:978
 #, python-format
 msgid ""
 "\n"
@@ -1434,29 +1439,29 @@ msgid ""
 "Your password is now: %(password)s\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:982
+#: ../roundup/cgi/actions.py:987
 #, python-format
 msgid "Password reset and email sent to %s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:991
+#: ../roundup/cgi/actions.py:996
 msgid "Unknown username"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:999
+#: ../roundup/cgi/actions.py:1004
 msgid "Unknown email address"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1004
+#: ../roundup/cgi/actions.py:1009
 msgid "You need to specify a username or address"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1015
+#: ../roundup/cgi/actions.py:1020
 #, python-format
 msgid "Confirm reset of password for %s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1016
+#: ../roundup/cgi/actions.py:1021
 #, python-format
 msgid ""
 "\n"
@@ -1470,31 +1475,31 @@ msgid ""
 "You should then receive another email with the new password.\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1029
+#: ../roundup/cgi/actions.py:1034
 #, python-format
 msgid "Email sent to primary notification address for %s."
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1031
+#: ../roundup/cgi/actions.py:1036
 #, python-format
 msgid "Email sent to %s."
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1046
+#: ../roundup/cgi/actions.py:1051
 msgid "You are now registered, welcome!"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1139
+#: ../roundup/cgi/actions.py:1144
 #, python-format
 msgid "Username '%s' is already used."
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1163
+#: ../roundup/cgi/actions.py:1168
 #, python-format
 msgid "Complete your registration to %(tracker_name)s -- key %(key)s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1167
+#: ../roundup/cgi/actions.py:1172
 #, python-format
 msgid ""
 "To complete your registration of the user \"%(name)s\" with\n"
@@ -1509,12 +1514,12 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1181
+#: ../roundup/cgi/actions.py:1186
 #, python-format
 msgid "Complete your registration to %s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1182
+#: ../roundup/cgi/actions.py:1187
 #, python-format
 msgid ""
 "To complete your registration of the user \"%(name)s\" with\n"
@@ -1524,44 +1529,44 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1206
+#: ../roundup/cgi/actions.py:1211
 msgid "It is not permitted to supply roles at registration."
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1220
+#: ../roundup/cgi/actions.py:1225
 msgid "You are logged out"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1250
+#: ../roundup/cgi/actions.py:1255
 msgid "Username required"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1354
+#: ../roundup/cgi/actions.py:1359
 #, python-format
 msgid "Welcome %(username)s!"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1477
+#: ../roundup/cgi/actions.py:1482
 #, python-format
 msgid "Logins occurring too fast. Please wait: %s seconds."
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1515 ../roundup/cgi/actions.py:1526
-#: ../roundup/cgi/actions.py:1515:1526
+#: ../roundup/cgi/actions.py:1520 ../roundup/cgi/actions.py:1531
+#: ../roundup/cgi/actions.py:1520:1531
 msgid "Invalid login"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1532
+#: ../roundup/cgi/actions.py:1537
 msgid "You do not have permission to login"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1577 ../roundup/cgi/actions.py:1757
-#: ../roundup/cgi/actions.py:1577:1757
+#: ../roundup/cgi/actions.py:1582 ../roundup/cgi/actions.py:1762
+#: ../roundup/cgi/actions.py:1582:1762
 #, python-format
 msgid "Column \"%(column)s\" not found in %(class)s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1822
+#: ../roundup/cgi/actions.py:1827
 #, python-format
 msgid "You do not have permission to view %(class)s"
 msgstr ""
@@ -1671,8 +1676,8 @@ msgstr ""
 msgid "Unrecognized charset: %r"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1381 ../roundup/cgi/client.py:2394
-#: ../roundup/cgi/client.py:1381:2394
+#: ../roundup/cgi/client.py:1381 ../roundup/cgi/client.py:2396
+#: ../roundup/cgi/client.py:1381:2396
 msgid "broken form: multiple @action values submitted"
 msgstr ""
 
@@ -1750,57 +1755,58 @@ msgstr ""
 
 #: ../roundup/cgi/client.py:1679
 #, python-format
-msgid "csrf X-REQUESTED-WITH xmlrpc required header check failed for user%s."
+msgid ""
+"csrf X-REQUESTED-WITH xmlrpc required header check failed for user%(userid)s."
 msgstr ""
 
 #: ../roundup/cgi/client.py:1720
 #, python-format
-msgid "Required csrf field missing for user%s"
+msgid "Required csrf field missing for user%(userid)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1722 ../roundup/cgi/client.py:1749
-#: ../roundup/cgi/client.py:1766 ../roundup/cgi/client.py:1722:1749 :1766
+#: ../roundup/cgi/client.py:1723 ../roundup/cgi/client.py:1751
+#: ../roundup/cgi/client.py:1768 ../roundup/cgi/client.py:1723:1751 :1768
 msgid ""
 "We can't validate your session (csrf failure). Re-enter any unsaved data and "
 "try again."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1726
+#: ../roundup/cgi/client.py:1728
 #, python-format
-msgid "csrf field not supplied by user%s"
+msgid "csrf field not supplied by user%(userid)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1738
+#: ../roundup/cgi/client.py:1740
 #, python-format
 msgid ""
 "Csrf mismatch user: current user %(user)s != stored user %(stored)s, current "
 "session, stored session: %(cur_sess)s,%(stor_sess)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1756
+#: ../roundup/cgi/client.py:1758
 #, python-format
 msgid ""
 "Csrf mismatch user: current session %(curr_sess)s != stored session "
 "%(stor_sess)s, current user/stored user is: %(user)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1948
+#: ../roundup/cgi/client.py:1950
 msgid "You are not allowed to view this file."
 msgstr ""
 
-#: ../roundup/cgi/client.py:2272
+#: ../roundup/cgi/client.py:2274
 #, python-format
 msgid "%(starttag)sTime elapsed: %(seconds)fs%(endtag)s\n"
 msgstr ""
 
-#: ../roundup/cgi/client.py:2276
+#: ../roundup/cgi/client.py:2278
 #, python-format
 msgid ""
 "%(starttag)sCache hits: %(cache_hits)d, misses %(cache_misses)d. Loading "
 "items: %(get_items)f secs. Filtering: %(filtering)f secs.%(endtag)s\n"
 msgstr ""
 
-#: ../roundup/cgi/client.py:2815
+#: ../roundup/cgi/client.py:2817
 #, python-format
 msgid ""
 "Cache failure: compressed file %(compressed)s is older than its source file "
@@ -1863,135 +1869,135 @@ msgstr[1] ""
 msgid "You are not allowed to %(action)s items of class %(class)s"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:916
+#: ../roundup/cgi/templating.py:892
 msgid "(list)"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:991
+#: ../roundup/cgi/templating.py:975
 msgid "Submit New Entry"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:1013 ../roundup/cgi/templating.py:1189
-#: ../roundup/cgi/templating.py:1824 ../roundup/cgi/templating.py:1855
-#: ../roundup/cgi/templating.py:1876 ../roundup/cgi/templating.py:1914
-#: ../roundup/cgi/templating.py:1967 ../roundup/cgi/templating.py:1991
-#: ../roundup/cgi/templating.py:1998 ../roundup/cgi/templating.py:2035
-#: ../roundup/cgi/templating.py:2088 ../roundup/cgi/templating.py:2121
-#: ../roundup/cgi/templating.py:2216 ../roundup/cgi/templating.py:2237
-#: ../roundup/cgi/templating.py:2328 ../roundup/cgi/templating.py:2348
-#: ../roundup/cgi/templating.py:2370 ../roundup/cgi/templating.py:2413
-#: ../roundup/cgi/templating.py:2423 ../roundup/cgi/templating.py:2488
-#: ../roundup/cgi/templating.py:2791 ../roundup/cgi/templating.py:1013:1189
-#: :1824:1855 :1876:1914 :1967:1991 :1998:2035 :2088:2121 :2216:2237 :2328:2348
-#: :2370:2413 :2423:2488 :2791
+#: ../roundup/cgi/templating.py:997 ../roundup/cgi/templating.py:1174
+#: ../roundup/cgi/templating.py:1809 ../roundup/cgi/templating.py:1840
+#: ../roundup/cgi/templating.py:1861 ../roundup/cgi/templating.py:1899
+#: ../roundup/cgi/templating.py:1952 ../roundup/cgi/templating.py:1976
+#: ../roundup/cgi/templating.py:1983 ../roundup/cgi/templating.py:2020
+#: ../roundup/cgi/templating.py:2077 ../roundup/cgi/templating.py:2115
+#: ../roundup/cgi/templating.py:2215 ../roundup/cgi/templating.py:2236
+#: ../roundup/cgi/templating.py:2357 ../roundup/cgi/templating.py:2377
+#: ../roundup/cgi/templating.py:2399 ../roundup/cgi/templating.py:2442
+#: ../roundup/cgi/templating.py:2452 ../roundup/cgi/templating.py:2517
+#: ../roundup/cgi/templating.py:2820 ../roundup/cgi/templating.py:997:1174
+#: :1809:1840 :1861:1899 :1952:1976 :1983:2020 :2077:2115 :2215:2236 :2357:2377
+#: :2399:2442 :2452:2517 :2820
 msgid "[hidden]"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:1014
+#: ../roundup/cgi/templating.py:998
 msgid "New node - no history"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:1154
+#: ../roundup/cgi/templating.py:1139
 msgid "Submit Changes"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:1232
+#: ../roundup/cgi/templating.py:1217
 msgid "<em>The indicated property no longer exists</em>"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:1268
+#: ../roundup/cgi/templating.py:1253
 #, python-format
 msgid "The linked class %(classname)s no longer exists"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:1305 ../roundup/cgi/templating.py:1335
-#: ../roundup/cgi/templating.py:2497 ../roundup/cgi/templating.py:2800
-#: ../roundup/cgi/templating.py:1305:1335 :2497:2800
+#: ../roundup/cgi/templating.py:1290 ../roundup/cgi/templating.py:1320
+#: ../roundup/cgi/templating.py:2526 ../roundup/cgi/templating.py:2829
+#: ../roundup/cgi/templating.py:1290:1320 :2526:2829
 msgid "[label is missing]"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:1309 ../roundup/cgi/templating.py:1338
-#: ../roundup/cgi/templating.py:1309:1338
+#: ../roundup/cgi/templating.py:1294 ../roundup/cgi/templating.py:1323
+#: ../roundup/cgi/templating.py:1294:1323
 msgid "<strike>The linked node no longer exists</strike>"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:1400
+#: ../roundup/cgi/templating.py:1385
 #, python-format
 msgid "%s: (no value)"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:1416
+#: ../roundup/cgi/templating.py:1401
 #, python-format
 msgid ""
 "<strong><em>This event %s is not handled by the history display!</em></strong>"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:1429
+#: ../roundup/cgi/templating.py:1414
 msgid "<tr><td colspan=4><strong>Note:</strong></td></tr>"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:1438
+#: ../roundup/cgi/templating.py:1423
 msgid "History"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:1440
+#: ../roundup/cgi/templating.py:1425
 msgid "<th>Date</th>"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:1441
+#: ../roundup/cgi/templating.py:1426
 msgid "<th>User</th>"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:1442
+#: ../roundup/cgi/templating.py:1427
 msgid "<th>Action</th>"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:1443
+#: ../roundup/cgi/templating.py:1428
 msgid "<th>Args</th>"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:1494
+#: ../roundup/cgi/templating.py:1479
 #, python-format
 msgid "Copy of %(class)s %(id)s"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:2125 ../roundup/cgi/templating.py:2160
-#: ../roundup/cgi/templating.py:1382:2125 :2160
+#: ../roundup/cgi/templating.py:2119 ../roundup/cgi/templating.py:2154
+#: ../roundup/cgi/templating.py:1367:2119 :2154
 msgid "No"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:2125 ../roundup/cgi/templating.py:2154
-#: ../roundup/cgi/templating.py:1382:2125 :2154
+#: ../roundup/cgi/templating.py:2119 ../roundup/cgi/templating.py:2148
+#: ../roundup/cgi/templating.py:1367:2119 :2148
 msgid "Yes"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:2286
+#: ../roundup/cgi/templating.py:2315
 msgid ""
 "default value for DateHTMLProperty must be either DateHTMLProperty or string "
 "date representation."
 msgstr ""
 
-#: ../roundup/cgi/templating.py:2468
+#: ../roundup/cgi/templating.py:2497
 #, python-format
 msgid "Attempt to look up %(attr)s on a missing value"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:2479
+#: ../roundup/cgi/templating.py:2508
 #, python-format
 msgid "Attempt to look up %(item)s on a missing value"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:2584
+#: ../roundup/cgi/templating.py:2613
 #, python-format
 msgid "<option %svalue=\"-1\">- no selection -</option>"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:3745
+#: ../roundup/cgi/templating.py:3777
 #, python-format
 msgid "Unable to read or expand file '%(name)s' in template '%(template)s'."
 msgstr ""
 
-#: ../roundup/cgi/templating.py:3795
+#: ../roundup/cgi/templating.py:3827
 #, python-format
 msgid ""
 "Found an incorrect token when expandfile applied string subsitution on "
@@ -2155,54 +2161,54 @@ msgstr ""
 msgid "in %s"
 msgstr ""
 
-#: ../roundup/hyperdb.py:120
+#: ../roundup/hyperdb.py:126
 #, python-format
 msgid "property %(property)s: %(errormsg)s"
 msgstr ""
 
-#: ../roundup/hyperdb.py:149
+#: ../roundup/hyperdb.py:161
 #, python-format
 msgid "property %(property)s: %(value)r is an invalid date (%(errormsg)s)"
 msgstr ""
 
-#: ../roundup/hyperdb.py:172
+#: ../roundup/hyperdb.py:184
 #, python-format
 msgid ""
 "property %(property)s: %(value)r is an invalid date interval (%(errormsg)s)"
 msgstr ""
 
-#: ../roundup/hyperdb.py:434
+#: ../roundup/hyperdb.py:446
 #, python-format
 msgid "property %(property)s: %(value)r is not a number"
 msgstr ""
 
-#: ../roundup/hyperdb.py:448
+#: ../roundup/hyperdb.py:460
 #, python-format
 msgid "property %(property)s: %(value)r is not an integer"
 msgstr ""
 
-#: ../roundup/hyperdb.py:470
+#: ../roundup/hyperdb.py:482
 #, python-format
 msgid "\"%s\" not a node designator"
 msgstr ""
 
-#: ../roundup/hyperdb.py:1499 ../roundup/hyperdb.py:1507
-#: ../roundup/hyperdb.py:1499:1507
+#: ../roundup/hyperdb.py:1515 ../roundup/hyperdb.py:1523
+#: ../roundup/hyperdb.py:1515:1523
 #, python-format
 msgid "Not a property name: %s"
 msgstr ""
 
-#: ../roundup/hyperdb.py:2038
+#: ../roundup/hyperdb.py:2054
 #, python-format
 msgid "property %(property)s: %(value)r is not a %(classname)s."
 msgstr ""
 
-#: ../roundup/hyperdb.py:2044
+#: ../roundup/hyperdb.py:2060
 #, python-format
 msgid "you may only enter ID values for property %s"
 msgstr ""
 
-#: ../roundup/hyperdb.py:2079
+#: ../roundup/hyperdb.py:2095
 #, python-format
 msgid "%(property)r is not a property of %(classname)s"
 msgstr ""
@@ -2456,60 +2462,60 @@ msgid ""
 "are: %(stack)s"
 msgstr ""
 
-#: ../roundup/pygettext.py:401
+#: ../roundup/pygettext.py:400
 #, python-format
 msgid "*** %(file)s:%(lineno)s: Seen unexpected token \"%(token)s\""
 msgstr ""
 
-#: ../roundup/pygettext.py:457
+#: ../roundup/pygettext.py:456
 #, python-format
 msgid "# File: %(filename)s, line: %(lineno)d"
 msgstr ""
 
-#: ../roundup/pygettext.py:464
+#: ../roundup/pygettext.py:463
 #, python-format
 msgid " %(filename)s:%(lineno)d"
 msgstr ""
 
-#: ../roundup/pygettext.py:540
+#: ../roundup/pygettext.py:539
 #, python-format
 msgid "Invalid value for --style: %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:548
+#: ../roundup/pygettext.py:547
 #, python-format
 msgid "pygettext.py (xgettext for Python) %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:554
+#: ../roundup/pygettext.py:553
 #, python-format
 msgid "--width argument must be an integer: %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:582
+#: ../roundup/pygettext.py:581
 #, python-format
 msgid "Can't read --exclude-file: %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:601
+#: ../roundup/pygettext.py:600
 msgid "Reading standard input"
 msgstr ""
 
-#: ../roundup/pygettext.py:606
+#: ../roundup/pygettext.py:605
 #, python-format
 msgid "Working on %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:640
+#: ../roundup/pygettext.py:639
 msgid "a unicode string"
 msgstr ""
 
-#: ../roundup/pygettext.py:642
+#: ../roundup/pygettext.py:641
 #, python-format
 msgid "*** Seen unexpected token \"%(token)s\""
 msgstr ""
 
-#: ../roundup/pygettext.py:643
+#: ../roundup/pygettext.py:642
 msgid "morethanonestring"
 msgstr ""
 
@@ -2629,32 +2635,32 @@ msgstr ""
 msgid "creator"
 msgstr ""
 
-#: ../roundup/roundupdb.py:426
+#: ../roundup/roundupdb.py:447
 #, python-format
 msgid "No key for \"%(adr)s\" in keyring"
 msgstr ""
 
-#: ../roundup/roundupdb.py:504
+#: ../roundup/roundupdb.py:525
 #, python-format
 msgid "New submission from %(authname)s%(authaddr)s:"
 msgstr ""
 
-#: ../roundup/roundupdb.py:507
+#: ../roundup/roundupdb.py:528
 #, python-format
 msgid "%(authname)s%(authaddr)s added the comment:"
 msgstr ""
 
-#: ../roundup/roundupdb.py:510
+#: ../roundup/roundupdb.py:531
 #, python-format
 msgid "Change by %(authname)s%(authaddr)s:"
 msgstr ""
 
-#: ../roundup/roundupdb.py:529
+#: ../roundup/roundupdb.py:550
 #, python-format
 msgid "File '%(filename)s' not attached - you can download it from %(link)s."
 msgstr ""
 
-#: ../roundup/roundupdb.py:904
+#: ../roundup/roundupdb.py:925
 #, python-format
 msgid ""
 "\n"
@@ -2753,58 +2759,58 @@ msgid ""
 "<body><h1>Roundup trackers index</h1><ol>\n"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:598
+#: ../roundup/scripts/roundup_server.py:602
 #, python-format
 msgid "Error: %(type)s: %(value)s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:610
+#: ../roundup/scripts/roundup_server.py:614
 msgid "WARNING: ignoring \"-g\" argument, not root"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:616
+#: ../roundup/scripts/roundup_server.py:620
 msgid "Can't change groups - no grp module"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:625
+#: ../roundup/scripts/roundup_server.py:629
 #, python-format
 msgid "Group %(group)s doesn't exist"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:637
+#: ../roundup/scripts/roundup_server.py:641
 msgid "Can't run as root!"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:640
+#: ../roundup/scripts/roundup_server.py:644
 msgid "WARNING: ignoring \"-u\" argument, not root"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:646
+#: ../roundup/scripts/roundup_server.py:650
 msgid "Can't change users - no pwd module"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:655
+#: ../roundup/scripts/roundup_server.py:659
 #, python-format
 msgid "User %(user)s doesn't exist"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:867
+#: ../roundup/scripts/roundup_server.py:871
 #, python-format
 msgid "Multiprocess mode \"%s\" is not available, switching to single-process"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:895
+#: ../roundup/scripts/roundup_server.py:899
 #, python-format
 msgid "Unable to bind to port %s, port already in use."
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:899
+#: ../roundup/scripts/roundup_server.py:903
 #, python-format
 msgid ""
 "Unable to bind to port %(port)s, access not allowed, errno: %(errno)s %(msg)s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:978
+#: ../roundup/scripts/roundup_server.py:982
 msgid ""
 " -c <Command>  Windows Service options.\n"
 "               If you want to run the server as a Windows Service, you\n"
@@ -2814,7 +2820,7 @@ msgid ""
 "               specifics."
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:985
+#: ../roundup/scripts/roundup_server.py:989
 msgid ""
 " -u <UID>      runs the Roundup web server as this UID\n"
 " -g <GID>      runs the Roundup web server as this GID\n"
@@ -2824,7 +2830,7 @@ msgid ""
 " -D            run the server in the foreground even when -d is used."
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:993
+#: ../roundup/scripts/roundup_server.py:997
 #, python-format
 msgid ""
 "\n"
@@ -2896,20 +2902,24 @@ msgid ""
 "   any url-unsafe characters like spaces, as these confuse IE.\n"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:1173
+#: ../roundup/scripts/roundup_server.py:1177
 msgid "Instances must be name=home"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:1187
+#: ../roundup/scripts/roundup_server.py:1191
 #, python-format
 msgid "Configuration saved to %s"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:1205
+#: ../roundup/scripts/roundup_server.py:1206
+msgid "If you specify a PID file you must use -l or -L."
+msgstr ""
+
+#: ../roundup/scripts/roundup_server.py:1212
 msgid "Sorry, you can't run the server as a daemon on this Operating System"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:1225
+#: ../roundup/scripts/roundup_server.py:1232
 #, python-format
 msgid "Roundup server started on %(HOST)s:%(PORT)s"
 msgstr ""
@@ -4163,46 +4173,46 @@ msgstr ""
 msgid "clear this message"
 msgstr ""
 
-#: ../share/roundup/templates/classic/html/page.html:257
-#: ../share/roundup/templates/classic/html/page.html:270
-#: ../share/roundup/templates/classic/html/page.html:288
-#: ../share/roundup/templates/classic/html/page.html:302
-#: ../share/roundup/templates/devel/html/page.html:316
-#: ../share/roundup/templates/devel/html/page.html:329
-#: ../share/roundup/templates/devel/html/page.html:347
-#: ../share/roundup/templates/devel/html/page.html:361
-#: ../share/roundup/templates/minimal/html/page.html:239
-#: ../share/roundup/templates/minimal/html/page.html:254
-#: ../share/roundup/templates/minimal/html/page.html:268
-#: ../share/roundup/templates/responsive/html/page.html:331
-#: ../share/roundup/templates/responsive/html/page.html:344
-#: ../share/roundup/templates/responsive/html/page.html:362
-#: ../share/roundup/templates/responsive/html/page.html:376
-msgid "don't care"
-msgstr ""
-
-#: ../share/roundup/templates/classic/html/page.html:259
-#: ../share/roundup/templates/classic/html/page.html:272
-#: ../share/roundup/templates/classic/html/page.html:290
+#: ../share/roundup/templates/classic/html/page.html:258
+#: ../share/roundup/templates/classic/html/page.html:271
+#: ../share/roundup/templates/classic/html/page.html:289
 #: ../share/roundup/templates/classic/html/page.html:303
-#: ../share/roundup/templates/devel/html/page.html:318
-#: ../share/roundup/templates/devel/html/page.html:331
-#: ../share/roundup/templates/devel/html/page.html:349
+#: ../share/roundup/templates/devel/html/page.html:317
+#: ../share/roundup/templates/devel/html/page.html:330
+#: ../share/roundup/templates/devel/html/page.html:348
 #: ../share/roundup/templates/devel/html/page.html:362
-#: ../share/roundup/templates/minimal/html/page.html:241
-#: ../share/roundup/templates/minimal/html/page.html:256
+#: ../share/roundup/templates/minimal/html/page.html:240
+#: ../share/roundup/templates/minimal/html/page.html:255
 #: ../share/roundup/templates/minimal/html/page.html:269
-#: ../share/roundup/templates/responsive/html/page.html:333
-#: ../share/roundup/templates/responsive/html/page.html:346
-#: ../share/roundup/templates/responsive/html/page.html:364
+#: ../share/roundup/templates/responsive/html/page.html:332
+#: ../share/roundup/templates/responsive/html/page.html:345
+#: ../share/roundup/templates/responsive/html/page.html:363
 #: ../share/roundup/templates/responsive/html/page.html:377
+msgid "don't care"
+msgstr ""
+
+#: ../share/roundup/templates/classic/html/page.html:260
+#: ../share/roundup/templates/classic/html/page.html:273
+#: ../share/roundup/templates/classic/html/page.html:291
+#: ../share/roundup/templates/classic/html/page.html:304
+#: ../share/roundup/templates/devel/html/page.html:319
+#: ../share/roundup/templates/devel/html/page.html:332
+#: ../share/roundup/templates/devel/html/page.html:350
+#: ../share/roundup/templates/devel/html/page.html:363
+#: ../share/roundup/templates/minimal/html/page.html:242
+#: ../share/roundup/templates/minimal/html/page.html:257
+#: ../share/roundup/templates/minimal/html/page.html:270
+#: ../share/roundup/templates/responsive/html/page.html:334
+#: ../share/roundup/templates/responsive/html/page.html:347
+#: ../share/roundup/templates/responsive/html/page.html:365
+#: ../share/roundup/templates/responsive/html/page.html:378
 msgid "------------"
 msgstr ""
 
-#: ../share/roundup/templates/classic/html/page.html:335
-#: ../share/roundup/templates/devel/html/page.html:390
-#: ../share/roundup/templates/minimal/html/page.html:297
-#: ../share/roundup/templates/responsive/html/page.html:405
+#: ../share/roundup/templates/classic/html/page.html:336
+#: ../share/roundup/templates/devel/html/page.html:391
+#: ../share/roundup/templates/minimal/html/page.html:298
+#: ../share/roundup/templates/responsive/html/page.html:406
 msgid "no value"
 msgstr ""
 
diff --git a/locale/ru.po b/locale/ru.po
index 37cd8cf1a..bbc8bdc8e 100644
--- a/locale/ru.po
+++ b/locale/ru.po
@@ -5,9 +5,9 @@
 #
 msgid ""
 msgstr ""
-"Project-Id-Version: Roundup 2.5.0\n"
+"Project-Id-Version: Roundup 2.5.0b1\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
-"POT-Creation-Date: 2025-01-12 20:17-0500\n"
+"POT-Creation-Date: 2025-06-11 16:02-0400\n"
 "PO-Revision-Date: 2013-10-31 12:21+0100\n"
 "Last-Translator: alexander smishlajev <alex@tycobka.lv>\n"
 "Language-Team: Russian\n"
@@ -29,19 +29,19 @@ msgstr "
 msgid "You may not retire the admin or anonymous user"
 msgstr "îÅÌØÚÑ ÕÄÁÌÑÔØ ÐÏÌØÚÏ×ÁÔÅÌÅÊ admin É anonymous."
 
-#: ../roundup/admin.py:131
+#: ../roundup/admin.py:132
 msgid ""
 "Have 'display designator[,designator*]' show header inside\n"
 "      []'s before items. Includes retired/active status.\n"
 msgstr ""
 
-#: ../roundup/admin.py:135
+#: ../roundup/admin.py:136
 msgid ""
 "Have 'display designator' and 'specification class' show\n"
 "      protected fields: creator, id etc.\n"
 msgstr ""
 
-#: ../roundup/admin.py:139
+#: ../roundup/admin.py:140
 msgid ""
 "Controls history options. It is a bitstring where setting\n"
 "      the bit disables the feature. A value of 0 (default)\n"
@@ -52,50 +52,50 @@ msgid ""
 "      history.\n"
 msgstr ""
 
-#: ../roundup/admin.py:148
+#: ../roundup/admin.py:149
 msgid ""
 "Set the number of lines of history to keep for this session.\n"
 "      -1 is infinite.\n"
 msgstr ""
 
-#: ../roundup/admin.py:152
+#: ../roundup/admin.py:153
 msgid "Set indexer to use when running 'reindex' NYI\n"
 msgstr ""
 
-#: ../roundup/admin.py:155
+#: ../roundup/admin.py:156
 msgid "Force reopening of tracker when running each command.\n"
 msgstr ""
 
-#: ../roundup/admin.py:158
+#: ../roundup/admin.py:159
 msgid ""
 "set the number of rows imported before a database commit is\n"
 "      done. Used only for imports on PostgreSQL.\n"
 msgstr ""
 
-#: ../roundup/admin.py:160
+#: ../roundup/admin.py:161
 msgid "Show retired items in table, list etc. One of 'no', 'only', 'both'\n"
 msgstr ""
 
-#: ../roundup/admin.py:162
+#: ../roundup/admin.py:163
 msgid "internal mapping for show_retired.\n"
 msgstr ""
 
-#: ../roundup/admin.py:163
+#: ../roundup/admin.py:164
 msgid "Enable verbose output: tracing, descriptions...\n"
 msgstr ""
 
-#: ../roundup/admin.py:175 ../roundup/admin.py:1188 ../roundup/admin.py:1858
-#: ../roundup/admin.py:1890 ../roundup/admin.py:175:1188 :1858:1890
+#: ../roundup/admin.py:176 ../roundup/admin.py:1199 ../roundup/admin.py:1869
+#: ../roundup/admin.py:1901 ../roundup/admin.py:176:1199 :1869:1901
 #, python-format
 msgid "no such class \"%(classname)s\""
 msgstr "ëÌÁÓÓ \"%(classname)s\" ÎÅ ÓÕÝÅÓÔ×ÕÅÔ"
 
-#: ../roundup/admin.py:188
+#: ../roundup/admin.py:189
 #, python-format
 msgid "argument \"%(arg)s\" not propname=value"
 msgstr "ÁÒÇÕÍÅÎÔ \"%(arg)s\" ÄÏÌÖÅÎ ÉÍÅÔØ ×ÉÄ ÉÍÑ=ÚÎÁÞÅÎÉÅ"
 
-#: ../roundup/admin.py:201
+#: ../roundup/admin.py:202
 #, python-format
 msgid ""
 "Problem: %(message)s\n"
@@ -104,7 +104,7 @@ msgstr ""
 "ïÛÉÂËÁ: %(message)s\n"
 "\n"
 
-#: ../roundup/admin.py:202
+#: ../roundup/admin.py:203
 #, fuzzy, python-format
 msgid ""
 "%(message)sUsage: roundup-admin [options] [<command> <arguments>]\n"
@@ -156,12 +156,12 @@ msgstr ""
 " roundup-admin help <command>             -- ÓÐÒÁ×ËÁ ÐÏ ËÏÍÁÎÄÅ\n"
 " roundup-admin help all                   -- ×ÓÅ ÓÐÒÁ×ÏÞÎÙÅ ÓÏÏÂÝÅÎÉÑ\n"
 
-#: ../roundup/admin.py:231
+#: ../roundup/admin.py:232
 #, fuzzy
 msgid "Commands: "
 msgstr "ëÏÍÁÎÄÙ:"
 
-#: ../roundup/admin.py:238
+#: ../roundup/admin.py:249
 msgid ""
 "Commands may be abbreviated as long as the abbreviation\n"
 "matches only one command, e.g. l == li == lis == list."
@@ -175,7 +175,7 @@ msgstr ""
 # ÎÏ ÍÎÅ ÜÔÏ ÓÏ×ÓÅÍ ÎÅ ÎÒÁ×ÉÔÓÑ.
 #
 # ÞÔÏ ÌÕÞÛÅ ÎÁÐÉÓÁÔØ ×ÍÅÓÔÏ "××ÅÓÔÉ Ó ÔÅÒÍÉÎÁÌÁ"?
-#: ../roundup/admin.py:270
+#: ../roundup/admin.py:281
 #, fuzzy
 msgid ""
 "\n"
@@ -308,23 +308,23 @@ msgstr ""
 "\n"
 "óÐÒÁ×ËÁ ÐÏ ËÏÍÁÎÄÁÍ:\n"
 
-#: ../roundup/admin.py:334
+#: ../roundup/admin.py:345
 #, python-format
 msgid "%s:"
 msgstr ""
 
-#: ../roundup/admin.py:439 ../roundup/admin.py:1415
-#: ../roundup/admin.py:439:1415
+#: ../roundup/admin.py:450 ../roundup/admin.py:1426
+#: ../roundup/admin.py:450:1426
 msgid "Templates:"
 msgstr "ûÁÂÌÏÎÙ:"
 
-#: ../roundup/admin.py:442 ../roundup/admin.py:1425
-#: ../roundup/admin.py:442:1425
+#: ../roundup/admin.py:453 ../roundup/admin.py:1436
+#: ../roundup/admin.py:453:1436
 msgid "Back ends:"
 msgstr "óÅÒ×ÅÒÙ:"
 
 #. noqa: ARG002
-#: ../roundup/admin.py:459
+#: ../roundup/admin.py:470
 msgid ""
 "Usage: commit\n"
 "        Commit changes made to the database during an interactive session.\n"
@@ -348,7 +348,7 @@ msgstr ""
 "        Á×ÔÏÍÁÔÉÞÅÓËÉ, ÅÓÌÉ ÐÒÉ ×ÙÐÏÌÎÅÎÉÉ ËÏÍÁÎÄÙ ÎÅ ÐÒÏÉÚÏÛÌÏ ÏÛÉÂËÉ.\n"
 "        "
 
-#: ../roundup/admin.py:474
+#: ../roundup/admin.py:485
 msgid ""
 "Usage: create classname property=value ...\n"
 "        Create a new entry of a given class.\n"
@@ -366,42 +366,42 @@ msgstr ""
 "        ÜÔÏÇÏ ÏÂßÅËÔÁ ÕËÁÚÁÎÎÙÍÉ ÚÎÁÞÅÎÉÑÍÉ.\n"
 "        "
 
-#: ../roundup/admin.py:482 ../roundup/admin.py:555 ../roundup/admin.py:606
-#: ../roundup/admin.py:733 ../roundup/admin.py:806 ../roundup/admin.py:851
-#: ../roundup/admin.py:902 ../roundup/admin.py:999 ../roundup/admin.py:1216
-#: ../roundup/admin.py:1388 ../roundup/admin.py:1516 ../roundup/admin.py:1599
-#: ../roundup/admin.py:1725 ../roundup/admin.py:1848 ../roundup/admin.py:1880
-#: ../roundup/admin.py:1996 ../roundup/admin.py:2050 ../roundup/admin.py:2098
-#: ../roundup/admin.py:482:555 :1216:1388:1516 :1599:1725 :1848:1880 :1996:2050
-#: :2098 :606:733 :806:851 :902:999
+#: ../roundup/admin.py:493 ../roundup/admin.py:566 ../roundup/admin.py:617
+#: ../roundup/admin.py:744 ../roundup/admin.py:817 ../roundup/admin.py:862
+#: ../roundup/admin.py:913 ../roundup/admin.py:1010 ../roundup/admin.py:1227
+#: ../roundup/admin.py:1399 ../roundup/admin.py:1527 ../roundup/admin.py:1610
+#: ../roundup/admin.py:1736 ../roundup/admin.py:1859 ../roundup/admin.py:1891
+#: ../roundup/admin.py:2007 ../roundup/admin.py:2061 ../roundup/admin.py:2109
+#: ../roundup/admin.py:493:566 :1227:1399 :1527:1610 :1736:1859 :1891:2007
+#: :2061:2109 :617:744 :817:862 :913:1010
 msgid "Not enough arguments supplied"
 msgstr "îÅÄÏÓÔÁÔÏÞÎÏ ÁÒÇÕÍÅÎÔÏ×"
 
-#: ../roundup/admin.py:502
+#: ../roundup/admin.py:513
 #, python-format
 msgid "%(propname)s (Password): "
 msgstr " %(propname)s (ÐÁÒÏÌØ): "
 
-#: ../roundup/admin.py:505
+#: ../roundup/admin.py:516
 #, python-format
 msgid "   %(propname)s (Again): "
 msgstr "%(propname)s (ÅÝÅ ÒÁÚ): "
 
-#: ../roundup/admin.py:509
+#: ../roundup/admin.py:520
 msgid "Sorry, try again..."
 msgstr "ðÁÒÏÌÉ ÎÅ ÓÏ×ÐÁÌÉ.  ðÏÐÒÏÂÕÊÔÅ ÅÝÅ ÒÁÚ."
 
-#: ../roundup/admin.py:514
+#: ../roundup/admin.py:525
 #, python-format
 msgid "%(propname)s (%(proptype)s): "
 msgstr ""
 
-#: ../roundup/admin.py:533
+#: ../roundup/admin.py:544
 #, python-format
 msgid "you must provide the \"%(propname)s\" property."
 msgstr "áÔÒÉÂÕÔ \"%(propname)s\" ÄÏÌÖÅÎ ÂÙÔØ ÚÁÐÏÌÎÅÎ."
 
-#: ../roundup/admin.py:545
+#: ../roundup/admin.py:556
 #, fuzzy
 msgid ""
 "Usage: display designator[,designator]*\n"
@@ -421,13 +421,13 @@ msgstr ""
 "        ÚÁÄÁÎÎÙÈ ÏÐÉÓÁÔÅÌÑÍÉ.\n"
 "        "
 
-#: ../roundup/admin.py:586
+#: ../roundup/admin.py:597
 #, fuzzy, python-format
 msgid "%(protected)s%(key)s: %(value)s"
 msgstr "%(key)s: %(value)s (ËÌÀÞÅ×ÏÊ ÁÔÒÉÂÕÔ)"
 
 #. grab the directory to export to
-#: ../roundup/admin.py:589
+#: ../roundup/admin.py:600
 #, fuzzy
 msgid ""
 "Usage: export [[-]class[,class]] export_dir\n"
@@ -468,7 +468,7 @@ msgstr ""
 "        exporttables.\n"
 "        "
 
-#: ../roundup/admin.py:704
+#: ../roundup/admin.py:715
 #, fuzzy
 msgid ""
 "Usage: exporttables [[-]class[,class]] export_dir\n"
@@ -510,7 +510,7 @@ msgstr ""
 "        ÐÏÌÎÏÓÔØÀ, ÉÓÐÏÌØÚÕÊÔÅ ËÏÍÁÎÄÕ export.\n"
 "        "
 
-#: ../roundup/admin.py:723
+#: ../roundup/admin.py:734
 #, fuzzy
 msgid ""
 "Usage: filter classname propname=value ...\n"
@@ -531,19 +531,19 @@ msgstr ""
 "        ËÏÔÏÒÙÊ ÓÓÙÌÁÅÔÓÑ ÁÔÒÉÂÕÔ, ÉÌÉ ËÌÀÞÏÍ ÜÔÏÇÏ ÏÂßÅËÔÁ.\n"
 "        "
 
-#: ../roundup/admin.py:764
+#: ../roundup/admin.py:775
 #, fuzzy, python-format
 msgid "Class %(curclassname)s has no property %(pn)s in %(propname)s."
 msgstr "ëÌÁÓÓ %(classname)s ÎÅ ÉÍÅÅÔ ÁÔÒÉÂÕÔÁ \"%(propname)s\""
 
-#: ../roundup/admin.py:791 ../roundup/admin.py:840 ../roundup/admin.py:1536
-#: ../roundup/admin.py:1549 ../roundup/admin.py:2120
-#: ../roundup/admin.py:791:840 :1536:1549:2120
+#: ../roundup/admin.py:802 ../roundup/admin.py:851 ../roundup/admin.py:1547
+#: ../roundup/admin.py:1560 ../roundup/admin.py:2131
+#: ../roundup/admin.py:802:851 :1547:1560:2131
 #, python-format
 msgid "%(classname)s has no property \"%(propname)s\""
 msgstr "ëÌÁÓÓ %(classname)s ÎÅ ÉÍÅÅÔ ÁÔÒÉÂÕÔÁ \"%(propname)s\""
 
-#: ../roundup/admin.py:798
+#: ../roundup/admin.py:809
 msgid ""
 "Usage: find classname propname=value ...\n"
 "        Find the nodes of the given class with a given link property value.\n"
@@ -561,7 +561,7 @@ msgstr ""
 "        ËÏÔÏÒÙÊ ÓÓÙÌÁÅÔÓÑ ÁÔÒÉÂÕÔ, ÉÌÉ ËÌÀÞÏÍ ÜÔÏÇÏ ÏÂßÅËÔÁ.\n"
 "        "
 
-#: ../roundup/admin.py:847
+#: ../roundup/admin.py:858
 #, fuzzy
 msgid ""
 "Usage: genconfig filename\n"
@@ -573,7 +573,7 @@ msgstr ""
 "        ÉÓÐÏÌØÚÕÑ ÎÁÓÔÒÏÊËÉ ÐÏ ÕÍÏÌÞÁÎÉÀ.\n"
 "        "
 
-#: ../roundup/admin.py:864
+#: ../roundup/admin.py:875
 #, python-format
 msgid ""
 "Changing option\n"
@@ -581,20 +581,20 @@ msgid ""
 "from old default of %(old_number)s to new default of %(new_number)s."
 msgstr ""
 
-#: ../roundup/admin.py:875
+#: ../roundup/admin.py:886
 #, python-format
 msgid ""
 "Update 'password_pbkdf2_default_rounds' to a number equal to or larger\n"
 "  than %s.\n"
 msgstr ""
 
-#: ../roundup/admin.py:882
+#: ../roundup/admin.py:893
 msgid ""
 "Check the rdbms mysql_* settings. Your charset and collations may need\n"
 "  to be changed. See upgrading instructions.\n"
 msgstr ""
 
-#: ../roundup/admin.py:892
+#: ../roundup/admin.py:903
 #, fuzzy
 msgid ""
 "Usage: get property designator[,designator]*\n"
@@ -615,24 +615,24 @@ msgstr ""
 "        ÐÅÒÅÞÉÓÌÅÎÎÙÈ × ÓÐÉÓËÅ ÏÐÉÓÁÔÅÌÅÊ.\n"
 "        "
 
-#: ../roundup/admin.py:925
+#: ../roundup/admin.py:936
 #, python-format
 msgid "property %s is not of type Multilink or Link so -d flag does not apply."
 msgstr ""
 "ëÌÀÞ '-d' ÎÅÐÒÉÍÅÎÉÍ, ÐÏÔÏÍÕ ÞÔÏ ÔÉÐ ÁÔÒÉÂÕÔÁ %s - ÎÅ Link É ÎÅ Multilink"
 
-#: ../roundup/admin.py:942 ../roundup/admin.py:1190 ../roundup/admin.py:1864
-#: ../roundup/admin.py:1892 ../roundup/admin.py:942:1190 :1864:1892
+#: ../roundup/admin.py:953 ../roundup/admin.py:1201 ../roundup/admin.py:1875
+#: ../roundup/admin.py:1903 ../roundup/admin.py:953:1201 :1875:1903
 #, python-format
 msgid "no such %(classname)s node \"%(nodeid)s\""
 msgstr "÷ ËÌÁÓÓÅ %(classname)s ÎÅÔ ÏÂßÅËÔÁ \"%(nodeid)s\""
 
-#: ../roundup/admin.py:945
+#: ../roundup/admin.py:956
 #, python-format
 msgid "no such %(classname)s property \"%(propname)s\""
 msgstr "õ ËÌÁÓÓÁ %(classname)s ÎÅÔ ÁÔÒÉÂÕÔÁ \"%(propname)s\""
 
-#: ../roundup/admin.py:950
+#: ../roundup/admin.py:961
 msgid ""
 "Usage: help topic\n"
 "        Give help about topic.\n"
@@ -652,12 +652,12 @@ msgstr ""
 "        all       -- ×ÓÅ ÓÐÒÁ×ËÉ\n"
 "        "
 
-#: ../roundup/admin.py:969
+#: ../roundup/admin.py:980
 #, python-format
 msgid "Sorry, no help for \"%(topic)s\""
 msgstr "é×ÉÎÉÔÅ, ÓÐÒÁ×ËÁ \"%(topic)s\" ÎÅ ÓÕÝÅÓÔ×ÕÅÔ."
 
-#: ../roundup/admin.py:986
+#: ../roundup/admin.py:997
 #, fuzzy
 msgid ""
 "Usage: history designator [skipquiet] [raw]\n"
@@ -681,27 +681,27 @@ msgstr ""
 "        ÉÓÐÏÌØÚÏ×ÁÎÙ × ÄÒÕÇÉÈ ÏÂßÅËÔÁÈ.\n"
 "        "
 
-#: ../roundup/admin.py:1011
+#: ../roundup/admin.py:1022
 #, python-format
 msgid "Unexpected argument(s): %s. Expected 'skipquiet' or 'raw'."
 msgstr ""
 
-#: ../roundup/admin.py:1062
+#: ../roundup/admin.py:1073
 #, fuzzy
 msgid "removed"
 msgstr "ÕÄÁÌÉÔØ"
 
-#: ../roundup/admin.py:1064
+#: ../roundup/admin.py:1075
 msgid "added"
 msgstr ""
 
-#: ../roundup/admin.py:1066
+#: ../roundup/admin.py:1077
 #, python-format
 msgid "Unknown history set operation '%s'. Expected +/-."
 msgstr ""
 
 #. .Hint added issue23 to superseder
-#: ../roundup/admin.py:1091
+#: ../roundup/admin.py:1102
 #, fuzzy, python-format
 msgid "added %(class)s%(item_id)s to %(propname)s"
 msgstr "éÚÍÅÎÅÎÙ ÁÔÒÉÂÕÔÙ %(properties)s ÏÂßÅËÔÁ %(class)s %(id)s"
@@ -709,29 +709,29 @@ msgstr "
 #. .Hint read as: assignedto was admin(1)
 #. where assignedto is the property
 #. admin is the key name for value 1
-#: ../roundup/admin.py:1112
+#: ../roundup/admin.py:1123
 #, python-format
 msgid "%(prop)s was %(name)s(%(value)s)"
 msgstr ""
 
-#: ../roundup/admin.py:1118 ../roundup/admin.py:1147
-#: ../roundup/admin.py:1118:1147
+#: ../roundup/admin.py:1129 ../roundup/admin.py:1158
+#: ../roundup/admin.py:1129:1158
 #, fuzzy, python-format
 msgid "%(prop)s was %(value)s"
 msgstr "%(key)s: %(value)s (ËÌÀÞÅ×ÏÊ ÁÔÒÉÂÕÔ)"
 
-#: ../roundup/admin.py:1137
+#: ../roundup/admin.py:1148
 #, python-format
 msgid "%(prop)s was [%(value_list)s]"
 msgstr ""
 
 #. .Hint modified nosy: added demo(3)
-#: ../roundup/admin.py:1144
+#: ../roundup/admin.py:1155
 #, python-format
 msgid "modified %(prop)s: %(how)s"
 msgstr ""
 
-#: ../roundup/admin.py:1195
+#: ../roundup/admin.py:1206
 #, fuzzy
 msgid ""
 "Usage: import import_dir\n"
@@ -777,7 +777,7 @@ msgstr ""
 "        ÉÚ ÓÕÝÅÓÔ×ÕÀÝÅÊ ÂÁÚÙ ×ÓÅ ÏÂßÅËÔÙ).\n"
 "        "
 
-#: ../roundup/admin.py:1306
+#: ../roundup/admin.py:1317
 msgid ""
 "Usage: importtables export_dir\n"
 "        This imports the database tables exported using exporttables.\n"
@@ -788,7 +788,7 @@ msgstr ""
 
 #  password
 #. password
-#: ../roundup/admin.py:1314
+#: ../roundup/admin.py:1325
 msgid ""
 "Usage: initialise [adminpw]\n"
 "        Initialise a new Roundup tracker.\n"
@@ -806,23 +806,23 @@ msgstr ""
 "        éÎÉÃÉÁÌÉÚÁÃÉÑ ÔÒÅËÅÒÁ ÄÅÌÁÅÔÓÑ ÆÕÎËÃÉÅÊ dbinit.init()\n"
 "        "
 
-#: ../roundup/admin.py:1328
+#: ../roundup/admin.py:1339
 msgid "Admin Password: "
 msgstr "ðÁÒÏÌØ ÁÄÍÉÎÉÓÔÒÁÔÏÒÁ: "
 
-#: ../roundup/admin.py:1329
+#: ../roundup/admin.py:1340
 msgid "       Confirm: "
 msgstr "              åÝÅ ÒÁÚ: "
 
-#: ../roundup/admin.py:1333
+#: ../roundup/admin.py:1344
 msgid "Instance home does not exist"
 msgstr "äÏÍÁÛÎÉÊ ËÁÔÁÌÏÇ ÔÒÅËÅÒÁ ÎÅ ÓÕÝÅÓÔ×ÕÅÔ"
 
-#: ../roundup/admin.py:1337
+#: ../roundup/admin.py:1348
 msgid "Instance has not been installed"
 msgstr "ôÒÅËÅÒ ÎÅ ÕÓÔÁÎÏ×ÌÅÎ"
 
-#: ../roundup/admin.py:1345
+#: ../roundup/admin.py:1356
 msgid ""
 "WARNING: The database is already initialised!\n"
 "If you re-initialise it, you will lose all the data!\n"
@@ -832,7 +832,7 @@ msgstr ""
 "ðÏ×ÔÏÒÎÁÑ ÉÎÉÃÉÁÌÉÚÁÃÉÑ ÕÎÉÞÔÏÖÉÔ ×ÓÅ ×ÁÛÉ ÄÁÎÎÙÅ!\n"
 "õÄÁÌÉÔØ ÓÕÝÅÓÔ×ÕÀÝÕÀ ÂÁÚÕ? Y/N: "
 
-#: ../roundup/admin.py:1365
+#: ../roundup/admin.py:1376
 msgid ""
 "Usage: install [template [backend [key=val[,key=val]]]]\n"
 "        Install a new Roundup tracker.\n"
@@ -884,12 +884,12 @@ msgstr ""
 "        óÍ.ÔÁËÖÅ \"help initopts\".\n"
 "        "
 
-#: ../roundup/admin.py:1394
+#: ../roundup/admin.py:1405
 #, python-format
 msgid "Instance home parent directory \"%(parent)s\" does not exist"
 msgstr "ëÁÔÁÌÏÇ \"%(parent)s\" ÎÅ ÓÕÝÅÓÔ×ÕÅÔ"
 
-#: ../roundup/admin.py:1403
+#: ../roundup/admin.py:1414
 #, python-format
 msgid ""
 "WARNING: There appears to be a tracker in \"%(tracker_home)s\"!\n"
@@ -900,22 +900,22 @@ msgstr ""
 "ðÏ×ÔÏÒÎÁÑ ÕÓÔÁÎÏ×ËÁ ÕÎÉÞÔÏÖÉÔ ×ÓÅ ×ÁÛÉ ÄÁÎÎÙÅ!\n"
 "õÄÁÌÉÔØ ÓÕÝÅÓÔ×ÕÀÝÉÊ ÔÒÅËÅÒ? Y/N: "
 
-#: ../roundup/admin.py:1416
+#: ../roundup/admin.py:1427
 #, fuzzy
 msgid "Select template"
 msgstr "÷ÙÂÅÒÉÔÅ ÛÁÂÌÏÎ [classic]: "
 
-#: ../roundup/admin.py:1426
+#: ../roundup/admin.py:1437
 #, fuzzy
 msgid "Select backend"
 msgstr "÷ÙÂÅÒÉÔÅ ÓÅÒ×ÅÒ [anydbm]: "
 
-#: ../roundup/admin.py:1437
+#: ../roundup/admin.py:1448
 #, python-format
 msgid "Error in configuration settings: \"%s\""
 msgstr "ïÛÉÂËÁ × ÐÁÒÁÍÅÔÒÁÈ ËÏÎÆÉÇÕÒÁÃÉÉ: \"%s\""
 
-#: ../roundup/admin.py:1470
+#: ../roundup/admin.py:1481
 #, python-format
 msgid ""
 "\n"
@@ -928,12 +928,12 @@ msgstr ""
 " ôÅÐÅÒØ ×ÁÍ ÎÕÖÎÏ ÉÓÐÒÁ×ÉÔØ ËÏÎÆÉÇÕÒÁÃÉÏÎÎÙÊ ÆÁÊÌ ÔÒÅËÅÒÁ:\n"
 "   %(config_file)s"
 
-#: ../roundup/admin.py:1480
+#: ../roundup/admin.py:1491
 msgid " ... at a minimum, you must set following options:"
 msgstr " ... ËÁË ÍÉÎÉÍÕÍ, ×Ù ÄÏÌÖÎÙ ÕÓÔÁÎÏ×ÉÔØ ÎÁÓÔÒÏÊËÉ:"
 
 # õËÁÚÁÎÏ ÁÎÇÌÉÊÓËÏÅ ÎÁÚ×ÁÎÉÅ ÄÏËÕÍÅÎÔÁ
-#: ../roundup/admin.py:1485
+#: ../roundup/admin.py:1496
 #, python-format
 msgid ""
 "\n"
@@ -960,7 +960,7 @@ msgstr ""
 " ðÏÓÌÅ ÜÔÏÇÏ ×Ù ÄÏÌÖÎÙ ×ÙÐÏÌÎÉÔØ ËÏÍÁÎÄÕ \"roundup-admin initialise\".\n"
 "---------------------------------------------------------------------------\n"
 
-#: ../roundup/admin.py:1501
+#: ../roundup/admin.py:1512
 msgid ""
 "Usage: list classname [property]\n"
 "        List the instances of a class.\n"
@@ -989,17 +989,17 @@ msgstr ""
 "        ×ÙÄÁÅÔ ÓÐÉÓÏË ÚÎÁÞÅÎÉÊ ÜÔÏÇÏ ÁÔÒÉÂÕÔÁ.\n"
 "        "
 
-#: ../roundup/admin.py:1514
+#: ../roundup/admin.py:1525
 msgid "Too many arguments supplied"
 msgstr "ðÏÄÁÎÏ ÓÌÉÛËÏÍ ÍÎÏÇÏ ÐÁÒÁÍÅÔÒÏ×"
 
-#: ../roundup/admin.py:1547
+#: ../roundup/admin.py:1558
 #, python-format
 msgid "%(nodeid)4s: %(value)s"
 msgstr ""
 
 #. noqa: ARG002  - args unused
-#: ../roundup/admin.py:1554
+#: ../roundup/admin.py:1565
 msgid ""
 "Usage: migrate\n"
 "        Update a tracker's database to be compatible with the Roundup\n"
@@ -1022,17 +1022,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1574
+#: ../roundup/admin.py:1585
 #, python-format
 msgid "Tracker updated to schema version %s."
 msgstr ""
 
-#: ../roundup/admin.py:1578
+#: ../roundup/admin.py:1589
 #, python-format
 msgid "No migration action required. At schema version %s."
 msgstr ""
 
-#: ../roundup/admin.py:1583
+#: ../roundup/admin.py:1594
 #, fuzzy
 msgid ""
 "Usage: pack period | date\n"
@@ -1071,11 +1071,11 @@ msgstr ""
 "\n"
 "        "
 
-#: ../roundup/admin.py:1609
+#: ../roundup/admin.py:1620
 msgid "Invalid format"
 msgstr "îÅÐÒÁ×ÉÌØÎÙÊ ÆÏÒÍÁÔ"
 
-#: ../roundup/admin.py:1620
+#: ../roundup/admin.py:1631
 msgid ""
 "Usage: perftest [mode] [arguments]*\n"
 "        Time operations in Roundup.\n"
@@ -1093,25 +1093,25 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1657
+#: ../roundup/admin.py:1668
 msgid "Invalid 'rounds'. Must be larger than 999."
 msgstr ""
 
-#: ../roundup/admin.py:1661
+#: ../roundup/admin.py:1672
 #, python-format
 msgid "Invalid 'rounds'. It must be an integer not: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1688
+#: ../roundup/admin.py:1699
 msgid "scheme does not support rounds."
 msgstr ""
 
-#: ../roundup/admin.py:1691
+#: ../roundup/admin.py:1702
 #, python-format
 msgid "Hash time: %(time)0.9f seconds, scheme: %(scheme)s, rounds: %(rounds)s"
 msgstr ""
 
-#: ../roundup/admin.py:1697
+#: ../roundup/admin.py:1708
 msgid ""
 "Usage: pragma setting=value | 'list'\n"
 "        Set internal admin settings to a value.\n"
@@ -1140,49 +1140,49 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1732
+#: ../roundup/admin.py:1743
 #, python-format
 msgid "Argument must be setting=value, was given: %s."
 msgstr ""
 
-#: ../roundup/admin.py:1735
+#: ../roundup/admin.py:1746
 msgid "Current settings and values (NYI - not yet implemented):"
 msgstr ""
 
-#: ../roundup/admin.py:1746
+#: ../roundup/admin.py:1757
 msgid ""
 "      Help for this pragma is missing. Please report it to the Roundup "
 "project.\n"
 msgstr ""
 
-#: ../roundup/admin.py:1752
+#: ../roundup/admin.py:1763
 #, fuzzy, python-format
 msgid "Unknown setting %s. Try \"pragma list\"."
 msgstr "îÅÉÚ×ÅÓÔÎÏÅ ÉÍÑ ÐÏÌØÚÏ×ÁÔÅÌÑ"
 
-#: ../roundup/admin.py:1762
+#: ../roundup/admin.py:1773
 #, python-format
 msgid "Incorrect value for boolean setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1769
+#: ../roundup/admin.py:1780
 #, python-format
 msgid "Incorrect value for integer setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1776
+#: ../roundup/admin.py:1787
 #, python-format
 msgid ""
 "Incorrect value for setting %(setting)s: %(value)s. Should be no, both, or "
 "only."
 msgstr ""
 
-#: ../roundup/admin.py:1786
+#: ../roundup/admin.py:1797
 #, python-format
 msgid "Internal error: pragma can not handle values of type: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1795
+#: ../roundup/admin.py:1806
 #, fuzzy
 msgid ""
 "Usage: reindex [classname|classname:#-#|designator]*\n"
@@ -1206,17 +1206,17 @@ msgstr ""
 "        ÄÁÎÎÙÈ.  ïÂÙÞÎÏ ÐÏÓÔÒÏÅÎÉÅ ÉÎÄÅËÓÏ× ÐÒÏÉÓÈÏÄÉÔ Á×ÔÏÍÁÔÉÞÅÓËÉ.\n"
 "        "
 
-#: ../roundup/admin.py:1817
+#: ../roundup/admin.py:1828
 #, python-format
 msgid "no such item \"%(designator)s\""
 msgstr "ÏÂßÅËÔ \"%(designator)s\" ÎÅ ÓÕÝÅÓÔ×ÕÅÔ"
 
-#: ../roundup/admin.py:1827
+#: ../roundup/admin.py:1838
 #, fuzzy, python-format
 msgid "no such item \"%(class)s%(id)s\""
 msgstr "ÏÂßÅËÔ \"%(designator)s\" ÎÅ ÓÕÝÅÓÔ×ÕÅÔ"
 
-#: ../roundup/admin.py:1839
+#: ../roundup/admin.py:1850
 #, fuzzy
 msgid ""
 "Usage: restore designator[,designator]*\n"
@@ -1235,7 +1235,7 @@ msgstr ""
 "        ÍÏÖÎÏ ÐÏÌØÚÏ×ÁÔØÓÑ ÓÎÏ×Á.\n"
 "        "
 
-#: ../roundup/admin.py:1870
+#: ../roundup/admin.py:1881
 #, fuzzy
 msgid ""
 "Usage: retire designator[,designator]*\n"
@@ -1258,7 +1258,7 @@ msgstr ""
 "        "
 
 #. noqa: ARG002 - args unused
-#: ../roundup/admin.py:1898
+#: ../roundup/admin.py:1909
 msgid ""
 "Usage: rollback\n"
 "        Undo all changes that are pending commit to the database.\n"
@@ -1279,7 +1279,7 @@ msgstr ""
 "        ÂÙÌÏ × ÍÏÍÅÎÔ ÐÏÓÌÅÄÎÅÊ ÚÁÐÉÓÉ.\n"
 "        "
 
-#: ../roundup/admin.py:1911
+#: ../roundup/admin.py:1922
 msgid ""
 "Usage: security [Role name]\n"
 "        Display the Permissions available to one or all Roles.\n"
@@ -1292,49 +1292,49 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1926
+#: ../roundup/admin.py:1937
 #, fuzzy, python-format
 msgid "No such Role \"%(role)s\"\n"
 msgstr "òÏÌØ \"%(role)s\" ÎÅ ÓÕÝÅÓÔ×ÕÅÔ"
 
-#: ../roundup/admin.py:1932
+#: ../roundup/admin.py:1943
 #, fuzzy, python-format
 msgid "New Web users get the Roles \"%(role)s\"\n"
 msgstr "îÏ×ÙÅ ÐÏÌØÚÏ×ÁÔÅÌÉ web ÐÏÌÕÞÁÀÔ ÒÏÌÉ \"%(role)s\""
 
-#: ../roundup/admin.py:1935
+#: ../roundup/admin.py:1946
 #, fuzzy, python-format
 msgid "New Web users get the Role \"%(role)s\"\n"
 msgstr "îÏ×ÙÅ ÐÏÌØÚÏ×ÁÔÅÌÉ web ÐÏÌÕÞÁÀÔ ÒÏÌØ \"%(role)s\""
 
-#: ../roundup/admin.py:1939
+#: ../roundup/admin.py:1950
 #, fuzzy, python-format
 msgid "New Email users get the Roles \"%(role)s\"\n"
 msgstr "îÏ×ÙÅ ÐÏÌØÚÏ×ÁÔÅÌÉ email ÐÏÌÕÞÁÀÔ ÒÏÌÉ \"%(role)s\""
 
-#: ../roundup/admin.py:1941
+#: ../roundup/admin.py:1952
 #, fuzzy, python-format
 msgid "New Email users get the Role \"%(role)s\"\n"
 msgstr "îÏ×ÙÅ ÐÏÌØÚÏ×ÁÔÅÌÉ email ÐÏÌÕÞÁÀÔ ÒÏÌØ \"%(role)s\""
 
-#: ../roundup/admin.py:1944
+#: ../roundup/admin.py:1955
 #, fuzzy, python-format
 msgid "Role \"%(name)s\":\n"
 msgstr "òÏÌØ \"%(name)s\":"
 
-#: ../roundup/admin.py:1950
+#: ../roundup/admin.py:1961
 #, fuzzy
 msgid " %(description)s (%(name)s for \"%(klass)s\""
 msgstr " %(description)s (%(name)s ÔÏÌØËÏ ÄÌÑ ËÌÁÓÓÁ \"%(klass)s\")"
 
-#: ../roundup/admin.py:1950
+#: ../roundup/admin.py:1961
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\": %(properties)s only)\n"
 msgstr ""
 " %(description)s (%(name)s ÄÌÑ ËÌÁÓÓÁ \"%(klass)s\": ÔÏÌØËÏ Ó×ÏÊÓÔ×Á "
 "%(properties)s)"
 
-#: ../roundup/admin.py:1963
+#: ../roundup/admin.py:1974
 #, python-format
 msgid ""
 "\n"
@@ -1342,17 +1342,17 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/admin.py:1969
+#: ../roundup/admin.py:1980
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\" only)\n"
 msgstr " %(description)s (%(name)s ÔÏÌØËÏ ÄÌÑ ËÌÁÓÓÁ \"%(klass)s\")"
 
-#: ../roundup/admin.py:1972
+#: ../roundup/admin.py:1983
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s)\n"
 msgstr " %(description)s (%(name)s ÔÏÌØËÏ ÄÌÑ ËÌÁÓÓÁ \"%(klass)s\")"
 
-#: ../roundup/admin.py:1976
+#: ../roundup/admin.py:1987
 #, fuzzy
 msgid ""
 "Usage: set items property=value [property=value ...]\n"
@@ -1387,7 +1387,7 @@ msgstr ""
 "        ÁÔÒÉÂÕÔ.  (îÁÐÒÉÍÅÒ, \"1,2,3\".)\n"
 "        "
 
-#: ../roundup/admin.py:2044
+#: ../roundup/admin.py:2055
 msgid ""
 "Usage: specification classname\n"
 "        Show the properties for a classname.\n"
@@ -1401,17 +1401,17 @@ msgstr ""
 "        ÷ÙÄÁÅÔ ÓÐÉÓÏË ÁÔÒÉÂÕÔÏ× ÕËÁÚÁÎÎÏÇÏ ËÌÁÓÓÁ.\n"
 "        "
 
-#: ../roundup/admin.py:2063
+#: ../roundup/admin.py:2074
 #, fuzzy, python-format
 msgid "%(key)s: %(value)s (key property)\n"
 msgstr "%(key)s: %(value)s (ËÌÀÞÅ×ÏÊ ÁÔÒÉÂÕÔ)"
 
-#: ../roundup/admin.py:2066
+#: ../roundup/admin.py:2077
 #, fuzzy, python-format
 msgid "%(key)s: %(value)s\n"
 msgstr "%(key)s: %(value)s (ËÌÀÞÅ×ÏÊ ÁÔÒÉÂÕÔ)"
 
-#: ../roundup/admin.py:2069
+#: ../roundup/admin.py:2080
 msgid ""
 "Usage: table classname [property[,property]*]\n"
 "        List the instances of a class in tabular form.\n"
@@ -1471,17 +1471,17 @@ msgstr ""
 "        ÏÂÒÅÚÁÅÔ ÚÎÁÞÅÎÉÑ ÓÔÏÌÂÃÁ \"Name\" ÄÏ ÞÅÔÙÒÅÈ ÓÉÍ×ÏÌÏ×.\n"
 "        "
 
-#: ../roundup/admin.py:2115
+#: ../roundup/admin.py:2126
 #, python-format
 msgid "\"%(spec)s\" not name:width"
 msgstr "úÎÁÞÅÎÉÅ \"%(spec)s\" ÄÏÌÖÎÏ ÂÙÔØ ÚÁÄÁÎÏ ËÁË ÉÍÑ:ÛÉÒÉÎÁ"
 
-#: ../roundup/admin.py:2137
+#: ../roundup/admin.py:2148
 #, python-format
 msgid "\"%(spec)s\" does not have an integer width: \"%(width)s\""
 msgstr ""
 
-#: ../roundup/admin.py:2173
+#: ../roundup/admin.py:2184
 msgid ""
 "Usage: templates [trace_search]\n"
 "        List templates and their installed directories.\n"
@@ -1491,7 +1491,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2201
+#: ../roundup/admin.py:2212
 #, fuzzy
 msgid ""
 "Usage: updateconfig <filename>\n"
@@ -1506,35 +1506,35 @@ msgstr ""
 "        ÉÓÐÏÌØÚÕÑ ÎÁÓÔÒÏÊËÉ ÐÏ ÕÍÏÌÞÁÎÉÀ.\n"
 "        "
 
-#: ../roundup/admin.py:2210 ../roundup/cgi/actions.py:886
-#: ../roundup/cgi/actions.py:897 ../roundup/cgi/actions.py:1099
-#: ../roundup/cgi/actions.py:1113 ../roundup/cgi/actions.py:886:897 :1099:1113
+#: ../roundup/admin.py:2221 ../roundup/cgi/actions.py:891
+#: ../roundup/cgi/actions.py:902 ../roundup/cgi/actions.py:1104
+#: ../roundup/cgi/actions.py:1118 ../roundup/cgi/actions.py:891:902 :1104:1118
 #, python-format
 msgid "Error: %s"
 msgstr "ïÛÉÂËÁ: %s"
 
-#: ../roundup/admin.py:2242
+#: ../roundup/admin.py:2253
 #, python-format
 msgid "Unknown command \"%(command)s\" (\"help commands\" for a list)"
 msgstr ""
 "ëÏÍÁÎÄÁ \"%(command)s\" ÎÅÉÚ×ÅÓÔÎÁ. (\"help commands\" ×ÙÄÁÅÔ ÓÐÉÓÏË ËÏÍÁÎÄ)"
 
-#: ../roundup/admin.py:2248
+#: ../roundup/admin.py:2259
 #, python-format
 msgid "Multiple commands match \"%(command)s\": %(list)s"
 msgstr "\"%(command)s\" ÓÏÏÔ×ÅÔÓÔ×ÕÅÔ ÎÅÓËÏÌØËÉÍ ËÏÍÁÎÄÁÍ: %(list)s"
 
-#: ../roundup/admin.py:2263
+#: ../roundup/admin.py:2274
 msgid "Enter tracker home: "
 msgstr "äÏÍÁÛÎÉÊ ËÁÔÁÌÏÇ ÔÒÅËÅÒÁ: "
 
-#: ../roundup/admin.py:2292 ../roundup/admin.py:2296
-#: ../roundup/admin.py:2292:2296
+#: ../roundup/admin.py:2303 ../roundup/admin.py:2307
+#: ../roundup/admin.py:2303:2307
 #, python-format
 msgid "Error: Couldn't open tracker: %(message)s"
 msgstr "ïÛÉÂËÁ: ôÒÅËÅÒ ÎÅ ÏÔËÒÙ×ÁÅÔÓÑ: %(message)s"
 
-#: ../roundup/admin.py:2344
+#: ../roundup/admin.py:2355
 #, python-format
 msgid ""
 "Roundup %s ready for input.\n"
@@ -1543,58 +1543,58 @@ msgstr ""
 "Roundup %s Ë ×ÁÛÉÍ ÕÓÌÕÇÁÍ.\n"
 "÷×ÅÄÉÔÅ \"help\" ÄÌÑ ÓÐÒÁ×ËÉ."
 
-#: ../roundup/admin.py:2377
+#: ../roundup/admin.py:2388
 msgid "Note: command history and editing not available"
 msgstr "ðÒÉÍÅÞÁÎÉÅ: ÒÁÂÏÔÁÅÔ ÒÅÄÁËÔÏÒ É ÉÓÔÏÒÉÑ ËÏÍÁÎÄ"
 
-#: ../roundup/admin.py:2383
+#: ../roundup/admin.py:2394
 msgid "exit..."
 msgstr "ÐÒÉÈÏÄÉÔÅ Ë ÎÁÍ ÅÝÅ..."
 
-#: ../roundup/admin.py:2396
+#: ../roundup/admin.py:2407
 msgid "There are unsaved changes. Commit them (y/N)? "
 msgstr "ïÊ, ÔÕÔ ÎÅÓÏÈÒÁÎÅÎÎÙÅ ÉÚÍÅÎÅÎÉÑ. úÁÐÉÓÁÔØ × ÂÁÚÕ ÄÁÎÎÙÈ (y/N)? "
 
-#: ../roundup/backends/back_anydbm.py:215
-#: ../roundup/backends/rdbms_common.py:928
+#: ../roundup/backends/back_anydbm.py:213
+#: ../roundup/backends/rdbms_common.py:926
 #, python-format
 msgid "Class \"%s\" already defined."
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:280
+#: ../roundup/backends/back_anydbm.py:278
 #: ../roundup/backends/sessions_dbm.py:61
 msgid "Couldn't identify database type"
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:314
+#: ../roundup/backends/back_anydbm.py:312
 #, python-format
 msgid ""
 "Couldn't open database - the required module '%s' (as dbm.gnu) is not "
 "available"
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:318
+#: ../roundup/backends/back_anydbm.py:316
 #, python-format
 msgid "Couldn't open database - the required module '%s' is not available"
 msgstr ""
 
 #: ../roundup/backends/back_anydbm.py:873
 #: ../roundup/backends/back_anydbm.py:886
-#: ../roundup/backends/back_anydbm.py:1160
-#: ../roundup/backends/back_anydbm.py:1195
-#: ../roundup/backends/back_anydbm.py:1424
-#: ../roundup/backends/back_anydbm.py:1442
-#: ../roundup/backends/back_anydbm.py:1489
-#: ../roundup/backends/back_anydbm.py:2135
+#: ../roundup/backends/back_anydbm.py:1162
+#: ../roundup/backends/back_anydbm.py:1197
+#: ../roundup/backends/back_anydbm.py:1426
+#: ../roundup/backends/back_anydbm.py:1444
+#: ../roundup/backends/back_anydbm.py:1492
+#: ../roundup/backends/back_anydbm.py:2138
 #: ../roundup/backends/back_anydbm.py:873:886
-#: ../roundup/backends/rdbms_common.py:1720
-#: ../roundup/backends/rdbms_common.py:1967
-#: ../roundup/backends/rdbms_common.py:2206
-#: ../roundup/backends/rdbms_common.py:2226
-#: ../roundup/backends/rdbms_common.py:2279
-#: ../roundup/backends/rdbms_common.py:3254
-#: ../roundup/backends/rdbms_common.py:1720:1967 :1160:1195 :1424:1442:1489
-#: :2135 :2206:2226 :2279:3254
+#: ../roundup/backends/rdbms_common.py:1721
+#: ../roundup/backends/rdbms_common.py:1972
+#: ../roundup/backends/rdbms_common.py:2211
+#: ../roundup/backends/rdbms_common.py:2231
+#: ../roundup/backends/rdbms_common.py:2293
+#: ../roundup/backends/rdbms_common.py:3268
+#: ../roundup/backends/rdbms_common.py:1721:1972 :1162:1197 :1426:1444:1492
+#: :2138 :2211:2231 :2293:3268
 msgid "Database open read-only"
 msgstr ""
 
@@ -1620,45 +1620,50 @@ msgstr ""
 msgid "Unable to get lock after 10 retries on %s."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:632
+#: ../roundup/backends/rdbms_common.py:630
 #, python-format
 msgid "ALTER operation disallowed: %(old)r -> %(new)r."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:867
+#: ../roundup/backends/rdbms_common.py:865
 #, python-format
 msgid "CREATE operation disallowed: \"%s\"."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:884
+#: ../roundup/backends/rdbms_common.py:882
 #, python-format
 msgid "DROP operation disallowed: \"%s\"."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:1863
+#: ../roundup/backends/rdbms_common.py:1864
 msgid "create"
 msgstr "ÓÏÚÄÁÎÉÅ"
 
-#: ../roundup/backends/rdbms_common.py:2038
+#: ../roundup/backends/rdbms_common.py:2043
 msgid "unlink"
 msgstr "ÏÔ×ÑÚËÁ"
 
-#: ../roundup/backends/rdbms_common.py:2042
+#: ../roundup/backends/rdbms_common.py:2047
 msgid "link"
 msgstr "ÐÒÉ×ÑÚËÁ"
 
-#: ../roundup/backends/rdbms_common.py:2187
+#: ../roundup/backends/rdbms_common.py:2192
 msgid "set"
 msgstr "ÕÓÔÁÎÏ×ËÁ"
 
-#: ../roundup/backends/rdbms_common.py:2216
+#: ../roundup/backends/rdbms_common.py:2221
 msgid "retired"
 msgstr "ÚÁÐÒÅÝÅÎÉÅ"
 
-#: ../roundup/backends/rdbms_common.py:2246
+#: ../roundup/backends/rdbms_common.py:2251
 msgid "restored"
 msgstr "×ÏÓÓÔÁÎÏ×ÌÅÎÉÅ"
 
+#: ../roundup/backends/rdbms_common.py:2265
+#, fuzzy, python-format
+msgid "class %(cls)s: %(value)r is not an id"
+msgstr "ÁÔÒÉÂÕÔ \"%(propname)s\": ÚÎÁÞÅÎÉÅ \"%(value)s\" ÏÔÓÕÔÓÔ×ÕÅÔ × ÓÐÉÓËÅ"
+
 #: ../roundup/backends/sessions_redis.py:78
 #: ../roundup/backends/sessions_redis.py:97
 #: ../roundup/backends/sessions_redis.py:78:97
@@ -1743,10 +1748,10 @@ msgstr ""
 "%(classname)s)"
 
 #: ../roundup/cgi/actions.py:228 ../roundup/cgi/actions.py:266
-#: ../roundup/cgi/actions.py:493 ../roundup/cgi/actions.py:833
-#: ../roundup/cgi/actions.py:880 ../roundup/cgi/actions.py:1084
-#: ../roundup/cgi/actions.py:1246 ../roundup/cgi/actions.py:228:266:1246
-#: :493:833 :880:1084
+#: ../roundup/cgi/actions.py:493 ../roundup/cgi/actions.py:838
+#: ../roundup/cgi/actions.py:885 ../roundup/cgi/actions.py:1089
+#: ../roundup/cgi/actions.py:1251 ../roundup/cgi/actions.py:228:266:1251
+#: :493:838 :885:1089
 #, fuzzy
 msgid "Invalid request"
 msgstr "îÅÐÒÁ×ÉÌØÎÙÊ ÆÏÒÍÁÔ"
@@ -1797,8 +1802,8 @@ msgstr "
 msgid "Invalid integer: "
 msgstr "îÅÐÒÁ×ÉÌØÎÙÊ ÐÁÒÏÌØ ÉÌÉ ÉÍÑ ÐÏÌØÚÏ×ÁÔÅÌÑ."
 
-#: ../roundup/cgi/actions.py:531 ../roundup/cgi/actions.py:735
-#: ../roundup/cgi/actions.py:531:735
+#: ../roundup/cgi/actions.py:531 ../roundup/cgi/actions.py:740
+#: ../roundup/cgi/actions.py:531:740
 #, python-format
 msgid "You do not have permission to create %(class)s"
 msgstr "õ ×ÁÓ ÎÅÔ ÒÁÚÒÅÛÅÎÉÑ ÓÏÚÄÁ×ÁÔØ %(class)s"
@@ -1808,8 +1813,8 @@ msgstr "
 msgid "Not enough values on line %(line)s"
 msgstr "÷ ÓÔÒÏËÅ %(line)s ÎÅ È×ÁÔÁÅÔ ÚÎÁÞÅÎÉÊ"
 
-#: ../roundup/cgi/actions.py:556 ../roundup/cgi/actions.py:723
-#: ../roundup/cgi/actions.py:556:723
+#: ../roundup/cgi/actions.py:556 ../roundup/cgi/actions.py:728
+#: ../roundup/cgi/actions.py:556:728
 #, python-format
 msgid "You do not have permission to edit %(class)s"
 msgstr "õ ×ÁÓ ÎÅÔ ÒÁÚÒÅÛÅÎÉÑ ÒÅÄÁËÔÉÒÏ×ÁÔØ %(class)s"
@@ -1818,17 +1823,17 @@ msgstr "
 msgid "Items edited OK"
 msgstr "ïÂßÅËÔÙ ÉÚÍÅÎÅÎÙ ÕÓÐÅÛÎÏ"
 
-#: ../roundup/cgi/actions.py:671
+#: ../roundup/cgi/actions.py:676
 #, python-format
 msgid "%(class)s %(id)s %(properties)s edited ok"
 msgstr "éÚÍÅÎÅÎÙ ÁÔÒÉÂÕÔÙ %(properties)s ÏÂßÅËÔÁ %(class)s %(id)s"
 
-#: ../roundup/cgi/actions.py:689
+#: ../roundup/cgi/actions.py:694
 #, python-format
 msgid "%(class)s %(id)s created"
 msgstr "%(class)s %(id)s ÓÏÚÄÁÎ"
 
-#: ../roundup/cgi/actions.py:817
+#: ../roundup/cgi/actions.py:822
 #, fuzzy, python-format
 msgid ""
 "Edit Error: someone else has edited this %(klass)s (%(props)s). View <a "
@@ -1838,12 +1843,12 @@ msgstr ""
 "target=\"new\" href=\"%(klass)s%(id)s\">ðÒÏÓÍÏÔÒÅÔØ ÜÔÉ ÉÚÍÅÎÅÎÉÑ</a> × "
 "ÄÒÕÇÏÍ ÏËÎÅ."
 
-#: ../roundup/cgi/actions.py:850
+#: ../roundup/cgi/actions.py:855
 #, python-format
 msgid "Edit Error: %s"
 msgstr "ïÛÉÂËÁ ÒÅÄÁËÔÉÒÏ×ÁÎÉÑ: %s"
 
-#: ../roundup/cgi/actions.py:931
+#: ../roundup/cgi/actions.py:936
 msgid ""
 "Invalid One Time Key!\n"
 "(a Mozilla bug may cause this message to show up erroneously, please check "
@@ -1853,12 +1858,12 @@ msgstr ""
 "(éÚ-ÚÁ ÏÛÉÂËÉ × ÂÒÁÕÚÅÒÅ Mozilla ÜÔÏ ÓÏÏÂÝÅÎÉÅ ÍÏÖÅÔ ÂÙÔØ ÎÅ×ÅÒÎÙÍ. "
 "ðÒÏ×ÅÒØÔÅ ×ÁÛÕ ÐÏÞÔÕ, ÐÏÖÁÌÕÊÓÔÁ.)"
 
-#: ../roundup/cgi/actions.py:972
+#: ../roundup/cgi/actions.py:977
 #, fuzzy, python-format
 msgid "Password reset for %s"
 msgstr "óÂÒÏÓ ÐÁÒÏÌÑ"
 
-#: ../roundup/cgi/actions.py:973
+#: ../roundup/cgi/actions.py:978
 #, python-format
 msgid ""
 "\n"
@@ -1867,29 +1872,29 @@ msgid ""
 "Your password is now: %(password)s\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:982
+#: ../roundup/cgi/actions.py:987
 #, python-format
 msgid "Password reset and email sent to %s"
 msgstr "ðÁÒÏÌØ ÓÂÒÏÛÅÎ.  ðÏ ÁÄÒÅÓÕ %s ÏÔÐÒÁ×ÌÅÎÏ ÐÉÓØÍÏ."
 
-#: ../roundup/cgi/actions.py:991
+#: ../roundup/cgi/actions.py:996
 msgid "Unknown username"
 msgstr "îÅÉÚ×ÅÓÔÎÏÅ ÉÍÑ ÐÏÌØÚÏ×ÁÔÅÌÑ"
 
-#: ../roundup/cgi/actions.py:999
+#: ../roundup/cgi/actions.py:1004
 msgid "Unknown email address"
 msgstr "îÅÉÚ×ÅÓÔÎÙÊ ÁÄÒÅÓ email"
 
-#: ../roundup/cgi/actions.py:1004
+#: ../roundup/cgi/actions.py:1009
 msgid "You need to specify a username or address"
 msgstr "÷Ù ÄÏÌÖÎÙ ÕËÁÚÁÔØ ÉÍÑ ÐÏÌØÚÏ×ÁÔÅÌÑ ÉÌÉ ÁÄÒÅÓ email"
 
-#: ../roundup/cgi/actions.py:1015
+#: ../roundup/cgi/actions.py:1020
 #, fuzzy, python-format
 msgid "Confirm reset of password for %s"
 msgstr "(ÅÝÅ ÒÁÚ)"
 
-#: ../roundup/cgi/actions.py:1016
+#: ../roundup/cgi/actions.py:1021
 #, python-format
 msgid ""
 "\n"
@@ -1903,31 +1908,31 @@ msgid ""
 "You should then receive another email with the new password.\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1029
+#: ../roundup/cgi/actions.py:1034
 #, python-format
 msgid "Email sent to primary notification address for %s."
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1031
+#: ../roundup/cgi/actions.py:1036
 #, fuzzy, python-format
 msgid "Email sent to %s."
 msgstr "ðÉÓØÍÏ ÏÔÐÒÁ×ÌÅÎÏ ÎÁ %s"
 
-#: ../roundup/cgi/actions.py:1046
+#: ../roundup/cgi/actions.py:1051
 msgid "You are now registered, welcome!"
 msgstr "÷Ù ÚÁÒÅÇÉÓÔÒÉÒÏ×ÁÎÙ.  äÏÂÒÏ ÐÏÖÁÌÏ×ÁÔØ!"
 
-#: ../roundup/cgi/actions.py:1139
+#: ../roundup/cgi/actions.py:1144
 #, python-format
 msgid "Username '%s' is already used."
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1163
+#: ../roundup/cgi/actions.py:1168
 #, python-format
 msgid "Complete your registration to %(tracker_name)s -- key %(key)s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1167
+#: ../roundup/cgi/actions.py:1172
 #, python-format
 msgid ""
 "To complete your registration of the user \"%(name)s\" with\n"
@@ -1943,12 +1948,12 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1181
+#: ../roundup/cgi/actions.py:1186
 #, python-format
 msgid "Complete your registration to %s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1182
+#: ../roundup/cgi/actions.py:1187
 #, python-format
 msgid ""
 "To complete your registration of the user \"%(name)s\" with\n"
@@ -1958,44 +1963,44 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1206
+#: ../roundup/cgi/actions.py:1211
 msgid "It is not permitted to supply roles at registration."
 msgstr "îÅÌØÚÑ ÕËÁÚÙ×ÁÔØ ÒÏÌÉ ÐÒÉ ÒÅÇÉÓÔÒÁÃÉÉ"
 
-#: ../roundup/cgi/actions.py:1220
+#: ../roundup/cgi/actions.py:1225
 msgid "You are logged out"
 msgstr "óÅÁÎÓ ÒÁÂÏÔÙ ÚÁ×ÅÒÛÅÎ"
 
-#: ../roundup/cgi/actions.py:1250
+#: ../roundup/cgi/actions.py:1255
 msgid "Username required"
 msgstr "îÅ ÕËÁÚÁÎÏ ÉÍÑ ÐÏÌØÚÏ×ÁÔÅÌÑ"
 
-#: ../roundup/cgi/actions.py:1354
+#: ../roundup/cgi/actions.py:1359
 #, python-format
 msgid "Welcome %(username)s!"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1477
+#: ../roundup/cgi/actions.py:1482
 #, python-format
 msgid "Logins occurring too fast. Please wait: %s seconds."
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1515 ../roundup/cgi/actions.py:1526
-#: ../roundup/cgi/actions.py:1515:1526
+#: ../roundup/cgi/actions.py:1520 ../roundup/cgi/actions.py:1531
+#: ../roundup/cgi/actions.py:1520:1531
 msgid "Invalid login"
 msgstr "îÅÐÒÁ×ÉÌØÎÙÊ ÐÁÒÏÌØ ÉÌÉ ÉÍÑ ÐÏÌØÚÏ×ÁÔÅÌÑ."
 
-#: ../roundup/cgi/actions.py:1532
+#: ../roundup/cgi/actions.py:1537
 msgid "You do not have permission to login"
 msgstr "õ ×ÁÓ ÎÅÔ ÒÁÚÒÅÛÅÎÉÑ ÎÁ ÒÁÂÏÔÕ Ó ÓÉÓÔÅÍÏÊ"
 
-#: ../roundup/cgi/actions.py:1577 ../roundup/cgi/actions.py:1757
-#: ../roundup/cgi/actions.py:1577:1757
+#: ../roundup/cgi/actions.py:1582 ../roundup/cgi/actions.py:1762
+#: ../roundup/cgi/actions.py:1582:1762
 #, python-format
 msgid "Column \"%(column)s\" not found in %(class)s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1822
+#: ../roundup/cgi/actions.py:1827
 #, fuzzy, python-format
 msgid "You do not have permission to view %(class)s"
 msgstr "õ ×ÁÓ ÎÅÔ ÒÁÚÒÅÛÅÎÉÑ ÒÅÄÁËÔÉÒÏ×ÁÔØ %(class)s"
@@ -2128,8 +2133,8 @@ msgstr "
 msgid "Unrecognized charset: %r"
 msgstr "ëÏÄÉÒÏ×ËÁ %r ÎÅ ÒÁÓÐÏÚÎÁÎÁ"
 
-#: ../roundup/cgi/client.py:1381 ../roundup/cgi/client.py:2394
-#: ../roundup/cgi/client.py:1381:2394
+#: ../roundup/cgi/client.py:1381 ../roundup/cgi/client.py:2396
+#: ../roundup/cgi/client.py:1381:2396
 msgid "broken form: multiple @action values submitted"
 msgstr ""
 
@@ -2207,50 +2212,51 @@ msgstr ""
 
 #: ../roundup/cgi/client.py:1679
 #, python-format
-msgid "csrf X-REQUESTED-WITH xmlrpc required header check failed for user%s."
+msgid ""
+"csrf X-REQUESTED-WITH xmlrpc required header check failed for user%(userid)s."
 msgstr ""
 
 #: ../roundup/cgi/client.py:1720
 #, python-format
-msgid "Required csrf field missing for user%s"
+msgid "Required csrf field missing for user%(userid)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1722 ../roundup/cgi/client.py:1749
-#: ../roundup/cgi/client.py:1766 ../roundup/cgi/client.py:1722:1749:1766
+#: ../roundup/cgi/client.py:1723 ../roundup/cgi/client.py:1751
+#: ../roundup/cgi/client.py:1768 ../roundup/cgi/client.py:1723:1751:1768
 msgid ""
 "We can't validate your session (csrf failure). Re-enter any unsaved data and "
 "try again."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1726
+#: ../roundup/cgi/client.py:1728
 #, python-format
-msgid "csrf field not supplied by user%s"
+msgid "csrf field not supplied by user%(userid)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1738
+#: ../roundup/cgi/client.py:1740
 #, python-format
 msgid ""
 "Csrf mismatch user: current user %(user)s != stored user %(stored)s, current "
 "session, stored session: %(cur_sess)s,%(stor_sess)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1756
+#: ../roundup/cgi/client.py:1758
 #, python-format
 msgid ""
 "Csrf mismatch user: current session %(curr_sess)s != stored session "
 "%(stor_sess)s, current user/stored user is: %(user)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1948
+#: ../roundup/cgi/client.py:1950
 msgid "You are not allowed to view this file."
 msgstr "õ ×ÁÓ ÎÅÔ ÒÁÚÒÅÛÅÎÉÑ ÎÁ ÐÒÏÓÍÏÔÒ ÜÔÏÇÏ ÆÁÊÌÁ."
 
-#: ../roundup/cgi/client.py:2272
+#: ../roundup/cgi/client.py:2274
 #, python-format
 msgid "%(starttag)sTime elapsed: %(seconds)fs%(endtag)s\n"
 msgstr "%(starttag)súÁÔÒÁÞÅÎÎÏÅ ×ÒÅÍÑ: %(seconds)fs%(endtag)s\n"
 
-#: ../roundup/cgi/client.py:2276
+#: ../roundup/cgi/client.py:2278
 #, python-format
 msgid ""
 "%(starttag)sCache hits: %(cache_hits)d, misses %(cache_misses)d. Loading "
@@ -2260,7 +2266,7 @@ msgstr ""
 "%(cache_misses)d. úÁÇÒÕÚËÁ ÏÂßÅËÔÏ×: %(get_items)f ÓÅË. æÉÌØÔÒÁÃÉÑ: "
 "%(filtering)f ÓÅË.%(endtag)s\n"
 
-#: ../roundup/cgi/client.py:2815
+#: ../roundup/cgi/client.py:2817
 #, python-format
 msgid ""
 "Cache failure: compressed file %(compressed)s is older than its source file "
@@ -2329,113 +2335,113 @@ msgstr[2] "
 msgid "You are not allowed to %(action)s items of class %(class)s"
 msgstr "õ ×ÁÓ ÎÅÔ ÒÁÚÒÅÛÅÎÉÑ %(action)s ÄÌÑ ËÌÁÓÓÁ %(class)s"
 
-#: ../roundup/cgi/templating.py:916
+#: ../roundup/cgi/templating.py:892
 msgid "(list)"
 msgstr "(ÓÐÉÓÏË)"
 
-#: ../roundup/cgi/templating.py:991
+#: ../roundup/cgi/templating.py:975
 msgid "Submit New Entry"
 msgstr "äÏÂÁ×ÉÔØ"
 
 # ../roundup/cgi/templating.py:673 :792 :1166 :1187 :1231 :1253 :1287 :1326
 # :1377 :1394 :1470 :1490 :1503 :1520 :1530 :1580 :1755
-#: ../roundup/cgi/templating.py:1013 ../roundup/cgi/templating.py:1189
-#: ../roundup/cgi/templating.py:1824 ../roundup/cgi/templating.py:1855
-#: ../roundup/cgi/templating.py:1876 ../roundup/cgi/templating.py:1914
-#: ../roundup/cgi/templating.py:1967 ../roundup/cgi/templating.py:1991
-#: ../roundup/cgi/templating.py:1998 ../roundup/cgi/templating.py:2035
-#: ../roundup/cgi/templating.py:2088 ../roundup/cgi/templating.py:2121
-#: ../roundup/cgi/templating.py:2216 ../roundup/cgi/templating.py:2237
-#: ../roundup/cgi/templating.py:2328 ../roundup/cgi/templating.py:2348
-#: ../roundup/cgi/templating.py:2370 ../roundup/cgi/templating.py:2413
-#: ../roundup/cgi/templating.py:2423 ../roundup/cgi/templating.py:2488
-#: ../roundup/cgi/templating.py:2791 ../roundup/cgi/templating.py:1013:1189
-#: :1824:1855 :1876:1914 :1967:1991 :1998:2035 :2088:2121 :2216:2237 :2328:2348
-#: :2370:2413 :2423:2488:2791
+#: ../roundup/cgi/templating.py:997 ../roundup/cgi/templating.py:1174
+#: ../roundup/cgi/templating.py:1809 ../roundup/cgi/templating.py:1840
+#: ../roundup/cgi/templating.py:1861 ../roundup/cgi/templating.py:1899
+#: ../roundup/cgi/templating.py:1952 ../roundup/cgi/templating.py:1976
+#: ../roundup/cgi/templating.py:1983 ../roundup/cgi/templating.py:2020
+#: ../roundup/cgi/templating.py:2077 ../roundup/cgi/templating.py:2115
+#: ../roundup/cgi/templating.py:2215 ../roundup/cgi/templating.py:2236
+#: ../roundup/cgi/templating.py:2357 ../roundup/cgi/templating.py:2377
+#: ../roundup/cgi/templating.py:2399 ../roundup/cgi/templating.py:2442
+#: ../roundup/cgi/templating.py:2452 ../roundup/cgi/templating.py:2517
+#: ../roundup/cgi/templating.py:2820 ../roundup/cgi/templating.py:997:1174
+#: :1809:1840 :1861:1899 :1952:1976 :1983:2020 :2077:2115 :2215:2236 :2357:2377
+#: :2399:2442 :2452:2517:2820
 msgid "[hidden]"
 msgstr "[ÎÅÄÏÓÔÕÐÎÏ]"
 
-#: ../roundup/cgi/templating.py:1014
+#: ../roundup/cgi/templating.py:998
 msgid "New node - no history"
 msgstr "îÏ×ÁÑ ËÁÒÔÏÞËÁ - ÎÅÔ ÉÓÔÏÒÉÉ"
 
-#: ../roundup/cgi/templating.py:1154
+#: ../roundup/cgi/templating.py:1139
 msgid "Submit Changes"
 msgstr "éÚÍÅÎÉÔØ"
 
-#: ../roundup/cgi/templating.py:1232
+#: ../roundup/cgi/templating.py:1217
 msgid "<em>The indicated property no longer exists</em>"
 msgstr "<em>õËÁÚÁÎÎÙÊ ÁÔÒÉÂÕÔ ÕÖÅ ÎÅ ÓÕÝÅÓÔ×ÕÅÔ.</em>"
 
-#: ../roundup/cgi/templating.py:1268
+#: ../roundup/cgi/templating.py:1253
 #, python-format
 msgid "The linked class %(classname)s no longer exists"
 msgstr "ó×ÑÚÑÎÎÙÊ ËÌÁÓÓ %(classname)s ÕÖÅ ÎÅ ÓÕÝÅÓÔ×ÕÅÔ"
 
-#: ../roundup/cgi/templating.py:1305 ../roundup/cgi/templating.py:1335
-#: ../roundup/cgi/templating.py:2497 ../roundup/cgi/templating.py:2800
-#: ../roundup/cgi/templating.py:1305:1335 :2497:2800
+#: ../roundup/cgi/templating.py:1290 ../roundup/cgi/templating.py:1320
+#: ../roundup/cgi/templating.py:2526 ../roundup/cgi/templating.py:2829
+#: ../roundup/cgi/templating.py:1290:1320 :2526:2829
 msgid "[label is missing]"
 msgstr ""
 
 # :823
-#: ../roundup/cgi/templating.py:1309 ../roundup/cgi/templating.py:1338
-#: ../roundup/cgi/templating.py:1309:1338
+#: ../roundup/cgi/templating.py:1294 ../roundup/cgi/templating.py:1323
+#: ../roundup/cgi/templating.py:1294:1323
 msgid "<strike>The linked node no longer exists</strike>"
 msgstr "<strike>ó×ÑÚÁÎÎÙÊ ÏÂßÅËÔ ÕÖÅ ÎÅ ÓÕÝÅÓÔ×ÕÅÔ</strike>"
 
-#: ../roundup/cgi/templating.py:1400
+#: ../roundup/cgi/templating.py:1385
 #, python-format
 msgid "%s: (no value)"
 msgstr "%s: (ÎÅÔ ÚÎÁÞÅÎÉÑ)"
 
-#: ../roundup/cgi/templating.py:1416
+#: ../roundup/cgi/templating.py:1401
 #, fuzzy, python-format
 msgid ""
 "<strong><em>This event %s is not handled by the history display!</em></"
 "strong>"
 msgstr "<strong><em>îÅÉÚ×ÅÓÔÎÙÊ ÔÉÐ ÓÏÂÙÔÉÑ!</em></strong>"
 
-#: ../roundup/cgi/templating.py:1429
+#: ../roundup/cgi/templating.py:1414
 msgid "<tr><td colspan=4><strong>Note:</strong></td></tr>"
 msgstr "<tr><td colspan=4><strong>ðÒÉÍÅÞÁÎÉÅ:</strong></td></tr>"
 
-#: ../roundup/cgi/templating.py:1438
+#: ../roundup/cgi/templating.py:1423
 msgid "History"
 msgstr "éÓÔÏÒÉÑ"
 
-#: ../roundup/cgi/templating.py:1440
+#: ../roundup/cgi/templating.py:1425
 msgid "<th>Date</th>"
 msgstr "<th>äÁÔÁ</th>"
 
-#: ../roundup/cgi/templating.py:1441
+#: ../roundup/cgi/templating.py:1426
 msgid "<th>User</th>"
 msgstr "<th>ðÏÌØÚÏ×ÁÔÅÌØ</th>"
 
-#: ../roundup/cgi/templating.py:1442
+#: ../roundup/cgi/templating.py:1427
 msgid "<th>Action</th>"
 msgstr "<th>äÅÊÓÔ×ÉÅ</th>"
 
-#: ../roundup/cgi/templating.py:1443
+#: ../roundup/cgi/templating.py:1428
 msgid "<th>Args</th>"
 msgstr "<th>ðÁÒÁÍÅÔÒÙ</th>"
 
-#: ../roundup/cgi/templating.py:1494
+#: ../roundup/cgi/templating.py:1479
 #, python-format
 msgid "Copy of %(class)s %(id)s"
 msgstr "ëÏÐÉÑ: %(class)s %(id)s"
 
-#: ../roundup/cgi/templating.py:2125 ../roundup/cgi/templating.py:2160
-#: ../roundup/cgi/templating.py:1382:2125:2160
+#: ../roundup/cgi/templating.py:2119 ../roundup/cgi/templating.py:2154
+#: ../roundup/cgi/templating.py:1367:2119:2154
 msgid "No"
 msgstr "îÅÔ"
 
-#: ../roundup/cgi/templating.py:2125 ../roundup/cgi/templating.py:2154
-#: ../roundup/cgi/templating.py:1382:2125:2154
+#: ../roundup/cgi/templating.py:2119 ../roundup/cgi/templating.py:2148
+#: ../roundup/cgi/templating.py:1367:2119:2148
 msgid "Yes"
 msgstr "äÁ"
 
-#: ../roundup/cgi/templating.py:2286
+#: ../roundup/cgi/templating.py:2315
 msgid ""
 "default value for DateHTMLProperty must be either DateHTMLProperty or string "
 "date representation."
@@ -2443,27 +2449,27 @@ msgstr ""
 "ÚÎÁÞÅÎÉÅ ÐÏ ÕÍÏÌÞÁÎÉÀ ÄÌÑ DateHTMLProperty ÄÏÌÖÎÏ ÂÙÔØ ÏÂßÅËÔÏÍ "
 "DateHTMLProperty ÉÌÉ ÓÔÒÏËÏ×ÙÍ ÐÒÅÄÓÔÁ×ÌÅÎÉÅÍ ÄÁÔÙ."
 
-#: ../roundup/cgi/templating.py:2468
+#: ../roundup/cgi/templating.py:2497
 #, python-format
 msgid "Attempt to look up %(attr)s on a missing value"
 msgstr "ðÏÐÙÔËÁ ÐÏÌÕÞÉÔØ ÁÔÒÉÂÕÔ \"%(attr)s\" ÎÅÓÕÝÅÓÔ×ÕÀÝÅÇÏ ÏÂßÅËÔÁ"
 
-#: ../roundup/cgi/templating.py:2479
+#: ../roundup/cgi/templating.py:2508
 #, fuzzy, python-format
 msgid "Attempt to look up %(item)s on a missing value"
 msgstr "ðÏÐÙÔËÁ ÐÏÌÕÞÉÔØ ÁÔÒÉÂÕÔ \"%(attr)s\" ÎÅÓÕÝÅÓÔ×ÕÀÝÅÇÏ ÏÂßÅËÔÁ"
 
-#: ../roundup/cgi/templating.py:2584
+#: ../roundup/cgi/templating.py:2613
 #, python-format
 msgid "<option %svalue=\"-1\">- no selection -</option>"
 msgstr "<option %svalue=\"-1\">- ÎÅ ÕËÁÚÁÎÏ -</option>"
 
-#: ../roundup/cgi/templating.py:3745
+#: ../roundup/cgi/templating.py:3777
 #, python-format
 msgid "Unable to read or expand file '%(name)s' in template '%(template)s'."
 msgstr ""
 
-#: ../roundup/cgi/templating.py:3795
+#: ../roundup/cgi/templating.py:3827
 #, python-format
 msgid ""
 "Found an incorrect token when expandfile applied string subsitution on "
@@ -2645,54 +2651,54 @@ msgstr "%s 
 msgid "in %s"
 msgstr "ÞÅÒÅÚ %s"
 
-#: ../roundup/hyperdb.py:120
+#: ../roundup/hyperdb.py:126
 #, fuzzy, python-format
 msgid "property %(property)s: %(errormsg)s"
 msgstr "ïÛÉÂËÁ: %s: %s"
 
-#: ../roundup/hyperdb.py:149
+#: ../roundup/hyperdb.py:161
 #, python-format
 msgid "property %(property)s: %(value)r is an invalid date (%(errormsg)s)"
 msgstr ""
 
-#: ../roundup/hyperdb.py:172
+#: ../roundup/hyperdb.py:184
 #, python-format
 msgid ""
 "property %(property)s: %(value)r is an invalid date interval (%(errormsg)s)"
 msgstr ""
 
-#: ../roundup/hyperdb.py:434
+#: ../roundup/hyperdb.py:446
 #, fuzzy, python-format
 msgid "property %(property)s: %(value)r is not a number"
 msgstr "ÁÔÒÉÂÕÔ \"%(propname)s\": ÚÎÁÞÅÎÉÅ \"%(value)s\" ÏÔÓÕÔÓÔ×ÕÅÔ × ÓÐÉÓËÅ"
 
-#: ../roundup/hyperdb.py:448
+#: ../roundup/hyperdb.py:460
 #, fuzzy, python-format
 msgid "property %(property)s: %(value)r is not an integer"
 msgstr "ÁÔÒÉÂÕÔ \"%(propname)s\": ÚÎÁÞÅÎÉÅ \"%(value)s\" ÏÔÓÕÔÓÔ×ÕÅÔ × ÓÐÉÓËÅ"
 
-#: ../roundup/hyperdb.py:470
+#: ../roundup/hyperdb.py:482
 #, python-format
 msgid "\"%s\" not a node designator"
 msgstr ""
 
-#: ../roundup/hyperdb.py:1499 ../roundup/hyperdb.py:1507
-#: ../roundup/hyperdb.py:1499:1507
+#: ../roundup/hyperdb.py:1515 ../roundup/hyperdb.py:1523
+#: ../roundup/hyperdb.py:1515:1523
 #, python-format
 msgid "Not a property name: %s"
 msgstr ""
 
-#: ../roundup/hyperdb.py:2038
+#: ../roundup/hyperdb.py:2054
 #, fuzzy, python-format
 msgid "property %(property)s: %(value)r is not a %(classname)s."
 msgstr "ÁÔÒÉÂÕÔ \"%(propname)s\": ÚÎÁÞÅÎÉÅ \"%(value)s\" ÏÔÓÕÔÓÔ×ÕÅÔ × ÓÐÉÓËÅ"
 
-#: ../roundup/hyperdb.py:2044
+#: ../roundup/hyperdb.py:2060
 #, python-format
 msgid "you may only enter ID values for property %s"
 msgstr ""
 
-#: ../roundup/hyperdb.py:2079
+#: ../roundup/hyperdb.py:2095
 #, python-format
 msgid "%(property)r is not a property of %(classname)s"
 msgstr ""
@@ -3026,60 +3032,60 @@ msgid ""
 "are: %(stack)s"
 msgstr ""
 
-#: ../roundup/pygettext.py:401
+#: ../roundup/pygettext.py:400
 #, python-format
 msgid "*** %(file)s:%(lineno)s: Seen unexpected token \"%(token)s\""
 msgstr ""
 
-#: ../roundup/pygettext.py:457
+#: ../roundup/pygettext.py:456
 #, python-format
 msgid "# File: %(filename)s, line: %(lineno)d"
 msgstr ""
 
-#: ../roundup/pygettext.py:464
+#: ../roundup/pygettext.py:463
 #, python-format
 msgid " %(filename)s:%(lineno)d"
 msgstr ""
 
-#: ../roundup/pygettext.py:540
+#: ../roundup/pygettext.py:539
 #, fuzzy, python-format
 msgid "Invalid value for --style: %s"
 msgstr "îÅÐÒÁ×ÉÌØÎÙÊ ÐÁÒÏÌØ ÉÌÉ ÉÍÑ ÐÏÌØÚÏ×ÁÔÅÌÑ."
 
-#: ../roundup/pygettext.py:548
+#: ../roundup/pygettext.py:547
 #, python-format
 msgid "pygettext.py (xgettext for Python) %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:554
+#: ../roundup/pygettext.py:553
 #, python-format
 msgid "--width argument must be an integer: %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:582
+#: ../roundup/pygettext.py:581
 #, python-format
 msgid "Can't read --exclude-file: %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:601
+#: ../roundup/pygettext.py:600
 msgid "Reading standard input"
 msgstr ""
 
-#: ../roundup/pygettext.py:606
+#: ../roundup/pygettext.py:605
 #, python-format
 msgid "Working on %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:640
+#: ../roundup/pygettext.py:639
 msgid "a unicode string"
 msgstr ""
 
-#: ../roundup/pygettext.py:642
+#: ../roundup/pygettext.py:641
 #, python-format
 msgid "*** Seen unexpected token \"%(token)s\""
 msgstr ""
 
-#: ../roundup/pygettext.py:643
+#: ../roundup/pygettext.py:642
 msgid "morethanonestring"
 msgstr ""
 
@@ -3199,33 +3205,33 @@ msgstr "
 msgid "creator"
 msgstr "Á×ÔÏÒ"
 
-#: ../roundup/roundupdb.py:426
+#: ../roundup/roundupdb.py:447
 #, python-format
 msgid "No key for \"%(adr)s\" in keyring"
 msgstr ""
 
-#: ../roundup/roundupdb.py:504
+#: ../roundup/roundupdb.py:525
 #, python-format
 msgid "New submission from %(authname)s%(authaddr)s:"
 msgstr "îÏ×ÏÅ ÐÏÓÔÕÐÌÅÎÉÅ ÏÔ %(authname)s%(authaddr)s:"
 
-#: ../roundup/roundupdb.py:507
+#: ../roundup/roundupdb.py:528
 #, python-format
 msgid "%(authname)s%(authaddr)s added the comment:"
 msgstr "%(authname)s%(authaddr)s ÄÏÂÁ×ÉÌ ÚÁÍÅÞÁÎÉÅ:"
 
-#: ../roundup/roundupdb.py:510
+#: ../roundup/roundupdb.py:531
 #, python-format
 msgid "Change by %(authname)s%(authaddr)s:"
 msgstr "éÚÍÅÎÅÎÉÅ %(authname)s%(authaddr)s:"
 
-#: ../roundup/roundupdb.py:529
+#: ../roundup/roundupdb.py:550
 #, python-format
 msgid "File '%(filename)s' not attached - you can download it from %(link)s."
 msgstr ""
 "æÁÊÌ '%(filename)s' ÎÅ ×ÌÏÖÅÎ - ×Ù ÍÏÖÅÔÅ ÓËÁÞÁÔØ ÅÇÏ ÐÏ ÁÄÒÅÓÕ %(link)s."
 
-#: ../roundup/roundupdb.py:904
+#: ../roundup/roundupdb.py:925
 #, python-format
 msgid ""
 "\n"
@@ -3335,62 +3341,62 @@ msgstr ""
 "<html><head><title>óÐÉÓÏË ÔÒÅËÅÒÏ× Roundup</title></head>\n"
 "<body><h1>óÐÉÓÏË ÔÒÅËÅÒÏ× Roundup</h1><ol>\n"
 
-#: ../roundup/scripts/roundup_server.py:598
+#: ../roundup/scripts/roundup_server.py:602
 #, fuzzy, python-format
 msgid "Error: %(type)s: %(value)s"
 msgstr "%(key)s: %(value)s (ËÌÀÞÅ×ÏÊ ÁÔÒÉÂÕÔ)"
 
-#: ../roundup/scripts/roundup_server.py:610
+#: ../roundup/scripts/roundup_server.py:614
 msgid "WARNING: ignoring \"-g\" argument, not root"
 msgstr ""
 "÷îéíáîéå: ÐÁÒÁÍÅÔÒ \"-g\" ÎÅ ÉÓÐÏÌØÚÕÅÔÓÑ, ÏÎ ÒÁÚÒÅÛÅÎ ÔÏÌØËÏ ÄÌÑ "
 "ÐÏÌØÚÏ×ÁÔÅÌÑ root"
 
-#: ../roundup/scripts/roundup_server.py:616
+#: ../roundup/scripts/roundup_server.py:620
 msgid "Can't change groups - no grp module"
 msgstr "ðÏÄÍÅÎÁ ÇÒÕÐÐÙ ÎÅ×ÏÚÍÏÖÎÁ - ÎÕÖÅÎ ÍÏÄÕÌØ grp"
 
-#: ../roundup/scripts/roundup_server.py:625
+#: ../roundup/scripts/roundup_server.py:629
 #, python-format
 msgid "Group %(group)s doesn't exist"
 msgstr "çÒÕÐÐÁ %(group)s ÎÅ ÓÕÝÅÓÔ×ÕÅÔ"
 
-#: ../roundup/scripts/roundup_server.py:637
+#: ../roundup/scripts/roundup_server.py:641
 msgid "Can't run as root!"
 msgstr "úÁÐÕÓË ÓÅÒ×ÅÒÁ Ó ÐÏÌÎÏÍÏÞÉÑÍÉ ÐÏÌØÚÏ×ÁÔÅÌÑ root ÚÁÐÒÅÝÅÎ!"
 
-#: ../roundup/scripts/roundup_server.py:640
+#: ../roundup/scripts/roundup_server.py:644
 msgid "WARNING: ignoring \"-u\" argument, not root"
 msgstr ""
 "÷îéíáîéå: ÐÁÒÁÍÅÔÒ \"-u\" ÎÅ ÉÓÐÏÌØÚÕÅÔÓÑ, ÏÎ ÒÁÚÒÅÛÅÎ ÔÏÌØËÏ ÄÌÑ "
 "ÐÏÌØÚÏ×ÁÔÅÌÑ root"
 
-#: ../roundup/scripts/roundup_server.py:646
+#: ../roundup/scripts/roundup_server.py:650
 msgid "Can't change users - no pwd module"
 msgstr "ðÏÄÍÅÎÁ ÐÏÌØÚÏ×ÁÔÅÌÑ ÎÅ×ÏÚÍÏÖÎÁ - ÎÕÖÅÎ ÍÏÄÕÌØ pwd"
 
-#: ../roundup/scripts/roundup_server.py:655
+#: ../roundup/scripts/roundup_server.py:659
 #, python-format
 msgid "User %(user)s doesn't exist"
 msgstr "ðÏÌØÚÏ×ÁÔÅÌØ %(user)s ÎÅ ÓÕÝÅÓÔ×ÕÅÔ"
 
-#: ../roundup/scripts/roundup_server.py:867
+#: ../roundup/scripts/roundup_server.py:871
 #, python-format
 msgid "Multiprocess mode \"%s\" is not available, switching to single-process"
 msgstr "òÅÖÉÍ \"%s\" ÎÅÄÏÓÔÕÐÅÎ, ÐÅÒÅËÌÀÞÁÅÍÓÑ × ÏÄÎÏÚÁÄÁÞÎÙÊ ÒÅÖÉÍ"
 
-#: ../roundup/scripts/roundup_server.py:895
+#: ../roundup/scripts/roundup_server.py:899
 #, python-format
 msgid "Unable to bind to port %s, port already in use."
 msgstr "îÅ×ÏÚÍÏÖÎÏ ÕÓÔÁÎÏ×ÉÔØ ÓÅÒ×ÅÒ ÎÁ ÐÏÒÔÕ %s, ÐÏÒÔ ÕÖÅ ÚÁÎÑÔ."
 
-#: ../roundup/scripts/roundup_server.py:899
+#: ../roundup/scripts/roundup_server.py:903
 #, fuzzy, python-format
 msgid ""
 "Unable to bind to port %(port)s, access not allowed, errno: %(errno)s %(msg)s"
 msgstr "îÅ×ÏÚÍÏÖÎÏ ÕÓÔÁÎÏ×ÉÔØ ÓÅÒ×ÅÒ ÎÁ ÐÏÒÔÕ %s, ÐÏÒÔ ÕÖÅ ÚÁÎÑÔ."
 
-#: ../roundup/scripts/roundup_server.py:978
+#: ../roundup/scripts/roundup_server.py:982
 msgid ""
 " -c <Command>  Windows Service options.\n"
 "               If you want to run the server as a Windows Service, you\n"
@@ -3407,7 +3413,7 @@ msgstr ""
 "               ÆÁÊÌ ÐÒÏÔÏËÏÌÁ.  ëÏÍÁÎÄÁ 'roundup-server -c help'\n"
 "               ×ÙÄÁÅÔ ÓÐÒÁ×ËÕ Ï ËÏÍÁÎÄÎÏÊ ÓÔÒÏËÅ ÓÅÒ×ÉÓÁ Windows."
 
-#: ../roundup/scripts/roundup_server.py:985
+#: ../roundup/scripts/roundup_server.py:989
 #, fuzzy
 msgid ""
 " -u <UID>      runs the Roundup web server as this UID\n"
@@ -3423,7 +3429,7 @@ msgstr ""
 "               É ÚÁÐÕÓÔÉÔØ ÓÅÒ×ÅÒ × ÆÏÎÏ×ÏÍ ÒÅÖÉÍÅ.  åÓÌÉ ÕËÁÚÁÎÏ \"-d\",\n"
 "               ÆÁÊÌ ÐÒÏÔÏËÏÌÁ *ÏÂÑÚÁÔÅÌØÎÏ* ÄÏÌÖÅÎ ÂÙÔØ ÚÁÄÁÎ ËÌÀÞÏÍ \"-l\""
 
-#: ../roundup/scripts/roundup_server.py:993
+#: ../roundup/scripts/roundup_server.py:997
 #, fuzzy, python-format
 msgid ""
 "\n"
@@ -3552,21 +3558,25 @@ msgstr ""
 "   ÎÅ ÍÏÇÕÔ ÉÓÐÏÌØÚÏ×ÁÔØÓÑ × URL (ÐÒÏÂÅÌÙ, ÒÕÓÓËÉÅ ÂÕË×Ù É ÐÒÏÞ.),\n"
 "   ÐÏÔÏÍÕ ÞÔÏ ÔÁËÉÅ ÉÍÅÎÁ ÓÂÉ×ÁÀÔ Ó ÔÏÌËÕ ÎÅËÏÔÏÒÙÅ ÂÒÁÕÚÅÒÙ ÔÉÐÁ IE.\n"
 
-#: ../roundup/scripts/roundup_server.py:1173
+#: ../roundup/scripts/roundup_server.py:1177
 msgid "Instances must be name=home"
 msgstr "óÐÉÓÏË ÔÒÅËÅÒÏ× ÄÏÌÖÅÎ ÂÙÔØ × ÆÏÒÍÁÔÅ ÉÍÑ=ËÁÔÁÌÏÇ"
 
-#: ../roundup/scripts/roundup_server.py:1187
+#: ../roundup/scripts/roundup_server.py:1191
 #, python-format
 msgid "Configuration saved to %s"
 msgstr "ëÏÎÆÉÇÕÒÁÃÉÑ ÚÁÐÉÓÁÎÁ × %s"
 
-#: ../roundup/scripts/roundup_server.py:1205
+#: ../roundup/scripts/roundup_server.py:1206
+msgid "If you specify a PID file you must use -l or -L."
+msgstr ""
+
+#: ../roundup/scripts/roundup_server.py:1212
 msgid "Sorry, you can't run the server as a daemon on this Operating System"
 msgstr ""
 "éÚ×ÉÎÉÔÅ, × ÜÔÏÊ ÏÐÅÒÁÃÉÏÎÎÏÊ ÓÉÓÔÅÍÅ ÒÁÂÏÔÁ × ÆÏÎÏ×ÏÍ ÒÅÖÉÍÅ ÎÅ×ÏÚÍÏÖÎÁ"
 
-#: ../roundup/scripts/roundup_server.py:1225
+#: ../roundup/scripts/roundup_server.py:1232
 #, python-format
 msgid "Roundup server started on %(HOST)s:%(PORT)s"
 msgstr "óÅÒ×ÅÒ Roundup ÇÏÔÏ× Ë ÒÁÂÏÔÅ ÐÏ ÁÄÒÅÓÕ %(HOST)s:%(PORT)s"
@@ -4850,46 +4860,46 @@ msgstr "
 msgid "clear this message"
 msgstr "ÓÂÒÏÓÉÔØ ÜÔÏ ÓÏÏÂÝÅÎÉÅ"
 
-#: ../share/roundup/templates/classic/html/page.html:257
-#: ../share/roundup/templates/classic/html/page.html:270
-#: ../share/roundup/templates/classic/html/page.html:288
-#: ../share/roundup/templates/classic/html/page.html:302
-#: ../share/roundup/templates/devel/html/page.html:316
-#: ../share/roundup/templates/devel/html/page.html:329
-#: ../share/roundup/templates/devel/html/page.html:347
-#: ../share/roundup/templates/devel/html/page.html:361
-#: ../share/roundup/templates/minimal/html/page.html:239
-#: ../share/roundup/templates/minimal/html/page.html:254
-#: ../share/roundup/templates/minimal/html/page.html:268
-#: ../share/roundup/templates/responsive/html/page.html:331
-#: ../share/roundup/templates/responsive/html/page.html:344
-#: ../share/roundup/templates/responsive/html/page.html:362
-#: ../share/roundup/templates/responsive/html/page.html:376
-msgid "don't care"
-msgstr "ÎÅ×ÁÖÎÏ"
-
-#: ../share/roundup/templates/classic/html/page.html:259
-#: ../share/roundup/templates/classic/html/page.html:272
-#: ../share/roundup/templates/classic/html/page.html:290
+#: ../share/roundup/templates/classic/html/page.html:258
+#: ../share/roundup/templates/classic/html/page.html:271
+#: ../share/roundup/templates/classic/html/page.html:289
 #: ../share/roundup/templates/classic/html/page.html:303
-#: ../share/roundup/templates/devel/html/page.html:318
-#: ../share/roundup/templates/devel/html/page.html:331
-#: ../share/roundup/templates/devel/html/page.html:349
+#: ../share/roundup/templates/devel/html/page.html:317
+#: ../share/roundup/templates/devel/html/page.html:330
+#: ../share/roundup/templates/devel/html/page.html:348
 #: ../share/roundup/templates/devel/html/page.html:362
-#: ../share/roundup/templates/minimal/html/page.html:241
-#: ../share/roundup/templates/minimal/html/page.html:256
+#: ../share/roundup/templates/minimal/html/page.html:240
+#: ../share/roundup/templates/minimal/html/page.html:255
 #: ../share/roundup/templates/minimal/html/page.html:269
-#: ../share/roundup/templates/responsive/html/page.html:333
-#: ../share/roundup/templates/responsive/html/page.html:346
-#: ../share/roundup/templates/responsive/html/page.html:364
+#: ../share/roundup/templates/responsive/html/page.html:332
+#: ../share/roundup/templates/responsive/html/page.html:345
+#: ../share/roundup/templates/responsive/html/page.html:363
 #: ../share/roundup/templates/responsive/html/page.html:377
+msgid "don't care"
+msgstr "ÎÅ×ÁÖÎÏ"
+
+#: ../share/roundup/templates/classic/html/page.html:260
+#: ../share/roundup/templates/classic/html/page.html:273
+#: ../share/roundup/templates/classic/html/page.html:291
+#: ../share/roundup/templates/classic/html/page.html:304
+#: ../share/roundup/templates/devel/html/page.html:319
+#: ../share/roundup/templates/devel/html/page.html:332
+#: ../share/roundup/templates/devel/html/page.html:350
+#: ../share/roundup/templates/devel/html/page.html:363
+#: ../share/roundup/templates/minimal/html/page.html:242
+#: ../share/roundup/templates/minimal/html/page.html:257
+#: ../share/roundup/templates/minimal/html/page.html:270
+#: ../share/roundup/templates/responsive/html/page.html:334
+#: ../share/roundup/templates/responsive/html/page.html:347
+#: ../share/roundup/templates/responsive/html/page.html:365
+#: ../share/roundup/templates/responsive/html/page.html:378
 msgid "------------"
 msgstr ""
 
-#: ../share/roundup/templates/classic/html/page.html:335
-#: ../share/roundup/templates/devel/html/page.html:390
-#: ../share/roundup/templates/minimal/html/page.html:297
-#: ../share/roundup/templates/responsive/html/page.html:405
+#: ../share/roundup/templates/classic/html/page.html:336
+#: ../share/roundup/templates/devel/html/page.html:391
+#: ../share/roundup/templates/minimal/html/page.html:298
+#: ../share/roundup/templates/responsive/html/page.html:406
 msgid "no value"
 msgstr "ÎÅÔ ÚÎÁÞÅÎÉÑ"
 
diff --git a/locale/zh_CN.po b/locale/zh_CN.po
index 1a3ba6229..2e2b80191 100644
--- a/locale/zh_CN.po
+++ b/locale/zh_CN.po
@@ -6,9 +6,9 @@
 #
 msgid ""
 msgstr ""
-"Project-Id-Version: Roundup 2.5.0\n"
+"Project-Id-Version: Roundup 2.5.0b1\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
-"POT-Creation-Date: 2025-01-12 20:17-0500\n"
+"POT-Creation-Date: 2025-06-11 16:02-0400\n"
 "PO-Revision-Date: 2013-10-31 12:22+0100\n"
 "Last-Translator: Cheer Xiao <xiaqqaix@gmail.com>\n"
 "Language-Team: Chinese Simplified <limodou@gmail.com>\n"
@@ -30,19 +30,19 @@ msgstr "ä½  %(action)s %(classname)s ç±»åž‹çš„æƒé™ã€‚"
 msgid "You may not retire the admin or anonymous user"
 msgstr "ä½ ä¸èƒ½æ’¤é™¤ç®¡ç†å‘˜æˆ–åŒ¿åç”¨æˆ·"
 
-#: ../roundup/admin.py:131
+#: ../roundup/admin.py:132
 msgid ""
 "Have 'display designator[,designator*]' show header inside\n"
 "      []'s before items. Includes retired/active status.\n"
 msgstr ""
 
-#: ../roundup/admin.py:135
+#: ../roundup/admin.py:136
 msgid ""
 "Have 'display designator' and 'specification class' show\n"
 "      protected fields: creator, id etc.\n"
 msgstr ""
 
-#: ../roundup/admin.py:139
+#: ../roundup/admin.py:140
 msgid ""
 "Controls history options. It is a bitstring where setting\n"
 "      the bit disables the feature. A value of 0 (default)\n"
@@ -53,52 +53,52 @@ msgid ""
 "      history.\n"
 msgstr ""
 
-#: ../roundup/admin.py:148
+#: ../roundup/admin.py:149
 msgid ""
 "Set the number of lines of history to keep for this session.\n"
 "      -1 is infinite.\n"
 msgstr ""
 
-#: ../roundup/admin.py:152
+#: ../roundup/admin.py:153
 msgid "Set indexer to use when running 'reindex' NYI\n"
 msgstr ""
 
-#: ../roundup/admin.py:155
+#: ../roundup/admin.py:156
 msgid "Force reopening of tracker when running each command.\n"
 msgstr ""
 
-#: ../roundup/admin.py:158
+#: ../roundup/admin.py:159
 msgid ""
 "set the number of rows imported before a database commit is\n"
 "      done. Used only for imports on PostgreSQL.\n"
 msgstr ""
 
-#: ../roundup/admin.py:160
+#: ../roundup/admin.py:161
 msgid "Show retired items in table, list etc. One of 'no', 'only', 'both'\n"
 msgstr ""
 
-#: ../roundup/admin.py:162
+#: ../roundup/admin.py:163
 msgid "internal mapping for show_retired.\n"
 msgstr ""
 
-#: ../roundup/admin.py:163
+#: ../roundup/admin.py:164
 msgid "Enable verbose output: tracing, descriptions...\n"
 msgstr ""
 
 # ../roundup/admin.py:84 :943 :992 :1014
-#: ../roundup/admin.py:175 ../roundup/admin.py:1188 ../roundup/admin.py:1858
-#: ../roundup/admin.py:1890 ../roundup/admin.py:175:1188 :1858:1890
+#: ../roundup/admin.py:176 ../roundup/admin.py:1199 ../roundup/admin.py:1869
+#: ../roundup/admin.py:1901 ../roundup/admin.py:176:1199 :1869:1901
 #, python-format
 msgid "no such class \"%(classname)s\""
 msgstr "æ— æ­¤ç±»åˆ« \"%(classname)s\""
 
 # ../roundup/admin.py:94 :98
-#: ../roundup/admin.py:188
+#: ../roundup/admin.py:189
 #, python-format
 msgid "argument \"%(arg)s\" not propname=value"
 msgstr "å‚æ•° \"%(arg)s\" ä¸æ˜¯ propname=value çš„å½¢å¼"
 
-#: ../roundup/admin.py:201
+#: ../roundup/admin.py:202
 #, python-format
 msgid ""
 "Problem: %(message)s\n"
@@ -107,7 +107,7 @@ msgstr ""
 "é—®é¢˜: %(message)s\n"
 "\n"
 
-#: ../roundup/admin.py:202
+#: ../roundup/admin.py:203
 #, fuzzy, python-format
 msgid ""
 "%(message)sUsage: roundup-admin [options] [<command> <arguments>]\n"
@@ -157,12 +157,12 @@ msgstr ""
 " roundup-admin help <command>             -- å‘½ä»¤è¯¦è§£å¸®åŠ©\n"
 " roundup-admin help all                   -- æ‰€æœ‰å¯ç”¨çš„å¸®åŠ©\n"
 
-#: ../roundup/admin.py:231
+#: ../roundup/admin.py:232
 #, fuzzy
 msgid "Commands: "
 msgstr "å‘½ä»¤:"
 
-#: ../roundup/admin.py:238
+#: ../roundup/admin.py:249
 msgid ""
 "Commands may be abbreviated as long as the abbreviation\n"
 "matches only one command, e.g. l == li == lis == list."
@@ -170,7 +170,7 @@ msgstr ""
 "å‘½ä»¤å¯ä»¥è¢«ç¼©å†™ï¼Œåªè¦ç¼©å†™åªæœ‰ä¸€ä¸ªå‘½ä»¤å¯ä»¥åŒ¹é…ä¸Šï¼Œ\n"
 "å¦‚ï¼šl == li == lis == list."
 
-#: ../roundup/admin.py:270
+#: ../roundup/admin.py:281
 #, fuzzy
 msgid ""
 "\n"
@@ -295,25 +295,25 @@ msgstr ""
 "\n"
 "ä½¿ç”¨å¸®åŠ©ï¼š\n"
 
-#: ../roundup/admin.py:334
+#: ../roundup/admin.py:345
 #, python-format
 msgid "%s:"
 msgstr "%s:"
 
 # ../roundup/admin.py:337 :387
-#: ../roundup/admin.py:439 ../roundup/admin.py:1415
-#: ../roundup/admin.py:439:1415
+#: ../roundup/admin.py:450 ../roundup/admin.py:1426
+#: ../roundup/admin.py:450:1426
 msgid "Templates:"
 msgstr "æ¨¡æ¿:"
 
 # ../roundup/admin.py:340 :398
-#: ../roundup/admin.py:442 ../roundup/admin.py:1425
-#: ../roundup/admin.py:442:1425
+#: ../roundup/admin.py:453 ../roundup/admin.py:1436
+#: ../roundup/admin.py:453:1436
 msgid "Back ends:"
 msgstr "åŽç«¯:"
 
 #. noqa: ARG002
-#: ../roundup/admin.py:459
+#: ../roundup/admin.py:470
 msgid ""
 "Usage: commit\n"
 "        Commit changes made to the database during an interactive session.\n"
@@ -334,7 +334,7 @@ msgstr ""
 "        åœ¨å‘½ä»¤è¡Œä¸­çš„ One-off å‘½ä»¤å¦‚æžœæˆåŠŸä¼šè¢«è‡ªåŠ¨æäº¤ã€‚\n"
 "        "
 
-#: ../roundup/admin.py:474
+#: ../roundup/admin.py:485
 msgid ""
 "Usage: create classname property=value ...\n"
 "        Create a new entry of a given class.\n"
@@ -354,42 +354,42 @@ msgstr ""
 
 # ../roundup/admin.py:359 :494 :573 :623 :676 :697 :725 :796 :863 :934 :982
 # :1004 :1031 :1093 :1159
-#: ../roundup/admin.py:482 ../roundup/admin.py:555 ../roundup/admin.py:606
-#: ../roundup/admin.py:733 ../roundup/admin.py:806 ../roundup/admin.py:851
-#: ../roundup/admin.py:902 ../roundup/admin.py:999 ../roundup/admin.py:1216
-#: ../roundup/admin.py:1388 ../roundup/admin.py:1516 ../roundup/admin.py:1599
-#: ../roundup/admin.py:1725 ../roundup/admin.py:1848 ../roundup/admin.py:1880
-#: ../roundup/admin.py:1996 ../roundup/admin.py:2050 ../roundup/admin.py:2098
-#: ../roundup/admin.py:482:555 :1216:1388:1516 :1599:1725 :1848:1880 :1996:2050
-#: :2098 :606:733 :806:851 :902:999
+#: ../roundup/admin.py:493 ../roundup/admin.py:566 ../roundup/admin.py:617
+#: ../roundup/admin.py:744 ../roundup/admin.py:817 ../roundup/admin.py:862
+#: ../roundup/admin.py:913 ../roundup/admin.py:1010 ../roundup/admin.py:1227
+#: ../roundup/admin.py:1399 ../roundup/admin.py:1527 ../roundup/admin.py:1610
+#: ../roundup/admin.py:1736 ../roundup/admin.py:1859 ../roundup/admin.py:1891
+#: ../roundup/admin.py:2007 ../roundup/admin.py:2061 ../roundup/admin.py:2109
+#: ../roundup/admin.py:493:566 :1227:1399 :1527:1610 :1736:1859 :1891:2007
+#: :2061:2109 :617:744 :817:862 :913:1010
 msgid "Not enough arguments supplied"
 msgstr "æœªæä¾›è¶³å¤Ÿçš„å‚æ•°"
 
-#: ../roundup/admin.py:502
+#: ../roundup/admin.py:513
 #, python-format
 msgid "%(propname)s (Password): "
 msgstr "%(propname)s (å¯†ç ):"
 
-#: ../roundup/admin.py:505
+#: ../roundup/admin.py:516
 #, python-format
 msgid "   %(propname)s (Again): "
 msgstr "   %(propname)s (å†æ¬¡)ï¼š"
 
-#: ../roundup/admin.py:509
+#: ../roundup/admin.py:520
 msgid "Sorry, try again..."
 msgstr "æŠ±æ­‰ï¼Œå†è¯•ä¸€æ¬¡..."
 
-#: ../roundup/admin.py:514
+#: ../roundup/admin.py:525
 #, python-format
 msgid "%(propname)s (%(proptype)s): "
 msgstr ""
 
-#: ../roundup/admin.py:533
+#: ../roundup/admin.py:544
 #, python-format
 msgid "you must provide the \"%(propname)s\" property."
 msgstr "ä½ å¿…é¡»æä¾› \"%(propname)s\" å±žæ€§ã€‚"
 
-#: ../roundup/admin.py:545
+#: ../roundup/admin.py:556
 #, fuzzy
 msgid ""
 "Usage: display designator[,designator]*\n"
@@ -408,13 +408,13 @@ msgstr ""
 "        å°†æ˜¾ç¤ºç»™å‡ºç»“ç‚¹çš„å±žæ€§å’Œç›¸åº”çš„å€¼ã€‚\n"
 "        "
 
-#: ../roundup/admin.py:586
+#: ../roundup/admin.py:597
 #, fuzzy, python-format
 msgid "%(protected)s%(key)s: %(value)s"
 msgstr "%(key)s: %(value)s"
 
 #. grab the directory to export to
-#: ../roundup/admin.py:589
+#: ../roundup/admin.py:600
 #, fuzzy
 msgid ""
 "Usage: export [[-]class[,class]] export_dir\n"
@@ -442,7 +442,7 @@ msgstr ""
 "        æ”¾åœ¨æŒ‡å®šçš„ç›®æ ‡ç›®å½•ä¸­ã€‚\n"
 "        "
 
-#: ../roundup/admin.py:704
+#: ../roundup/admin.py:715
 #, fuzzy
 msgid ""
 "Usage: exporttables [[-]class[,class]] export_dir\n"
@@ -471,7 +471,7 @@ msgstr ""
 "        æ”¾åœ¨æŒ‡å®šçš„ç›®æ ‡ç›®å½•ä¸­ã€‚\n"
 "        "
 
-#: ../roundup/admin.py:723
+#: ../roundup/admin.py:734
 #, fuzzy
 msgid ""
 "Usage: filter classname propname=value ...\n"
@@ -493,20 +493,20 @@ msgstr ""
 "        "
 
 # ../roundup/admin.py:663 :816 :828 :882
-#: ../roundup/admin.py:764
+#: ../roundup/admin.py:775
 #, fuzzy, python-format
 msgid "Class %(curclassname)s has no property %(pn)s in %(propname)s."
 msgstr "%(classname)s æ²¡æœ‰ \"%(propname)s\" å±žæ€§"
 
 # ../roundup/admin.py:663 :816 :828 :882
-#: ../roundup/admin.py:791 ../roundup/admin.py:840 ../roundup/admin.py:1536
-#: ../roundup/admin.py:1549 ../roundup/admin.py:2120
-#: ../roundup/admin.py:791:840 :1536:1549:2120
+#: ../roundup/admin.py:802 ../roundup/admin.py:851 ../roundup/admin.py:1547
+#: ../roundup/admin.py:1560 ../roundup/admin.py:2131
+#: ../roundup/admin.py:802:851 :1547:1560:2131
 #, python-format
 msgid "%(classname)s has no property \"%(propname)s\""
 msgstr "%(classname)s æ²¡æœ‰ \"%(propname)s\" å±žæ€§"
 
-#: ../roundup/admin.py:798
+#: ../roundup/admin.py:809
 msgid ""
 "Usage: find classname propname=value ...\n"
 "        Find the nodes of the given class with a given link property value.\n"
@@ -524,14 +524,14 @@ msgstr ""
 "        æˆ–è€…æ˜¯ç»“ç‚¹çš„é”®å€¼ã€‚\n"
 "        "
 
-#: ../roundup/admin.py:847
+#: ../roundup/admin.py:858
 msgid ""
 "Usage: genconfig filename\n"
 "        Create a new tracker config file with default values in filename.\n"
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:864
+#: ../roundup/admin.py:875
 #, python-format
 msgid ""
 "Changing option\n"
@@ -539,20 +539,20 @@ msgid ""
 "from old default of %(old_number)s to new default of %(new_number)s."
 msgstr ""
 
-#: ../roundup/admin.py:875
+#: ../roundup/admin.py:886
 #, python-format
 msgid ""
 "Update 'password_pbkdf2_default_rounds' to a number equal to or larger\n"
 "  than %s.\n"
 msgstr ""
 
-#: ../roundup/admin.py:882
+#: ../roundup/admin.py:893
 msgid ""
 "Check the rdbms mysql_* settings. Your charset and collations may need\n"
 "  to be changed. See upgrading instructions.\n"
 msgstr ""
 
-#: ../roundup/admin.py:892
+#: ../roundup/admin.py:903
 #, fuzzy
 msgid ""
 "Usage: get property designator[,designator]*\n"
@@ -572,24 +572,24 @@ msgstr ""
 "        "
 
 # ../roundup/admin.py:527 :542
-#: ../roundup/admin.py:925
+#: ../roundup/admin.py:936
 #, python-format
 msgid "property %s is not of type Multilink or Link so -d flag does not apply."
 msgstr "å±žæ€§ %s ä¸æ˜¯ Multilink æˆ– Link ç±»åž‹ï¼Œæ‰€ä»¥ -d æ ‡å¿—ä¸èƒ½åº”ç”¨ã€‚"
 
 # ../roundup/admin.py:550 :945 :994 :1016
-#: ../roundup/admin.py:942 ../roundup/admin.py:1190 ../roundup/admin.py:1864
-#: ../roundup/admin.py:1892 ../roundup/admin.py:942:1190 :1864:1892
+#: ../roundup/admin.py:953 ../roundup/admin.py:1201 ../roundup/admin.py:1875
+#: ../roundup/admin.py:1903 ../roundup/admin.py:953:1201 :1875:1903
 #, python-format
 msgid "no such %(classname)s node \"%(nodeid)s\""
 msgstr "æ²¡æœ‰è¿™æ ·çš„ %(classname)s ç»“ç‚¹ \"%(nodeid)s\""
 
-#: ../roundup/admin.py:945
+#: ../roundup/admin.py:956
 #, python-format
 msgid "no such %(classname)s property \"%(propname)s\""
 msgstr "æ²¡æœ‰è¿™æ ·çš„ %(classname)s å±žæ€§ \"%(propname)s\""
 
-#: ../roundup/admin.py:950
+#: ../roundup/admin.py:961
 msgid ""
 "Usage: help topic\n"
 "        Give help about topic.\n"
@@ -609,12 +609,12 @@ msgstr ""
 "        all       -- æ‰€æœ‰å¯ç”¨çš„å¸®åŠ©\n"
 "        "
 
-#: ../roundup/admin.py:969
+#: ../roundup/admin.py:980
 #, python-format
 msgid "Sorry, no help for \"%(topic)s\""
 msgstr "æŠ±æ­‰ï¼Œæ²¡æœ‰â€œ%(topic)sâ€çš„å¸®åŠ©ä¿¡æ¯"
 
-#: ../roundup/admin.py:986
+#: ../roundup/admin.py:997
 #, fuzzy
 msgid ""
 "Usage: history designator [skipquiet] [raw]\n"
@@ -636,27 +636,27 @@ msgstr ""
 "        å®ƒçš„é”®å€¼å¯ä»¥è¢«é‡ç”¨ã€‚\n"
 "        "
 
-#: ../roundup/admin.py:1011
+#: ../roundup/admin.py:1022
 #, python-format
 msgid "Unexpected argument(s): %s. Expected 'skipquiet' or 'raw'."
 msgstr ""
 
-#: ../roundup/admin.py:1062
+#: ../roundup/admin.py:1073
 #, fuzzy
 msgid "removed"
 msgstr "åˆ é™¤"
 
-#: ../roundup/admin.py:1064
+#: ../roundup/admin.py:1075
 msgid "added"
 msgstr ""
 
-#: ../roundup/admin.py:1066
+#: ../roundup/admin.py:1077
 #, python-format
 msgid "Unknown history set operation '%s'. Expected +/-."
 msgstr ""
 
 #. .Hint added issue23 to superseder
-#: ../roundup/admin.py:1091
+#: ../roundup/admin.py:1102
 #, fuzzy, python-format
 msgid "added %(class)s%(item_id)s to %(propname)s"
 msgstr "%(class)s %(id)s %(properties)s ç¼–è¾‘æˆåŠŸ"
@@ -664,29 +664,29 @@ msgstr "%(class)s %(id)s %(properties)s ç¼–è¾‘æˆåŠŸ"
 #. .Hint read as: assignedto was admin(1)
 #. where assignedto is the property
 #. admin is the key name for value 1
-#: ../roundup/admin.py:1112
+#: ../roundup/admin.py:1123
 #, python-format
 msgid "%(prop)s was %(name)s(%(value)s)"
 msgstr ""
 
-#: ../roundup/admin.py:1118 ../roundup/admin.py:1147
-#: ../roundup/admin.py:1118:1147
+#: ../roundup/admin.py:1129 ../roundup/admin.py:1158
+#: ../roundup/admin.py:1129:1158
 #, fuzzy, python-format
 msgid "%(prop)s was %(value)s"
 msgstr "%(key)s: %(value)s"
 
-#: ../roundup/admin.py:1137
+#: ../roundup/admin.py:1148
 #, python-format
 msgid "%(prop)s was [%(value_list)s]"
 msgstr ""
 
 #. .Hint modified nosy: added demo(3)
-#: ../roundup/admin.py:1144
+#: ../roundup/admin.py:1155
 #, python-format
 msgid "modified %(prop)s: %(how)s"
 msgstr ""
 
-#: ../roundup/admin.py:1195
+#: ../roundup/admin.py:1206
 #, fuzzy
 msgid ""
 "Usage: import import_dir\n"
@@ -728,7 +728,7 @@ msgstr ""
 "        æ—§æ•°æ®ã€‚)\n"
 "        "
 
-#: ../roundup/admin.py:1306
+#: ../roundup/admin.py:1317
 msgid ""
 "Usage: importtables export_dir\n"
 "        This imports the database tables exported using exporttables.\n"
@@ -738,7 +738,7 @@ msgid ""
 msgstr ""
 
 #. password
-#: ../roundup/admin.py:1314
+#: ../roundup/admin.py:1325
 msgid ""
 "Usage: initialise [adminpw]\n"
 "        Initialise a new Roundup tracker.\n"
@@ -756,23 +756,23 @@ msgstr ""
 "        æ‰§è¡Œtrackerçš„åˆå§‹åŒ–å‡½æ•° dbinit.init()\n"
 "        "
 
-#: ../roundup/admin.py:1328
+#: ../roundup/admin.py:1339
 msgid "Admin Password: "
 msgstr "ç®¡ç†å‘˜å¯†ç :"
 
-#: ../roundup/admin.py:1329
+#: ../roundup/admin.py:1340
 msgid "       Confirm: "
 msgstr "       ç¡®è®¤:"
 
-#: ../roundup/admin.py:1333
+#: ../roundup/admin.py:1344
 msgid "Instance home does not exist"
 msgstr "å®žä¾‹ç›®å½•ä¸å­˜åœ¨"
 
-#: ../roundup/admin.py:1337
+#: ../roundup/admin.py:1348
 msgid "Instance has not been installed"
 msgstr "å®žä¾‹è¿˜æ²¡æœ‰å®‰è£…"
 
-#: ../roundup/admin.py:1345
+#: ../roundup/admin.py:1356
 msgid ""
 "WARNING: The database is already initialised!\n"
 "If you re-initialise it, you will lose all the data!\n"
@@ -782,7 +782,7 @@ msgstr ""
 "å¦‚æžœä½ é‡æ–°åˆå§‹åŒ–å®ƒï¼Œæ‰€æœ‰çš„æ•°æ®å°†ä¼šä¸¢å¤±ï¼\n"
 "åˆ é™¤å®ƒå—ï¼ŸY/N: "
 
-#: ../roundup/admin.py:1365
+#: ../roundup/admin.py:1376
 #, fuzzy
 msgid ""
 "Usage: install [template [backend [key=val[,key=val]]]]\n"
@@ -822,12 +822,12 @@ msgstr ""
 "        è¯·æŸ¥çœ‹åˆå§‹åŒ–å‚æ•°å¸®åŠ©ã€‚\n"
 "        "
 
-#: ../roundup/admin.py:1394
+#: ../roundup/admin.py:1405
 #, python-format
 msgid "Instance home parent directory \"%(parent)s\" does not exist"
 msgstr "å®žä¾‹ç›®å½•çš„çˆ¶ç›®å½• \"%(parent)s\" ä¸å­˜åœ¨"
 
-#: ../roundup/admin.py:1403
+#: ../roundup/admin.py:1414
 #, python-format
 msgid ""
 "WARNING: There appears to be a tracker in \"%(tracker_home)s\"!\n"
@@ -838,22 +838,22 @@ msgstr ""
 "å¦‚æžœä½ é‡æ–°å®‰è£…ï¼Œæ‰€æœ‰çš„æ•°æ®å°†ä¼šä¸¢å¤±ï¼\n"
 "åˆ é™¤å®ƒå—ï¼ŸY/N: "
 
-#: ../roundup/admin.py:1416
+#: ../roundup/admin.py:1427
 #, fuzzy
 msgid "Select template"
 msgstr "é€‰æ‹©æ¨¡æ¿ [classic]:"
 
-#: ../roundup/admin.py:1426
+#: ../roundup/admin.py:1437
 #, fuzzy
 msgid "Select backend"
 msgstr "é€‰æ‹©åŽç«¯ [anydbm]:"
 
-#: ../roundup/admin.py:1437
+#: ../roundup/admin.py:1448
 #, python-format
 msgid "Error in configuration settings: \"%s\""
 msgstr "é…ç½®è®¾å®šæœ‰é”™: â€œ%sâ€"
 
-#: ../roundup/admin.py:1470
+#: ../roundup/admin.py:1481
 #, fuzzy, python-format
 msgid ""
 "\n"
@@ -865,11 +865,11 @@ msgstr ""
 " çŽ°åœ¨ä½ åº”è¯¥ä¿®æ”¹trackerçš„é…ç½®æ–‡ä»¶ï¼š\n"
 "   %(config_file)s"
 
-#: ../roundup/admin.py:1480
+#: ../roundup/admin.py:1491
 msgid " ... at a minimum, you must set following options:"
 msgstr " ... è‡³å°‘ï¼Œä½ å¿…é¡»è®¾ç½®ä»¥ä¸‹é€‰é¡¹ï¼š"
 
-#: ../roundup/admin.py:1485
+#: ../roundup/admin.py:1496
 #, fuzzy, python-format
 msgid ""
 "\n"
@@ -893,7 +893,7 @@ msgstr ""
 "   %(database_init_file)s\n"
 " ... æŸ¥çœ‹å…³äºŽå®¢æˆ·åŒ–çš„æ–‡æ¡£æ¥äº†è§£æ›´å¤šçš„ä¿¡æ¯ã€‚\n"
 
-#: ../roundup/admin.py:1501
+#: ../roundup/admin.py:1512
 msgid ""
 "Usage: list classname [property]\n"
 "        List the instances of a class.\n"
@@ -919,17 +919,17 @@ msgstr ""
 "        å®šäº†å±žæ€§ï¼Œå¯¹æ¯ä¸ªç±»åž‹å®žä¾‹ä¼šæ‰“å°å‡ºè¿™ä¸ªå±žæ€§ã€‚\n"
 "        "
 
-#: ../roundup/admin.py:1514
+#: ../roundup/admin.py:1525
 msgid "Too many arguments supplied"
 msgstr "æä¾›äº†å¤ªå¤šçš„å‚æ•°äº†"
 
-#: ../roundup/admin.py:1547
+#: ../roundup/admin.py:1558
 #, python-format
 msgid "%(nodeid)4s: %(value)s"
 msgstr "%(nodeid)4s: %(value)s"
 
 #. noqa: ARG002  - args unused
-#: ../roundup/admin.py:1554
+#: ../roundup/admin.py:1565
 msgid ""
 "Usage: migrate\n"
 "        Update a tracker's database to be compatible with the Roundup\n"
@@ -952,17 +952,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1574
+#: ../roundup/admin.py:1585
 #, python-format
 msgid "Tracker updated to schema version %s."
 msgstr ""
 
-#: ../roundup/admin.py:1578
+#: ../roundup/admin.py:1589
 #, fuzzy, python-format
 msgid "No migration action required. At schema version %s."
 msgstr "ä¸å¿…æ‰§è¡Œè¿ç§»"
 
-#: ../roundup/admin.py:1583
+#: ../roundup/admin.py:1594
 #, fuzzy
 msgid ""
 "Usage: pack period | date\n"
@@ -999,11 +999,11 @@ msgstr ""
 "\n"
 "        "
 
-#: ../roundup/admin.py:1609
+#: ../roundup/admin.py:1620
 msgid "Invalid format"
 msgstr "æ— æ•ˆçš„æ ¼å¼"
 
-#: ../roundup/admin.py:1620
+#: ../roundup/admin.py:1631
 msgid ""
 "Usage: perftest [mode] [arguments]*\n"
 "        Time operations in Roundup.\n"
@@ -1021,25 +1021,25 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1657
+#: ../roundup/admin.py:1668
 msgid "Invalid 'rounds'. Must be larger than 999."
 msgstr ""
 
-#: ../roundup/admin.py:1661
+#: ../roundup/admin.py:1672
 #, python-format
 msgid "Invalid 'rounds'. It must be an integer not: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1688
+#: ../roundup/admin.py:1699
 msgid "scheme does not support rounds."
 msgstr ""
 
-#: ../roundup/admin.py:1691
+#: ../roundup/admin.py:1702
 #, python-format
 msgid "Hash time: %(time)0.9f seconds, scheme: %(scheme)s, rounds: %(rounds)s"
 msgstr ""
 
-#: ../roundup/admin.py:1697
+#: ../roundup/admin.py:1708
 msgid ""
 "Usage: pragma setting=value | 'list'\n"
 "        Set internal admin settings to a value.\n"
@@ -1068,49 +1068,49 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1732
+#: ../roundup/admin.py:1743
 #, python-format
 msgid "Argument must be setting=value, was given: %s."
 msgstr ""
 
-#: ../roundup/admin.py:1735
+#: ../roundup/admin.py:1746
 msgid "Current settings and values (NYI - not yet implemented):"
 msgstr ""
 
-#: ../roundup/admin.py:1746
+#: ../roundup/admin.py:1757
 msgid ""
 "      Help for this pragma is missing. Please report it to the Roundup "
 "project.\n"
 msgstr ""
 
-#: ../roundup/admin.py:1752
+#: ../roundup/admin.py:1763
 #, fuzzy, python-format
 msgid "Unknown setting %s. Try \"pragma list\"."
 msgstr "æœªçŸ¥ç”¨æˆ·å"
 
-#: ../roundup/admin.py:1762
+#: ../roundup/admin.py:1773
 #, python-format
 msgid "Incorrect value for boolean setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1769
+#: ../roundup/admin.py:1780
 #, python-format
 msgid "Incorrect value for integer setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1776
+#: ../roundup/admin.py:1787
 #, python-format
 msgid ""
 "Incorrect value for setting %(setting)s: %(value)s. Should be no, both, or "
 "only."
 msgstr ""
 
-#: ../roundup/admin.py:1786
+#: ../roundup/admin.py:1797
 #, python-format
 msgid "Internal error: pragma can not handle values of type: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1795
+#: ../roundup/admin.py:1806
 #, fuzzy
 msgid ""
 "Usage: reindex [classname|classname:#-#|designator]*\n"
@@ -1133,17 +1133,17 @@ msgstr ""
 "        é‡æ–°ç”Ÿæˆ tracker çš„æœç´¢ç´¢å¼•ï¼Œå®ƒå°†è‡ªåŠ¨è¿›è¡Œã€‚\n"
 "        "
 
-#: ../roundup/admin.py:1817
+#: ../roundup/admin.py:1828
 #, python-format
 msgid "no such item \"%(designator)s\""
 msgstr "æ²¡æœ‰è¿™æ ·çš„æ¡ç›® \"%(designator)s\""
 
-#: ../roundup/admin.py:1827
+#: ../roundup/admin.py:1838
 #, fuzzy, python-format
 msgid "no such item \"%(class)s%(id)s\""
 msgstr "æ²¡æœ‰è¿™æ ·çš„æ¡ç›® \"%(designator)s\""
 
-#: ../roundup/admin.py:1839
+#: ../roundup/admin.py:1850
 #, fuzzy
 msgid ""
 "Usage: restore designator[,designator]*\n"
@@ -1161,7 +1161,7 @@ msgstr ""
 "        ç»™å®šçš„ç»“ç‚¹å°†å¯¹ç”¨æˆ·æ¥è¯´å†æ¬¡ç”Ÿæ•ˆã€‚\n"
 "        "
 
-#: ../roundup/admin.py:1870
+#: ../roundup/admin.py:1881
 #, fuzzy
 msgid ""
 "Usage: retire designator[,designator]*\n"
@@ -1182,7 +1182,7 @@ msgstr ""
 "        "
 
 #. noqa: ARG002 - args unused
-#: ../roundup/admin.py:1898
+#: ../roundup/admin.py:1909
 msgid ""
 "Usage: rollback\n"
 "        Undo all changes that are pending commit to the database.\n"
@@ -1201,7 +1201,7 @@ msgstr ""
 "        äº§ç”Ÿå˜åŒ–ã€‚\n"
 "        "
 
-#: ../roundup/admin.py:1911
+#: ../roundup/admin.py:1922
 msgid ""
 "Usage: security [Role name]\n"
 "        Display the Permissions available to one or all Roles.\n"
@@ -1214,47 +1214,47 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1926
+#: ../roundup/admin.py:1937
 #, fuzzy, python-format
 msgid "No such Role \"%(role)s\"\n"
 msgstr "æ²¡æœ‰è¿™æ ·çš„è§’è‰² \"%(role)s\""
 
-#: ../roundup/admin.py:1932
+#: ../roundup/admin.py:1943
 #, fuzzy, python-format
 msgid "New Web users get the Roles \"%(role)s\"\n"
 msgstr "æ–°Webç”¨æˆ·å¾—åˆ°è§’è‰² \"%(role)s\""
 
-#: ../roundup/admin.py:1935
+#: ../roundup/admin.py:1946
 #, fuzzy, python-format
 msgid "New Web users get the Role \"%(role)s\"\n"
 msgstr "æ–°Webç”¨æˆ·å¾—åˆ°è§’è‰² \"%(role)s\""
 
-#: ../roundup/admin.py:1939
+#: ../roundup/admin.py:1950
 #, fuzzy, python-format
 msgid "New Email users get the Roles \"%(role)s\"\n"
 msgstr "æ–°é‚®ä»¶ç”¨æˆ·å¾—åˆ°è§’è‰² \"%(role)s\""
 
-#: ../roundup/admin.py:1941
+#: ../roundup/admin.py:1952
 #, fuzzy, python-format
 msgid "New Email users get the Role \"%(role)s\"\n"
 msgstr "æ–°é‚®ä»¶ç”¨æˆ·å¾—åˆ°è§’è‰² \"%(role)s\""
 
-#: ../roundup/admin.py:1944
+#: ../roundup/admin.py:1955
 #, fuzzy, python-format
 msgid "Role \"%(name)s\":\n"
 msgstr "è§’è‰² \"%(name)s\"ï¼š"
 
-#: ../roundup/admin.py:1950
+#: ../roundup/admin.py:1961
 #, fuzzy
 msgid " %(description)s (%(name)s for \"%(klass)s\""
 msgstr " %(description)s (%(name)s ä»…ç”¨äºŽ \"%(klass)s\")"
 
-#: ../roundup/admin.py:1950
+#: ../roundup/admin.py:1961
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\": %(properties)s only)\n"
 msgstr " %(description)s (%(name)s ä»…ç”¨äºŽ \"%(klass)s\")"
 
-#: ../roundup/admin.py:1963
+#: ../roundup/admin.py:1974
 #, python-format
 msgid ""
 "\n"
@@ -1262,17 +1262,17 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/admin.py:1969
+#: ../roundup/admin.py:1980
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\" only)\n"
 msgstr " %(description)s (%(name)s ä»…ç”¨äºŽ \"%(klass)s\")"
 
-#: ../roundup/admin.py:1972
+#: ../roundup/admin.py:1983
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s)\n"
 msgstr " %(description)s (%(name)s)"
 
-#: ../roundup/admin.py:1976
+#: ../roundup/admin.py:1987
 #, fuzzy
 msgid ""
 "Usage: set items property=value [property=value ...]\n"
@@ -1305,7 +1305,7 @@ msgstr ""
 "        ä½ éœ€è¦ä¸ºå¤šé“¾æŽ¥æä¾›ç”¨é€—å·åˆ†éš”çš„æ•°å­—(ä¾‹å¦‚ \"1,2,3\")ã€‚\n"
 "        "
 
-#: ../roundup/admin.py:2044
+#: ../roundup/admin.py:2055
 msgid ""
 "Usage: specification classname\n"
 "        Show the properties for a classname.\n"
@@ -1319,17 +1319,17 @@ msgstr ""
 "        ä¼šåˆ—å‡ºç»™å®šç±»åž‹çš„å±žæ€§ã€‚\n"
 "        "
 
-#: ../roundup/admin.py:2063
+#: ../roundup/admin.py:2074
 #, fuzzy, python-format
 msgid "%(key)s: %(value)s (key property)\n"
 msgstr "%(key)s: %(value)s (å…³é”®å±žæ€§)"
 
-#: ../roundup/admin.py:2066
+#: ../roundup/admin.py:2077
 #, fuzzy, python-format
 msgid "%(key)s: %(value)s\n"
 msgstr "%(key)s: %(value)s"
 
-#: ../roundup/admin.py:2069
+#: ../roundup/admin.py:2080
 msgid ""
 "Usage: table classname [property[,property]*]\n"
 "        List the instances of a class in tabular form.\n"
@@ -1387,17 +1387,17 @@ msgstr ""
 "        å°†ç”Ÿæˆ4ä¸ªå­—ç¬¦å®½çš„ \"Name\" åˆ—ã€‚\n"
 "        "
 
-#: ../roundup/admin.py:2115
+#: ../roundup/admin.py:2126
 #, python-format
 msgid "\"%(spec)s\" not name:width"
 msgstr "\"%(spec)s\" ä¸æ˜¯ åå­—:å®½åº¦"
 
-#: ../roundup/admin.py:2137
+#: ../roundup/admin.py:2148
 #, python-format
 msgid "\"%(spec)s\" does not have an integer width: \"%(width)s\""
 msgstr ""
 
-#: ../roundup/admin.py:2173
+#: ../roundup/admin.py:2184
 msgid ""
 "Usage: templates [trace_search]\n"
 "        List templates and their installed directories.\n"
@@ -1407,7 +1407,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2201
+#: ../roundup/admin.py:2212
 msgid ""
 "Usage: updateconfig <filename>\n"
 "        Merge existing tracker config with new settings.\n"
@@ -1418,34 +1418,34 @@ msgid ""
 msgstr ""
 
 # ../roundup/cgi/actions.py:549 :559 :730 :749
-#: ../roundup/admin.py:2210 ../roundup/cgi/actions.py:886
-#: ../roundup/cgi/actions.py:897 ../roundup/cgi/actions.py:1099
-#: ../roundup/cgi/actions.py:1113 ../roundup/cgi/actions.py:886:897 :1099:1113
+#: ../roundup/admin.py:2221 ../roundup/cgi/actions.py:891
+#: ../roundup/cgi/actions.py:902 ../roundup/cgi/actions.py:1104
+#: ../roundup/cgi/actions.py:1118 ../roundup/cgi/actions.py:891:902 :1104:1118
 #, python-format
 msgid "Error: %s"
 msgstr "é”™è¯¯ï¼š%s"
 
-#: ../roundup/admin.py:2242
+#: ../roundup/admin.py:2253
 #, python-format
 msgid "Unknown command \"%(command)s\" (\"help commands\" for a list)"
 msgstr "æœªçŸ¥å‘½ä»¤ \"%(command)s\" (\"help commands\" æŸ¥çœ‹å‘½ä»¤åˆ—è¡¨)"
 
-#: ../roundup/admin.py:2248
+#: ../roundup/admin.py:2259
 #, python-format
 msgid "Multiple commands match \"%(command)s\": %(list)s"
 msgstr "å¤šå‘½ä»¤åŒ¹é… \"%(command)s\": %(list)s"
 
-#: ../roundup/admin.py:2263
+#: ../roundup/admin.py:2274
 msgid "Enter tracker home: "
 msgstr "è¾“å…¥trackerèµ·å§‹ç›®å½•ï¼š"
 
-#: ../roundup/admin.py:2292 ../roundup/admin.py:2296
-#: ../roundup/admin.py:2292:2296
+#: ../roundup/admin.py:2303 ../roundup/admin.py:2307
+#: ../roundup/admin.py:2303:2307
 #, python-format
 msgid "Error: Couldn't open tracker: %(message)s"
 msgstr "é”™è¯¯ï¼šä¸èƒ½æ‰“å¼€trackerï¼š%(message)s"
 
-#: ../roundup/admin.py:2344
+#: ../roundup/admin.py:2355
 #, python-format
 msgid ""
 "Roundup %s ready for input.\n"
@@ -1454,58 +1454,58 @@ msgstr ""
 "Roundup %s è¾“å…¥å°±ç»ªã€‚\n"
 "æ•²å…¥ \"help\" èŽ·å¾—å¸®åŠ©ã€‚"
 
-#: ../roundup/admin.py:2377
+#: ../roundup/admin.py:2388
 msgid "Note: command history and editing not available"
 msgstr "æ³¨æ„ï¼šå‘½ä»¤åŽ†å²å’Œç¼–è¾‘æ— æ•ˆ"
 
-#: ../roundup/admin.py:2383
+#: ../roundup/admin.py:2394
 msgid "exit..."
 msgstr "é€€å‡º..."
 
-#: ../roundup/admin.py:2396
+#: ../roundup/admin.py:2407
 msgid "There are unsaved changes. Commit them (y/N)? "
 msgstr "å­˜åœ¨æœªè¢«ä¿å­˜çš„æ”¹åŠ¨ã€‚æäº¤å—(y/N)ï¼Ÿ"
 
-#: ../roundup/backends/back_anydbm.py:215
-#: ../roundup/backends/rdbms_common.py:928
+#: ../roundup/backends/back_anydbm.py:213
+#: ../roundup/backends/rdbms_common.py:926
 #, python-format
 msgid "Class \"%s\" already defined."
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:280
+#: ../roundup/backends/back_anydbm.py:278
 #: ../roundup/backends/sessions_dbm.py:61
 msgid "Couldn't identify database type"
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:314
+#: ../roundup/backends/back_anydbm.py:312
 #, python-format
 msgid ""
 "Couldn't open database - the required module '%s' (as dbm.gnu) is not "
 "available"
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:318
+#: ../roundup/backends/back_anydbm.py:316
 #, python-format
 msgid "Couldn't open database - the required module '%s' is not available"
 msgstr ""
 
 #: ../roundup/backends/back_anydbm.py:873
 #: ../roundup/backends/back_anydbm.py:886
-#: ../roundup/backends/back_anydbm.py:1160
-#: ../roundup/backends/back_anydbm.py:1195
-#: ../roundup/backends/back_anydbm.py:1424
-#: ../roundup/backends/back_anydbm.py:1442
-#: ../roundup/backends/back_anydbm.py:1489
-#: ../roundup/backends/back_anydbm.py:2135
+#: ../roundup/backends/back_anydbm.py:1162
+#: ../roundup/backends/back_anydbm.py:1197
+#: ../roundup/backends/back_anydbm.py:1426
+#: ../roundup/backends/back_anydbm.py:1444
+#: ../roundup/backends/back_anydbm.py:1492
+#: ../roundup/backends/back_anydbm.py:2138
 #: ../roundup/backends/back_anydbm.py:873:886
-#: ../roundup/backends/rdbms_common.py:1720
-#: ../roundup/backends/rdbms_common.py:1967
-#: ../roundup/backends/rdbms_common.py:2206
-#: ../roundup/backends/rdbms_common.py:2226
-#: ../roundup/backends/rdbms_common.py:2279
-#: ../roundup/backends/rdbms_common.py:3254
-#: ../roundup/backends/rdbms_common.py:1720:1967 :1160:1195 :1424:1442:1489
-#: :2135 :2206:2226 :2279:3254
+#: ../roundup/backends/rdbms_common.py:1721
+#: ../roundup/backends/rdbms_common.py:1972
+#: ../roundup/backends/rdbms_common.py:2211
+#: ../roundup/backends/rdbms_common.py:2231
+#: ../roundup/backends/rdbms_common.py:2293
+#: ../roundup/backends/rdbms_common.py:3268
+#: ../roundup/backends/rdbms_common.py:1721:1972 :1162:1197 :1426:1444:1492
+#: :2138 :2211:2231 :2293:3268
 msgid "Database open read-only"
 msgstr ""
 
@@ -1531,45 +1531,50 @@ msgstr ""
 msgid "Unable to get lock after 10 retries on %s."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:632
+#: ../roundup/backends/rdbms_common.py:630
 #, python-format
 msgid "ALTER operation disallowed: %(old)r -> %(new)r."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:867
+#: ../roundup/backends/rdbms_common.py:865
 #, python-format
 msgid "CREATE operation disallowed: \"%s\"."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:884
+#: ../roundup/backends/rdbms_common.py:882
 #, python-format
 msgid "DROP operation disallowed: \"%s\"."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:1863
+#: ../roundup/backends/rdbms_common.py:1864
 msgid "create"
 msgstr "åˆ›å»º"
 
-#: ../roundup/backends/rdbms_common.py:2038
+#: ../roundup/backends/rdbms_common.py:2043
 msgid "unlink"
 msgstr "è§£é“¾"
 
-#: ../roundup/backends/rdbms_common.py:2042
+#: ../roundup/backends/rdbms_common.py:2047
 msgid "link"
 msgstr "é“¾æŽ¥"
 
-#: ../roundup/backends/rdbms_common.py:2187
+#: ../roundup/backends/rdbms_common.py:2192
 msgid "set"
 msgstr "ä¿®æ”¹"
 
-#: ../roundup/backends/rdbms_common.py:2216
+#: ../roundup/backends/rdbms_common.py:2221
 msgid "retired"
 msgstr "æ’¤é™¤"
 
-#: ../roundup/backends/rdbms_common.py:2246
+#: ../roundup/backends/rdbms_common.py:2251
 msgid "restored"
 msgstr "æ¢å¤"
 
+#: ../roundup/backends/rdbms_common.py:2265
+#, fuzzy, python-format
+msgid "class %(cls)s: %(value)r is not an id"
+msgstr "å±žæ€§ \"%(propname)s\": \"%(value)s\" å½“å‰ä¸åœ¨åˆ—è¡¨ä¸­"
+
 #: ../roundup/backends/sessions_redis.py:78
 #: ../roundup/backends/sessions_redis.py:97
 #: ../roundup/backends/sessions_redis.py:78:97
@@ -1652,10 +1657,10 @@ msgid "\"%(input)s\" is not an ID (%(classname)s ID required)"
 msgstr "\"%(input)s\" ä¸æ˜¯ä¸€ä¸ª ID (è¦æ±‚ %(classname)s ID)"
 
 #: ../roundup/cgi/actions.py:228 ../roundup/cgi/actions.py:266
-#: ../roundup/cgi/actions.py:493 ../roundup/cgi/actions.py:833
-#: ../roundup/cgi/actions.py:880 ../roundup/cgi/actions.py:1084
-#: ../roundup/cgi/actions.py:1246 ../roundup/cgi/actions.py:228:266:1246
-#: :493:833 :880:1084
+#: ../roundup/cgi/actions.py:493 ../roundup/cgi/actions.py:838
+#: ../roundup/cgi/actions.py:885 ../roundup/cgi/actions.py:1089
+#: ../roundup/cgi/actions.py:1251 ../roundup/cgi/actions.py:228:266:1251
+#: :493:838 :885:1089
 msgid "Invalid request"
 msgstr "æ— æ•ˆè¯·æ±‚"
 
@@ -1705,8 +1710,8 @@ msgstr "æ— æ•ˆè¯·æ±‚"
 msgid "Invalid integer: "
 msgstr "æ— æ•ˆç™»å½•"
 
-#: ../roundup/cgi/actions.py:531 ../roundup/cgi/actions.py:735
-#: ../roundup/cgi/actions.py:531:735
+#: ../roundup/cgi/actions.py:531 ../roundup/cgi/actions.py:740
+#: ../roundup/cgi/actions.py:531:740
 #, python-format
 msgid "You do not have permission to create %(class)s"
 msgstr "ä½ æ²¡æœ‰æƒé™æ¥åˆ›å»º %(class)s"
@@ -1716,8 +1721,8 @@ msgstr "ä½ æ²¡æœ‰æƒé™æ¥åˆ›å»º %(class)s"
 msgid "Not enough values on line %(line)s"
 msgstr "åœ¨ %(line)s è¡Œæ²¡æœ‰è¶³å¤Ÿçš„å€¼"
 
-#: ../roundup/cgi/actions.py:556 ../roundup/cgi/actions.py:723
-#: ../roundup/cgi/actions.py:556:723
+#: ../roundup/cgi/actions.py:556 ../roundup/cgi/actions.py:728
+#: ../roundup/cgi/actions.py:556:728
 #, python-format
 msgid "You do not have permission to edit %(class)s"
 msgstr "ä½ æ²¡æœ‰æƒé™æ¥ç¼–è¾‘ %(class)s"
@@ -1726,29 +1731,29 @@ msgstr "ä½ æ²¡æœ‰æƒé™æ¥ç¼–è¾‘ %(class)s"
 msgid "Items edited OK"
 msgstr "é¡¹ç›®ç¼–è¾‘æˆåŠŸ"
 
-#: ../roundup/cgi/actions.py:671
+#: ../roundup/cgi/actions.py:676
 #, python-format
 msgid "%(class)s %(id)s %(properties)s edited ok"
 msgstr "%(class)s %(id)s %(properties)s ç¼–è¾‘æˆåŠŸ"
 
-#: ../roundup/cgi/actions.py:689
+#: ../roundup/cgi/actions.py:694
 #, python-format
 msgid "%(class)s %(id)s created"
 msgstr "%(class)s %(id)s è¢«åˆ›å»º"
 
-#: ../roundup/cgi/actions.py:817
+#: ../roundup/cgi/actions.py:822
 #, python-format
 msgid ""
 "Edit Error: someone else has edited this %(klass)s (%(props)s). View <a "
 "target=\"_blank\" href=\"%(klass)s%(id)s\">their changes</a> in a new window."
 msgstr ""
 
-#: ../roundup/cgi/actions.py:850
+#: ../roundup/cgi/actions.py:855
 #, python-format
 msgid "Edit Error: %s"
 msgstr "ç¼–è¾‘é”™è¯¯ï¼š%s"
 
-#: ../roundup/cgi/actions.py:931
+#: ../roundup/cgi/actions.py:936
 msgid ""
 "Invalid One Time Key!\n"
 "(a Mozilla bug may cause this message to show up erroneously, please check "
@@ -1757,12 +1762,12 @@ msgstr ""
 "Invalid One Time Key!\n"
 "(ä¸€ä¸ª Mozilla çš„é”™è¯¯å¯èƒ½ä¼šé”™è¯¯åœ°å¼•å‘è¿™ä¸ªæ¶ˆæ¯ï¼Œä½ æ£€æŸ¥ä½ çš„é‚®ä»¶)"
 
-#: ../roundup/cgi/actions.py:972
+#: ../roundup/cgi/actions.py:977
 #, fuzzy, python-format
 msgid "Password reset for %s"
 msgstr "å¯†ç é‡è®¾è¯·æ±‚"
 
-#: ../roundup/cgi/actions.py:973
+#: ../roundup/cgi/actions.py:978
 #, python-format
 msgid ""
 "\n"
@@ -1771,29 +1776,29 @@ msgid ""
 "Your password is now: %(password)s\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:982
+#: ../roundup/cgi/actions.py:987
 #, python-format
 msgid "Password reset and email sent to %s"
 msgstr "å¯†ç è¢«é‡è®¾ï¼Œé‚®ä»¶è¢«å‘ç»™ %s"
 
-#: ../roundup/cgi/actions.py:991
+#: ../roundup/cgi/actions.py:996
 msgid "Unknown username"
 msgstr "æœªçŸ¥ç”¨æˆ·å"
 
-#: ../roundup/cgi/actions.py:999
+#: ../roundup/cgi/actions.py:1004
 msgid "Unknown email address"
 msgstr "æœªçŸ¥é‚®ä»¶åœ°å€"
 
-#: ../roundup/cgi/actions.py:1004
+#: ../roundup/cgi/actions.py:1009
 msgid "You need to specify a username or address"
 msgstr "ä½ éœ€è¦æŒ‡å®šç”¨æˆ·åæˆ–åœ°å€"
 
-#: ../roundup/cgi/actions.py:1015
+#: ../roundup/cgi/actions.py:1020
 #, fuzzy, python-format
 msgid "Confirm reset of password for %s"
 msgstr "ç¡®è®¤å¯†ç "
 
-#: ../roundup/cgi/actions.py:1016
+#: ../roundup/cgi/actions.py:1021
 #, python-format
 msgid ""
 "\n"
@@ -1807,31 +1812,31 @@ msgid ""
 "You should then receive another email with the new password.\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1029
+#: ../roundup/cgi/actions.py:1034
 #, python-format
 msgid "Email sent to primary notification address for %s."
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1031
+#: ../roundup/cgi/actions.py:1036
 #, fuzzy, python-format
 msgid "Email sent to %s."
 msgstr "é‚®ä»¶å‘ç»™ %s"
 
-#: ../roundup/cgi/actions.py:1046
+#: ../roundup/cgi/actions.py:1051
 msgid "You are now registered, welcome!"
 msgstr "ä½ å·²ç»æ³¨å†Œï¼Œæ¬¢è¿Žï¼"
 
-#: ../roundup/cgi/actions.py:1139
+#: ../roundup/cgi/actions.py:1144
 #, python-format
 msgid "Username '%s' is already used."
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1163
+#: ../roundup/cgi/actions.py:1168
 #, python-format
 msgid "Complete your registration to %(tracker_name)s -- key %(key)s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1167
+#: ../roundup/cgi/actions.py:1172
 #, python-format
 msgid ""
 "To complete your registration of the user \"%(name)s\" with\n"
@@ -1847,12 +1852,12 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1181
+#: ../roundup/cgi/actions.py:1186
 #, python-format
 msgid "Complete your registration to %s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1182
+#: ../roundup/cgi/actions.py:1187
 #, python-format
 msgid ""
 "To complete your registration of the user \"%(name)s\" with\n"
@@ -1862,44 +1867,44 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1206
+#: ../roundup/cgi/actions.py:1211
 msgid "It is not permitted to supply roles at registration."
 msgstr "ä¸å…è®¸åœ¨æ³¨å†Œæ—¶æŒ‡ä¾›è§’è‰²ã€‚"
 
-#: ../roundup/cgi/actions.py:1220
+#: ../roundup/cgi/actions.py:1225
 msgid "You are logged out"
 msgstr "ä½ å·²ç»ç™»å‡º"
 
-#: ../roundup/cgi/actions.py:1250
+#: ../roundup/cgi/actions.py:1255
 msgid "Username required"
 msgstr "éœ€è¦ç”¨æˆ·å"
 
-#: ../roundup/cgi/actions.py:1354
+#: ../roundup/cgi/actions.py:1359
 #, python-format
 msgid "Welcome %(username)s!"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1477
+#: ../roundup/cgi/actions.py:1482
 #, python-format
 msgid "Logins occurring too fast. Please wait: %s seconds."
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1515 ../roundup/cgi/actions.py:1526
-#: ../roundup/cgi/actions.py:1515:1526
+#: ../roundup/cgi/actions.py:1520 ../roundup/cgi/actions.py:1531
+#: ../roundup/cgi/actions.py:1520:1531
 msgid "Invalid login"
 msgstr "æ— æ•ˆç™»å½•"
 
-#: ../roundup/cgi/actions.py:1532
+#: ../roundup/cgi/actions.py:1537
 msgid "You do not have permission to login"
 msgstr "ä½ æ²¡æœ‰ç™»å½•çš„æƒé™"
 
-#: ../roundup/cgi/actions.py:1577 ../roundup/cgi/actions.py:1757
-#: ../roundup/cgi/actions.py:1577:1757
+#: ../roundup/cgi/actions.py:1582 ../roundup/cgi/actions.py:1762
+#: ../roundup/cgi/actions.py:1582:1762
 #, python-format
 msgid "Column \"%(column)s\" not found in %(class)s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1822
+#: ../roundup/cgi/actions.py:1827
 #, python-format
 msgid "You do not have permission to view %(class)s"
 msgstr "ä½ æ²¡æœ‰æŸ¥çœ‹ %(class)s çš„æƒé™"
@@ -2023,8 +2028,8 @@ msgstr "è¡¨æ ¼é”™è¯¯ï¼š"
 msgid "Unrecognized charset: %r"
 msgstr "æ— æ³•è¯†åˆ«çš„å­—ç¬¦é›†ï¼š%r"
 
-#: ../roundup/cgi/client.py:1381 ../roundup/cgi/client.py:2394
-#: ../roundup/cgi/client.py:1381:2394
+#: ../roundup/cgi/client.py:1381 ../roundup/cgi/client.py:2396
+#: ../roundup/cgi/client.py:1381:2396
 msgid "broken form: multiple @action values submitted"
 msgstr ""
 
@@ -2102,57 +2107,58 @@ msgstr ""
 
 #: ../roundup/cgi/client.py:1679
 #, python-format
-msgid "csrf X-REQUESTED-WITH xmlrpc required header check failed for user%s."
+msgid ""
+"csrf X-REQUESTED-WITH xmlrpc required header check failed for user%(userid)s."
 msgstr ""
 
 #: ../roundup/cgi/client.py:1720
 #, python-format
-msgid "Required csrf field missing for user%s"
+msgid "Required csrf field missing for user%(userid)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1722 ../roundup/cgi/client.py:1749
-#: ../roundup/cgi/client.py:1766 ../roundup/cgi/client.py:1722:1749:1766
+#: ../roundup/cgi/client.py:1723 ../roundup/cgi/client.py:1751
+#: ../roundup/cgi/client.py:1768 ../roundup/cgi/client.py:1723:1751:1768
 msgid ""
 "We can't validate your session (csrf failure). Re-enter any unsaved data and "
 "try again."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1726
+#: ../roundup/cgi/client.py:1728
 #, python-format
-msgid "csrf field not supplied by user%s"
+msgid "csrf field not supplied by user%(userid)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1738
+#: ../roundup/cgi/client.py:1740
 #, python-format
 msgid ""
 "Csrf mismatch user: current user %(user)s != stored user %(stored)s, current "
 "session, stored session: %(cur_sess)s,%(stor_sess)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1756
+#: ../roundup/cgi/client.py:1758
 #, python-format
 msgid ""
 "Csrf mismatch user: current session %(curr_sess)s != stored session "
 "%(stor_sess)s, current user/stored user is: %(user)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1948
+#: ../roundup/cgi/client.py:1950
 msgid "You are not allowed to view this file."
 msgstr "ä½ æ²¡æœ‰æŸ¥çœ‹æ­¤æ–‡ä»¶çš„æƒé™"
 
-#: ../roundup/cgi/client.py:2272
+#: ../roundup/cgi/client.py:2274
 #, python-format
 msgid "%(starttag)sTime elapsed: %(seconds)fs%(endtag)s\n"
 msgstr ""
 
-#: ../roundup/cgi/client.py:2276
+#: ../roundup/cgi/client.py:2278
 #, python-format
 msgid ""
 "%(starttag)sCache hits: %(cache_hits)d, misses %(cache_misses)d. Loading "
 "items: %(get_items)f secs. Filtering: %(filtering)f secs.%(endtag)s\n"
 msgstr ""
 
-#: ../roundup/cgi/client.py:2815
+#: ../roundup/cgi/client.py:2817
 #, python-format
 msgid ""
 "Cache failure: compressed file %(compressed)s is older than its source file "
@@ -2216,137 +2222,137 @@ msgstr[0] "è¦æ±‚çš„ %(class)s å±žæ€§ %(property)s æ²¡æœ‰è¢«æä¾›"
 msgid "You are not allowed to %(action)s items of class %(class)s"
 msgstr "ä½ ä¸å…è®¸ %(action)s ç±» %(class)s çš„é¡¹ç›®"
 
-#: ../roundup/cgi/templating.py:916
+#: ../roundup/cgi/templating.py:892
 msgid "(list)"
 msgstr "(åˆ—è¡¨)"
 
-#: ../roundup/cgi/templating.py:991
+#: ../roundup/cgi/templating.py:975
 msgid "Submit New Entry"
 msgstr "æäº¤"
 
-#: ../roundup/cgi/templating.py:1013 ../roundup/cgi/templating.py:1189
-#: ../roundup/cgi/templating.py:1824 ../roundup/cgi/templating.py:1855
-#: ../roundup/cgi/templating.py:1876 ../roundup/cgi/templating.py:1914
-#: ../roundup/cgi/templating.py:1967 ../roundup/cgi/templating.py:1991
-#: ../roundup/cgi/templating.py:1998 ../roundup/cgi/templating.py:2035
-#: ../roundup/cgi/templating.py:2088 ../roundup/cgi/templating.py:2121
-#: ../roundup/cgi/templating.py:2216 ../roundup/cgi/templating.py:2237
-#: ../roundup/cgi/templating.py:2328 ../roundup/cgi/templating.py:2348
-#: ../roundup/cgi/templating.py:2370 ../roundup/cgi/templating.py:2413
-#: ../roundup/cgi/templating.py:2423 ../roundup/cgi/templating.py:2488
-#: ../roundup/cgi/templating.py:2791 ../roundup/cgi/templating.py:1013:1189
-#: :1824:1855 :1876:1914 :1967:1991 :1998:2035 :2088:2121 :2216:2237 :2328:2348
-#: :2370:2413 :2423:2488:2791
+#: ../roundup/cgi/templating.py:997 ../roundup/cgi/templating.py:1174
+#: ../roundup/cgi/templating.py:1809 ../roundup/cgi/templating.py:1840
+#: ../roundup/cgi/templating.py:1861 ../roundup/cgi/templating.py:1899
+#: ../roundup/cgi/templating.py:1952 ../roundup/cgi/templating.py:1976
+#: ../roundup/cgi/templating.py:1983 ../roundup/cgi/templating.py:2020
+#: ../roundup/cgi/templating.py:2077 ../roundup/cgi/templating.py:2115
+#: ../roundup/cgi/templating.py:2215 ../roundup/cgi/templating.py:2236
+#: ../roundup/cgi/templating.py:2357 ../roundup/cgi/templating.py:2377
+#: ../roundup/cgi/templating.py:2399 ../roundup/cgi/templating.py:2442
+#: ../roundup/cgi/templating.py:2452 ../roundup/cgi/templating.py:2517
+#: ../roundup/cgi/templating.py:2820 ../roundup/cgi/templating.py:997:1174
+#: :1809:1840 :1861:1899 :1952:1976 :1983:2020 :2077:2115 :2215:2236 :2357:2377
+#: :2399:2442 :2452:2517:2820
 msgid "[hidden]"
 msgstr "[éšè—]"
 
-#: ../roundup/cgi/templating.py:1014
+#: ../roundup/cgi/templating.py:998
 msgid "New node - no history"
 msgstr "æ–°è®°å½• - æ— åŽ†å²"
 
-#: ../roundup/cgi/templating.py:1154
+#: ../roundup/cgi/templating.py:1139
 msgid "Submit Changes"
 msgstr "æäº¤å˜åŠ¨"
 
-#: ../roundup/cgi/templating.py:1232
+#: ../roundup/cgi/templating.py:1217
 msgid "<em>The indicated property no longer exists</em>"
 msgstr "<em>æŒ‡ç¤ºçš„å±žæ€§ä¸å†å­˜åœ¨</em>"
 
-#: ../roundup/cgi/templating.py:1268
+#: ../roundup/cgi/templating.py:1253
 #, python-format
 msgid "The linked class %(classname)s no longer exists"
 msgstr "é“¾æŽ¥çš„ç±» %(classname)s ä¸å†å­˜åœ¨"
 
-#: ../roundup/cgi/templating.py:1305 ../roundup/cgi/templating.py:1335
-#: ../roundup/cgi/templating.py:2497 ../roundup/cgi/templating.py:2800
-#: ../roundup/cgi/templating.py:1305:1335 :2497:2800
+#: ../roundup/cgi/templating.py:1290 ../roundup/cgi/templating.py:1320
+#: ../roundup/cgi/templating.py:2526 ../roundup/cgi/templating.py:2829
+#: ../roundup/cgi/templating.py:1290:1320 :2526:2829
 msgid "[label is missing]"
 msgstr ""
 
 # ../roundup/cgi/templating.py:872 :893
-#: ../roundup/cgi/templating.py:1309 ../roundup/cgi/templating.py:1338
-#: ../roundup/cgi/templating.py:1309:1338
+#: ../roundup/cgi/templating.py:1294 ../roundup/cgi/templating.py:1323
+#: ../roundup/cgi/templating.py:1294:1323
 msgid "<strike>The linked node no longer exists</strike>"
 msgstr "<strike>é“¾æŽ¥çš„ç»“ç‚¹ä¸å†å­˜åœ¨</strike>"
 
-#: ../roundup/cgi/templating.py:1400
+#: ../roundup/cgi/templating.py:1385
 #, python-format
 msgid "%s: (no value)"
 msgstr "%s: (æ— å€¼)"
 
-#: ../roundup/cgi/templating.py:1416
+#: ../roundup/cgi/templating.py:1401
 #, fuzzy, python-format
 msgid ""
 "<strong><em>This event %s is not handled by the history display!</em></"
 "strong>"
 msgstr "<strong><em>è¿™ä¸ªäº‹ä»¶ä¸èƒ½è¢«åŽ†å²æ˜¾ç¤ºæ‰€å¤„ç†ï¼</em></strong>"
 
-#: ../roundup/cgi/templating.py:1429
+#: ../roundup/cgi/templating.py:1414
 msgid "<tr><td colspan=4><strong>Note:</strong></td></tr>"
 msgstr "<tr><td colspan=4><strong>æ³¨æ„ï¼š</strong></td></tr>"
 
-#: ../roundup/cgi/templating.py:1438
+#: ../roundup/cgi/templating.py:1423
 msgid "History"
 msgstr "åŽ†å²"
 
-#: ../roundup/cgi/templating.py:1440
+#: ../roundup/cgi/templating.py:1425
 msgid "<th>Date</th>"
 msgstr "<th>æ—¥æœŸ</th>"
 
-#: ../roundup/cgi/templating.py:1441
+#: ../roundup/cgi/templating.py:1426
 msgid "<th>User</th>"
 msgstr "<th>ç”¨æˆ·</th>"
 
-#: ../roundup/cgi/templating.py:1442
+#: ../roundup/cgi/templating.py:1427
 msgid "<th>Action</th>"
 msgstr "<th>åŠ¨ä½œ</th>"
 
-#: ../roundup/cgi/templating.py:1443
+#: ../roundup/cgi/templating.py:1428
 msgid "<th>Args</th>"
 msgstr "<th>å‚æ•°</th>"
 
-#: ../roundup/cgi/templating.py:1494
+#: ../roundup/cgi/templating.py:1479
 #, fuzzy, python-format
 msgid "Copy of %(class)s %(id)s"
 msgstr "%(class)s %(id)s è¢«åˆ›å»º"
 
-#: ../roundup/cgi/templating.py:2125 ../roundup/cgi/templating.py:2160
-#: ../roundup/cgi/templating.py:1382:2125:2160
+#: ../roundup/cgi/templating.py:2119 ../roundup/cgi/templating.py:2154
+#: ../roundup/cgi/templating.py:1367:2119:2154
 msgid "No"
 msgstr "å¦"
 
-#: ../roundup/cgi/templating.py:2125 ../roundup/cgi/templating.py:2154
-#: ../roundup/cgi/templating.py:1382:2125:2154
+#: ../roundup/cgi/templating.py:2119 ../roundup/cgi/templating.py:2148
+#: ../roundup/cgi/templating.py:1367:2119:2148
 msgid "Yes"
 msgstr "æ˜¯"
 
-#: ../roundup/cgi/templating.py:2286
+#: ../roundup/cgi/templating.py:2315
 msgid ""
 "default value for DateHTMLProperty must be either DateHTMLProperty or string "
 "date representation."
 msgstr "DateHTMLProperty çš„ç¼ºçœå€¼æˆ–è€…æ˜¯ DateHTMLProperty æˆ–å­—ç¬¦ä¸²çš„æ—¥æœŸè¡¨ç¤ºã€‚"
 
-#: ../roundup/cgi/templating.py:2468
+#: ../roundup/cgi/templating.py:2497
 #, python-format
 msgid "Attempt to look up %(attr)s on a missing value"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:2479
+#: ../roundup/cgi/templating.py:2508
 #, python-format
 msgid "Attempt to look up %(item)s on a missing value"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:2584
+#: ../roundup/cgi/templating.py:2613
 #, python-format
 msgid "<option %svalue=\"-1\">- no selection -</option>"
 msgstr "<option %svalue=\"-1\">- æœªé€‰æ‹© -</option>"
 
-#: ../roundup/cgi/templating.py:3745
+#: ../roundup/cgi/templating.py:3777
 #, python-format
 msgid "Unable to read or expand file '%(name)s' in template '%(template)s'."
 msgstr ""
 
-#: ../roundup/cgi/templating.py:3795
+#: ../roundup/cgi/templating.py:3827
 #, python-format
 msgid ""
 "Found an incorrect token when expandfile applied string subsitution on "
@@ -2504,54 +2510,54 @@ msgstr "%sä¹‹å‰"
 msgid "in %s"
 msgstr "åœ¨ %s"
 
-#: ../roundup/hyperdb.py:120
+#: ../roundup/hyperdb.py:126
 #, fuzzy, python-format
 msgid "property %(property)s: %(errormsg)s"
 msgstr "å±žæ€§ %s: %s"
 
-#: ../roundup/hyperdb.py:149
+#: ../roundup/hyperdb.py:161
 #, python-format
 msgid "property %(property)s: %(value)r is an invalid date (%(errormsg)s)"
 msgstr ""
 
-#: ../roundup/hyperdb.py:172
+#: ../roundup/hyperdb.py:184
 #, python-format
 msgid ""
 "property %(property)s: %(value)r is an invalid date interval (%(errormsg)s)"
 msgstr ""
 
-#: ../roundup/hyperdb.py:434
+#: ../roundup/hyperdb.py:446
 #, fuzzy, python-format
 msgid "property %(property)s: %(value)r is not a number"
 msgstr "å±žæ€§ \"%(propname)s\": \"%(value)s\" å½“å‰ä¸åœ¨åˆ—è¡¨ä¸­"
 
-#: ../roundup/hyperdb.py:448
+#: ../roundup/hyperdb.py:460
 #, fuzzy, python-format
 msgid "property %(property)s: %(value)r is not an integer"
 msgstr "å±žæ€§ \"%(propname)s\": \"%(value)s\" å½“å‰ä¸åœ¨åˆ—è¡¨ä¸­"
 
-#: ../roundup/hyperdb.py:470
+#: ../roundup/hyperdb.py:482
 #, python-format
 msgid "\"%s\" not a node designator"
 msgstr ""
 
-#: ../roundup/hyperdb.py:1499 ../roundup/hyperdb.py:1507
-#: ../roundup/hyperdb.py:1499:1507
+#: ../roundup/hyperdb.py:1515 ../roundup/hyperdb.py:1523
+#: ../roundup/hyperdb.py:1515:1523
 #, python-format
 msgid "Not a property name: %s"
 msgstr "ä¸æ˜¯å±žæ€§å: %s"
 
-#: ../roundup/hyperdb.py:2038
+#: ../roundup/hyperdb.py:2054
 #, fuzzy, python-format
 msgid "property %(property)s: %(value)r is not a %(classname)s."
 msgstr "å±žæ€§ \"%(propname)s\": \"%(value)s\" å½“å‰ä¸åœ¨åˆ—è¡¨ä¸­"
 
-#: ../roundup/hyperdb.py:2044
+#: ../roundup/hyperdb.py:2060
 #, python-format
 msgid "you may only enter ID values for property %s"
 msgstr ""
 
-#: ../roundup/hyperdb.py:2079
+#: ../roundup/hyperdb.py:2095
 #, python-format
 msgid "%(property)r is not a property of %(classname)s"
 msgstr ""
@@ -2806,60 +2812,60 @@ msgid ""
 "are: %(stack)s"
 msgstr ""
 
-#: ../roundup/pygettext.py:401
+#: ../roundup/pygettext.py:400
 #, python-format
 msgid "*** %(file)s:%(lineno)s: Seen unexpected token \"%(token)s\""
 msgstr ""
 
-#: ../roundup/pygettext.py:457
+#: ../roundup/pygettext.py:456
 #, python-format
 msgid "# File: %(filename)s, line: %(lineno)d"
 msgstr ""
 
-#: ../roundup/pygettext.py:464
+#: ../roundup/pygettext.py:463
 #, python-format
 msgid " %(filename)s:%(lineno)d"
 msgstr ""
 
-#: ../roundup/pygettext.py:540
+#: ../roundup/pygettext.py:539
 #, fuzzy, python-format
 msgid "Invalid value for --style: %s"
 msgstr "æ— æ•ˆç™»å½•"
 
-#: ../roundup/pygettext.py:548
+#: ../roundup/pygettext.py:547
 #, python-format
 msgid "pygettext.py (xgettext for Python) %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:554
+#: ../roundup/pygettext.py:553
 #, python-format
 msgid "--width argument must be an integer: %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:582
+#: ../roundup/pygettext.py:581
 #, python-format
 msgid "Can't read --exclude-file: %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:601
+#: ../roundup/pygettext.py:600
 msgid "Reading standard input"
 msgstr ""
 
-#: ../roundup/pygettext.py:606
+#: ../roundup/pygettext.py:605
 #, python-format
 msgid "Working on %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:640
+#: ../roundup/pygettext.py:639
 msgid "a unicode string"
 msgstr ""
 
-#: ../roundup/pygettext.py:642
+#: ../roundup/pygettext.py:641
 #, python-format
 msgid "*** Seen unexpected token \"%(token)s\""
 msgstr ""
 
-#: ../roundup/pygettext.py:643
+#: ../roundup/pygettext.py:642
 msgid "morethanonestring"
 msgstr ""
 
@@ -2979,32 +2985,32 @@ msgstr "åˆ›å»º"
 msgid "creator"
 msgstr "åˆ›å»ºè€…"
 
-#: ../roundup/roundupdb.py:426
+#: ../roundup/roundupdb.py:447
 #, python-format
 msgid "No key for \"%(adr)s\" in keyring"
 msgstr ""
 
-#: ../roundup/roundupdb.py:504
+#: ../roundup/roundupdb.py:525
 #, python-format
 msgid "New submission from %(authname)s%(authaddr)s:"
 msgstr ""
 
-#: ../roundup/roundupdb.py:507
+#: ../roundup/roundupdb.py:528
 #, python-format
 msgid "%(authname)s%(authaddr)s added the comment:"
 msgstr ""
 
-#: ../roundup/roundupdb.py:510
+#: ../roundup/roundupdb.py:531
 #, python-format
 msgid "Change by %(authname)s%(authaddr)s:"
 msgstr ""
 
-#: ../roundup/roundupdb.py:529
+#: ../roundup/roundupdb.py:550
 #, python-format
 msgid "File '%(filename)s' not attached - you can download it from %(link)s."
 msgstr ""
 
-#: ../roundup/roundupdb.py:904
+#: ../roundup/roundupdb.py:925
 #, python-format
 msgid ""
 "\n"
@@ -3108,58 +3114,58 @@ msgstr ""
 "<html><head><title>Roundup tracker ç´¢å¼•</title></head>\n"
 "<body><h1>Roundup tracker ç´¢å¼•</h1><ol>\n"
 
-#: ../roundup/scripts/roundup_server.py:598
+#: ../roundup/scripts/roundup_server.py:602
 #, fuzzy, python-format
 msgid "Error: %(type)s: %(value)s"
 msgstr "%(key)s: %(value)s"
 
-#: ../roundup/scripts/roundup_server.py:610
+#: ../roundup/scripts/roundup_server.py:614
 msgid "WARNING: ignoring \"-g\" argument, not root"
 msgstr "è­¦å‘Šï¼šå¿½ç•¥ \"-g\" å‚æ•°ï¼Œä¸æ˜¯ root"
 
-#: ../roundup/scripts/roundup_server.py:616
+#: ../roundup/scripts/roundup_server.py:620
 msgid "Can't change groups - no grp module"
 msgstr "ä¸èƒ½ä¿®æ”¹ç»„ - æ—  grp æ¨¡å—"
 
-#: ../roundup/scripts/roundup_server.py:625
+#: ../roundup/scripts/roundup_server.py:629
 #, python-format
 msgid "Group %(group)s doesn't exist"
 msgstr "ç»„ %(group)s ä¸å­˜åœ¨"
 
-#: ../roundup/scripts/roundup_server.py:637
+#: ../roundup/scripts/roundup_server.py:641
 msgid "Can't run as root!"
 msgstr "ä¸èƒ½ä»¥ root è¿è¡Œï¼"
 
-#: ../roundup/scripts/roundup_server.py:640
+#: ../roundup/scripts/roundup_server.py:644
 msgid "WARNING: ignoring \"-u\" argument, not root"
 msgstr "è­¦å‘Šï¼šå¿½ç•¥ \"-u\" å‚æ•°ï¼Œä¸æ˜¯ root"
 
-#: ../roundup/scripts/roundup_server.py:646
+#: ../roundup/scripts/roundup_server.py:650
 msgid "Can't change users - no pwd module"
 msgstr "ä¸èƒ½ä¿®æ”¹ç”¨æˆ· - æ—  pwd æ¨¡å—"
 
-#: ../roundup/scripts/roundup_server.py:655
+#: ../roundup/scripts/roundup_server.py:659
 #, python-format
 msgid "User %(user)s doesn't exist"
 msgstr "ç”¨æˆ· %(user)s ä¸å­˜åœ¨"
 
-#: ../roundup/scripts/roundup_server.py:867
+#: ../roundup/scripts/roundup_server.py:871
 #, python-format
 msgid "Multiprocess mode \"%s\" is not available, switching to single-process"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:895
+#: ../roundup/scripts/roundup_server.py:899
 #, python-format
 msgid "Unable to bind to port %s, port already in use."
 msgstr "æ— æ³•ç»‘å®šåˆ°ç«¯å£ %s, ç«¯å£å·²ç»è¢«å ç”¨ã€‚"
 
-#: ../roundup/scripts/roundup_server.py:899
+#: ../roundup/scripts/roundup_server.py:903
 #, fuzzy, python-format
 msgid ""
 "Unable to bind to port %(port)s, access not allowed, errno: %(errno)s %(msg)s"
 msgstr "æ— æ³•ç»‘å®šåˆ°ç«¯å£ %s, ç«¯å£å·²ç»è¢«å ç”¨ã€‚"
 
-#: ../roundup/scripts/roundup_server.py:978
+#: ../roundup/scripts/roundup_server.py:982
 #, fuzzy
 msgid ""
 " -c <Command>  Windows Service options.\n"
@@ -3176,7 +3182,7 @@ msgstr ""
 "               å˜é‡ä¸Šé…ç½®ä¸€ä¸ªtrackerã€‚è¿™ä¸ªé€‰é¡¹ä¸Žå…¶ç»é€‰é¡¹æ˜¯äº’æ–¥çš„ã€‚æ‰“å…¥\n"
 "               \"roundup-server -c help\" æ¥äº†è§£WindowsæœåŠ¡çš„è§„èŒƒã€‚"
 
-#: ../roundup/scripts/roundup_server.py:985
+#: ../roundup/scripts/roundup_server.py:989
 #, fuzzy
 msgid ""
 " -u <UID>      runs the Roundup web server as this UID\n"
@@ -3192,7 +3198,7 @@ msgstr ""
 "åŽ»ã€‚\n"
 "               å¦‚æžœä½¿ç”¨äº† -d é€‰é¡¹ï¼Œåˆ™ -l é€‰é¡¹ *å¿…é¡»* è¦æŒ‡å®šã€‚"
 
-#: ../roundup/scripts/roundup_server.py:993
+#: ../roundup/scripts/roundup_server.py:997
 #, fuzzy, python-format
 msgid ""
 "\n"
@@ -3294,20 +3300,24 @@ msgstr ""
 "   æ„æ•°é‡çš„ name=home å¯¹ã€‚è¦ç¡®ä¿ name éƒ¨åˆ†ä¸èƒ½åŒ…æ‹¬ä»»ä½•éžurlå®‰å…¨çš„\n"
 "   å­—ç¬¦ï¼Œè±¡ç©ºæ ¼ï¼Œå› ä¸ºå®ƒä»¬ä¼šæŠŠIEæžä¹±ã€‚\n"
 
-#: ../roundup/scripts/roundup_server.py:1173
+#: ../roundup/scripts/roundup_server.py:1177
 msgid "Instances must be name=home"
 msgstr "å®žä¾‹å¿…é¡»æ˜¯ å®žä¾‹å=å®žä¾‹è·¯å¾„"
 
-#: ../roundup/scripts/roundup_server.py:1187
+#: ../roundup/scripts/roundup_server.py:1191
 #, python-format
 msgid "Configuration saved to %s"
 msgstr "é…ç½®ä¿å­˜åˆ° %s"
 
-#: ../roundup/scripts/roundup_server.py:1205
+#: ../roundup/scripts/roundup_server.py:1206
+msgid "If you specify a PID file you must use -l or -L."
+msgstr ""
+
+#: ../roundup/scripts/roundup_server.py:1212
 msgid "Sorry, you can't run the server as a daemon on this Operating System"
 msgstr "æŠ±æ­‰ï¼Œåœ¨è¿™ä¸ªæ“ä½œç³»ç»Ÿä¸Šä¸èƒ½ä»¥å®ˆæŠ¤è¿›ç¨‹çš„æ–¹å¼æ¥è¿è¡ŒæœåŠ¡"
 
-#: ../roundup/scripts/roundup_server.py:1225
+#: ../roundup/scripts/roundup_server.py:1232
 #, python-format
 msgid "Roundup server started on %(HOST)s:%(PORT)s"
 msgstr "Roundup server å¯åŠ¨äºŽ %(HOST)s:%(PORT)s"
@@ -4575,46 +4585,46 @@ msgstr "Roundup æ–‡æ¡£"
 msgid "clear this message"
 msgstr "æ¸…é™¤æ­¤æ¶ˆæ¯"
 
-#: ../share/roundup/templates/classic/html/page.html:257
-#: ../share/roundup/templates/classic/html/page.html:270
-#: ../share/roundup/templates/classic/html/page.html:288
-#: ../share/roundup/templates/classic/html/page.html:302
-#: ../share/roundup/templates/devel/html/page.html:316
-#: ../share/roundup/templates/devel/html/page.html:329
-#: ../share/roundup/templates/devel/html/page.html:347
-#: ../share/roundup/templates/devel/html/page.html:361
-#: ../share/roundup/templates/minimal/html/page.html:239
-#: ../share/roundup/templates/minimal/html/page.html:254
-#: ../share/roundup/templates/minimal/html/page.html:268
-#: ../share/roundup/templates/responsive/html/page.html:331
-#: ../share/roundup/templates/responsive/html/page.html:344
-#: ../share/roundup/templates/responsive/html/page.html:362
-#: ../share/roundup/templates/responsive/html/page.html:376
-msgid "don't care"
-msgstr "ä¸ç”¨å…³å¿ƒ"
-
-#: ../share/roundup/templates/classic/html/page.html:259
-#: ../share/roundup/templates/classic/html/page.html:272
-#: ../share/roundup/templates/classic/html/page.html:290
+#: ../share/roundup/templates/classic/html/page.html:258
+#: ../share/roundup/templates/classic/html/page.html:271
+#: ../share/roundup/templates/classic/html/page.html:289
 #: ../share/roundup/templates/classic/html/page.html:303
-#: ../share/roundup/templates/devel/html/page.html:318
-#: ../share/roundup/templates/devel/html/page.html:331
-#: ../share/roundup/templates/devel/html/page.html:349
+#: ../share/roundup/templates/devel/html/page.html:317
+#: ../share/roundup/templates/devel/html/page.html:330
+#: ../share/roundup/templates/devel/html/page.html:348
 #: ../share/roundup/templates/devel/html/page.html:362
-#: ../share/roundup/templates/minimal/html/page.html:241
-#: ../share/roundup/templates/minimal/html/page.html:256
+#: ../share/roundup/templates/minimal/html/page.html:240
+#: ../share/roundup/templates/minimal/html/page.html:255
 #: ../share/roundup/templates/minimal/html/page.html:269
-#: ../share/roundup/templates/responsive/html/page.html:333
-#: ../share/roundup/templates/responsive/html/page.html:346
-#: ../share/roundup/templates/responsive/html/page.html:364
+#: ../share/roundup/templates/responsive/html/page.html:332
+#: ../share/roundup/templates/responsive/html/page.html:345
+#: ../share/roundup/templates/responsive/html/page.html:363
 #: ../share/roundup/templates/responsive/html/page.html:377
+msgid "don't care"
+msgstr "ä¸ç”¨å…³å¿ƒ"
+
+#: ../share/roundup/templates/classic/html/page.html:260
+#: ../share/roundup/templates/classic/html/page.html:273
+#: ../share/roundup/templates/classic/html/page.html:291
+#: ../share/roundup/templates/classic/html/page.html:304
+#: ../share/roundup/templates/devel/html/page.html:319
+#: ../share/roundup/templates/devel/html/page.html:332
+#: ../share/roundup/templates/devel/html/page.html:350
+#: ../share/roundup/templates/devel/html/page.html:363
+#: ../share/roundup/templates/minimal/html/page.html:242
+#: ../share/roundup/templates/minimal/html/page.html:257
+#: ../share/roundup/templates/minimal/html/page.html:270
+#: ../share/roundup/templates/responsive/html/page.html:334
+#: ../share/roundup/templates/responsive/html/page.html:347
+#: ../share/roundup/templates/responsive/html/page.html:365
+#: ../share/roundup/templates/responsive/html/page.html:378
 msgid "------------"
 msgstr "------------"
 
-#: ../share/roundup/templates/classic/html/page.html:335
-#: ../share/roundup/templates/devel/html/page.html:390
-#: ../share/roundup/templates/minimal/html/page.html:297
-#: ../share/roundup/templates/responsive/html/page.html:405
+#: ../share/roundup/templates/classic/html/page.html:336
+#: ../share/roundup/templates/devel/html/page.html:391
+#: ../share/roundup/templates/minimal/html/page.html:298
+#: ../share/roundup/templates/responsive/html/page.html:406
 msgid "no value"
 msgstr "æ— å€¼"
 
diff --git a/locale/zh_TW.po b/locale/zh_TW.po
index 77821cb23..ab9087944 100644
--- a/locale/zh_TW.po
+++ b/locale/zh_TW.po
@@ -5,9 +5,9 @@
 #
 msgid ""
 msgstr ""
-"Project-Id-Version: Roundup 2.5.0\n"
+"Project-Id-Version: Roundup 2.5.0b1\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
-"POT-Creation-Date: 2025-01-12 20:17-0500\n"
+"POT-Creation-Date: 2025-06-11 16:02-0400\n"
 "PO-Revision-Date: 2013-10-31 12:23+0100\n"
 "Last-Translator: Fred Lin <gasolin@gmail>\n"
 "Language-Team: Chinese Traditional <gasolin@gmail.com>\n"
@@ -29,19 +29,19 @@ msgstr "ä½ æ²’æœ‰æ¬Šé™ä¾† %(action)s %(classname)s é¡žåž‹ã€‚"
 msgid "You may not retire the admin or anonymous user"
 msgstr "ä½ ä¸èƒ½åˆªé™¤ç®¡ç†å“¡æˆ–åŒ¿åç”¨æˆ¶"
 
-#: ../roundup/admin.py:131
+#: ../roundup/admin.py:132
 msgid ""
 "Have 'display designator[,designator*]' show header inside\n"
 "      []'s before items. Includes retired/active status.\n"
 msgstr ""
 
-#: ../roundup/admin.py:135
+#: ../roundup/admin.py:136
 msgid ""
 "Have 'display designator' and 'specification class' show\n"
 "      protected fields: creator, id etc.\n"
 msgstr ""
 
-#: ../roundup/admin.py:139
+#: ../roundup/admin.py:140
 msgid ""
 "Controls history options. It is a bitstring where setting\n"
 "      the bit disables the feature. A value of 0 (default)\n"
@@ -52,52 +52,52 @@ msgid ""
 "      history.\n"
 msgstr ""
 
-#: ../roundup/admin.py:148
+#: ../roundup/admin.py:149
 msgid ""
 "Set the number of lines of history to keep for this session.\n"
 "      -1 is infinite.\n"
 msgstr ""
 
-#: ../roundup/admin.py:152
+#: ../roundup/admin.py:153
 msgid "Set indexer to use when running 'reindex' NYI\n"
 msgstr ""
 
-#: ../roundup/admin.py:155
+#: ../roundup/admin.py:156
 msgid "Force reopening of tracker when running each command.\n"
 msgstr ""
 
-#: ../roundup/admin.py:158
+#: ../roundup/admin.py:159
 msgid ""
 "set the number of rows imported before a database commit is\n"
 "      done. Used only for imports on PostgreSQL.\n"
 msgstr ""
 
-#: ../roundup/admin.py:160
+#: ../roundup/admin.py:161
 msgid "Show retired items in table, list etc. One of 'no', 'only', 'both'\n"
 msgstr ""
 
-#: ../roundup/admin.py:162
+#: ../roundup/admin.py:163
 msgid "internal mapping for show_retired.\n"
 msgstr ""
 
-#: ../roundup/admin.py:163
+#: ../roundup/admin.py:164
 msgid "Enable verbose output: tracing, descriptions...\n"
 msgstr ""
 
 # ../roundup/admin.py:84 :943 :992 :1014
-#: ../roundup/admin.py:175 ../roundup/admin.py:1188 ../roundup/admin.py:1858
-#: ../roundup/admin.py:1890 ../roundup/admin.py:175:1188 :1858:1890
+#: ../roundup/admin.py:176 ../roundup/admin.py:1199 ../roundup/admin.py:1869
+#: ../roundup/admin.py:1901 ../roundup/admin.py:176:1199 :1869:1901
 #, python-format
 msgid "no such class \"%(classname)s\""
 msgstr "ç„¡æ­¤é¡žåˆ¥ \"%(classname)s\""
 
 # ../roundup/admin.py:94 :98
-#: ../roundup/admin.py:188
+#: ../roundup/admin.py:189
 #, python-format
 msgid "argument \"%(arg)s\" not propname=value"
 msgstr "åƒæ•¸ \"%(arg)s\" ä¸æ˜¯ propname=value çš„å½¢å¼"
 
-#: ../roundup/admin.py:201
+#: ../roundup/admin.py:202
 #, python-format
 msgid ""
 "Problem: %(message)s\n"
@@ -106,7 +106,7 @@ msgstr ""
 "å•é¡Œ: %(message)s\n"
 "\n"
 
-#: ../roundup/admin.py:202
+#: ../roundup/admin.py:203
 #, fuzzy, python-format
 msgid ""
 "%(message)sUsage: roundup-admin [options] [<command> <arguments>]\n"
@@ -156,12 +156,12 @@ msgstr ""
 " roundup-admin help <command>             -- å‘½ä»¤è©³è§£èªªæ˜Ž\n"
 " roundup-admin help all                   -- æ‰€æœ‰å¯ç”¨çš„èªªæ˜Ž\n"
 
-#: ../roundup/admin.py:231
+#: ../roundup/admin.py:232
 #, fuzzy
 msgid "Commands: "
 msgstr "å‘½ä»¤ï¼š"
 
-#: ../roundup/admin.py:238
+#: ../roundup/admin.py:249
 msgid ""
 "Commands may be abbreviated as long as the abbreviation\n"
 "matches only one command, e.g. l == li == lis == list."
@@ -169,7 +169,7 @@ msgstr ""
 "å‘½ä»¤å¯ä»¥è¢«ç¸®å¯«ï¼Œåªè¦ç¸®å¯«åªæœ‰ä¸€å€‹å‘½ä»¤å¯ä»¥åŒ¹é…ä¸Šï¼Œ\n"
 "å¦‚ï¼šl == li == lis == list."
 
-#: ../roundup/admin.py:270
+#: ../roundup/admin.py:281
 #, fuzzy
 msgid ""
 "\n"
@@ -293,25 +293,25 @@ msgstr ""
 "\n"
 "ä½¿ç”¨èªªæ˜Žï¼š\n"
 
-#: ../roundup/admin.py:334
+#: ../roundup/admin.py:345
 #, python-format
 msgid "%s:"
 msgstr ""
 
 # ../roundup/admin.py:337 :387
-#: ../roundup/admin.py:439 ../roundup/admin.py:1415
-#: ../roundup/admin.py:439:1415
+#: ../roundup/admin.py:450 ../roundup/admin.py:1426
+#: ../roundup/admin.py:450:1426
 msgid "Templates:"
 msgstr "æ¨¡æ¿ï¼š"
 
 # ../roundup/admin.py:340 :398
-#: ../roundup/admin.py:442 ../roundup/admin.py:1425
-#: ../roundup/admin.py:442:1425
+#: ../roundup/admin.py:453 ../roundup/admin.py:1436
+#: ../roundup/admin.py:453:1436
 msgid "Back ends:"
 msgstr "å¾Œç«¯ï¼š"
 
 #. noqa: ARG002
-#: ../roundup/admin.py:459
+#: ../roundup/admin.py:470
 msgid ""
 "Usage: commit\n"
 "        Commit changes made to the database during an interactive session.\n"
@@ -332,7 +332,7 @@ msgstr ""
 "        åœ¨å‘½ä»¤è¡Œä¸­çš„ One-off å‘½ä»¤å¦‚æžœæˆåŠŸæœƒè¢«è‡ªå‹•æäº¤ã€‚\n"
 "        "
 
-#: ../roundup/admin.py:474
+#: ../roundup/admin.py:485
 msgid ""
 "Usage: create classname property=value ...\n"
 "        Create a new entry of a given class.\n"
@@ -352,42 +352,42 @@ msgstr ""
 
 # ../roundup/admin.py:359 :494 :573 :623 :676 :697 :725 :796 :863 :934 :982
 # :1004 :1031 :1093 :1159
-#: ../roundup/admin.py:482 ../roundup/admin.py:555 ../roundup/admin.py:606
-#: ../roundup/admin.py:733 ../roundup/admin.py:806 ../roundup/admin.py:851
-#: ../roundup/admin.py:902 ../roundup/admin.py:999 ../roundup/admin.py:1216
-#: ../roundup/admin.py:1388 ../roundup/admin.py:1516 ../roundup/admin.py:1599
-#: ../roundup/admin.py:1725 ../roundup/admin.py:1848 ../roundup/admin.py:1880
-#: ../roundup/admin.py:1996 ../roundup/admin.py:2050 ../roundup/admin.py:2098
-#: ../roundup/admin.py:482:555 :1216:1388:1516 :1599:1725 :1848:1880 :1996:2050
-#: :2098 :606:733 :806:851 :902:999
+#: ../roundup/admin.py:493 ../roundup/admin.py:566 ../roundup/admin.py:617
+#: ../roundup/admin.py:744 ../roundup/admin.py:817 ../roundup/admin.py:862
+#: ../roundup/admin.py:913 ../roundup/admin.py:1010 ../roundup/admin.py:1227
+#: ../roundup/admin.py:1399 ../roundup/admin.py:1527 ../roundup/admin.py:1610
+#: ../roundup/admin.py:1736 ../roundup/admin.py:1859 ../roundup/admin.py:1891
+#: ../roundup/admin.py:2007 ../roundup/admin.py:2061 ../roundup/admin.py:2109
+#: ../roundup/admin.py:493:566 :1227:1399 :1527:1610 :1736:1859 :1891:2007
+#: :2061:2109 :617:744 :817:862 :913:1010
 msgid "Not enough arguments supplied"
 msgstr "æœªæä¾›è¶³å¤ çš„åƒæ•¸"
 
-#: ../roundup/admin.py:502
+#: ../roundup/admin.py:513
 #, python-format
 msgid "%(propname)s (Password): "
 msgstr "%(propname)s (å£ä»¤)ï¼š"
 
-#: ../roundup/admin.py:505
+#: ../roundup/admin.py:516
 #, python-format
 msgid "   %(propname)s (Again): "
 msgstr "   %(propname)s (å†æ¬¡)ï¼š"
 
-#: ../roundup/admin.py:509
+#: ../roundup/admin.py:520
 msgid "Sorry, try again..."
 msgstr "æŠ±æ­‰ï¼Œå†è©¦ä¸€æ¬¡..."
 
-#: ../roundup/admin.py:514
+#: ../roundup/admin.py:525
 #, python-format
 msgid "%(propname)s (%(proptype)s): "
 msgstr ""
 
-#: ../roundup/admin.py:533
+#: ../roundup/admin.py:544
 #, python-format
 msgid "you must provide the \"%(propname)s\" property."
 msgstr "ä½ å¿…é ˆæä¾› \"%(propname)s\" å±¬æ€§ã€‚"
 
-#: ../roundup/admin.py:545
+#: ../roundup/admin.py:556
 #, fuzzy
 msgid ""
 "Usage: display designator[,designator]*\n"
@@ -406,13 +406,13 @@ msgstr ""
 "        å°‡é¡¯ç¤ºçµ¦å‡ºçµé»žçš„å±¬æ€§å’Œç›¸æ‡‰çš„å€¼ã€‚\n"
 "        "
 
-#: ../roundup/admin.py:586
+#: ../roundup/admin.py:597
 #, fuzzy, python-format
 msgid "%(protected)s%(key)s: %(value)s"
 msgstr "%(key)s: %(value)s (é—œéµå±¬æ€§)"
 
 #. grab the directory to export to
-#: ../roundup/admin.py:589
+#: ../roundup/admin.py:600
 #, fuzzy
 msgid ""
 "Usage: export [[-]class[,class]] export_dir\n"
@@ -440,7 +440,7 @@ msgstr ""
 "        æ”¾åœ¨æŒ‡å®šçš„ç›®æ¨™ç›®éŒ„ä¸­ã€‚\n"
 "        "
 
-#: ../roundup/admin.py:704
+#: ../roundup/admin.py:715
 #, fuzzy
 msgid ""
 "Usage: exporttables [[-]class[,class]] export_dir\n"
@@ -469,7 +469,7 @@ msgstr ""
 "        æ”¾åœ¨æŒ‡å®šçš„ç›®æ¨™ç›®éŒ„ä¸­ã€‚\n"
 "        "
 
-#: ../roundup/admin.py:723
+#: ../roundup/admin.py:734
 #, fuzzy
 msgid ""
 "Usage: filter classname propname=value ...\n"
@@ -491,20 +491,20 @@ msgstr ""
 "        "
 
 # ../roundup/admin.py:663 :816 :828 :882
-#: ../roundup/admin.py:764
+#: ../roundup/admin.py:775
 #, fuzzy, python-format
 msgid "Class %(curclassname)s has no property %(pn)s in %(propname)s."
 msgstr "%(classname)s æ²’æœ‰ \"%(propname)s\" å±¬æ€§"
 
 # ../roundup/admin.py:663 :816 :828 :882
-#: ../roundup/admin.py:791 ../roundup/admin.py:840 ../roundup/admin.py:1536
-#: ../roundup/admin.py:1549 ../roundup/admin.py:2120
-#: ../roundup/admin.py:791:840 :1536:1549:2120
+#: ../roundup/admin.py:802 ../roundup/admin.py:851 ../roundup/admin.py:1547
+#: ../roundup/admin.py:1560 ../roundup/admin.py:2131
+#: ../roundup/admin.py:802:851 :1547:1560:2131
 #, python-format
 msgid "%(classname)s has no property \"%(propname)s\""
 msgstr "%(classname)s æ²’æœ‰ \"%(propname)s\" å±¬æ€§"
 
-#: ../roundup/admin.py:798
+#: ../roundup/admin.py:809
 msgid ""
 "Usage: find classname propname=value ...\n"
 "        Find the nodes of the given class with a given link property value.\n"
@@ -522,14 +522,14 @@ msgstr ""
 "        æˆ–è€…æ˜¯çµé»žçš„éµå€¼ã€‚\n"
 "        "
 
-#: ../roundup/admin.py:847
+#: ../roundup/admin.py:858
 msgid ""
 "Usage: genconfig filename\n"
 "        Create a new tracker config file with default values in filename.\n"
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:864
+#: ../roundup/admin.py:875
 #, python-format
 msgid ""
 "Changing option\n"
@@ -537,20 +537,20 @@ msgid ""
 "from old default of %(old_number)s to new default of %(new_number)s."
 msgstr ""
 
-#: ../roundup/admin.py:875
+#: ../roundup/admin.py:886
 #, python-format
 msgid ""
 "Update 'password_pbkdf2_default_rounds' to a number equal to or larger\n"
 "  than %s.\n"
 msgstr ""
 
-#: ../roundup/admin.py:882
+#: ../roundup/admin.py:893
 msgid ""
 "Check the rdbms mysql_* settings. Your charset and collations may need\n"
 "  to be changed. See upgrading instructions.\n"
 msgstr ""
 
-#: ../roundup/admin.py:892
+#: ../roundup/admin.py:903
 #, fuzzy
 msgid ""
 "Usage: get property designator[,designator]*\n"
@@ -570,24 +570,24 @@ msgstr ""
 "        "
 
 # ../roundup/admin.py:527 :542
-#: ../roundup/admin.py:925
+#: ../roundup/admin.py:936
 #, python-format
 msgid "property %s is not of type Multilink or Link so -d flag does not apply."
 msgstr "å±¬æ€§ %s ä¸æ˜¯ Multilink æˆ– Link é¡žåž‹ï¼Œæ‰€ä»¥ -d æ¨™èªŒä¸èƒ½æ‡‰ç”¨ã€‚"
 
 # ../roundup/admin.py:550 :945 :994 :1016
-#: ../roundup/admin.py:942 ../roundup/admin.py:1190 ../roundup/admin.py:1864
-#: ../roundup/admin.py:1892 ../roundup/admin.py:942:1190 :1864:1892
+#: ../roundup/admin.py:953 ../roundup/admin.py:1201 ../roundup/admin.py:1875
+#: ../roundup/admin.py:1903 ../roundup/admin.py:953:1201 :1875:1903
 #, python-format
 msgid "no such %(classname)s node \"%(nodeid)s\""
 msgstr "æ²’æœ‰é€™æ¨£çš„ %(classname)s çµé»ž \"%(nodeid)s\""
 
-#: ../roundup/admin.py:945
+#: ../roundup/admin.py:956
 #, python-format
 msgid "no such %(classname)s property \"%(propname)s\""
 msgstr "æ²’æœ‰é€™æ¨£çš„ %(classname)s å±¬æ€§ \"%(propname)s\""
 
-#: ../roundup/admin.py:950
+#: ../roundup/admin.py:961
 msgid ""
 "Usage: help topic\n"
 "        Give help about topic.\n"
@@ -607,12 +607,12 @@ msgstr ""
 "        all       -- æ‰€æœ‰å¯ç”¨çš„èªªæ˜Ž\n"
 "        "
 
-#: ../roundup/admin.py:969
+#: ../roundup/admin.py:980
 #, python-format
 msgid "Sorry, no help for \"%(topic)s\""
 msgstr "æŠ±æ­‰ï¼Œæ²’æœ‰å° \"%(topic)s\" çš„èªªæ˜Žä¿¡æ¯"
 
-#: ../roundup/admin.py:986
+#: ../roundup/admin.py:997
 #, fuzzy
 msgid ""
 "Usage: history designator [skipquiet] [raw]\n"
@@ -634,27 +634,27 @@ msgstr ""
 "        å®ƒçš„éµå€¼å¯ä»¥è¢«é‡ç”¨ã€‚\n"
 "        "
 
-#: ../roundup/admin.py:1011
+#: ../roundup/admin.py:1022
 #, python-format
 msgid "Unexpected argument(s): %s. Expected 'skipquiet' or 'raw'."
 msgstr ""
 
-#: ../roundup/admin.py:1062
+#: ../roundup/admin.py:1073
 #, fuzzy
 msgid "removed"
 msgstr "åˆªé™¤"
 
-#: ../roundup/admin.py:1064
+#: ../roundup/admin.py:1075
 msgid "added"
 msgstr ""
 
-#: ../roundup/admin.py:1066
+#: ../roundup/admin.py:1077
 #, python-format
 msgid "Unknown history set operation '%s'. Expected +/-."
 msgstr ""
 
 #. .Hint added issue23 to superseder
-#: ../roundup/admin.py:1091
+#: ../roundup/admin.py:1102
 #, fuzzy, python-format
 msgid "added %(class)s%(item_id)s to %(propname)s"
 msgstr "%(class)s %(id)s %(properties)s ç·¨è¼¯æˆåŠŸ"
@@ -662,29 +662,29 @@ msgstr "%(class)s %(id)s %(properties)s ç·¨è¼¯æˆåŠŸ"
 #. .Hint read as: assignedto was admin(1)
 #. where assignedto is the property
 #. admin is the key name for value 1
-#: ../roundup/admin.py:1112
+#: ../roundup/admin.py:1123
 #, python-format
 msgid "%(prop)s was %(name)s(%(value)s)"
 msgstr ""
 
-#: ../roundup/admin.py:1118 ../roundup/admin.py:1147
-#: ../roundup/admin.py:1118:1147
+#: ../roundup/admin.py:1129 ../roundup/admin.py:1158
+#: ../roundup/admin.py:1129:1158
 #, fuzzy, python-format
 msgid "%(prop)s was %(value)s"
 msgstr "%(key)s: %(value)s (é—œéµå±¬æ€§)"
 
-#: ../roundup/admin.py:1137
+#: ../roundup/admin.py:1148
 #, python-format
 msgid "%(prop)s was [%(value_list)s]"
 msgstr ""
 
 #. .Hint modified nosy: added demo(3)
-#: ../roundup/admin.py:1144
+#: ../roundup/admin.py:1155
 #, python-format
 msgid "modified %(prop)s: %(how)s"
 msgstr ""
 
-#: ../roundup/admin.py:1195
+#: ../roundup/admin.py:1206
 #, fuzzy
 msgid ""
 "Usage: import import_dir\n"
@@ -726,7 +726,7 @@ msgstr ""
 "        èˆŠæ•¸æ“šã€‚)\n"
 "        "
 
-#: ../roundup/admin.py:1306
+#: ../roundup/admin.py:1317
 msgid ""
 "Usage: importtables export_dir\n"
 "        This imports the database tables exported using exporttables.\n"
@@ -736,7 +736,7 @@ msgid ""
 msgstr ""
 
 #. password
-#: ../roundup/admin.py:1314
+#: ../roundup/admin.py:1325
 msgid ""
 "Usage: initialise [adminpw]\n"
 "        Initialise a new Roundup tracker.\n"
@@ -754,23 +754,23 @@ msgstr ""
 "        åŸ·è¡Œtrackerçš„åˆå§‹åŒ–å‡½æ•¸ dbinit.init()\n"
 "        "
 
-#: ../roundup/admin.py:1328
+#: ../roundup/admin.py:1339
 msgid "Admin Password: "
 msgstr "ç®¡ç†å“¡å£ä»¤ï¼š"
 
-#: ../roundup/admin.py:1329
+#: ../roundup/admin.py:1340
 msgid "       Confirm: "
 msgstr "       ç¢ºèªï¼š"
 
-#: ../roundup/admin.py:1333
+#: ../roundup/admin.py:1344
 msgid "Instance home does not exist"
 msgstr "å¯¦ä¾‹ç›®éŒ„ä¸å­˜åœ¨"
 
-#: ../roundup/admin.py:1337
+#: ../roundup/admin.py:1348
 msgid "Instance has not been installed"
 msgstr "å¯¦ä¾‹é‚„æ²’æœ‰å®‰è£"
 
-#: ../roundup/admin.py:1345
+#: ../roundup/admin.py:1356
 msgid ""
 "WARNING: The database is already initialised!\n"
 "If you re-initialise it, you will lose all the data!\n"
@@ -780,7 +780,7 @@ msgstr ""
 "å¦‚æžœä½ é‡æ–°åˆå§‹åŒ–å®ƒï¼Œæ‰€æœ‰çš„æ•¸æ“šå°‡æœƒä¸Ÿå¤±ï¼\n"
 "åˆªé™¤å®ƒå—Žï¼ŸY/N: "
 
-#: ../roundup/admin.py:1365
+#: ../roundup/admin.py:1376
 #, fuzzy
 msgid ""
 "Usage: install [template [backend [key=val[,key=val]]]]\n"
@@ -820,12 +820,12 @@ msgstr ""
 "        è«‹æŸ¥çœ‹åˆå§‹åŒ–åƒæ•¸èªªæ˜Žã€‚\n"
 "        "
 
-#: ../roundup/admin.py:1394
+#: ../roundup/admin.py:1405
 #, python-format
 msgid "Instance home parent directory \"%(parent)s\" does not exist"
 msgstr "å¯¦ä¾‹ç›®éŒ„çš„çˆ¶ç›®éŒ„ \"%(parent)s\" ä¸å­˜åœ¨"
 
-#: ../roundup/admin.py:1403
+#: ../roundup/admin.py:1414
 #, python-format
 msgid ""
 "WARNING: There appears to be a tracker in \"%(tracker_home)s\"!\n"
@@ -836,22 +836,22 @@ msgstr ""
 "å¦‚æžœä½ æ‰“ç®—é‡æ–°å®‰è£å®ƒï¼Œæ‰€æœ‰çš„æ•¸æ“šå°‡æœƒä¸Ÿå¤±ï¼\n"
 "åˆªé™¤å®ƒå—Žï¼ŸY/N: "
 
-#: ../roundup/admin.py:1416
+#: ../roundup/admin.py:1427
 #, fuzzy
 msgid "Select template"
 msgstr "é¸æ“‡æ¨¡æ¿ [classic]ï¼š"
 
-#: ../roundup/admin.py:1426
+#: ../roundup/admin.py:1437
 #, fuzzy
 msgid "Select backend"
 msgstr "é¸æ“‡å¾Œç«¯ [anydbm]ï¼š"
 
-#: ../roundup/admin.py:1437
+#: ../roundup/admin.py:1448
 #, fuzzy, python-format
 msgid "Error in configuration settings: \"%s\""
 msgstr "é…ç½®ä¿å­˜åˆ° %s"
 
-#: ../roundup/admin.py:1470
+#: ../roundup/admin.py:1481
 #, fuzzy, python-format
 msgid ""
 "\n"
@@ -863,11 +863,11 @@ msgstr ""
 " ç¾åœ¨ä½ æ‡‰è©²ä¿®æ”¹trackerçš„é…ç½®æ–‡ä»¶ï¼š\n"
 "   %(config_file)s"
 
-#: ../roundup/admin.py:1480
+#: ../roundup/admin.py:1491
 msgid " ... at a minimum, you must set following options:"
 msgstr " ... è‡³å°‘ï¼Œä½ å¿…é ˆè¨­ç½®ä»¥ä¸‹é¸é …ï¼š"
 
-#: ../roundup/admin.py:1485
+#: ../roundup/admin.py:1496
 #, fuzzy, python-format
 msgid ""
 "\n"
@@ -891,7 +891,7 @@ msgstr ""
 "   %(database_init_file)s\n"
 " ... æŸ¥çœ‹é—œæ–¼å®¢æˆ¶åŒ–çš„æ–‡æª”ä¾†çž­è§£æ›´å¤šçš„ä¿¡æ¯ã€‚\n"
 
-#: ../roundup/admin.py:1501
+#: ../roundup/admin.py:1512
 msgid ""
 "Usage: list classname [property]\n"
 "        List the instances of a class.\n"
@@ -917,17 +917,17 @@ msgstr ""
 "        å®šäº†å±¬æ€§ï¼Œå°æ¯å€‹é¡žåž‹å¯¦ä¾‹æœƒåˆ—å°å‡ºé€™å€‹å±¬æ€§ã€‚\n"
 "        "
 
-#: ../roundup/admin.py:1514
+#: ../roundup/admin.py:1525
 msgid "Too many arguments supplied"
 msgstr "æä¾›äº†å¤ªå¤šçš„åƒæ•¸äº†"
 
-#: ../roundup/admin.py:1547
+#: ../roundup/admin.py:1558
 #, python-format
 msgid "%(nodeid)4s: %(value)s"
 msgstr ""
 
 #. noqa: ARG002  - args unused
-#: ../roundup/admin.py:1554
+#: ../roundup/admin.py:1565
 msgid ""
 "Usage: migrate\n"
 "        Update a tracker's database to be compatible with the Roundup\n"
@@ -950,17 +950,17 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1574
+#: ../roundup/admin.py:1585
 #, python-format
 msgid "Tracker updated to schema version %s."
 msgstr ""
 
-#: ../roundup/admin.py:1578
+#: ../roundup/admin.py:1589
 #, python-format
 msgid "No migration action required. At schema version %s."
 msgstr ""
 
-#: ../roundup/admin.py:1583
+#: ../roundup/admin.py:1594
 #, fuzzy
 msgid ""
 "Usage: pack period | date\n"
@@ -997,11 +997,11 @@ msgstr ""
 "\n"
 "        "
 
-#: ../roundup/admin.py:1609
+#: ../roundup/admin.py:1620
 msgid "Invalid format"
 msgstr "ç„¡æ•ˆçš„æ ¼å¼"
 
-#: ../roundup/admin.py:1620
+#: ../roundup/admin.py:1631
 msgid ""
 "Usage: perftest [mode] [arguments]*\n"
 "        Time operations in Roundup.\n"
@@ -1019,25 +1019,25 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1657
+#: ../roundup/admin.py:1668
 msgid "Invalid 'rounds'. Must be larger than 999."
 msgstr ""
 
-#: ../roundup/admin.py:1661
+#: ../roundup/admin.py:1672
 #, python-format
 msgid "Invalid 'rounds'. It must be an integer not: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1688
+#: ../roundup/admin.py:1699
 msgid "scheme does not support rounds."
 msgstr ""
 
-#: ../roundup/admin.py:1691
+#: ../roundup/admin.py:1702
 #, python-format
 msgid "Hash time: %(time)0.9f seconds, scheme: %(scheme)s, rounds: %(rounds)s"
 msgstr ""
 
-#: ../roundup/admin.py:1697
+#: ../roundup/admin.py:1708
 msgid ""
 "Usage: pragma setting=value | 'list'\n"
 "        Set internal admin settings to a value.\n"
@@ -1066,49 +1066,49 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1732
+#: ../roundup/admin.py:1743
 #, python-format
 msgid "Argument must be setting=value, was given: %s."
 msgstr ""
 
-#: ../roundup/admin.py:1735
+#: ../roundup/admin.py:1746
 msgid "Current settings and values (NYI - not yet implemented):"
 msgstr ""
 
-#: ../roundup/admin.py:1746
+#: ../roundup/admin.py:1757
 msgid ""
 "      Help for this pragma is missing. Please report it to the Roundup "
 "project.\n"
 msgstr ""
 
-#: ../roundup/admin.py:1752
+#: ../roundup/admin.py:1763
 #, fuzzy, python-format
 msgid "Unknown setting %s. Try \"pragma list\"."
 msgstr "æœªçŸ¥ç”¨æˆ¶å"
 
-#: ../roundup/admin.py:1762
+#: ../roundup/admin.py:1773
 #, python-format
 msgid "Incorrect value for boolean setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1769
+#: ../roundup/admin.py:1780
 #, python-format
 msgid "Incorrect value for integer setting %(setting)s: %(value)s."
 msgstr ""
 
-#: ../roundup/admin.py:1776
+#: ../roundup/admin.py:1787
 #, python-format
 msgid ""
 "Incorrect value for setting %(setting)s: %(value)s. Should be no, both, or "
 "only."
 msgstr ""
 
-#: ../roundup/admin.py:1786
+#: ../roundup/admin.py:1797
 #, python-format
 msgid "Internal error: pragma can not handle values of type: %s"
 msgstr ""
 
-#: ../roundup/admin.py:1795
+#: ../roundup/admin.py:1806
 #, fuzzy
 msgid ""
 "Usage: reindex [classname|classname:#-#|designator]*\n"
@@ -1131,17 +1131,17 @@ msgstr ""
 "        é‡æ–°ç”Ÿæˆ tracker çš„æœç´¢ç´¢å¼•ï¼Œå®ƒå°‡è‡ªå‹•é€²è¡Œã€‚\n"
 "        "
 
-#: ../roundup/admin.py:1817
+#: ../roundup/admin.py:1828
 #, python-format
 msgid "no such item \"%(designator)s\""
 msgstr "æ²’æœ‰é€™æ¨£çš„æ¢ç›® \"%(designator)s\""
 
-#: ../roundup/admin.py:1827
+#: ../roundup/admin.py:1838
 #, fuzzy, python-format
 msgid "no such item \"%(class)s%(id)s\""
 msgstr "æ²’æœ‰é€™æ¨£çš„æ¢ç›® \"%(designator)s\""
 
-#: ../roundup/admin.py:1839
+#: ../roundup/admin.py:1850
 #, fuzzy
 msgid ""
 "Usage: restore designator[,designator]*\n"
@@ -1159,7 +1159,7 @@ msgstr ""
 "        çµ¦å®šçš„çµé»žå°‡å°ç”¨æˆ¶ä¾†èªªå†æ¬¡ç”Ÿæ•ˆã€‚\n"
 "        "
 
-#: ../roundup/admin.py:1870
+#: ../roundup/admin.py:1881
 #, fuzzy
 msgid ""
 "Usage: retire designator[,designator]*\n"
@@ -1180,7 +1180,7 @@ msgstr ""
 "        "
 
 #. noqa: ARG002 - args unused
-#: ../roundup/admin.py:1898
+#: ../roundup/admin.py:1909
 msgid ""
 "Usage: rollback\n"
 "        Undo all changes that are pending commit to the database.\n"
@@ -1199,7 +1199,7 @@ msgstr ""
 "        ç”¢ç”Ÿè®ŠåŒ–ã€‚\n"
 "        "
 
-#: ../roundup/admin.py:1911
+#: ../roundup/admin.py:1922
 msgid ""
 "Usage: security [Role name]\n"
 "        Display the Permissions available to one or all Roles.\n"
@@ -1212,47 +1212,47 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:1926
+#: ../roundup/admin.py:1937
 #, fuzzy, python-format
 msgid "No such Role \"%(role)s\"\n"
 msgstr "æ²’æœ‰é€™æ¨£çš„è§’è‰² \"%(role)s\""
 
-#: ../roundup/admin.py:1932
+#: ../roundup/admin.py:1943
 #, fuzzy, python-format
 msgid "New Web users get the Roles \"%(role)s\"\n"
 msgstr "æ–°Webç”¨æˆ¶å¾—åˆ°è§’è‰² \"%(role)s\""
 
-#: ../roundup/admin.py:1935
+#: ../roundup/admin.py:1946
 #, fuzzy, python-format
 msgid "New Web users get the Role \"%(role)s\"\n"
 msgstr "æ–°Webç”¨æˆ¶å¾—åˆ°è§’è‰² \"%(role)s\""
 
-#: ../roundup/admin.py:1939
+#: ../roundup/admin.py:1950
 #, fuzzy, python-format
 msgid "New Email users get the Roles \"%(role)s\"\n"
 msgstr "æ–°éƒµä»¶ç”¨æˆ¶å¾—åˆ°è§’è‰² \"%(role)s\""
 
-#: ../roundup/admin.py:1941
+#: ../roundup/admin.py:1952
 #, fuzzy, python-format
 msgid "New Email users get the Role \"%(role)s\"\n"
 msgstr "æ–°éƒµä»¶ç”¨æˆ¶å¾—åˆ°è§’è‰² \"%(role)s\""
 
-#: ../roundup/admin.py:1944
+#: ../roundup/admin.py:1955
 #, fuzzy, python-format
 msgid "Role \"%(name)s\":\n"
 msgstr "è§’è‰² \"%(name)s\"ï¼š"
 
-#: ../roundup/admin.py:1950
+#: ../roundup/admin.py:1961
 #, fuzzy
 msgid " %(description)s (%(name)s for \"%(klass)s\""
 msgstr " %(description)s (%(name)s åƒ…ç”¨æ–¼ \"%(klass)s\")"
 
-#: ../roundup/admin.py:1950
+#: ../roundup/admin.py:1961
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\": %(properties)s only)\n"
 msgstr " %(description)s (%(name)s åƒ…ç”¨æ–¼ \"%(klass)s\")"
 
-#: ../roundup/admin.py:1963
+#: ../roundup/admin.py:1974
 #, python-format
 msgid ""
 "\n"
@@ -1260,17 +1260,17 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/admin.py:1969
+#: ../roundup/admin.py:1980
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s for \"%(klass)s\" only)\n"
 msgstr " %(description)s (%(name)s åƒ…ç”¨æ–¼ \"%(klass)s\")"
 
-#: ../roundup/admin.py:1972
+#: ../roundup/admin.py:1983
 #, fuzzy, python-format
 msgid " %(description)s (%(name)s)\n"
 msgstr " %(description)s (%(name)s åƒ…ç”¨æ–¼ \"%(klass)s\")"
 
-#: ../roundup/admin.py:1976
+#: ../roundup/admin.py:1987
 #, fuzzy
 msgid ""
 "Usage: set items property=value [property=value ...]\n"
@@ -1303,7 +1303,7 @@ msgstr ""
 "        ä½ éœ€è¦ç‚ºå¤šéˆæŽ¥æä¾›ç”¨é€—è™Ÿåˆ†éš”çš„æ•¸å­—(ä¾‹å¦‚ \"1,2,3\")ã€‚\n"
 "        "
 
-#: ../roundup/admin.py:2044
+#: ../roundup/admin.py:2055
 msgid ""
 "Usage: specification classname\n"
 "        Show the properties for a classname.\n"
@@ -1317,17 +1317,17 @@ msgstr ""
 "        æœƒåˆ—å‡ºçµ¦å®šé¡žåž‹çš„å±¬æ€§ã€‚\n"
 "        "
 
-#: ../roundup/admin.py:2063
+#: ../roundup/admin.py:2074
 #, fuzzy, python-format
 msgid "%(key)s: %(value)s (key property)\n"
 msgstr "%(key)s: %(value)s (é—œéµå±¬æ€§)"
 
-#: ../roundup/admin.py:2066
+#: ../roundup/admin.py:2077
 #, fuzzy, python-format
 msgid "%(key)s: %(value)s\n"
 msgstr "%(key)s: %(value)s (é—œéµå±¬æ€§)"
 
-#: ../roundup/admin.py:2069
+#: ../roundup/admin.py:2080
 msgid ""
 "Usage: table classname [property[,property]*]\n"
 "        List the instances of a class in tabular form.\n"
@@ -1385,17 +1385,17 @@ msgstr ""
 "        å°‡ç”Ÿæˆ4å€‹å­—ç¬¦å¯¬çš„ \"Name\" åˆ—ã€‚\n"
 "        "
 
-#: ../roundup/admin.py:2115
+#: ../roundup/admin.py:2126
 #, python-format
 msgid "\"%(spec)s\" not name:width"
 msgstr "\"%(spec)s\" ä¸æ˜¯ åå­—:å¯¬åº¦"
 
-#: ../roundup/admin.py:2137
+#: ../roundup/admin.py:2148
 #, python-format
 msgid "\"%(spec)s\" does not have an integer width: \"%(width)s\""
 msgstr ""
 
-#: ../roundup/admin.py:2173
+#: ../roundup/admin.py:2184
 msgid ""
 "Usage: templates [trace_search]\n"
 "        List templates and their installed directories.\n"
@@ -1405,7 +1405,7 @@ msgid ""
 "        "
 msgstr ""
 
-#: ../roundup/admin.py:2201
+#: ../roundup/admin.py:2212
 msgid ""
 "Usage: updateconfig <filename>\n"
 "        Merge existing tracker config with new settings.\n"
@@ -1416,34 +1416,34 @@ msgid ""
 msgstr ""
 
 # ../roundup/cgi/actions.py:549 :559 :730 :749
-#: ../roundup/admin.py:2210 ../roundup/cgi/actions.py:886
-#: ../roundup/cgi/actions.py:897 ../roundup/cgi/actions.py:1099
-#: ../roundup/cgi/actions.py:1113 ../roundup/cgi/actions.py:886:897 :1099:1113
+#: ../roundup/admin.py:2221 ../roundup/cgi/actions.py:891
+#: ../roundup/cgi/actions.py:902 ../roundup/cgi/actions.py:1104
+#: ../roundup/cgi/actions.py:1118 ../roundup/cgi/actions.py:891:902 :1104:1118
 #, python-format
 msgid "Error: %s"
 msgstr "éŒ¯èª¤ï¼š%s"
 
-#: ../roundup/admin.py:2242
+#: ../roundup/admin.py:2253
 #, python-format
 msgid "Unknown command \"%(command)s\" (\"help commands\" for a list)"
 msgstr "æœªçŸ¥å‘½ä»¤ \"%(command)s\" (\"help commands\" æŸ¥çœ‹å‘½ä»¤åˆ—è¡¨)"
 
-#: ../roundup/admin.py:2248
+#: ../roundup/admin.py:2259
 #, python-format
 msgid "Multiple commands match \"%(command)s\": %(list)s"
 msgstr "å¤šå‘½ä»¤åŒ¹é… \"%(command)s\": %(list)s"
 
-#: ../roundup/admin.py:2263
+#: ../roundup/admin.py:2274
 msgid "Enter tracker home: "
 msgstr "è¼¸å…¥trackerèµ·å§‹ç›®éŒ„ï¼š"
 
-#: ../roundup/admin.py:2292 ../roundup/admin.py:2296
-#: ../roundup/admin.py:2292:2296
+#: ../roundup/admin.py:2303 ../roundup/admin.py:2307
+#: ../roundup/admin.py:2303:2307
 #, python-format
 msgid "Error: Couldn't open tracker: %(message)s"
 msgstr "éŒ¯èª¤ï¼šä¸èƒ½æ‰“é–‹trackerï¼š%(message)s"
 
-#: ../roundup/admin.py:2344
+#: ../roundup/admin.py:2355
 #, python-format
 msgid ""
 "Roundup %s ready for input.\n"
@@ -1452,58 +1452,58 @@ msgstr ""
 "Roundup %s è¼¸å…¥å°±ç·’ã€‚\n"
 "æ•²å…¥ \"help\" ç²å¾—èªªæ˜Žã€‚"
 
-#: ../roundup/admin.py:2377
+#: ../roundup/admin.py:2388
 msgid "Note: command history and editing not available"
 msgstr "æ³¨æ„ï¼šå‘½ä»¤æ­·å²å’Œç·¨è¼¯ç„¡æ•ˆ"
 
-#: ../roundup/admin.py:2383
+#: ../roundup/admin.py:2394
 msgid "exit..."
 msgstr "é€€å‡º..."
 
-#: ../roundup/admin.py:2396
+#: ../roundup/admin.py:2407
 msgid "There are unsaved changes. Commit them (y/N)? "
 msgstr "å­˜åœ¨æœªè¢«ä¿å­˜çš„æ”¹å‹•ã€‚æäº¤å—Ž(y/N)ï¼Ÿ"
 
-#: ../roundup/backends/back_anydbm.py:215
-#: ../roundup/backends/rdbms_common.py:928
+#: ../roundup/backends/back_anydbm.py:213
+#: ../roundup/backends/rdbms_common.py:926
 #, python-format
 msgid "Class \"%s\" already defined."
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:280
+#: ../roundup/backends/back_anydbm.py:278
 #: ../roundup/backends/sessions_dbm.py:61
 msgid "Couldn't identify database type"
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:314
+#: ../roundup/backends/back_anydbm.py:312
 #, python-format
 msgid ""
 "Couldn't open database - the required module '%s' (as dbm.gnu) is not "
 "available"
 msgstr ""
 
-#: ../roundup/backends/back_anydbm.py:318
+#: ../roundup/backends/back_anydbm.py:316
 #, python-format
 msgid "Couldn't open database - the required module '%s' is not available"
 msgstr ""
 
 #: ../roundup/backends/back_anydbm.py:873
 #: ../roundup/backends/back_anydbm.py:886
-#: ../roundup/backends/back_anydbm.py:1160
-#: ../roundup/backends/back_anydbm.py:1195
-#: ../roundup/backends/back_anydbm.py:1424
-#: ../roundup/backends/back_anydbm.py:1442
-#: ../roundup/backends/back_anydbm.py:1489
-#: ../roundup/backends/back_anydbm.py:2135
+#: ../roundup/backends/back_anydbm.py:1162
+#: ../roundup/backends/back_anydbm.py:1197
+#: ../roundup/backends/back_anydbm.py:1426
+#: ../roundup/backends/back_anydbm.py:1444
+#: ../roundup/backends/back_anydbm.py:1492
+#: ../roundup/backends/back_anydbm.py:2138
 #: ../roundup/backends/back_anydbm.py:873:886
-#: ../roundup/backends/rdbms_common.py:1720
-#: ../roundup/backends/rdbms_common.py:1967
-#: ../roundup/backends/rdbms_common.py:2206
-#: ../roundup/backends/rdbms_common.py:2226
-#: ../roundup/backends/rdbms_common.py:2279
-#: ../roundup/backends/rdbms_common.py:3254
-#: ../roundup/backends/rdbms_common.py:1720:1967 :1160:1195 :1424:1442:1489
-#: :2135 :2206:2226 :2279:3254
+#: ../roundup/backends/rdbms_common.py:1721
+#: ../roundup/backends/rdbms_common.py:1972
+#: ../roundup/backends/rdbms_common.py:2211
+#: ../roundup/backends/rdbms_common.py:2231
+#: ../roundup/backends/rdbms_common.py:2293
+#: ../roundup/backends/rdbms_common.py:3268
+#: ../roundup/backends/rdbms_common.py:1721:1972 :1162:1197 :1426:1444:1492
+#: :2138 :2211:2231 :2293:3268
 msgid "Database open read-only"
 msgstr ""
 
@@ -1529,45 +1529,50 @@ msgstr ""
 msgid "Unable to get lock after 10 retries on %s."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:632
+#: ../roundup/backends/rdbms_common.py:630
 #, python-format
 msgid "ALTER operation disallowed: %(old)r -> %(new)r."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:867
+#: ../roundup/backends/rdbms_common.py:865
 #, python-format
 msgid "CREATE operation disallowed: \"%s\"."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:884
+#: ../roundup/backends/rdbms_common.py:882
 #, python-format
 msgid "DROP operation disallowed: \"%s\"."
 msgstr ""
 
-#: ../roundup/backends/rdbms_common.py:1863
+#: ../roundup/backends/rdbms_common.py:1864
 msgid "create"
 msgstr "å»ºç«‹"
 
-#: ../roundup/backends/rdbms_common.py:2038
+#: ../roundup/backends/rdbms_common.py:2043
 msgid "unlink"
 msgstr "è§£é™¤"
 
-#: ../roundup/backends/rdbms_common.py:2042
+#: ../roundup/backends/rdbms_common.py:2047
 msgid "link"
 msgstr "éˆæŽ¥"
 
-#: ../roundup/backends/rdbms_common.py:2187
+#: ../roundup/backends/rdbms_common.py:2192
 msgid "set"
 msgstr "è¨­ç½®"
 
-#: ../roundup/backends/rdbms_common.py:2216
+#: ../roundup/backends/rdbms_common.py:2221
 msgid "retired"
 msgstr "æ”¶å›ž"
 
-#: ../roundup/backends/rdbms_common.py:2246
+#: ../roundup/backends/rdbms_common.py:2251
 msgid "restored"
 msgstr "æ¢å¾©"
 
+#: ../roundup/backends/rdbms_common.py:2265
+#, fuzzy, python-format
+msgid "class %(cls)s: %(value)r is not an id"
+msgstr "å±¬æ€§ \"%(propname)s\": \"%(value)s\" ç•¶å‰ä¸åœ¨åˆ—è¡¨ä¸­"
+
 #: ../roundup/backends/sessions_redis.py:78
 #: ../roundup/backends/sessions_redis.py:97
 #: ../roundup/backends/sessions_redis.py:78:97
@@ -1650,10 +1655,10 @@ msgid "\"%(input)s\" is not an ID (%(classname)s ID required)"
 msgstr "\"%(input)s\" ä¸æ˜¯ä¸€å€‹ ID (è¦æ±‚ %(classname)s ID)"
 
 #: ../roundup/cgi/actions.py:228 ../roundup/cgi/actions.py:266
-#: ../roundup/cgi/actions.py:493 ../roundup/cgi/actions.py:833
-#: ../roundup/cgi/actions.py:880 ../roundup/cgi/actions.py:1084
-#: ../roundup/cgi/actions.py:1246 ../roundup/cgi/actions.py:228:266:1246
-#: :493:833 :880:1084
+#: ../roundup/cgi/actions.py:493 ../roundup/cgi/actions.py:838
+#: ../roundup/cgi/actions.py:885 ../roundup/cgi/actions.py:1089
+#: ../roundup/cgi/actions.py:1251 ../roundup/cgi/actions.py:228:266:1251
+#: :493:838 :885:1089
 #, fuzzy
 msgid "Invalid request"
 msgstr "ç„¡æ•ˆçš„æ ¼å¼"
@@ -1706,8 +1711,8 @@ msgstr "ç„¡æ•ˆçš„æ ¼å¼"
 msgid "Invalid integer: "
 msgstr "ç„¡æ•ˆç™»éŒ„"
 
-#: ../roundup/cgi/actions.py:531 ../roundup/cgi/actions.py:735
-#: ../roundup/cgi/actions.py:531:735
+#: ../roundup/cgi/actions.py:531 ../roundup/cgi/actions.py:740
+#: ../roundup/cgi/actions.py:531:740
 #, python-format
 msgid "You do not have permission to create %(class)s"
 msgstr "ä½ æ²’æœ‰æ¬Šé™ä¾†å»ºç«‹ %(class)s"
@@ -1717,8 +1722,8 @@ msgstr "ä½ æ²’æœ‰æ¬Šé™ä¾†å»ºç«‹ %(class)s"
 msgid "Not enough values on line %(line)s"
 msgstr "åœ¨ %(line)s è¡Œæ²’æœ‰è¶³å¤ çš„å€¼"
 
-#: ../roundup/cgi/actions.py:556 ../roundup/cgi/actions.py:723
-#: ../roundup/cgi/actions.py:556:723
+#: ../roundup/cgi/actions.py:556 ../roundup/cgi/actions.py:728
+#: ../roundup/cgi/actions.py:556:728
 #, python-format
 msgid "You do not have permission to edit %(class)s"
 msgstr "ä½ æ²’æœ‰æ¬Šé™ä¾†ç·¨è¼¯ %(class)s"
@@ -1727,29 +1732,29 @@ msgstr "ä½ æ²’æœ‰æ¬Šé™ä¾†ç·¨è¼¯ %(class)s"
 msgid "Items edited OK"
 msgstr "é …ç›®ç·¨è¼¯æˆåŠŸ"
 
-#: ../roundup/cgi/actions.py:671
+#: ../roundup/cgi/actions.py:676
 #, python-format
 msgid "%(class)s %(id)s %(properties)s edited ok"
 msgstr "%(class)s %(id)s %(properties)s ç·¨è¼¯æˆåŠŸ"
 
-#: ../roundup/cgi/actions.py:689
+#: ../roundup/cgi/actions.py:694
 #, python-format
 msgid "%(class)s %(id)s created"
 msgstr "%(class)s %(id)s è¢«å»ºç«‹"
 
-#: ../roundup/cgi/actions.py:817
+#: ../roundup/cgi/actions.py:822
 #, python-format
 msgid ""
 "Edit Error: someone else has edited this %(klass)s (%(props)s). View <a "
 "target=\"_blank\" href=\"%(klass)s%(id)s\">their changes</a> in a new window."
 msgstr ""
 
-#: ../roundup/cgi/actions.py:850
+#: ../roundup/cgi/actions.py:855
 #, python-format
 msgid "Edit Error: %s"
 msgstr "ç·¨è¼¯éŒ¯èª¤ï¼š%s"
 
-#: ../roundup/cgi/actions.py:931
+#: ../roundup/cgi/actions.py:936
 msgid ""
 "Invalid One Time Key!\n"
 "(a Mozilla bug may cause this message to show up erroneously, please check "
@@ -1758,12 +1763,12 @@ msgstr ""
 "Invalid One Time Key!\n"
 "(ä¸€å€‹ Mozilla çš„éŒ¯èª¤å¯èƒ½æœƒéŒ¯èª¤åœ°å¼•ç™¼é€™å€‹æ¶ˆæ¯ï¼Œä½ æª¢æŸ¥ä½ çš„éƒµä»¶)"
 
-#: ../roundup/cgi/actions.py:972
+#: ../roundup/cgi/actions.py:977
 #, fuzzy, python-format
 msgid "Password reset for %s"
 msgstr "å£ä»¤é‡è¨­è«‹æ±‚"
 
-#: ../roundup/cgi/actions.py:973
+#: ../roundup/cgi/actions.py:978
 #, python-format
 msgid ""
 "\n"
@@ -1772,29 +1777,29 @@ msgid ""
 "Your password is now: %(password)s\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:982
+#: ../roundup/cgi/actions.py:987
 #, python-format
 msgid "Password reset and email sent to %s"
 msgstr "å£ä»¤è¢«é‡è¨­ï¼Œéƒµä»¶è¢«ç™¼çµ¦ %s"
 
-#: ../roundup/cgi/actions.py:991
+#: ../roundup/cgi/actions.py:996
 msgid "Unknown username"
 msgstr "æœªçŸ¥ç”¨æˆ¶å"
 
-#: ../roundup/cgi/actions.py:999
+#: ../roundup/cgi/actions.py:1004
 msgid "Unknown email address"
 msgstr "æœªçŸ¥éƒµä»¶åœ°å€"
 
-#: ../roundup/cgi/actions.py:1004
+#: ../roundup/cgi/actions.py:1009
 msgid "You need to specify a username or address"
 msgstr "ä½ éœ€è¦æŒ‡å®šç”¨æˆ¶åæˆ–åœ°å€"
 
-#: ../roundup/cgi/actions.py:1015
+#: ../roundup/cgi/actions.py:1020
 #, fuzzy, python-format
 msgid "Confirm reset of password for %s"
 msgstr "å£ä»¤ç¢ºèª"
 
-#: ../roundup/cgi/actions.py:1016
+#: ../roundup/cgi/actions.py:1021
 #, python-format
 msgid ""
 "\n"
@@ -1808,31 +1813,31 @@ msgid ""
 "You should then receive another email with the new password.\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1029
+#: ../roundup/cgi/actions.py:1034
 #, python-format
 msgid "Email sent to primary notification address for %s."
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1031
+#: ../roundup/cgi/actions.py:1036
 #, fuzzy, python-format
 msgid "Email sent to %s."
 msgstr "éƒµä»¶ç™¼çµ¦ %s"
 
-#: ../roundup/cgi/actions.py:1046
+#: ../roundup/cgi/actions.py:1051
 msgid "You are now registered, welcome!"
 msgstr "ä½ å·²ç¶“è¨»å†Šï¼Œæ­¡è¿Žï¼"
 
-#: ../roundup/cgi/actions.py:1139
+#: ../roundup/cgi/actions.py:1144
 #, python-format
 msgid "Username '%s' is already used."
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1163
+#: ../roundup/cgi/actions.py:1168
 #, python-format
 msgid "Complete your registration to %(tracker_name)s -- key %(key)s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1167
+#: ../roundup/cgi/actions.py:1172
 #, python-format
 msgid ""
 "To complete your registration of the user \"%(name)s\" with\n"
@@ -1848,12 +1853,12 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1181
+#: ../roundup/cgi/actions.py:1186
 #, python-format
 msgid "Complete your registration to %s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1182
+#: ../roundup/cgi/actions.py:1187
 #, python-format
 msgid ""
 "To complete your registration of the user \"%(name)s\" with\n"
@@ -1863,44 +1868,44 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1206
+#: ../roundup/cgi/actions.py:1211
 msgid "It is not permitted to supply roles at registration."
 msgstr "ä¸å…è¨±åœ¨è¨»å†Šæ™‚æŒ‡ä¾›è§’è‰²ã€‚"
 
-#: ../roundup/cgi/actions.py:1220
+#: ../roundup/cgi/actions.py:1225
 msgid "You are logged out"
 msgstr "ä½ å·²ç¶“è¨»éŠ·"
 
-#: ../roundup/cgi/actions.py:1250
+#: ../roundup/cgi/actions.py:1255
 msgid "Username required"
 msgstr "éœ€è¦ç”¨æˆ¶å"
 
-#: ../roundup/cgi/actions.py:1354
+#: ../roundup/cgi/actions.py:1359
 #, python-format
 msgid "Welcome %(username)s!"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1477
+#: ../roundup/cgi/actions.py:1482
 #, python-format
 msgid "Logins occurring too fast. Please wait: %s seconds."
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1515 ../roundup/cgi/actions.py:1526
-#: ../roundup/cgi/actions.py:1515:1526
+#: ../roundup/cgi/actions.py:1520 ../roundup/cgi/actions.py:1531
+#: ../roundup/cgi/actions.py:1520:1531
 msgid "Invalid login"
 msgstr "ç„¡æ•ˆç™»éŒ„"
 
-#: ../roundup/cgi/actions.py:1532
+#: ../roundup/cgi/actions.py:1537
 msgid "You do not have permission to login"
 msgstr "ä½ æ²’æœ‰ç™»éŒ„çš„æ¬Šé™"
 
-#: ../roundup/cgi/actions.py:1577 ../roundup/cgi/actions.py:1757
-#: ../roundup/cgi/actions.py:1577:1757
+#: ../roundup/cgi/actions.py:1582 ../roundup/cgi/actions.py:1762
+#: ../roundup/cgi/actions.py:1582:1762
 #, python-format
 msgid "Column \"%(column)s\" not found in %(class)s"
 msgstr ""
 
-#: ../roundup/cgi/actions.py:1822
+#: ../roundup/cgi/actions.py:1827
 #, fuzzy, python-format
 msgid "You do not have permission to view %(class)s"
 msgstr "ä½ æ²’æœ‰æ¬Šé™ä¾†ç·¨è¼¯ %(class)s"
@@ -2024,8 +2029,8 @@ msgstr "è¡¨æ ¼éŒ¯èª¤ï¼š"
 msgid "Unrecognized charset: %r"
 msgstr "ç„¡æ³•è­˜åˆ¥çš„å­—ç¬¦é›†ï¼š%r"
 
-#: ../roundup/cgi/client.py:1381 ../roundup/cgi/client.py:2394
-#: ../roundup/cgi/client.py:1381:2394
+#: ../roundup/cgi/client.py:1381 ../roundup/cgi/client.py:2396
+#: ../roundup/cgi/client.py:1381:2396
 msgid "broken form: multiple @action values submitted"
 msgstr ""
 
@@ -2103,58 +2108,59 @@ msgstr ""
 
 #: ../roundup/cgi/client.py:1679
 #, python-format
-msgid "csrf X-REQUESTED-WITH xmlrpc required header check failed for user%s."
+msgid ""
+"csrf X-REQUESTED-WITH xmlrpc required header check failed for user%(userid)s."
 msgstr ""
 
 #: ../roundup/cgi/client.py:1720
 #, python-format
-msgid "Required csrf field missing for user%s"
+msgid "Required csrf field missing for user%(userid)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1722 ../roundup/cgi/client.py:1749
-#: ../roundup/cgi/client.py:1766 ../roundup/cgi/client.py:1722:1749:1766
+#: ../roundup/cgi/client.py:1723 ../roundup/cgi/client.py:1751
+#: ../roundup/cgi/client.py:1768 ../roundup/cgi/client.py:1723:1751:1768
 msgid ""
 "We can't validate your session (csrf failure). Re-enter any unsaved data and "
 "try again."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1726
+#: ../roundup/cgi/client.py:1728
 #, python-format
-msgid "csrf field not supplied by user%s"
+msgid "csrf field not supplied by user%(userid)s"
 msgstr ""
 
-#: ../roundup/cgi/client.py:1738
+#: ../roundup/cgi/client.py:1740
 #, python-format
 msgid ""
 "Csrf mismatch user: current user %(user)s != stored user %(stored)s, current "
 "session, stored session: %(cur_sess)s,%(stor_sess)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1756
+#: ../roundup/cgi/client.py:1758
 #, python-format
 msgid ""
 "Csrf mismatch user: current session %(curr_sess)s != stored session "
 "%(stor_sess)s, current user/stored user is: %(user)s for key %(key)s."
 msgstr ""
 
-#: ../roundup/cgi/client.py:1948
+#: ../roundup/cgi/client.py:1950
 #, fuzzy
 msgid "You are not allowed to view this file."
 msgstr "ä½ ä¸å…è¨±æŸ¥çœ‹æ­¤é "
 
-#: ../roundup/cgi/client.py:2272
+#: ../roundup/cgi/client.py:2274
 #, python-format
 msgid "%(starttag)sTime elapsed: %(seconds)fs%(endtag)s\n"
 msgstr ""
 
-#: ../roundup/cgi/client.py:2276
+#: ../roundup/cgi/client.py:2278
 #, python-format
 msgid ""
 "%(starttag)sCache hits: %(cache_hits)d, misses %(cache_misses)d. Loading "
 "items: %(get_items)f secs. Filtering: %(filtering)f secs.%(endtag)s\n"
 msgstr ""
 
-#: ../roundup/cgi/client.py:2815
+#: ../roundup/cgi/client.py:2817
 #, python-format
 msgid ""
 "Cache failure: compressed file %(compressed)s is older than its source file "
@@ -2218,137 +2224,137 @@ msgstr[0] "è¦æ±‚çš„ %(class)s å±¬æ€§ %(property)s æ²’æœ‰è¢«æä¾›"
 msgid "You are not allowed to %(action)s items of class %(class)s"
 msgstr "ä½ ä¸å…è¨± %(action)s é¡žåˆ¥ %(class)s çš„é …ç›®"
 
-#: ../roundup/cgi/templating.py:916
+#: ../roundup/cgi/templating.py:892
 msgid "(list)"
 msgstr "(åˆ—è¡¨)"
 
-#: ../roundup/cgi/templating.py:991
+#: ../roundup/cgi/templating.py:975
 msgid "Submit New Entry"
 msgstr "æäº¤æ–°çš„é …"
 
-#: ../roundup/cgi/templating.py:1013 ../roundup/cgi/templating.py:1189
-#: ../roundup/cgi/templating.py:1824 ../roundup/cgi/templating.py:1855
-#: ../roundup/cgi/templating.py:1876 ../roundup/cgi/templating.py:1914
-#: ../roundup/cgi/templating.py:1967 ../roundup/cgi/templating.py:1991
-#: ../roundup/cgi/templating.py:1998 ../roundup/cgi/templating.py:2035
-#: ../roundup/cgi/templating.py:2088 ../roundup/cgi/templating.py:2121
-#: ../roundup/cgi/templating.py:2216 ../roundup/cgi/templating.py:2237
-#: ../roundup/cgi/templating.py:2328 ../roundup/cgi/templating.py:2348
-#: ../roundup/cgi/templating.py:2370 ../roundup/cgi/templating.py:2413
-#: ../roundup/cgi/templating.py:2423 ../roundup/cgi/templating.py:2488
-#: ../roundup/cgi/templating.py:2791 ../roundup/cgi/templating.py:1013:1189
-#: :1824:1855 :1876:1914 :1967:1991 :1998:2035 :2088:2121 :2216:2237 :2328:2348
-#: :2370:2413 :2423:2488:2791
+#: ../roundup/cgi/templating.py:997 ../roundup/cgi/templating.py:1174
+#: ../roundup/cgi/templating.py:1809 ../roundup/cgi/templating.py:1840
+#: ../roundup/cgi/templating.py:1861 ../roundup/cgi/templating.py:1899
+#: ../roundup/cgi/templating.py:1952 ../roundup/cgi/templating.py:1976
+#: ../roundup/cgi/templating.py:1983 ../roundup/cgi/templating.py:2020
+#: ../roundup/cgi/templating.py:2077 ../roundup/cgi/templating.py:2115
+#: ../roundup/cgi/templating.py:2215 ../roundup/cgi/templating.py:2236
+#: ../roundup/cgi/templating.py:2357 ../roundup/cgi/templating.py:2377
+#: ../roundup/cgi/templating.py:2399 ../roundup/cgi/templating.py:2442
+#: ../roundup/cgi/templating.py:2452 ../roundup/cgi/templating.py:2517
+#: ../roundup/cgi/templating.py:2820 ../roundup/cgi/templating.py:997:1174
+#: :1809:1840 :1861:1899 :1952:1976 :1983:2020 :2077:2115 :2215:2236 :2357:2377
+#: :2399:2442 :2452:2517:2820
 msgid "[hidden]"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:1014
+#: ../roundup/cgi/templating.py:998
 msgid "New node - no history"
 msgstr "æ–°è¨˜éŒ„ - ç„¡æ­·å²"
 
-#: ../roundup/cgi/templating.py:1154
+#: ../roundup/cgi/templating.py:1139
 msgid "Submit Changes"
 msgstr "æäº¤è®Šå‹•"
 
-#: ../roundup/cgi/templating.py:1232
+#: ../roundup/cgi/templating.py:1217
 msgid "<em>The indicated property no longer exists</em>"
 msgstr "<em>æŒ‡ç¤ºçš„å±¬æ€§ä¸å†å­˜åœ¨</em>"
 
-#: ../roundup/cgi/templating.py:1268
+#: ../roundup/cgi/templating.py:1253
 #, python-format
 msgid "The linked class %(classname)s no longer exists"
 msgstr "éˆæŽ¥çš„é¡žåˆ¥ %(classname)s ä¸å†å­˜åœ¨"
 
-#: ../roundup/cgi/templating.py:1305 ../roundup/cgi/templating.py:1335
-#: ../roundup/cgi/templating.py:2497 ../roundup/cgi/templating.py:2800
-#: ../roundup/cgi/templating.py:1305:1335 :2497:2800
+#: ../roundup/cgi/templating.py:1290 ../roundup/cgi/templating.py:1320
+#: ../roundup/cgi/templating.py:2526 ../roundup/cgi/templating.py:2829
+#: ../roundup/cgi/templating.py:1290:1320 :2526:2829
 msgid "[label is missing]"
 msgstr ""
 
 # ../roundup/cgi/templating.py:872 :893
-#: ../roundup/cgi/templating.py:1309 ../roundup/cgi/templating.py:1338
-#: ../roundup/cgi/templating.py:1309:1338
+#: ../roundup/cgi/templating.py:1294 ../roundup/cgi/templating.py:1323
+#: ../roundup/cgi/templating.py:1294:1323
 msgid "<strike>The linked node no longer exists</strike>"
 msgstr "<strike>éˆæŽ¥çš„çµé»žä¸å†å­˜åœ¨</strike>"
 
-#: ../roundup/cgi/templating.py:1400
+#: ../roundup/cgi/templating.py:1385
 #, python-format
 msgid "%s: (no value)"
 msgstr "%s: (ç„¡å€¼)"
 
-#: ../roundup/cgi/templating.py:1416
+#: ../roundup/cgi/templating.py:1401
 #, fuzzy, python-format
 msgid ""
 "<strong><em>This event %s is not handled by the history display!</em></"
 "strong>"
 msgstr "<strong><em>é€™å€‹äº‹ä»¶ä¸èƒ½è¢«æ­·å²é¡¯ç¤ºæ‰€è™•ç†ï¼</em></strong>"
 
-#: ../roundup/cgi/templating.py:1429
+#: ../roundup/cgi/templating.py:1414
 msgid "<tr><td colspan=4><strong>Note:</strong></td></tr>"
 msgstr "<tr><td colspan=4><strong>æ³¨æ„ï¼š</strong></td></tr>"
 
-#: ../roundup/cgi/templating.py:1438
+#: ../roundup/cgi/templating.py:1423
 msgid "History"
 msgstr "æ­·å²"
 
-#: ../roundup/cgi/templating.py:1440
+#: ../roundup/cgi/templating.py:1425
 msgid "<th>Date</th>"
 msgstr "<th>æ—¥æœŸ</th>"
 
-#: ../roundup/cgi/templating.py:1441
+#: ../roundup/cgi/templating.py:1426
 msgid "<th>User</th>"
 msgstr "<th>ç”¨æˆ¶</th>"
 
-#: ../roundup/cgi/templating.py:1442
+#: ../roundup/cgi/templating.py:1427
 msgid "<th>Action</th>"
 msgstr "<th>å‹•ä½œ</th>"
 
-#: ../roundup/cgi/templating.py:1443
+#: ../roundup/cgi/templating.py:1428
 msgid "<th>Args</th>"
 msgstr "<th>åƒæ•¸</th>"
 
-#: ../roundup/cgi/templating.py:1494
+#: ../roundup/cgi/templating.py:1479
 #, fuzzy, python-format
 msgid "Copy of %(class)s %(id)s"
 msgstr "%(class)s %(id)s è¢«å»ºç«‹"
 
-#: ../roundup/cgi/templating.py:2125 ../roundup/cgi/templating.py:2160
-#: ../roundup/cgi/templating.py:1382:2125:2160
+#: ../roundup/cgi/templating.py:2119 ../roundup/cgi/templating.py:2154
+#: ../roundup/cgi/templating.py:1367:2119:2154
 msgid "No"
 msgstr "å¦"
 
-#: ../roundup/cgi/templating.py:2125 ../roundup/cgi/templating.py:2154
-#: ../roundup/cgi/templating.py:1382:2125:2154
+#: ../roundup/cgi/templating.py:2119 ../roundup/cgi/templating.py:2148
+#: ../roundup/cgi/templating.py:1367:2119:2148
 msgid "Yes"
 msgstr "æ˜¯"
 
-#: ../roundup/cgi/templating.py:2286
+#: ../roundup/cgi/templating.py:2315
 msgid ""
 "default value for DateHTMLProperty must be either DateHTMLProperty or string "
 "date representation."
 msgstr "DateHTMLProperty çš„é è¨­å€¼æˆ–è€…æ˜¯ DateHTMLProperty æˆ–å­—ç¬¦ä¸²çš„æ—¥æœŸè¡¨ç¤ºã€‚"
 
-#: ../roundup/cgi/templating.py:2468
+#: ../roundup/cgi/templating.py:2497
 #, python-format
 msgid "Attempt to look up %(attr)s on a missing value"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:2479
+#: ../roundup/cgi/templating.py:2508
 #, python-format
 msgid "Attempt to look up %(item)s on a missing value"
 msgstr ""
 
-#: ../roundup/cgi/templating.py:2584
+#: ../roundup/cgi/templating.py:2613
 #, python-format
 msgid "<option %svalue=\"-1\">- no selection -</option>"
 msgstr "<option %svalue=\"-1\">- æœªé¸æ“‡ -</option>"
 
-#: ../roundup/cgi/templating.py:3745
+#: ../roundup/cgi/templating.py:3777
 #, python-format
 msgid "Unable to read or expand file '%(name)s' in template '%(template)s'."
 msgstr ""
 
-#: ../roundup/cgi/templating.py:3795
+#: ../roundup/cgi/templating.py:3827
 #, python-format
 msgid ""
 "Found an incorrect token when expandfile applied string subsitution on "
@@ -2506,54 +2512,54 @@ msgstr "%s ä¹‹å‰"
 msgid "in %s"
 msgstr "åœ¨ %s"
 
-#: ../roundup/hyperdb.py:120
+#: ../roundup/hyperdb.py:126
 #, fuzzy, python-format
 msgid "property %(property)s: %(errormsg)s"
 msgstr "éŒ¯èª¤ï¼š%s: %s"
 
-#: ../roundup/hyperdb.py:149
+#: ../roundup/hyperdb.py:161
 #, python-format
 msgid "property %(property)s: %(value)r is an invalid date (%(errormsg)s)"
 msgstr ""
 
-#: ../roundup/hyperdb.py:172
+#: ../roundup/hyperdb.py:184
 #, python-format
 msgid ""
 "property %(property)s: %(value)r is an invalid date interval (%(errormsg)s)"
 msgstr ""
 
-#: ../roundup/hyperdb.py:434
+#: ../roundup/hyperdb.py:446
 #, fuzzy, python-format
 msgid "property %(property)s: %(value)r is not a number"
 msgstr "å±¬æ€§ \"%(propname)s\": \"%(value)s\" ç•¶å‰ä¸åœ¨åˆ—è¡¨ä¸­"
 
-#: ../roundup/hyperdb.py:448
+#: ../roundup/hyperdb.py:460
 #, fuzzy, python-format
 msgid "property %(property)s: %(value)r is not an integer"
 msgstr "å±¬æ€§ \"%(propname)s\": \"%(value)s\" ç•¶å‰ä¸åœ¨åˆ—è¡¨ä¸­"
 
-#: ../roundup/hyperdb.py:470
+#: ../roundup/hyperdb.py:482
 #, python-format
 msgid "\"%s\" not a node designator"
 msgstr ""
 
-#: ../roundup/hyperdb.py:1499 ../roundup/hyperdb.py:1507
-#: ../roundup/hyperdb.py:1499:1507
+#: ../roundup/hyperdb.py:1515 ../roundup/hyperdb.py:1523
+#: ../roundup/hyperdb.py:1515:1523
 #, fuzzy, python-format
 msgid "Not a property name: %s"
 msgstr "ä¸æ˜¯æ—¥æœŸæ ¼å¼ï¼š%s"
 
-#: ../roundup/hyperdb.py:2038
+#: ../roundup/hyperdb.py:2054
 #, fuzzy, python-format
 msgid "property %(property)s: %(value)r is not a %(classname)s."
 msgstr "å±¬æ€§ \"%(propname)s\": \"%(value)s\" ç•¶å‰ä¸åœ¨åˆ—è¡¨ä¸­"
 
-#: ../roundup/hyperdb.py:2044
+#: ../roundup/hyperdb.py:2060
 #, python-format
 msgid "you may only enter ID values for property %s"
 msgstr ""
 
-#: ../roundup/hyperdb.py:2079
+#: ../roundup/hyperdb.py:2095
 #, python-format
 msgid "%(property)r is not a property of %(classname)s"
 msgstr ""
@@ -2811,60 +2817,60 @@ msgid ""
 "are: %(stack)s"
 msgstr ""
 
-#: ../roundup/pygettext.py:401
+#: ../roundup/pygettext.py:400
 #, python-format
 msgid "*** %(file)s:%(lineno)s: Seen unexpected token \"%(token)s\""
 msgstr ""
 
-#: ../roundup/pygettext.py:457
+#: ../roundup/pygettext.py:456
 #, python-format
 msgid "# File: %(filename)s, line: %(lineno)d"
 msgstr ""
 
-#: ../roundup/pygettext.py:464
+#: ../roundup/pygettext.py:463
 #, python-format
 msgid " %(filename)s:%(lineno)d"
 msgstr ""
 
-#: ../roundup/pygettext.py:540
+#: ../roundup/pygettext.py:539
 #, fuzzy, python-format
 msgid "Invalid value for --style: %s"
 msgstr "ç„¡æ•ˆç™»éŒ„"
 
-#: ../roundup/pygettext.py:548
+#: ../roundup/pygettext.py:547
 #, python-format
 msgid "pygettext.py (xgettext for Python) %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:554
+#: ../roundup/pygettext.py:553
 #, python-format
 msgid "--width argument must be an integer: %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:582
+#: ../roundup/pygettext.py:581
 #, python-format
 msgid "Can't read --exclude-file: %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:601
+#: ../roundup/pygettext.py:600
 msgid "Reading standard input"
 msgstr ""
 
-#: ../roundup/pygettext.py:606
+#: ../roundup/pygettext.py:605
 #, python-format
 msgid "Working on %s"
 msgstr ""
 
-#: ../roundup/pygettext.py:640
+#: ../roundup/pygettext.py:639
 msgid "a unicode string"
 msgstr ""
 
-#: ../roundup/pygettext.py:642
+#: ../roundup/pygettext.py:641
 #, python-format
 msgid "*** Seen unexpected token \"%(token)s\""
 msgstr ""
 
-#: ../roundup/pygettext.py:643
+#: ../roundup/pygettext.py:642
 msgid "morethanonestring"
 msgstr ""
 
@@ -2985,32 +2991,32 @@ msgstr "å»ºç«‹"
 msgid "creator"
 msgstr "å»ºç«‹è€…"
 
-#: ../roundup/roundupdb.py:426
+#: ../roundup/roundupdb.py:447
 #, python-format
 msgid "No key for \"%(adr)s\" in keyring"
 msgstr ""
 
-#: ../roundup/roundupdb.py:504
+#: ../roundup/roundupdb.py:525
 #, python-format
 msgid "New submission from %(authname)s%(authaddr)s:"
 msgstr ""
 
-#: ../roundup/roundupdb.py:507
+#: ../roundup/roundupdb.py:528
 #, python-format
 msgid "%(authname)s%(authaddr)s added the comment:"
 msgstr ""
 
-#: ../roundup/roundupdb.py:510
+#: ../roundup/roundupdb.py:531
 #, python-format
 msgid "Change by %(authname)s%(authaddr)s:"
 msgstr ""
 
-#: ../roundup/roundupdb.py:529
+#: ../roundup/roundupdb.py:550
 #, python-format
 msgid "File '%(filename)s' not attached - you can download it from %(link)s."
 msgstr ""
 
-#: ../roundup/roundupdb.py:904
+#: ../roundup/roundupdb.py:925
 #, python-format
 msgid ""
 "\n"
@@ -3114,58 +3120,58 @@ msgstr ""
 "<html><head><title>Roundup tracker ç´¢å¼•</title></head>\n"
 "<body><h1>Roundup tracker ç´¢å¼•</h1><ol>\n"
 
-#: ../roundup/scripts/roundup_server.py:598
+#: ../roundup/scripts/roundup_server.py:602
 #, fuzzy, python-format
 msgid "Error: %(type)s: %(value)s"
 msgstr "%(key)s: %(value)s (é—œéµå±¬æ€§)"
 
-#: ../roundup/scripts/roundup_server.py:610
+#: ../roundup/scripts/roundup_server.py:614
 msgid "WARNING: ignoring \"-g\" argument, not root"
 msgstr "è­¦å‘Šï¼šå¿½ç•¥ \"-g\" åƒæ•¸ï¼Œä¸æ˜¯ root"
 
-#: ../roundup/scripts/roundup_server.py:616
+#: ../roundup/scripts/roundup_server.py:620
 msgid "Can't change groups - no grp module"
 msgstr "ä¸èƒ½ä¿®æ”¹çµ„ - ç„¡ grp æ¨¡å¡Š"
 
-#: ../roundup/scripts/roundup_server.py:625
+#: ../roundup/scripts/roundup_server.py:629
 #, python-format
 msgid "Group %(group)s doesn't exist"
 msgstr "çµ„ %(group)s ä¸å­˜åœ¨"
 
-#: ../roundup/scripts/roundup_server.py:637
+#: ../roundup/scripts/roundup_server.py:641
 msgid "Can't run as root!"
 msgstr "ä¸èƒ½ä»¥ root é‹è¡Œï¼"
 
-#: ../roundup/scripts/roundup_server.py:640
+#: ../roundup/scripts/roundup_server.py:644
 msgid "WARNING: ignoring \"-u\" argument, not root"
 msgstr "è­¦å‘Šï¼šå¿½ç•¥ \"-u\" åƒæ•¸ï¼Œä¸æ˜¯ root"
 
-#: ../roundup/scripts/roundup_server.py:646
+#: ../roundup/scripts/roundup_server.py:650
 msgid "Can't change users - no pwd module"
 msgstr "ä¸èƒ½ä¿®æ”¹ç”¨æˆ¶ - ç„¡ pwd æ¨¡å¡Š"
 
-#: ../roundup/scripts/roundup_server.py:655
+#: ../roundup/scripts/roundup_server.py:659
 #, python-format
 msgid "User %(user)s doesn't exist"
 msgstr "ç”¨æˆ¶ %(user)s ä¸å­˜åœ¨"
 
-#: ../roundup/scripts/roundup_server.py:867
+#: ../roundup/scripts/roundup_server.py:871
 #, python-format
 msgid "Multiprocess mode \"%s\" is not available, switching to single-process"
 msgstr ""
 
-#: ../roundup/scripts/roundup_server.py:895
+#: ../roundup/scripts/roundup_server.py:899
 #, python-format
 msgid "Unable to bind to port %s, port already in use."
 msgstr "ç„¡æ³•ç¶å®šåˆ°ç«¯å£ %s, ç«¯å£å·²ç¶“è¢«ä½”ç”¨ã€‚"
 
-#: ../roundup/scripts/roundup_server.py:899
+#: ../roundup/scripts/roundup_server.py:903
 #, fuzzy, python-format
 msgid ""
 "Unable to bind to port %(port)s, access not allowed, errno: %(errno)s %(msg)s"
 msgstr "ç„¡æ³•ç¶å®šåˆ°ç«¯å£ %s, ç«¯å£å·²ç¶“è¢«ä½”ç”¨ã€‚"
 
-#: ../roundup/scripts/roundup_server.py:978
+#: ../roundup/scripts/roundup_server.py:982
 #, fuzzy
 msgid ""
 " -c <Command>  Windows Service options.\n"
@@ -3182,7 +3188,7 @@ msgstr ""
 "               è®Šé‡ä¸Šé…ç½®ä¸€å€‹trackerã€‚é€™å€‹é¸é …èˆ‡å…¶ç¶“é¸é …æ˜¯äº’æ–¥çš„ã€‚æ‰“å…¥\n"
 "               \"roundup-server -c help\" ä¾†çž­è§£Windowsæœå‹™çš„è¦ç¯„ã€‚"
 
-#: ../roundup/scripts/roundup_server.py:985
+#: ../roundup/scripts/roundup_server.py:989
 #, fuzzy
 msgid ""
 " -u <UID>      runs the Roundup web server as this UID\n"
@@ -3198,7 +3204,7 @@ msgstr ""
 "åŽ»ã€‚\n"
 "               å¦‚æžœä½¿ç”¨äº† -d é¸é …ï¼Œå‰‡ -l é¸é … *å¿…é ˆ* è¦æŒ‡å®šã€‚"
 
-#: ../roundup/scripts/roundup_server.py:993
+#: ../roundup/scripts/roundup_server.py:997
 #, fuzzy, python-format
 msgid ""
 "\n"
@@ -3300,20 +3306,24 @@ msgstr ""
 "   æ„æ•¸é‡çš„ name=home å°ã€‚è¦ç¢ºä¿ name éƒ¨åˆ†ä¸èƒ½åŒ…æ‹¬ä»»ä½•éžurlå®‰å…¨çš„\n"
 "   å­—ç¬¦ï¼Œåƒç©ºæ ¼ï¼Œå› ç‚ºå®ƒå€‘æœƒæŠŠIEæžäº‚ã€‚\n"
 
-#: ../roundup/scripts/roundup_server.py:1173
+#: ../roundup/scripts/roundup_server.py:1177
 msgid "Instances must be name=home"
 msgstr "å¯¦ä¾‹å¿…é ˆæ˜¯ å¯¦ä¾‹å=å¯¦ä¾‹è·¯å¾‘"
 
-#: ../roundup/scripts/roundup_server.py:1187
+#: ../roundup/scripts/roundup_server.py:1191
 #, python-format
 msgid "Configuration saved to %s"
 msgstr "é…ç½®ä¿å­˜åˆ° %s"
 
-#: ../roundup/scripts/roundup_server.py:1205
+#: ../roundup/scripts/roundup_server.py:1206
+msgid "If you specify a PID file you must use -l or -L."
+msgstr ""
+
+#: ../roundup/scripts/roundup_server.py:1212
 msgid "Sorry, you can't run the server as a daemon on this Operating System"
 msgstr "æŠ±æ­‰ï¼Œåœ¨é€™å€‹æ“ä½œç³»çµ±ä¸Šä¸èƒ½ä»¥å®ˆè­·é€²ç¨‹çš„æ–¹å¼ä¾†é‹è¡Œæœå‹™"
 
-#: ../roundup/scripts/roundup_server.py:1225
+#: ../roundup/scripts/roundup_server.py:1232
 #, python-format
 msgid "Roundup server started on %(HOST)s:%(PORT)s"
 msgstr "Roundup server å•Ÿå‹•æ–¼ %(HOST)s:%(PORT)s"
@@ -4586,46 +4596,46 @@ msgstr "Roundupæ–‡æª”"
 msgid "clear this message"
 msgstr ""
 
-#: ../share/roundup/templates/classic/html/page.html:257
-#: ../share/roundup/templates/classic/html/page.html:270
-#: ../share/roundup/templates/classic/html/page.html:288
-#: ../share/roundup/templates/classic/html/page.html:302
-#: ../share/roundup/templates/devel/html/page.html:316
-#: ../share/roundup/templates/devel/html/page.html:329
-#: ../share/roundup/templates/devel/html/page.html:347
-#: ../share/roundup/templates/devel/html/page.html:361
-#: ../share/roundup/templates/minimal/html/page.html:239
-#: ../share/roundup/templates/minimal/html/page.html:254
-#: ../share/roundup/templates/minimal/html/page.html:268
-#: ../share/roundup/templates/responsive/html/page.html:331
-#: ../share/roundup/templates/responsive/html/page.html:344
-#: ../share/roundup/templates/responsive/html/page.html:362
-#: ../share/roundup/templates/responsive/html/page.html:376
-msgid "don't care"
-msgstr "ä¸ç”¨é—œå¿ƒ"
-
-#: ../share/roundup/templates/classic/html/page.html:259
-#: ../share/roundup/templates/classic/html/page.html:272
-#: ../share/roundup/templates/classic/html/page.html:290
+#: ../share/roundup/templates/classic/html/page.html:258
+#: ../share/roundup/templates/classic/html/page.html:271
+#: ../share/roundup/templates/classic/html/page.html:289
 #: ../share/roundup/templates/classic/html/page.html:303
-#: ../share/roundup/templates/devel/html/page.html:318
-#: ../share/roundup/templates/devel/html/page.html:331
-#: ../share/roundup/templates/devel/html/page.html:349
+#: ../share/roundup/templates/devel/html/page.html:317
+#: ../share/roundup/templates/devel/html/page.html:330
+#: ../share/roundup/templates/devel/html/page.html:348
 #: ../share/roundup/templates/devel/html/page.html:362
-#: ../share/roundup/templates/minimal/html/page.html:241
-#: ../share/roundup/templates/minimal/html/page.html:256
+#: ../share/roundup/templates/minimal/html/page.html:240
+#: ../share/roundup/templates/minimal/html/page.html:255
 #: ../share/roundup/templates/minimal/html/page.html:269
-#: ../share/roundup/templates/responsive/html/page.html:333
-#: ../share/roundup/templates/responsive/html/page.html:346
-#: ../share/roundup/templates/responsive/html/page.html:364
+#: ../share/roundup/templates/responsive/html/page.html:332
+#: ../share/roundup/templates/responsive/html/page.html:345
+#: ../share/roundup/templates/responsive/html/page.html:363
 #: ../share/roundup/templates/responsive/html/page.html:377
+msgid "don't care"
+msgstr "ä¸ç”¨é—œå¿ƒ"
+
+#: ../share/roundup/templates/classic/html/page.html:260
+#: ../share/roundup/templates/classic/html/page.html:273
+#: ../share/roundup/templates/classic/html/page.html:291
+#: ../share/roundup/templates/classic/html/page.html:304
+#: ../share/roundup/templates/devel/html/page.html:319
+#: ../share/roundup/templates/devel/html/page.html:332
+#: ../share/roundup/templates/devel/html/page.html:350
+#: ../share/roundup/templates/devel/html/page.html:363
+#: ../share/roundup/templates/minimal/html/page.html:242
+#: ../share/roundup/templates/minimal/html/page.html:257
+#: ../share/roundup/templates/minimal/html/page.html:270
+#: ../share/roundup/templates/responsive/html/page.html:334
+#: ../share/roundup/templates/responsive/html/page.html:347
+#: ../share/roundup/templates/responsive/html/page.html:365
+#: ../share/roundup/templates/responsive/html/page.html:378
 msgid "------------"
 msgstr ""
 
-#: ../share/roundup/templates/classic/html/page.html:335
-#: ../share/roundup/templates/devel/html/page.html:390
-#: ../share/roundup/templates/minimal/html/page.html:297
-#: ../share/roundup/templates/responsive/html/page.html:405
+#: ../share/roundup/templates/classic/html/page.html:336
+#: ../share/roundup/templates/devel/html/page.html:391
+#: ../share/roundup/templates/minimal/html/page.html:298
+#: ../share/roundup/templates/responsive/html/page.html:406
 msgid "no value"
 msgstr "ç„¡å€¼"
 
diff --git a/roundup/__init__.py b/roundup/__init__.py
index 2e14b388a..e4687d084 100644
--- a/roundup/__init__.py
+++ b/roundup/__init__.py
@@ -67,6 +67,6 @@
 '''
 __docformat__ = 'restructuredtext'
 
-__version__ = '2.5.0'
+__version__ = '2.5.0b1'
 
 # vim: set filetype=python ts=4 sw=4 et si
diff --git a/scripts/Docker/Dockerfile b/scripts/Docker/Dockerfile
index 27783085d..2fff864a6 100644
--- a/scripts/Docker/Dockerfile
+++ b/scripts/Docker/Dockerfile
@@ -233,7 +233,7 @@ ARG pip_mod
 LABEL "org.opencontainers.image.vendor"="Roundup Issue Tracker Team" \
       "org.opencontainers.image.title"="Roundup Issue Tracker" \
       "org.opencontainers.image.description"="Roundup Issue Tracker with multi-backend support installed via $source with python version $pythonversion" \
-      "org.opencontainers.image.version"="2.4.0" \
+      "org.opencontainers.image.version"="2.5.0beta1" \
       "org.opencontainers.image.authors"="roundup-devel@lists.sourceforge.net" \
       "org.opencontainers.image.licenses"="MIT AND ZPL-2.0 AND Python-2.0" \
       "org.opencontainers.image.documentation"="https://www.roundup-tracker.org/docs/installation.html" \
diff --git a/setup.py b/setup.py
index 9cb517252..51a321ff1 100755
--- a/setup.py
+++ b/setup.py
@@ -224,8 +224,8 @@ def main():
           python_requires=">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*",
           url='https://www.roundup-tracker.org',
           download_url='https://pypi.org/project/roundup',
-          classifiers=['Development Status :: 5 - Production/Stable',
-                       #'Development Status :: 4 - Beta',
+          classifiers=[#'Development Status :: 5 - Production/Stable',
+                       'Development Status :: 4 - Beta',
                        #'Development Status :: 3 - Alpha',
                        'Environment :: Console',
                        'Environment :: Web Environment',

From 5e500b7db9a4581658a39ba58fb42b0988279c7e Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 11 Jun 2025 17:05:35 -0400
Subject: [PATCH 189/398] Added tag 2.5.0b1 for changeset 3bf6ad421347

---
 .hgtags | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.hgtags b/.hgtags
index 75c9cd063..82dc7c4cb 100644
--- a/.hgtags
+++ b/.hgtags
@@ -154,3 +154,4 @@ a377590eba34724c5d30d80692257e5ae68aab13 2.4.0b0
 0000000000000000000000000000000000000000 2.4.1b1
 c10df5dfed95dc37e8092861886bf66614b77062 2.4.0b1
 4dfc07ee489ad000c8ffe7ee97b506c94fae6774 2.4.0
+3bf6ad421347c87ae3a6bebe288f8f1dfa7bd6ba 2.5.0b1

From 7e8536f63a333cfc812788555304f5bf743ee31c Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 11 Jun 2025 17:21:57 -0400
Subject: [PATCH 190/398] docs: update using make to generate docs for the
 release tarball

using only setup.py build_docs misses:

  html version of man pages
  html version of roundup-admin help
  doc version of a current config.ini file
---
 RELEASE.txt | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/RELEASE.txt b/RELEASE.txt
index 1b1a4b173..6ba0e1f90 100644
--- a/RELEASE.txt
+++ b/RELEASE.txt
@@ -97,7 +97,15 @@ Roundup release checklist:
 
 8.  Rebuild documentation in "share/doc/roundup/html"
 
-      python3 setup.py build_doc
+      cd doc
+      make
+
+    runs commands to turn man pages into html files and adds them to
+    html_extra/man_pages subdir. Then it generates html text from
+    running roundup_admin. Then it generates a current copy of a
+    config.ini file. Then it runs:
+
+       python3 setup.py build_doc
 
 9.  Generate source distribution:
 

From fec4b84a3e316f6f7939b73dc2fb4ce03ff8a07a Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 19 Jun 2025 15:09:05 -0400
Subject: [PATCH 191/398] chore(build): issue2551368 gpg 2.0 released on
 test.pypi.org

The former beta release was upgraded to a full release on test.pypi.
Change pip install to remove --pre prerelease flag.

Still waiting for the release to make it to the main pypi.org.
---
 .github/workflows/ci-test.yml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index 53c02357f..4242c0c14 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -240,9 +240,10 @@ jobs:
           # used for newer Python versions. Temporarily use the
           # testing index, which contains a newer version of the
           # bindings on 24.04 or released version for other OS
-          # versions. See issue2551368. 'pip install gpg' should work.
+          # versions. See issue2551368. 'pip install gpg' should work
+          # at some point when things are released to the production repo.
           pip install --index-url https://test.pypi.org/simple/ \
-                --extra-index-url https://pypi.org/simple --pre gpg;
+                --extra-index-url https://pypi.org/simple gpg;
 
       - name: Install aux packages that need versions differences
         # if zstd fails install, keep going with test, don't abort

From 99a088e25a26a82a7b404eb84c4a893526d4612d Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 19 Jun 2025 15:25:19 -0400
Subject: [PATCH 192/398] test: run tests with free threaded python 3.13

With luck this will not indicate any breakage.
---
 .github/workflows/ci-test.yml | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index 4242c0c14..c680a0dc1 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -71,12 +71,12 @@ jobs:
         experimental: [ false ]
 
         include:
-            # example: if 3.13 fails the jobs still succeeds
+            # example: if this version fails the jobs still succeeds
             # allow-prereleases in setup-python allows alpha/beta
-            # releases to run
-            #- python-version: 3.13
-            #  os: ubuntu-22.04
-            #  experimental: true
+            # releases to run. Also allow free threaded python testing
+            - python-version: 3.13t
+              os: ubuntu-24.04
+              experimental: true
             
             # 3.7 not available on new 22.04 runners, so run on 22.04 ubuntu
             - python-version: 3.7
@@ -132,7 +132,8 @@ jobs:
       # Display the Python version being used
       - name: Display Python and key module versions
         run: |
-          python -c "import sys; print('python version: ', sys.version)"
+          python --version --version
+          python -c "import sysconfig; print('GIL IS ENABLED: ', sysconfig.get_config_vars().get('Py_GIL_DISABLED', 'not defined'));"
           python -c "import sqlite3; print('sqlite version: ', sqlite3.sqlite_version)"
           python -c "import setuptools; print('setuptools version: ', setuptools.__version__);"
 

From 30f9a702e313141d6de373f0fa18beed16776bf5 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 19 Jun 2025 15:47:29 -0400
Subject: [PATCH 193/398] chore: bump actions used on github.

Need to check dependabot. It should have been giving me updates on these.
---
 .github/workflows/ci-test.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index c680a0dc1..52c8a487f 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -116,11 +116,11 @@ jobs:
         # if: {{ false }}
           # continue running if step fails
         # continue-on-error: true
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       # Setup version of Python to use
       - name: Set Up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: ${{ matrix.python-version }}
           allow-prereleases: true
@@ -317,7 +317,7 @@ jobs:
         
       - name: Upload coverage to Codecov
         # see: https://github.com/codecov/codecov-action#usage
-        uses: codecov/codecov-action@4fe8c5f003fae66aa5ebb77cfd3e7bfbbda0b6b0 # v3.1.5
+        uses: codecov/codecov-action@18283e04ce6e62d37312384ff67231eb8fd56d24 # v5.4.3
         with:
           verbose: true
           token: ${{ secrets.CODECOV_TOKEN }}

From 8f435edadc66f894b1060c38757f5e3c78b8b642 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 19 Jun 2025 15:57:12 -0400
Subject: [PATCH 194/398] chore(docker): update alpine python version.

---
 scripts/Docker/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/Docker/Dockerfile b/scripts/Docker/Dockerfile
index 2fff864a6..e00350d10 100644
--- a/scripts/Docker/Dockerfile
+++ b/scripts/Docker/Dockerfile
@@ -26,7 +26,7 @@ ARG source=local
 # Note this is the index digest for the image, not the manifest digest.
 # The index digest is shared across archetectures (amd64, arm64 etc.)
 # while the manifest digest is unique per platform/arch.
-ARG SHA256=b4d299311845147e7e47c970566906caf8378a1f04e5d3de65b5f2e834f8e3bf
+ARG SHA256=9b4929a72599b6c6389ece4ecbf415fd1355129f22bb92bb137eea098f05e975
 
 # Set to any non-empty value to enable shell debugging for troubleshooting
 ARG VERBOSE=

From 3c72014484b273188b8fe32dfd1fa8f04d9dba68 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 19 Jun 2025 16:05:22 -0400
Subject: [PATCH 195/398] chore: fix label for Py_GIL_DISABLED python config
 var.

---
 .github/workflows/ci-test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index 52c8a487f..0ee8c1d34 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -133,7 +133,7 @@ jobs:
       - name: Display Python and key module versions
         run: |
           python --version --version
-          python -c "import sysconfig; print('GIL IS ENABLED: ', sysconfig.get_config_vars().get('Py_GIL_DISABLED', 'not defined'));"
+          python -c "import sysconfig; print('GIL IS DISABLED: ', sysconfig.get_config_vars().get('Py_GIL_DISABLED', 'not defined'));"
           python -c "import sqlite3; print('sqlite version: ', sqlite3.sqlite_version)"
           python -c "import setuptools; print('setuptools version: ', setuptools.__version__);"
 

From d49c8359680f3fac00b47e2e692c55e34f9b2b06 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 19 Jun 2025 16:14:01 -0400
Subject: [PATCH 196/398] chore: update actions to current versions.

---
 .github/workflows/anchore.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/anchore.yml b/.github/workflows/anchore.yml
index a1c2e6a5f..f033f1361 100644
--- a/.github/workflows/anchore.yml
+++ b/.github/workflows/anchore.yml
@@ -37,20 +37,20 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout the code
-      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
     - name: Build the Docker image
       run: docker pull python:3-alpine; docker build . --file scripts/Docker/Dockerfile --tag localbuild/testimage:latest
     - name: List the Docker image
       run: docker image ls
     - name: Run the Anchore scan action itself with GitHub Advanced Security code scanning integration enabled
-      uses: anchore/scan-action@c35e932c2a7c572bfdb1c3dbcdadb2d4fc62418d # 3.6.1
+      uses: anchore/scan-action@be7a22da4f22dde446c4c4c099887ff5b256526c # 6.3.0
       id: scan
       with:
         image: "localbuild/testimage:latest"
         fail-build: true
     - name: Upload Anchore Scan Report
       if: always()
-      uses: github/codeql-action/upload-sarif@65c74964a9ed8c44ed9f19d4bbc5757a6a8e9ab9 # v2.16.1
+      uses: github/codeql-action/upload-sarif@b1e4dc3db58c9601794e22a9f6d28d45461b9dbf # v2.22.0
       with:
         sarif_file: ${{ steps.scan.outputs.sarif }}
     - name: Inspect action SARIF report

From c245a024357e2d1589108f7ef43ea0f48e0405e9 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 19 Jun 2025 16:16:58 -0400
Subject: [PATCH 197/398] chore: update actions cor codeql-analysis to current
 versions.

---
 .github/workflows/codeql-analysis.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 321f5d54f..0b214cc78 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -49,11 +49,11 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@65c74964a9ed8c44ed9f19d4bbc5757a6a8e9ab9 # v2.16.1
+      uses: github/codeql-action/init@b1e4dc3db58c9601794e22a9f6d28d45461b9dbf # v2.22.0
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -64,7 +64,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@65c74964a9ed8c44ed9f19d4bbc5757a6a8e9ab9 # v2.16.1
+      uses: github/codeql-action/autobuild@b1e4dc3db58c9601794e22a9f6d28d45461b9dbf # v2.22.0
 
     # â„¹ï¸ Command-line programs to run using the OS shell.
     # ðŸ“š https://git.io/JvXDl
@@ -78,4 +78,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@65c74964a9ed8c44ed9f19d4bbc5757a6a8e9ab9 # v2.16.1
+      uses: github/codeql-action/analyze@b1e4dc3db58c9601794e22a9f6d28d45461b9dbf # v2.22.0

From 9dfaf06a961ecbf4456eef240d90ecc183b0c490 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 19 Jun 2025 16:18:38 -0400
Subject: [PATCH 198/398] doc: fix typo

---
 CHANGES.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index cb4b79724..cc34cedc0 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -155,7 +155,7 @@ Features:
 - issue2551231 - template.py-HTMLClass::classhelp doesn't merge
   user defined classes. It now merges them in. (John Rouillard)
 - re-enable support for GPG/PGP encrypted emails using new python gpg
-  pakage on the test pypi instance. (Paul Schwabauer)
+  package on the test pypi instance. (Paul Schwabauer)
 
 2024-07-13 2.4.0
 

From 7c8dd13349e7d32d2c99f39ba5a0edaac3024250 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 19 Jun 2025 16:25:18 -0400
Subject: [PATCH 199/398] docs: update generated tracker_config.txt. Default is
 to not use native html number type

---
 doc/tracker_config.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/tracker_config.txt b/doc/tracker_config.txt
index 14f7e0a8c..1d132660f 100644
--- a/doc/tracker_config.txt
+++ b/doc/tracker_config.txt
@@ -641,7 +641,7 @@
   # if we use the input type 'number' for Number (and Integer)
   # properties. If set to 'no' we use input type 'text'.
   # Allowed values: yes, no
-  # Default: yes
+  # Default: no
   use_browser_number_input = no
 
 .. index:: config.ini; sections rdbms

From fd7f6b21dca0ce654f061d5edf2eacc887568437 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 19 Jun 2025 16:38:38 -0400
Subject: [PATCH 200/398] chore: update githup action ses clauses to latest
 versions.

---
 .github/workflows/ossf-scorecard.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ossf-scorecard.yml b/.github/workflows/ossf-scorecard.yml
index a5bca1faf..c6a5547e3 100644
--- a/.github/workflows/ossf-scorecard.yml
+++ b/.github/workflows/ossf-scorecard.yml
@@ -35,12 +35,12 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.10
+        uses: ossf/scorecard-action@05b42c624433fc40578a4040d5cf5e36ddca8cde # v5.2.1
         with:
           results_file: results.sarif
           results_format: sarif
@@ -62,7 +62,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4.3.0
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: SARIF file
           path: results.sarif
@@ -70,6 +70,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@65c74964a9ed8c44ed9f19d4bbc5757a6a8e9ab9 # v2.16.1
+        uses: github/codeql-action/upload-sarif@b1e4dc3db58c9601794e22a9f6d28d45461b9dbf # v2.22.0
         with:
           sarif_file: results.sarif

From f447c1681f6799efcc1773fd4dbe31a34fe4fb18 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 19 Jun 2025 16:53:03 -0400
Subject: [PATCH 201/398] test: set PYTHON_GIL to disable when using
 freethreaded

This should help detect issues with roundup, supporting libraries and
freethreading.
---
 .github/workflows/ci-test.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index 0ee8c1d34..fadc70a71 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -137,6 +137,12 @@ jobs:
           python -c "import sqlite3; print('sqlite version: ', sqlite3.sqlite_version)"
           python -c "import setuptools; print('setuptools version: ', setuptools.__version__);"
 
+      # from:
+      # https://hugovk.dev/blog/2025/free-threaded-python-on-github-actions/
+      - name: Set PYTHON_GIL when freethreaded
+        if: endsWith(matrix.python-version, 't')
+        run: |
+          echo "PYTHON_GIL=0" >> "$GITHUB_ENV"
       - name: Update pip
         run: python -m pip install --upgrade pip
 

From 1c10cebe996dab47eb0ab59866431355ff30221c Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 23 Jun 2025 01:08:15 -0400
Subject: [PATCH 202/398] chore(ci): bump coveralls action 2.2.3 -> 2.3.6
 (dependabot pull request)

---
 .github/workflows/ci-test.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index fadc70a71..8e88da76c 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -331,7 +331,7 @@ jobs:
       - name: Upload coverage to Coveralls
         # python 2.7 and 3.6 versions of coverage can't produce lcov files.
         if: matrix.python-version != '2.7' && matrix.python-version != '3.6'
-        uses: coverallsapp/github-action@3dfc5567390f6fa9267c0ee9c251e4c8c3f18949 # v2.2.3
+        uses: coverallsapp/github-action@648a8eb78e6d50909eff900e4ec85cab4524a45b # v2.3.6
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           path-to-lcov: coverage.lcov
@@ -367,7 +367,7 @@ jobs:
     
     steps:
       - name: Coveralls Finished
-        uses: coverallsapp/github-action@3dfc5567390f6fa9267c0ee9c251e4c8c3f18949 # v2.2.3
+        uses: coverallsapp/github-action@648a8eb78e6d50909eff900e4ec85cab4524a45b # v2.3.6
         with:
           github-token: ${{ secrets.github_token }}
           parallel-finished: true

From 7bed77af6d5c586b8bd059951d383e76a9f211d9 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 23 Jun 2025 01:10:42 -0400
Subject: [PATCH 203/398] chore(ci): bump actions in build-xapian.yml
 (dependabot pull request)

build-xapian isn't used anymore. But it is a template for testing
parts of the ci-tst workflow in isolation to try to fix issues.
---
 .github/workflows/build-xapian.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build-xapian.yml b/.github/workflows/build-xapian.yml
index 171aafb3e..4d6edf6dc 100644
--- a/.github/workflows/build-xapian.yml
+++ b/.github/workflows/build-xapian.yml
@@ -42,11 +42,11 @@ jobs:
         # if: {{ false }}
           # continue running if step fails
         # continue-on-error: true
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
         # Setup version of Python to use
       - name: Set Up Python 3.13
-        uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: 3.13
           allow-prereleases: true

From c05bf68d187c2222fa561f98eb38d27fea37725a Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 25 Jun 2025 23:05:19 -0400
Subject: [PATCH 204/398] docs(install): document how to install gpg 2.0

Add link in install doc to upgrading doc and document pip command there.
---
 doc/installation.txt |  9 ++++++++-
 doc/upgrading.txt    | 17 +++++++++++++++++
 2 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/doc/installation.txt b/doc/installation.txt
index db8ec54b0..84e4fd81b 100644
--- a/doc/installation.txt
+++ b/doc/installation.txt
@@ -248,7 +248,11 @@ gpg
   If gpg_ is installed you can configure the mail gateway to perform
   verification or decryption of incoming OpenPGP MIME messages. When
   configured, you can require email to be cryptographically signed
-  before roundup will allow it to make modifications to issues.
+  before roundup will allow it to make modifications to issues. (Note
+  with python 3.13 or newer on some platforms, you may need to install
+  version 2.0 of gpg from test.pypi.org. See the `gpg install
+  directions in the upgrading document`_.
+
 
 jinja2
   To use the jinja2 template (may still be experimental, check out
@@ -318,6 +322,9 @@ requests
 .. _Using Redis for Session Databases:
    admin_guide.html#using-redis-for-session-databases
 
+.. _gpg install directions in the upgrading document:
+   upgrading.html#directions-for-installing-gpg
+
 Installing Roundup
 ==================
 
diff --git a/doc/upgrading.txt b/doc/upgrading.txt
index 8ccb17431..e3c6eb9da 100644
--- a/doc/upgrading.txt
+++ b/doc/upgrading.txt
@@ -441,6 +441,23 @@ the database (client.db), form (client.form).
 
 You can find an example in :ref:`dynamic_csp`.
 
+Directions for installing gpg
+-----------------------------
+
+In this release a new version of the gpg module was needed for Ubuntu
+24.04 and python 3.13. Paul Schwabauer produced a new version of the
+gpg module. However it is only on the test instance of pypi. If you
+run into issues installing gpg with pip, you can use::
+
+    pip install --index-url https://test.pypi.org/simple/ \
+                --extra-index-url https://pypi.org/simple gpg;
+
+to installed version 2.0 of gpg from test.pypi.org obtaining it's
+requirements from pypi.org.
+
+When `issue2551368 <https://issues.roundup-tracker.org/issue2551368>`_
+is closed, you should be able to use ``pip install gpg`` again.   
+
 .. index:: Upgrading; 2.3.0 to 2.4.0
 
 Migrating from 2.3.0 to 2.4.0

From e68f652212a40917c5156056d1ffc32feccfe227 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 25 Jun 2025 23:10:56 -0400
Subject: [PATCH 205/398] docs: issue2551398 document enabling native browser
 number/integer types

The original default was to have them enabled. Due to issues with
locale (e.g. decimal thousands separator vs comma seperator) this is
disabled by default. See issue for details.
---
 doc/upgrading.txt | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/doc/upgrading.txt b/doc/upgrading.txt
index e3c6eb9da..b7d4cfb1d 100644
--- a/doc/upgrading.txt
+++ b/doc/upgrading.txt
@@ -362,11 +362,11 @@ There is no support for activating text mode using the
 keyboard. Tablet/touch support is mixed. Chrome supports
 double-tap to activate text mode input. Firefox does not.
 
-Revert native number inputs for Number() and Integer() (optional)
+Enable native number inputs for Number() and Integer() (optional)
 -----------------------------------------------------------------
 
 Roundup's ``field()`` method for properties of type ``Number()`` or
-``Integer()`` now use a native browser number input by default.
+``Integer()`` can use a native browser number input by default.
 
 This is configurable for *all* ``Number()`` and ``Integer()`` properties
 with the config option ``use_browser_number_input`` in section ``[web]``.
@@ -379,6 +379,8 @@ add a stepper control and try to constrain the input to
 integers. This can be overridden by passing a new step
 (e.g. ``step="50"``) to the ``field()`` method.
 
+This is an experiment and maybe changed based on feedback.
+
 Change in REST response for invalid CORS requests (info)
 --------------------------------------------------------
 

From a7f2311309588c2c1fb720194ec17494eada1a5f Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 29 Jun 2025 12:10:23 -0400
Subject: [PATCH 206/398] build: prep for 2.5.0 - fix py versions, add links to
 pypi

Mark supported python version as 3.7 or newer

alphabetize args to setup so I can find them

add project_urls for docs, changelog, contact, IRC issues licenses and
wiki.
---
 setup.py | 51 +++++++++++++++++++++++++++++++--------------------
 1 file changed, 31 insertions(+), 20 deletions(-)

diff --git a/setup.py b/setup.py
index 51a321ff1..9691796a7 100755
--- a/setup.py
+++ b/setup.py
@@ -210,20 +210,8 @@ def main():
         sys.exit(42)
 
     setup(name='roundup',
-          version=__version__,
           author="Richard Jones",
           author_email="richard@users.sourceforge.net",
-          maintainer="Ralf Schlatterbeck",
-          maintainer_email="rsc@runtux.com",
-          description="A simple-to-use and -install issue-tracking system"
-            " with command-line, web and e-mail interfaces. Highly"
-            " customisable.",
-          license="OSI Approved: MIT License, Zope Public License, Python Software Foundation License",
-          long_description=long_description,
-          long_description_content_type='text/x-rst',
-          python_requires=">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*",
-          url='https://www.roundup-tracker.org',
-          download_url='https://pypi.org/project/roundup',
           classifiers=[#'Development Status :: 5 - Production/Stable',
                        'Development Status :: 4 - Beta',
                        #'Development Status :: 3 - Alpha',
@@ -258,23 +246,46 @@ def main():
                        'Topic :: Software Development :: Bug Tracking',
                        'Topic :: Internet :: WWW/HTTP :: WSGI :: Application',
                        ],
-          extras_require={
-              "charting": ['pygal'],
-              "jinja2": ['jinja2'],
-              "extras": ['brotli', 'pytz'],
-              "test": ['pytest > 7.0.0'],
-              },
           # Override certain command classes with our own ones
           cmdclass={'build_doc': build_doc,
                      'build': build,
                      'bdist_rpm': bdist_rpm,
                      'install_lib': install_lib,
                      },
-          packages=packages,
+          data_files=data_files,
+          description="A simple-to-use and -install issue-tracking system"
+            " with command-line, web and e-mail interfaces. Highly"
+            " customisable.",
+          download_url='https://pypi.org/project/roundup',
           entry_points={
               'console_scripts': scripts,
           },
-          data_files=data_files)
+          extras_require={
+              "charting": ['pygal'],
+              "jinja2": ['jinja2'],
+              "extras": ['brotli', 'pytz'],
+              "test": ['pytest > 7.0.0'],
+              },
+          license="OSI Approved: MIT License, Zope Public License,"
+                  " Python Software Foundation License",
+          long_description=long_description,
+          long_description_content_type='text/x-rst',
+          maintainer="Ralf Schlatterbeck",
+          maintainer_email="rsc@runtux.com",
+          packages=packages,
+          project_urls={
+              "Documentation": "https://roundup-tracker.org/docs.html",
+              "Changelog": "https://sourceforge.net/p/roundup/code/ci/tip/tree/CHANGES.txt",
+              "Contact": "https://roundup-tracker.org/contact.html",
+              "IRC": "https://webchat.oftc.net/?randomnick=1&channels=roundup&prompt=1",
+              "Issues": "https://issues.roundup-tracker.org/",
+              "Licenses": "https://roundup-tracker.org/docs/license.html",
+              "Wiki": "https://wiki.roundup-tracker.org/",
+    },
+          python_requires=">=3.7",
+          url='https://www.roundup-tracker.org',
+          version=__version__,
+)
 
 
 if __name__ == '__main__':

From b6a072498a850ade000386919cfcc134abd8f7c9 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 30 Jun 2025 21:35:35 -0400
Subject: [PATCH 207/398] docs: augment the announcment with better description
 of top changes

---
 doc/announcement.txt | 127 ++++++++++++++++++++++++++-----------------
 1 file changed, 77 insertions(+), 50 deletions(-)

diff --git a/doc/announcement.txt b/doc/announcement.txt
index af9535591..cbf780fab 100644
--- a/doc/announcement.txt
+++ b/doc/announcement.txt
@@ -1,4 +1,4 @@
-I'm proud to release version 2.5.0b1 of the Roundup issue
+I'm proud to release version 2.5.0 of the Roundup issue
 tracker.  This release is a bugfix and feature release, so
 make sure to read `docs/upgrading.txt
 <https://www.roundup-tracker.org/docs/upgrading.html>`_ to
@@ -7,7 +7,8 @@ bring your tracker up to date.
 The 41 changes, as usual, include some new features and many
 bug fixes.
 
-Version 2.5.0b1 does not support Python 2.
+Version 2.5.0 does not support Python 2. The minimum Python
+version is 3.7.
 
 Note that you should run ``roundup-admin ... migrate`` to
 update the database schema version. Do this before you use
@@ -24,54 +25,80 @@ You can install it with::
 
 then unpack and test/install from the tarball.
 
-Among the notable improvements in 2.5.0 from the 2.4.0
-release are:
-
-* detect more errors in RPN search expressions. Return more
-  useful error messages. Documented (advanced) RPN search expressions
-  in the user guide.
-
-* change default password hash method to PBKDF2 with SHA512. You
-  may need to reset password_pbkdf2_default_rounds to a lower
-  value. See upgrading doc.
-
-* add filter function to Permission objects. This pushes some
-  permission checks down to the SQL database and speeds up display of
-  index pages.
-
-* fix crash bug on windows with Python 3.13
-
-* update doc on required REST headers. Also other docs updates.
-
-* detect error condition early when we can't respond with requested
-  REST format response (e.g. xml is requested).
-
-* do not generate an error if a PUT REST request sets the user's
-  address to the current value.
-
-* make ``roundup-gettext`` extract translatable strings from detectors
-  and extensions.
-
-* improve security of session cookies by marking them with the magic
-  ``__Secure__`` prefix.
-
-* make the rest endpoint return raw message or file content data. Use
-  the ``binary_content`` endpoint and a suitable ``Accept``` header in
-  the request.
-
-* add support for the ``defusedxml`` Python module to improve security when
-  using XML.
-
-* add templating function: ``utils.set_http_response(integer)`` to set
-  HTTP return code from your template.
-
-* add generation of native HTML date and number/integer inputs. See
-  Upgrading for caveats this is disabled by default.
-
-* re-enable support for GPG/PGP signed emails. Requires installing
-  from the test PyPi repository.
-
-* remove XHTML support simplifying the code base
+Among the significant enhancements in version 2.5.0 compared to
+the 2.4.0 release are:
+
+The property/field advanced search expression feature has been
+enhanced. The RPN search expression format was previously
+undocumented. Search expressions are usually built using the
+expression editor on the search page. They can be built manually
+by modifying the search URL. However errors in expressions could
+return results that didn't match the user's intent. This release
+documents the RPN expression syntax, adds expression error
+detection, and improves error reporting.
+
+To boost security, Roundup updated the default hash method for
+password storage. Now, we're using PBKDF2 with SHA512. Because of
+this change, you should change (lower) the value of
+password_pbkdf2_default_rounds in your tracker's config.ini. Check
+the upgrading documentation for more info. (Note this may cause
+longer authentication times, the upgrade doc describes how to
+downgrade the hash method.)
+
+For better security, Roundup's session token is now prefixed with
+the magic ``__Secure__`` tag when using HTTPS. This adds to the
+existing ``Secure`` property that comes with the session cookie.
+
+Roundup verifies the user's authorization for the data fetched
+from the database.  A new optional ``filter`` argument has been
+added to Permission objects. When the administrator supplies a
+filter function, it can boosts performance with SQL server
+databases. This function should provide selection criteria to
+offload permission checks to the database. Consequently, less data
+is retrieved from the database, leading to quicker display of
+index pages with reduced CPU and network traffic.
+
+Requsting binary data from a REST endpoint has been a
+hassle. Since JSON can't handle binary data, images (and other
+binary data) need to be encoded. This makes them significantly
+larger. The workaround was to use a non-REST endpoint for fetching
+non-text attachments. This update lets the REST endpoint return
+raw message or file content data. You can utilize the
+``binary_content`` endpoint along with an appropriate ``Accept``
+header (e.g. ``image/jpeg``) in your request.
+
+The ``roundup-gettext`` tool has been enhanced to extract
+translatable strings from detectors and extensions. This will
+simplify the process of translating your trackers.
+
+Other miscellaneous fixes include:
+
+* Fixed a crash bug on Windows with Python 3.13.
+
+* Updated documentation on required REST headers, along with other
+  documentation updates.
+
+* Early detection of error conditions when we can't provide the
+  requested REST format response (like when XML is requested).
+
+* An error is not generated if a PUT REST request sets the user's address
+  to its current value.
+
+* Added support for the ``defusedxml`` Python module to enhance
+  security when using XML.
+
+* Introduced a templating function:
+  ``utils.set_http_response(integer)`` to set the HTTP return code
+  directly from your template.
+
+* Added the ability to generate native HTML date and
+  number/integer inputs. Check Upgrading for caveats, as this
+  feature is disabled by default.
+
+* Re-enabled support for GPG/PGP signed emails, which requires
+  installation from the test PyPi repository.
+
+* Removed XHTML support to simplify the code base.
 
 The file CHANGES.txt has a detailed list of feature
 additions and bug fixes for each release. The most recent

From 5f14f64499be0b5c95767d4fc4dd7f04f069abcc Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 2 Jul 2025 11:27:06 -0400
Subject: [PATCH 208/398] docs: remove verb "see" from lists.

---
 doc/sc.txt | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/doc/sc.txt b/doc/sc.txt
index 042bbe4b9..8d0e81239 100644
--- a/doc/sc.txt
+++ b/doc/sc.txt
@@ -18,12 +18,12 @@ still have to use the `wayback machine <https://web.archive.org>`_
 to access some of the links on these pages. The papers in
 chronological order are:
 
-  * `See a short paper explaining Roundup <roundup_short_paper.html>`_
+  * `A short paper explaining Roundup <roundup_short_paper.html>`_
 
-  * `See the original overview document for Roundup submitted to the
+  * `The original overview document for Roundup submitted to the
     Software Carpentry competition <original_overview.html>`_
 
-  * `See the original specification document for Roundup submitted to the
+  * `The original specification document for Roundup submitted to the
     Software Carpentry competition <spec.html>`_
 
 

From 31157643039b8cf7b794aff8c6591a8a3bf634be Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 2 Jul 2025 12:24:03 -0400
Subject: [PATCH 209/398] chore(docs): fix links for iis server variables and
 flask fastcgi info

---
 doc/installation.txt | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/doc/installation.txt b/doc/installation.txt
index 84e4fd81b..7ba0a2688 100644
--- a/doc/installation.txt
+++ b/doc/installation.txt
@@ -1287,12 +1287,13 @@ wsgi server like uWSGI, Gnuicorn etc.
 
 To run Roundup using FastCGI, the flup_ package can be used under
 Python 2 and Python 3. We don't have a detailed config for this, but
-the basic idea can be found at:
-https://flask.palletsprojects.com/en/2.0.x/deploying/fastcgi/
+the basic idea `can be found in the wayback machine archive`_.
 
 If you have deployed Roundup using FastCGI and flup we welcome example
 configuration files and instructions.
 
+.. _can be found in the wayback machine archive:
+     https://web.archive.org/web/20241010170738/https://flask.palletsprojects.com/en/2.0.x/deploying/fastcgi/
 .. _flup: https://pypi.org/project/flup/
 
 WSGI Variations

From ecd4e44d77d8c64d8c6c1967542310a7de9e0da8 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 2 Jul 2025 12:26:21 -0400
Subject: [PATCH 210/398] docs: fix canonical link for www.roundup-tracker.org
 index page

the index page canonical link was:

  https://www...org/index.html

change the template so the canonical is set to

  https://www...org/

as that is how it's listed by crawlers.
---
 website/www/_templates/layout.html | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/website/www/_templates/layout.html b/website/www/_templates/layout.html
index af06d70f9..e40290fb6 100644
--- a/website/www/_templates/layout.html
+++ b/website/www/_templates/layout.html
@@ -48,7 +48,13 @@
         content="Page {{ pagename }} in documentation on the Roundup issue tracker, version {{ release|e }}.">
     {%- endif %}
     {%- if pageurl %}
+      {%- if pageurl.endswith("org/index.html") %}
+      <!-- strip the index.html to make
+           https://www.roundup-tracker.org/ canonical -->
+    <link rel="canonical" href="{{ pageurl[:-10] }}" />
+      {%- else %}
     <link rel="canonical" href="{{ pageurl|e }}" />
+      {%- endif %}
     {%- endif %}
     {%- if use_opensearch %}
     <link rel="search" type="application/opensearchdescription+xml"

From fdba590f175dd80fece568497c8392f4ed14cde4 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 3 Jul 2025 12:30:21 -0400
Subject: [PATCH 211/398] docs: fix registerutilMethod docs, format for
 highlights.

---
 doc/admin_guide.txt  |   5 +-
 doc/announcement.txt | 140 +++++++++++++++++++++++++------------------
 doc/upgrading.txt    |  15 +++--
 3 files changed, 94 insertions(+), 66 deletions(-)

diff --git a/doc/admin_guide.txt b/doc/admin_guide.txt
index 43c4c0501..d97c83a82 100644
--- a/doc/admin_guide.txt
+++ b/doc/admin_guide.txt
@@ -493,6 +493,10 @@ directory that generates the CSP on the fly. For example::
 
 	    Header values will be formatted with a dictionary including a
 	    nonce. Use to set a nonce for inline scripts.
+
+	    self is an instance of the TemplatingUtilities class, so
+	    you have access to self.client as well as any functions added
+	    using registerUtil.
 	'''
 	try:
 	    if self.client.client_nonce is None:
@@ -545,7 +549,6 @@ replace ``instance.registerUtilMethod`` with
 ``instance.registerUtil``. For example::
 
     def init(instance):
-        # Note the use of the new (in version 2.5) registerUtilMethod
         instance.registerUtil('AddHtmlHeaders', AddHtmlHeaders)
 
 The AddHtmlHeaders function needs to be changed so that ``self.client``
diff --git a/doc/announcement.txt b/doc/announcement.txt
index cbf780fab..2554ceaf2 100644
--- a/doc/announcement.txt
+++ b/doc/announcement.txt
@@ -28,78 +28,100 @@ then unpack and test/install from the tarball.
 Among the significant enhancements in version 2.5.0 compared to
 the 2.4.0 release are:
 
-The property/field advanced search expression feature has been
-enhanced. The RPN search expression format was previously
-undocumented. Search expressions are usually built using the
-expression editor on the search page. They can be built manually
-by modifying the search URL. However errors in expressions could
-return results that didn't match the user's intent. This release
-documents the RPN expression syntax, adds expression error
-detection, and improves error reporting.
-
-To boost security, Roundup updated the default hash method for
-password storage. Now, we're using PBKDF2 with SHA512. Because of
-this change, you should change (lower) the value of
-password_pbkdf2_default_rounds in your tracker's config.ini. Check
-the upgrading documentation for more info. (Note this may cause
-longer authentication times, the upgrade doc describes how to
-downgrade the hash method.)
-
-For better security, Roundup's session token is now prefixed with
-the magic ``__Secure__`` tag when using HTTPS. This adds to the
-existing ``Secure`` property that comes with the session cookie.
-
-Roundup verifies the user's authorization for the data fetched
-from the database.  A new optional ``filter`` argument has been
-added to Permission objects. When the administrator supplies a
-filter function, it can boosts performance with SQL server
-databases. This function should provide selection criteria to
-offload permission checks to the database. Consequently, less data
-is retrieved from the database, leading to quicker display of
-index pages with reduced CPU and network traffic.
-
-Requsting binary data from a REST endpoint has been a
-hassle. Since JSON can't handle binary data, images (and other
-binary data) need to be encoded. This makes them significantly
-larger. The workaround was to use a non-REST endpoint for fetching
-non-text attachments. This update lets the REST endpoint return
-raw message or file content data. You can utilize the
-``binary_content`` endpoint along with an appropriate ``Accept``
-header (e.g. ``image/jpeg``) in your request.
-
-The ``roundup-gettext`` tool has been enhanced to extract
-translatable strings from detectors and extensions. This will
-simplify the process of translating your trackers.
+* The property/field advanced search expression feature has been
+  enhanced and documented/
+
+   Search expressions are usually built using the
+   expression editor on the search page. They can be built manually
+   by modifying the search URL but the RPN search expression format
+   was undocumented. Errors in expressions could return results that
+   didn't match the user's intent. This release documents the RPN
+   expression syntax, adds basic expression error detection, and
+   improves error reporting.
+
+* The default hash method for password storage is more secure.
+
+  We use PBKDF2 with SHA512 (was SHA1). With this change you can
+  lower the value of password_pbkdf2_default_rounds in your
+  tracker's config.ini. Check the upgrading documentation for more
+  info. (Note this may cause longer authentication times, the
+  upgrade doc describes how to downgrade the hash method if required.)
+
+* Roundup's session token is now prefixed with the magic
+ ``__Secure__`` tag when using HTTPS.
+
+  This adds another layer of protection in addition to the
+  existing ``Secure`` property that comes with the session cookie.
+
+* Data authorization can be done at the database level speeding up
+  display of index pages.
+
+  Roundup verifies the user's authorization for the data fetched
+  from the database after retrieving data from the database. A new
+  optional ``filter`` argument has been added to Permission
+  objects. When the administrator supplies a filter function, it
+  can boost performance with SQL server databases by pushing
+  selection criteria to the database. By offloading some
+  permission checks to the database, less data is retrieved from
+  the database. This leads to quicker display of index pages with
+  reduced CPU and network traffic.
+
+* The REST endpoint can supply binary data (images, pdf, ...) to
+  its clients.
+
+  Requesting binary data from a REST endpoint has been a
+  hassle. Since JSON can't handle binary data, images (and other
+  binary data) need to be encoded. This makes them significantly
+  larger. The workaround was to use a non-REST endpoint for fetching
+  non-text attachments. This update lets the REST endpoint return
+  raw message or file content data. You can utilize the
+  ``binary_content`` endpoint along with an appropriate ``Accept``
+  header (e.g. ``image/jpeg``) in your request.
+
+* Extract translatable strings from your tracker easily
+
+  The ``roundup-gettext`` tool has been enhanced to extract
+  translatable strings from detectors and extensions. This will
+  simplify the process of translating your trackers.
 
 Other miscellaneous fixes include:
 
-* Fixed a crash bug on Windows with Python 3.13.
+* Fix a crash bug on Windows with Python 3.13.
 
-* Updated documentation on required REST headers, along with other
+* Update documentation on required REST headers, along with other
   documentation updates.
 
-* Early detection of error conditions when we can't provide the
-  requested REST format response (like when XML is requested).
+* Improve handling of an error condition generated when an invalid
+  REST response format is requested. For example if XML output is
+  requested, but dicttoxml is not installed, we now return an
+  error without doing any work.
 
-* An error is not generated if a PUT REST request sets the user's address
-  to its current value.
+* Fix an incorrect error report when a PUT REST request sets
+  the user's email address to its current value.
 
-* Added support for the ``defusedxml`` Python module to enhance
+* Add support for the ``defusedxml`` Python module to enhance
   security when using XML.
 
-* Introduced a templating function:
+* Introduce the templating function:
   ``utils.set_http_response(integer)`` to set the HTTP return code
-  directly from your template.
-
-* Added the ability to generate native HTML date and
-  number/integer inputs. Check Upgrading for caveats, as this
-  feature is disabled by default.
-
-* Re-enabled support for GPG/PGP signed emails, which requires
+  directly from your template. This allows the template logic to
+  return a 404 or other code when the user invokes a template
+  incorrectly.
+
+* Add a new ``registerUtilMethod('name', my_function)``. which
+  makes it easier to define and use complex templating utilities.
+  It passes a default argument that allows access to the client
+  instance, translation functions, and other templating utility
+  functions. Previously you had to pass the arguments explicitly
+  when calling the utility from the template.
+
+* Add the ability to generate native HTML date and
+  number/integer inputs. Check the upgrading document for caveats.
+  This feature is disabled by default.
+
+* Re-enable support for GPG/PGP signed emails, which requires
   installation from the test PyPi repository.
 
-* Removed XHTML support to simplify the code base.
-
 The file CHANGES.txt has a detailed list of feature
 additions and bug fixes for each release. The most recent
 changes from there are at the end of this announcement. Also
diff --git a/doc/upgrading.txt b/doc/upgrading.txt
index b7d4cfb1d..7178917db 100644
--- a/doc/upgrading.txt
+++ b/doc/upgrading.txt
@@ -434,12 +434,15 @@ to:
 you had to pass these objects from the template using the ``db``,
 ``request.client`` or ``request.form``  arguments.
 
-A new method for registering a template utility has been
-added. If you use the ``instance`` object's
-``registerUtilMethod()`` to register a utility function, you do
-not need to pass these arguments. The function is called as a
-method and the first argument is a ``client`` instance from which
-the database (client.db), form (client.form).
+A new method for registering a template utility has been added. If you
+use the ``instance`` object's ``registerUtilMethod()`` to register a
+utility function, you do not need to pass these arguments. The
+function is called as a method and the first argument is a
+TemplatingUtils (tu) instance from which the client object
+(tu.client), the database (tu.client.db), form (tu.client.form),
+request (tu.client.request), the translator for the current language
+(tu._) and any functions (tu.X) you registered using
+``registerUtil()`` are available.
 
 You can find an example in :ref:`dynamic_csp`.
 

From 109ab0299487774f29cd8b40e352e56c6c204899 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 3 Jul 2025 13:19:01 -0400
Subject: [PATCH 212/398] docs: bold summary lines in update list; fix
 formatting issue.

When scanning the document, the summary lines in the list didn't
standout. Also the spacing before and after the summary line were
equal. The spacing under the line should be less to tie it to the
following paragraph.

Not sure I like the bolded summary lines, it's a little too much
emphasis.

I think the css tweak works though.
---
 doc/_static/style.css |  9 +++++++++
 doc/announcement.txt  | 34 +++++++++++++++++-----------------
 2 files changed, 26 insertions(+), 17 deletions(-)

diff --git a/doc/_static/style.css b/doc/_static/style.css
index ac0a6a9b9..17e6cc080 100644
--- a/doc/_static/style.css
+++ b/doc/_static/style.css
@@ -51,6 +51,15 @@
 
 * + * { margin-block-start: 1.2em;}
 
+/* shrink spacing between first and following paragraph in a list item
+   when the first paragraph is bold/strong. Try to tie the first paragraph
+   pseudo header closer to the following paragraph. */
+li > p:has(strong):first-child
+ {
+    /* background: red; */
+    margin-block-end: -0.75em;
+}
+
 /* shrink spacing between list elements in tables of contents,
    badge displays */
 div.toctree-wrapper * + *, div.contents * + *, div.release_info * {
diff --git a/doc/announcement.txt b/doc/announcement.txt
index 2554ceaf2..379887700 100644
--- a/doc/announcement.txt
+++ b/doc/announcement.txt
@@ -28,18 +28,18 @@ then unpack and test/install from the tarball.
 Among the significant enhancements in version 2.5.0 compared to
 the 2.4.0 release are:
 
-* The property/field advanced search expression feature has been
-  enhanced and documented/
+* **The property/field advanced search expression feature has been
+  enhanced and documented.**
 
-   Search expressions are usually built using the
-   expression editor on the search page. They can be built manually
-   by modifying the search URL but the RPN search expression format
-   was undocumented. Errors in expressions could return results that
-   didn't match the user's intent. This release documents the RPN
-   expression syntax, adds basic expression error detection, and
-   improves error reporting.
+  Search expressions are usually built using the
+  expression editor on the search page. They can be built manually
+  by modifying the search URL but the RPN search expression format
+  was undocumented. Errors in expressions could return results that
+  didn't match the user's intent. This release documents the RPN
+  expression syntax, adds basic expression error detection, and
+  improves error reporting.
 
-* The default hash method for password storage is more secure.
+* **The default hash method for password storage is more secure.**
 
   We use PBKDF2 with SHA512 (was SHA1). With this change you can
   lower the value of password_pbkdf2_default_rounds in your
@@ -47,14 +47,14 @@ the 2.4.0 release are:
   info. (Note this may cause longer authentication times, the
   upgrade doc describes how to downgrade the hash method if required.)
 
-* Roundup's session token is now prefixed with the magic
- ``__Secure__`` tag when using HTTPS.
+* **Roundup's session token is now prefixed with the magic
+  ``__Secure__`` tag when using HTTPS.**
 
   This adds another layer of protection in addition to the
   existing ``Secure`` property that comes with the session cookie.
 
-* Data authorization can be done at the database level speeding up
-  display of index pages.
+* **Data authorization can be done at the database level speeding up
+  display of index pages.**
 
   Roundup verifies the user's authorization for the data fetched
   from the database after retrieving data from the database. A new
@@ -66,8 +66,8 @@ the 2.4.0 release are:
   the database. This leads to quicker display of index pages with
   reduced CPU and network traffic.
 
-* The REST endpoint can supply binary data (images, pdf, ...) to
-  its clients.
+* **The REST endpoint can supply binary data (images, pdf, ...) to
+  its clients.**
 
   Requesting binary data from a REST endpoint has been a
   hassle. Since JSON can't handle binary data, images (and other
@@ -78,7 +78,7 @@ the 2.4.0 release are:
   ``binary_content`` endpoint along with an appropriate ``Accept``
   header (e.g. ``image/jpeg``) in your request.
 
-* Extract translatable strings from your tracker easily
+* **Extract translatable strings from your tracker easily.**
 
   The ``roundup-gettext`` tool has been enhanced to extract
   translatable strings from detectors and extensions. This will

From 9248207c19e5cca9bd74e0941948d6647e94a745 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 3 Jul 2025 13:23:36 -0400
Subject: [PATCH 213/398] docs: fix doc for registerUtilMethod; style tweak for
 internal docs.

Pul the list pseudoheader style spacing tweat ot the stylesheet used
to generate the released docs.

Fix doc on arg to function defined with registerUtilMethod.
---
 doc/reference.txt             | 4 ++--
 website/www/_static/style.css | 9 +++++++++
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/doc/reference.txt b/doc/reference.txt
index 67ad999de..178f16688 100644
--- a/doc/reference.txt
+++ b/doc/reference.txt
@@ -1151,8 +1151,8 @@ mechanism.
   <customizing.html#adding-a-time-log-to-your-issues-4>`_ for an example)
 
 * ``instance.registerUtilMethod`` is also used for adding `templating
-  utilities`_, and provides a client instance by default to the
-  function. This makes more complex templating actions easier to
+  utilities`_, and provides a TemplatingUtils instance by default to
+  the function. This makes more complex templating actions easier to
   use. (see :ref:`dynamic_csp` for an example)
 
 * ``instance.registerAction`` is used to add more actions to the
diff --git a/website/www/_static/style.css b/website/www/_static/style.css
index c58a40f42..70b4cfa4d 100644
--- a/website/www/_static/style.css
+++ b/website/www/_static/style.css
@@ -51,6 +51,15 @@
 
 * + * { margin-block-start: 1.2em;}
 
+/* shrink spacing between first and following paragraph in a list item
+   when the first paragraph is bold/strong. Try to tie the first paragraph
+   pseudo header closer to the following paragraph. */
+li > p:has(strong):first-child
+ {
+    /* background: red; */
+    margin-block-end: -0.75em;
+}
+
 /* shrink spacing between list elements in tables of contents,
    badge displays */
 div.toctree-wrapper * + *, div.contents * + *, div.release_info * {

From 39d4c6aede070ea4ff2d75876b78936d9a3a3f6b Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 3 Jul 2025 13:33:59 -0400
Subject: [PATCH 214/398] docs: fix typo

---
 doc/upgrading.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/upgrading.txt b/doc/upgrading.txt
index 7178917db..3db6c20ad 100644
--- a/doc/upgrading.txt
+++ b/doc/upgrading.txt
@@ -109,7 +109,7 @@ Deprecation Notices (required)
     library has been removed in 2.5.0. Only the Python supplied
     sqlite3 library is supported.
   * Roundup 2.5.0 supports Python 3.7 or newer. (It is not tested
-    on Python 3.6. It may work but we don;t support it.)
+    on Python 3.6. It may work but we don't support it.)
 
 Update responsive template _generic.404.html and query.item.html (recommended)
 ------------------------------------------------------------------------------

From ef938856a8d3fb0385e7eb0af3b8c7adf06422e6 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Tue, 8 Jul 2025 10:23:09 -0400
Subject: [PATCH 215/398] bug: fix template use of structure with untrusted
 data

Looks like an xSS bug with an early version of the template that was
fixed in the code but never in the deployed tracker.  It has been a
while since this particular construct has been in the classic template
which is the base for the tracker.

This has been fixed on the deployed tracker as well.

reported by 4bug of ChaMd5 Security Team H1 Group
---
 website/issues/html/issue.item.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/website/issues/html/issue.item.html b/website/issues/html/issue.item.html
index 32b305718..9389fad59 100644
--- a/website/issues/html/issue.item.html
+++ b/website/issues/html/issue.item.html
@@ -45,7 +45,7 @@
  <td colspan="3" tal:condition="context/title/is_edit_ok"
      tal:content="structure python:context.title.field(id='title', size=60)">title</td>
  <td colspan="3" tal:condition="not:context/title/is_edit_ok">
-  <span tal:content="structure context/title/plain"/>
+  <span tal:content="context/title/plain"/>
   <input type="hidden" name="title" tal:attributes="value context/title">
  </td>
 </tr>

From 633acdf98319fb400324a1c9fa2896703a36f919 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Tue, 8 Jul 2025 13:38:08 -0400
Subject: [PATCH 216/398] bug(security): fix XSS exploit in devel and
 responsive templates

Replace all occurances of:

  tal:content="structure context/MUMBLE/plain"

with

   tal:content="context/MUMBLE/plain"

This seems to have been an old way to handle display of a field when
the user did not have edit rights. It does not occur in current (later
than 2009) classic tracker templates. But probably was unsed in
earlier classic templates since devel, reponsive and the roundup issue
tracker templates were based on classic.

Add CVE placeholder to security.txt and link to fix directions added
to upgrading.txt. Add note in announcement.txt and CHANGES.txt

Add a details element around the table of contents in the upgrading
guide. It was getting long.

Updated a missed XSS issue in the roundup tracker template. Live site
is already fixed.

XSS bug reported by 4bug of ChaMd5 Security Team H1 Group
---
 CHANGES.txt                                   |  2 +
 doc/announcement.txt                          |  9 +-
 doc/security.txt                              |  6 ++
 doc/upgrading.txt                             | 87 ++++++++++++++++++-
 .../templates/devel/html/bug.item.html        |  2 +-
 .../templates/devel/html/milestone.item.html  |  4 +-
 .../templates/devel/html/task.item.html       |  2 +-
 .../templates/responsive/html/bug.item.html   | 24 ++---
 .../responsive/html/milestone.item.html       |  4 +-
 .../templates/responsive/html/task.item.html  | 22 ++---
 website/issues/html/issue.item.html           |  2 +-
 11 files changed, 132 insertions(+), 32 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index cc34cedc0..b41ffbdd5 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -98,6 +98,8 @@ Fixed:
   Rouillard)
 - fix potential HTTP Response Splitting issue in
   roundup-server. Discovered by CodeQL in CI. (John Rouillard)
+- XSS issue in devel and responsive templates. Reported by 4bug of
+  ChaMd5 Security Team H1 Group. (John Rouillard).
 
 Features:
 
diff --git a/doc/announcement.txt b/doc/announcement.txt
index 379887700..0a4f07e16 100644
--- a/doc/announcement.txt
+++ b/doc/announcement.txt
@@ -4,7 +4,7 @@ make sure to read `docs/upgrading.txt
 <https://www.roundup-tracker.org/docs/upgrading.html>`_ to
 bring your tracker up to date.
 
-The 41 changes, as usual, include some new features and many
+The 42 changes, as usual, include some new features and many
 bug fixes.
 
 Version 2.5.0 does not support Python 2. The minimum Python
@@ -28,6 +28,13 @@ then unpack and test/install from the tarball.
 Among the significant enhancements in version 2.5.0 compared to
 the 2.4.0 release are:
 
+* **XSS vulnerability with devel and responsive templates fixed**
+
+  Just before release an XSS security issue with trackers based on
+  the devel or responsive templates was discovered. The updating
+  directions include instructions on fixing this issue with the
+  html templates.
+
 * **The property/field advanced search expression feature has been
   enhanced and documented.**
 
diff --git a/doc/security.txt b/doc/security.txt
index 97f8cc062..402bfd5b4 100644
--- a/doc/security.txt
+++ b/doc/security.txt
@@ -28,6 +28,10 @@ source release tarballs.
 CVE Announcements
 -----------------
 
+  * `CVE-2025-pending`_ - :ref:`XSS security issue with devel or
+    responsive templates <CVE-2025-pending>`. Fixed in release 2.5.0,
+    directions available for fixing trackers based on these templates.
+
   * `CVE-2024-39124`_ - :ref:`classhelpers (_generic.help.html) are
     vulnerable to an XSS attack. <CVE-2024-39124>` Requires fixing
     tracker homes.
@@ -39,6 +43,8 @@ CVE Announcements
     executed. <CVE-2024-39126>` Fixed in release 2.4.0, directions
     available for fixing in prior versions.
 
+.. _CVE-2025-pending:
+        https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-pending
 .. _CVE-2024-39124:
         https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39124
 .. _CVE-2024-39125:
diff --git a/doc/upgrading.txt b/doc/upgrading.txt
index 3db6c20ad..1062e80c8 100644
--- a/doc/upgrading.txt
+++ b/doc/upgrading.txt
@@ -91,16 +91,101 @@ your database.
   lists.sourceforge.net). Version 2.3.0 is the last version to support
   XHTML.
 
-Contents:
+.. raw:: html
+
+  <details>
+  <summary>Contents:</summary>
 
 .. contents::
    :local:
 
+.. raw:: html
+
+  </details>
+
 .. index:: Upgrading; 2.4.0 to 2.5.0
 
 Migrating from 2.4.0 to 2.5.0
 =============================
 
+.. _CVE-2025-pending:
+
+XSS security issue with devel and responsive templates (required)
+-----------------------------------------------------------------
+
+The devel and responsive templates prior to Roundup 2.5 used this
+construct::
+
+  tal:content="structure context/MUMBLE/plain"
+
+Where ``MUMBLE`` is a property of your issues (e.g. title).
+
+This construct allows a URL with a carefully crafted query parameter
+to execute arbitrary JavaScript.
+
+You should check all your trackers.  The classic template has not used
+this construct since at least 2009, but your tracker's templates may
+use the offending construct anyway.
+
+This fix will apply if your tracker is based on the responsive or
+devel template. Check the TEMPLATE-INFO.txt file in your tracker
+home. The template name is the first component of the ``Name``
+field. For example a Name like::
+
+   Name: responsive-bugtracker
+
+   Name: devel-bugtracker
+
+shows that tracker is based on the responsive or devel templates.
+
+.. _cve-2025-pending-fixed:
+
+To fix this, remove the ``structure`` declaration when it is used with
+a plain representation. So fixing the code by replacing the example
+above with::
+
+  tal:content="context/MUMBLE/plain"
+
+prevents the attack.
+
+To check for this issue, search for ``structure`` followed by
+``/plain`` in all your html templates. If you are on a Linux/Unix
+system you can search the html subdirectory of your tracker with the
+following::
+
+   grep 'structure.*/plain' *.html
+
+which should return any lines with issues.
+
+.. warning::
+
+   Backup the files in the ``html`` subdirectory of your tracker in case
+   an edit goes wrong.
+
+You can fix this issue using the GNU sed command::
+
+  sed -i.bak -e '/structure.*\/plain/s/structure.//' *.html
+
+to edit the files in place and remove the structure keyword. It will
+create a ``.bak`` file with the original contents of the file. If you
+are on windows, some text editors support search and replace using a
+regular expression.
+
+If the construct is split across lines::
+
+     tal:content="structure
+              context/MUMBLE/plain"
+
+the commands above will miss the construct. So you should also search
+the html files using ``grep /plain *.html`` and verify that all of the
+``context/MUMBLE/plain`` include ``tal:content`` as in the `fixed
+example above <#cve-2025-pending-fixed>`_. Any lines that have
+``context/MUMBLE/plain`` without ``tal:content=`` before it need to be
+manually verified/fixed.
+
+The distributed devel and responsive templates do not split the
+construct across lines, but if you changed the files it may be split.
+
 Deprecation Notices (required)
 ------------------------------
 
diff --git a/share/roundup/templates/devel/html/bug.item.html b/share/roundup/templates/devel/html/bug.item.html
index b0c1ac107..3ef539f05 100644
--- a/share/roundup/templates/devel/html/bug.item.html
+++ b/share/roundup/templates/devel/html/bug.item.html
@@ -45,7 +45,7 @@
  <td colspan="3" tal:condition="context/title/is_edit_ok"
      tal:content="structure python:context.title.field(size=40)">title</td>
  <td colspan="3" tal:condition="not:context/title/is_edit_ok">
-  <span tal:content="structure context/title/plain"/>
+  <span tal:content="context/title/plain"/>
   <input type="hidden" name="title" tal:attributes="value context/title">
  </td>
 </tr>
diff --git a/share/roundup/templates/devel/html/milestone.item.html b/share/roundup/templates/devel/html/milestone.item.html
index 7378ddc42..1ddb2d3fb 100644
--- a/share/roundup/templates/devel/html/milestone.item.html
+++ b/share/roundup/templates/devel/html/milestone.item.html
@@ -28,7 +28,7 @@
       </td>
       <td colspan="5"
           tal:condition="python: not request.user.hasPermission('Edit')"
-          tal:content="structure context/title/plain">
+          tal:content="context/title/plain">
         title
       </td>
     </tr>
@@ -54,7 +54,7 @@
       </td>
       <td colspan="5"
           tal:condition="python: not request.user.hasPermission('Edit')"
-          tal:content="structure context/status/plain">
+          tal:content="context/status/plain">
         status
       </td>
     </tr>
diff --git a/share/roundup/templates/devel/html/task.item.html b/share/roundup/templates/devel/html/task.item.html
index e207cb0da..0d832287a 100644
--- a/share/roundup/templates/devel/html/task.item.html
+++ b/share/roundup/templates/devel/html/task.item.html
@@ -45,7 +45,7 @@
  <td colspan="3" tal:condition="context/title/is_edit_ok"
      tal:content="structure python:context.title.field(size=60)">title</td>
  <td colspan="3" tal:condition="not:context/title/is_edit_ok">
-  <span tal:content="structure context/title/plain"/>
+  <span tal:content="context/title/plain"/>
   <input type="hidden" name="title" tal:attributes="value context/title">
  </td>
 </tr>
diff --git a/share/roundup/templates/responsive/html/bug.item.html b/share/roundup/templates/responsive/html/bug.item.html
index f677c332f..c5bc6f247 100644
--- a/share/roundup/templates/responsive/html/bug.item.html
+++ b/share/roundup/templates/responsive/html/bug.item.html
@@ -42,13 +42,13 @@
         <div class='container-fluid' tal:condition="not:context/is_edit_ok">
           <dl class='dl-horizontal'>
             <dt i18n:translate="">Title</dt>
-            <dd tal:content="structure context/title/plain"></dd>
+            <dd tal:content="context/title/plain"></dd>
             <dt i18n:translate="">Type</dt>
-            <dd tal:content="structure context/type/plain"></dd>
+            <dd tal:content="context/type/plain"></dd>
             <dt i18n:translate="">Components</dt>
-            <dd tal:content="structure context/components/plain"></dd>
+            <dd tal:content="context/components/plain"></dd>
             <dt i18n:translate="">Version</dt>
-            <dd tal:content="structure context/versions/plain"></dd>
+            <dd tal:content="context/versions/plain"></dd>
           </dl>
         </div>
         <div class='container-fluid' tal:condition="context/is_edit_ok">
@@ -126,23 +126,23 @@
           <div class='row-fluid'>
             <dl class='dl-horizontal span6'>
               <dt i18n:translate="">Status</dt>
-              <dd tal:content="structure context/status/plain"></dd>
+              <dd tal:content="context/status/plain"></dd>
               <dt i18n:translate="">Resolution</dt>
-              <dd tal:content="structure context/resolution/plain"></dd>
+              <dd tal:content="context/resolution/plain"></dd>
               <dt i18n:translate="">Dependencies</dt>
-              <dd tal:content="structure context/dependencies/plain"></dd>
+              <dd tal:content="context/dependencies/plain"></dd>
               <dt i18n:translate="">Superseder</dt>
-              <dd tal:content="structure context/superseder/plain"></dd>
+              <dd tal:content="context/superseder/plain"></dd>
             </dl>
             <dl class='dl-horizontal span6'>
               <dt i18n:translate="">Assigned to</dt>
-              <dd tal:content="structure context/assignee/plain"></dd>
+              <dd tal:content="context/assignee/plain"></dd>
               <dt i18n:translate="">Nosy list</dt>
-              <dd tal:content="structure context/nosy/plain"></dd>
+              <dd tal:content="context/nosy/plain"></dd>
               <dt i18n:translate="">Priority</dt>
-              <dd tal:content="structure context/priority/plain"></dd>
+              <dd tal:content="context/priority/plain"></dd>
               <dt i18n:translate="">Keywords</dt>
-              <dd tal:content="structure context/keywords/plain"></dd>
+              <dd tal:content="context/keywords/plain"></dd>
             </dl>
           </div>
         </div>
diff --git a/share/roundup/templates/responsive/html/milestone.item.html b/share/roundup/templates/responsive/html/milestone.item.html
index 3a62ca1fe..b27858853 100644
--- a/share/roundup/templates/responsive/html/milestone.item.html
+++ b/share/roundup/templates/responsive/html/milestone.item.html
@@ -24,7 +24,7 @@
       </td>
       <td colspan="5"
           tal:condition="python: not request.user.hasPermission('Edit')"
-          tal:content="structure context/title/plain">
+          tal:content="context/title/plain">
         title
       </td>
     </tr>
@@ -50,7 +50,7 @@
       </td>
       <td colspan="5"
           tal:condition="python: not request.user.hasPermission('Edit')"
-          tal:content="structure context/status/plain">
+          tal:content="context/status/plain">
         status
       </td>
     </tr>
diff --git a/share/roundup/templates/responsive/html/task.item.html b/share/roundup/templates/responsive/html/task.item.html
index e3efa8237..68a02bd88 100644
--- a/share/roundup/templates/responsive/html/task.item.html
+++ b/share/roundup/templates/responsive/html/task.item.html
@@ -43,11 +43,11 @@
         <div class='container-fluid' tal:condition="not:context/is_edit_ok">
           <dl class='dl-horizontal'>
             <dt i18n:translate="">Title</dt>
-            <dd tal:content="structure context/title/plain"></dd>
+            <dd tal:content="context/title/plain"></dd>
             <dt i18n:translate="">Type</dt>
-            <dd tal:content="structure context/type/plain"></dd>
+            <dd tal:content="context/type/plain"></dd>
             <dt i18n:translate="">Components</dt>
-            <dd tal:content="structure context/components/plain"></dd>
+            <dd tal:content="context/components/plain"></dd>
           </dl>
         </div>
         <div class='container-fluid' tal:condition="context/is_edit_ok">
@@ -61,7 +61,7 @@
           <div class='control-group vspace-two' tal:condition="not:context/title/is_edit_ok">
             <label class='control-label' i18n:translate="">Title</label>
             <div class='controls'>
-              <span class='input-xxlarge uneditable-input' tal:content="structure context/title/plain"></span>
+              <span class='input-xxlarge uneditable-input' tal:content="context/title/plain"></span>
             </div>
           </div>
 
@@ -102,21 +102,21 @@
           <div class='row-fluid'>
             <dl class='dl-horizontal span6'>
               <dt i18n:translate="">Status</dt>
-              <dd tal:content="structure context/status/plain"></dd>
+              <dd tal:content="context/status/plain"></dd>
               <dt i18n:translate="">Resolution</dt>
-              <dd tal:content="structure context/resolution/plain"></dd>
+              <dd tal:content="context/resolution/plain"></dd>
               <dt i18n:translate="">Dependencies</dt>
-              <dd tal:content="structure context/dependencies/plain"></dd>
+              <dd tal:content="context/dependencies/plain"></dd>
               <dt i18n:translate="">Superseder</dt>
-              <dd tal:content="structure context/superseder/plain"></dd>
+              <dd tal:content="context/superseder/plain"></dd>
             </dl>
             <dl class='dl-horizontal span6'>
               <dt i18n:translate="">Assigned to</dt>
-              <dd tal:content="structure context/assignee/plain"></dd>
+              <dd tal:content="context/assignee/plain"></dd>
               <dt i18n:translate="">Nosy list</dt>
-              <dd tal:content="structure context/nosy/plain"></dd>
+              <dd tal:content="context/nosy/plain"></dd>
               <dt i18n:translate="">Priority</dt>
-              <dd tal:content="structure context/priority/plain"></dd>
+              <dd tal:content="context/priority/plain"></dd>
             </dl>
           </div>
         </div>
diff --git a/website/issues/html/issue.item.html b/website/issues/html/issue.item.html
index 9389fad59..d9504abe5 100644
--- a/website/issues/html/issue.item.html
+++ b/website/issues/html/issue.item.html
@@ -127,7 +127,7 @@
   </select>
  </td>
  <td tal:condition="not:context/assignee/is_edit_ok">
-  <span tal:replace="structure context/assignee/plain" />
+  <span tal:replace="context/assignee/plain" />
  </td>
  <th><label for="nosy" i18n:translate="">Nosy List</label>:
   <span tal:condition="context/nosy/is_edit_ok"

From c3b2402c119cddd37a9b84bad8f89f1004944118 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 9 Jul 2025 09:42:48 -0400
Subject: [PATCH 217/398] docs(style): make shadows on pre sections have tint
 of background

The grey shadows on a wheat colored background looked bad. Add some
of the backgound color to the shadow.
---
 doc/_static/style.css         | 4 ++--
 website/www/_static/style.css | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/doc/_static/style.css b/doc/_static/style.css
index 17e6cc080..9f2ee9942 100644
--- a/doc/_static/style.css
+++ b/doc/_static/style.css
@@ -455,9 +455,9 @@ div.highlight > pre {
        linear-gradient(to right, #f5f4d8, #f5f4d8),
        /* Shadow */
        radial-gradient(farthest-side at 0px 50%,
-		       rgba(0, 0, 20, 0.5), rgba(255, 255, 255, 0)),
+		       rgba(181, 181, 113, 0.75), rgba(255, 255, 255, 0)),
        radial-gradient(farthest-side at 100% 50%,
-		       rgba(0, 0, 20, 0.5), rgba(255, 255, 255, 0));
+		       rgba(181, 181, 113, 0.75), rgba(255, 255, 255, 0));
     /* square shadows */
     /*
     linear-gradient(to right, rgba(0, 0, 0, 0.25), rgba(255, 255, 255, 0)),
diff --git a/website/www/_static/style.css b/website/www/_static/style.css
index 70b4cfa4d..743cdb45d 100644
--- a/website/www/_static/style.css
+++ b/website/www/_static/style.css
@@ -455,9 +455,9 @@ div.highlight > pre {
        linear-gradient(to right, #f5f4d8, #f5f4d8),
        /* Shadow */
        radial-gradient(farthest-side at 0px 50%,
-		       rgba(0, 0, 20, 0.5), rgba(255, 255, 255, 0)),
+		       rgba(181, 181, 113, 0.75), rgba(255, 255, 255, 0)),
        radial-gradient(farthest-side at 100% 50%,
-		       rgba(0, 0, 20, 0.5), rgba(255, 255, 255, 0));
+		       rgba(181, 181, 113, 0.75), rgba(255, 255, 255, 0));
     /* square shadows */
     /*
     linear-gradient(to right, rgba(0, 0, 0, 0.25), rgba(255, 255, 255, 0)),

From 1a1d8573750ac87418647b3133f851cc41085127 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 9 Jul 2025 09:43:37 -0400
Subject: [PATCH 218/398] docs: relabel/label a couple of headers

---
 doc/upgrading.txt | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/doc/upgrading.txt b/doc/upgrading.txt
index 1062e80c8..8fd48ba96 100644
--- a/doc/upgrading.txt
+++ b/doc/upgrading.txt
@@ -110,8 +110,8 @@ Migrating from 2.4.0 to 2.5.0
 
 .. _CVE-2025-pending:
 
-XSS security issue with devel and responsive templates (required)
------------------------------------------------------------------
+XSS security issue with devel and responsive templates (recommended)
+--------------------------------------------------------------------
 
 The devel and responsive templates prior to Roundup 2.5 used this
 construct::
@@ -531,8 +531,8 @@ request (tu.client.request), the translator for the current language
 
 You can find an example in :ref:`dynamic_csp`.
 
-Directions for installing gpg
------------------------------
+Directions for installing gpg (optional)
+----------------------------------------
 
 In this release a new version of the gpg module was needed for Ubuntu
 24.04 and python 3.13. Paul Schwabauer produced a new version of the

From 377d1e8117c3a82a79b61049e2ca3e077157c0be Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 9 Jul 2025 09:44:59 -0400
Subject: [PATCH 219/398] doc: put example in callout using ::

---
 doc/upgrading.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/upgrading.txt b/doc/upgrading.txt
index 8fd48ba96..54c1cd3ab 100644
--- a/doc/upgrading.txt
+++ b/doc/upgrading.txt
@@ -1077,7 +1077,7 @@ improvement, encouraging a wider adoption of the feature. In the
 event that an undiscovered bug arises, it can still be disabled
 if you experience problems. To disable it, modify your wsgi
 startup script and add the feature_flags to the RequestDispatcher
-as below:
+as below::
 
    feature_flags = { "cache_tracker": False }
    app =  RequestDispatcher(tracker_home, feature_flags=feature_flags)

From 179e5af07f92d52e4aea3b991672e5b9d6222c1e Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 9 Jul 2025 19:10:00 -0400
Subject: [PATCH 220/398] docs: fix example

---
 doc/upgrading.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/upgrading.txt b/doc/upgrading.txt
index 54c1cd3ab..4d01aa375 100644
--- a/doc/upgrading.txt
+++ b/doc/upgrading.txt
@@ -276,7 +276,7 @@ tracker's ``interfaces.py``::
   Password.default_scheme = Password.deprecated_schemes.pop(0)
   # Add PBKDF2S5 (PBKDF2-SHA512) as a valid scheme. Passwords
   # using it will be rehashed to use PBDKF2.
-  Password.experimental_schemes[0] = "PBKDF2S5"
+  Password.experimental_schemes.insert(0, "PBKDF2S5")
 
 If you proceed with this, you should set
 ``password_pbkdf2_default_rounds`` to 2 million or more rounds to keep

From 2ac84281ffb5ffd63e337f69f73344493c3af4e7 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 10 Jul 2025 22:25:44 -0400
Subject: [PATCH 221/398] doc: tighten up line spacing in multicol lists by
 removing p margins.

---
 doc/_static/style.css         | 3 +++
 website/www/_static/style.css | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/doc/_static/style.css b/doc/_static/style.css
index 9f2ee9942..92cfa2620 100644
--- a/doc/_static/style.css
+++ b/doc/_static/style.css
@@ -483,6 +483,9 @@ ul.multicol {
 ul.multicol > * {
   margin-block-start: 0; /* remove spacing added by * + * here */
 }
+ul.multicol > li > p { /* remove spacing around paragraphs to tighten up list */
+    margin: 0;
+}
 
 div.file_insert { /* use to insert COPYING into license.txt */
     background: #f3f1cc;
diff --git a/website/www/_static/style.css b/website/www/_static/style.css
index 743cdb45d..a8516d195 100644
--- a/website/www/_static/style.css
+++ b/website/www/_static/style.css
@@ -483,6 +483,9 @@ ul.multicol {
 ul.multicol > * {
   margin-block-start: 0; /* remove spacing added by * + * here */
 }
+ul.multicol > li > p { /* remove spacing around paragraphs to tighten up list */
+    margin: 0;
+}
 
 div.file_insert { /* use to insert COPYING into license.txt */
     background: #f3f1cc;

From fc043c2e6a9067146d48a511155babe2dbc9a766 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 10 Jul 2025 22:27:49 -0400
Subject: [PATCH 222/398] doc: add glossary entry for "html directory"

---
 doc/glossary.txt | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/doc/glossary.txt b/doc/glossary.txt
index b2969fb0a..d41ba7bfe 100644
--- a/doc/glossary.txt
+++ b/doc/glossary.txt
@@ -32,6 +32,15 @@ Roundup Glossary
       a dash '-', and a number. E.g. ``file-1``. These are used to create
       new instances of a class via the web interface.
 
+   html directory
+      there is a directory called **html** in tracker homes. This
+      contains html files (called templates) that are processed by the
+      templating processor (TAL or jinja2) for delivery to a web
+      client. However there is also a ``templates`` setting in the
+      tracker's ``config.ini`` file. The default value for this is
+      ``html``. However any directories listed as templates should be
+      considered an ``html directory``
+
    hyperdb
       a software layer between the user and the underlying :term:`db`.
       It is responsible for mutating the underlying db when the schema

From e9a64888b48d409486edeaa7b7efc619278bbc48 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 10 Jul 2025 23:03:27 -0400
Subject: [PATCH 223/398] doc: add detector and template defs.

The detector def also includes auditor and reactor defs.

Template as in html template also provides context/def for tracker template.
---
 doc/glossary.txt | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/doc/glossary.txt b/doc/glossary.txt
index d41ba7bfe..946577d53 100644
--- a/doc/glossary.txt
+++ b/doc/glossary.txt
@@ -32,6 +32,20 @@ Roundup Glossary
       a dash '-', and a number. E.g. ``file-1``. These are used to create
       new instances of a class via the web interface.
 
+   detectors
+      There are two types of detectors that execute Python code in
+      response to changes to the database.
+
+      auditors
+	are run before a permanent change is made to the database.
+	They validate that the change is allowed. For example is
+	the current user allowed to change the status field.
+
+      reactors
+	are run after a change has been committed to the
+	database. They are used to perform actions like sending
+	notification messages, updating other tickets etc.
+
    html directory
       there is a directory called **html** in tracker homes. This
       contains html files (called templates) that are processed by the
@@ -65,6 +79,22 @@ Roundup Glossary
       tracker. Contained in the file ``schema.py``. The permissions
       for the schema items are usually defined in the same file.
 
+   template
+
+      this term has two meanings depending on context.
+
+      It refers to files that are processed by a templating engine to
+      produce output suitable for machine or human consumption. For
+      example a template could produce a html page that includes the
+      name of the user.
+
+      It also can mean a **Tracker template**. This is a set of files
+      used to install a new tracker. Tracker templates define a
+      tracker with a particular look and feel, :term:`schema`,
+      permissions model, and :term:`detectors`. Roundu ships with five
+      templates and people on the net `have produced other templates`_
+
+
    tracker
       the schema and hyperdb that forms one issue tracker
 
@@ -77,5 +107,6 @@ Roundup Glossary
 
 Back to `Table of Contents`_
 
+.. _`have produced other templates`: https://wiki.roundup-tracker.org/TrackerTemplates
 .. _`Table of Contents`: ../docs.html
 

From 65ac8f4dcb03a9a36a67c3e98fdf79cbd2a0b3fb Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Fri, 11 Jul 2025 19:30:27 -0400
Subject: [PATCH 224/398] bug(security): CVE-2025-53865 - XSS bug

Extensive fixes in devel, responsive templates known to be
exploitable.

Similar constructs in classic and minimal templates not known
to be exploitable, but changed anyway.

doc/upgrading.txt:

  Reformat to 66 characters.

  Update with assigned CVE number.

  Add section on fixing tal:replace with unsafe data.

  Document analysis and assumptions in comment in file.

doc/security.txt:

  Update with CVE number.
---
 doc/security.txt                              |   8 +-
 doc/upgrading.txt                             | 209 +++++++++++++++---
 .../classic/html/_generic.collision.html      |   2 +-
 .../templates/classic/html/msg.item.html      |   2 +-
 .../devel/html/_generic.collision.html        |   2 +-
 .../templates/devel/html/bug.item.html        |   6 +-
 .../templates/devel/html/keyword.item.html    |   4 +-
 .../templates/devel/html/milestone.item.html  |   2 +-
 .../templates/devel/html/msg.item.html        |   2 +-
 share/roundup/templates/devel/html/page.html  |   2 +-
 .../templates/devel/html/task.item.html       |   6 +-
 .../templates/devel/html/user.item.html       |   4 +-
 .../minimal/html/_generic.collision.html      |   2 +-
 .../responsive/html/_generic.collision.html   |   2 +-
 .../templates/responsive/html/bug.item.html   |   6 +-
 .../responsive/html/keyword.item.html         |   4 +-
 .../responsive/html/milestone.item.html       |   2 +-
 .../templates/responsive/html/msg.item.html   |   2 +-
 .../templates/responsive/html/page.html       |   2 +-
 .../templates/responsive/html/task.item.html  |   6 +-
 .../templates/responsive/html/user.item.html  |   4 +-
 website/issues/html/_generic.collision.html   |   2 +-
 website/issues/html/issue.item.html           |   8 +-
 website/issues/html/msg.item.html             |   3 +-
 website/issues/html/user.item.html            |   6 +-
 25 files changed, 228 insertions(+), 70 deletions(-)

diff --git a/doc/security.txt b/doc/security.txt
index 402bfd5b4..819c8e05d 100644
--- a/doc/security.txt
+++ b/doc/security.txt
@@ -28,8 +28,8 @@ source release tarballs.
 CVE Announcements
 -----------------
 
-  * `CVE-2025-pending`_ - :ref:`XSS security issue with devel or
-    responsive templates <CVE-2025-pending>`. Fixed in release 2.5.0,
+  * `CVE-2025-53865`_ - :ref:`XSS security issue with devel or
+    responsive templates <CVE-2025-53865>`. Fixed in release 2.5.0,
     directions available for fixing trackers based on these templates.
 
   * `CVE-2024-39124`_ - :ref:`classhelpers (_generic.help.html) are
@@ -43,8 +43,8 @@ CVE Announcements
     executed. <CVE-2024-39126>` Fixed in release 2.4.0, directions
     available for fixing in prior versions.
 
-.. _CVE-2025-pending:
-        https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-pending
+.. _CVE-2025-53865:
+        https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53865
 .. _CVE-2024-39124:
         https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39124
 .. _CVE-2024-39125:
diff --git a/doc/upgrading.txt b/doc/upgrading.txt
index 4d01aa375..827fb3a5f 100644
--- a/doc/upgrading.txt
+++ b/doc/upgrading.txt
@@ -108,11 +108,31 @@ your database.
 Migrating from 2.4.0 to 2.5.0
 =============================
 
-.. _CVE-2025-pending:
+.. _CVE-2025-53865:
 
 XSS security issue with devel and responsive templates (recommended)
 --------------------------------------------------------------------
 
+There are actually two different issues under this heading.
+
+  1. incorrect use of the ``structure`` keyword with
+     ``tal:content``
+  2. use of ``tal:replace`` on unsafe input
+
+In the discussion below, the :term:`html directory` means one or
+more directories listed in the ``templates`` key of your
+tracker's ``config.ini`` file.
+
+These directions can be used to solve the XSS security issue with
+any version of Roundup. Even if you used a classic or minimal
+template, you should check your trackers for these issues. The
+classic template fixed most of these many years ago, but the
+updates were not made to the devel and responsive templates. No
+report of similar issues with the jinja template has been seen.
+
+Incorrect use of structure in templates
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
 The devel and responsive templates prior to Roundup 2.5 used this
 construct::
 
@@ -120,12 +140,12 @@ construct::
 
 Where ``MUMBLE`` is a property of your issues (e.g. title).
 
-This construct allows a URL with a carefully crafted query parameter
-to execute arbitrary JavaScript.
+This construct allows a URL with a carefully crafted query
+parameter to execute arbitrary JavaScript.
 
-You should check all your trackers.  The classic template has not used
-this construct since at least 2009, but your tracker's templates may
-use the offending construct anyway.
+You should check all your trackers.  The classic template has not
+used this construct since at least 2009, but your tracker's
+templates may use the offending construct anyway.
 
 This fix will apply if your tracker is based on the responsive or
 devel template. Check the TEMPLATE-INFO.txt file in your tracker
@@ -138,11 +158,11 @@ field. For example a Name like::
 
 shows that tracker is based on the responsive or devel templates.
 
-.. _cve-2025-pending-fixed:
+.. _cve-2025-53865-fixed:
 
-To fix this, remove the ``structure`` declaration when it is used with
-a plain representation. So fixing the code by replacing the example
-above with::
+To fix this, remove the ``structure`` declaration when it is used
+with a plain representation. So fixing the code by replacing the
+example above with::
 
   tal:content="context/MUMBLE/plain"
 
@@ -150,8 +170,8 @@ prevents the attack.
 
 To check for this issue, search for ``structure`` followed by
 ``/plain`` in all your html templates. If you are on a Linux/Unix
-system you can search the html subdirectory of your tracker with the
-following::
+system you can search the html subdirectory of your tracker with
+the following::
 
    grep 'structure.*/plain' *.html
 
@@ -159,32 +179,169 @@ which should return any lines with issues.
 
 .. warning::
 
-   Backup the files in the ``html`` subdirectory of your tracker in case
-   an edit goes wrong.
+   Backup the files in the ``html`` subdirectory of your tracker
+   in case an edit goes wrong.
 
-You can fix this issue using the GNU sed command::
+As an example, you could fix this issue using the GNU sed
+command::
 
   sed -i.bak -e '/structure.*\/plain/s/structure.//' *.html
 
-to edit the files in place and remove the structure keyword. It will
-create a ``.bak`` file with the original contents of the file. If you
-are on windows, some text editors support search and replace using a
-regular expression.
+to edit the files in place and remove the structure keyword. It
+will create a ``.bak`` file with the original contents of the
+file. If your templates were changed, this might still miss some
+entries. If you are on windows, some text editors support search
+and replace using a regular expression.
 
 If the construct is split across lines::
 
      tal:content="structure
               context/MUMBLE/plain"
 
-the commands above will miss the construct. So you should also search
-the html files using ``grep /plain *.html`` and verify that all of the
-``context/MUMBLE/plain`` include ``tal:content`` as in the `fixed
-example above <#cve-2025-pending-fixed>`_. Any lines that have
-``context/MUMBLE/plain`` without ``tal:content=`` before it need to be
-manually verified/fixed.
+the commands above will miss the construct. So you should also
+search the html files using ``grep /plain *.html`` and verify
+that all of the ``context/MUMBLE/plain`` include ``tal:content``
+as in the `fixed example above <#cve-2025-53865-fixed>`_. Any
+lines that have ``context/MUMBLE/plain`` without ``tal:content=``
+before it need to be manually verified/fixed.
 
 The distributed devel and responsive templates do not split the
-construct across lines, but if you changed the files it may be split.
+construct across lines, but if you changed the files it may be
+split.
+
+tal:replace used with unsafe input
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The problem was caused by the following markup::
+
+  <span tal:replace="context/MUMBLE" />
+
+in the head of the ``bug.item.html``, ``task.item.html`` and
+other files in the devel and responsive templates.
+
+This was fixed many years ago in the classic template's
+``index.item.html``. The classic template replaces the above
+construct with::
+
+  <tal:x tal:content="context/MUMBLE" />
+
+``tal:content`` explicitly escapes the result unless the
+``structure`` directive is used. ``tal:replace`` expects the
+result to be safe and usable in an HTML context.
+
+TAL drops any tags that it doesn't know about from the output.
+``<tal:x tal:content="..." />`` results in the value of the
+content expression without a surrounding html tag. (Effectively
+replacing the construct.)
+
+The following diff for ``bug.item.html`` in the devel template
+shows the change to make things safe (remove lines starting with
+``-`` and add lines staring with ``+``)::
+
+     <tal:block metal:use-macro="templates/page/macros/frame">
+     <title metal:fill-slot="head_title">
+     <tal:block condition="context/id" i18n:translate=""
+    - >Bug <span tal:replace="context/id" i18n:name="id"
+    - />: <span tal:replace="context/title" i18n:name="title"
+    - /> - <span tal:replace="config/TRACKER_NAME" i18n:name="tracker"
+    + >Bug <tal:x tal:content="context/id" i18n:name="id"
+    + />: <tal:x tal:content="context/title" i18n:name="title"
+    + /> - <tal:x tal:content="config/TRACKER_NAME" i18n:name="tracker"
+     /></tal:block>
+     <tal:block condition="not:context/id" i18n:translate=""
+      >New Bug report - <span tal:replace="config/TRACKER_NAME" i18n:name="tracker"
+
+A similar change was applied in the following html files in the
+devel or responsive templates:
+
+.. rst-class:: multicol
+
+* _generic.collision.html
+* bug.item.html
+* keyword.item.html
+* milestone.item.html
+* msg.item.html
+* task.item.html
+* user.item.html
+
+Also ``page.html`` should be changed from::
+
+   <p class="label"><b tal:replace="request/user/username">username</b></p>
+
+to::
+
+   <p class="label"><b tal:replace="python:request.user.username.plain(escape=1)">username</b></p>
+
+The code audit found the ``tal:replace`` construct is used with
+``context/id`` and ``context/designator`` paths. The references
+to these paths have been changed to use ``tal:x`` in the classic
+template's ``msg.item.html`` file and the classic and minimal
+template's ``_generic.collision.html`` file.
+
+These paths are critical to navigation in Roundup and are set
+from the path part of the URL. Roundup's URL path validation
+makes it unlikely that an attacker could exploit them. If you
+wish you can change your templates or copy the corresponding
+files from the template if you haven't made local changes.
+
+Also you may have used copies of these insecure templates
+elsewhere in your tracker (e.g. to create a feature class).  To
+find other possible issues you can use the command::
+
+  grep -r "tal:replace=" *.html
+
+in your tracker's :term:`html directory`. Check each occurrence
+and if needed, change it to the safer form. You should consider
+any reference to ``context`` to be under the user's (attacker's)
+control. Also ``db`` (excluding ``db/config``) and ``request``
+references that use user supplied content
+(e.g. ``request/user/username`` above) should be changed to
+``tal:x`` form
+
+.. comment:
+   As part of the analysis, the following command was used to find
+   potentially vulnerable stuff in the templates. Each grep -v was
+   removed to display items in that category and they were checked::
+
+     grep -r 'tal:replace' . | grep -v 'replace="batch' | \
+        grep -v 'replace="config' | grep -v 'replace="db/config' | \
+        grep -v 'replace="structure' | grep -v 'replace="python:' | \
+        grep -v 'replace="request/'
+
+
+   context/id, context/designator:
+     assume safe if used in an class.item.html page as the page
+     wouldn't be shown if they weren't valid numbers/designators.
+
+     Might not be ok referenced in a _generic fallback page though.
+
+   config, db/config, batch, nothing:
+     should be safe as they are not under user control
+
+   request/classname (python:request._classname), request/template:
+     should be safe as they are needed to navigate to a display page,
+     so if they are invalid nothing will be displayed.
+
+   utils, python:
+     assume it's written correctly and is safe (could use some new
+     tests for the shipped utility functions). The intent of these
+     can be to deliver blocks of <script> or other html markup.
+
+   db, request:
+     might be dangerous when accessing user supplied values.
+
+   request/user/username:
+     Escape these. If the username is an XSS issue, an attacker could
+     use it to compromise a user.
+
+   request/dispname:
+     should be quoted and is by the existing python: code.
+
+   Open question: why does there have to be an error generated by the
+   url @sort=1. Without invalid sort param, the exploit url doesn't
+   work and the context appears to use the database's title not the one
+   in the url. Also its not positional @sort=1 can appear anywhere in
+   the url.
 
 Deprecation Notices (required)
 ------------------------------
diff --git a/share/roundup/templates/classic/html/_generic.collision.html b/share/roundup/templates/classic/html/_generic.collision.html
index 2a2768a3d..aa1fe4c66 100644
--- a/share/roundup/templates/classic/html/_generic.collision.html
+++ b/share/roundup/templates/classic/html/_generic.collision.html
@@ -11,6 +11,6 @@
   There has been a collision. Another user updated this node
   while you were editing. Please <a href='${context}'>reload</a>
   the node and review your edits.
-"><span tal:replace="context/designator" i18n:name="context" />
+"><tal:x tal:content="context/designator" i18n:name="context" />
 </td>
 </tal:block>
diff --git a/share/roundup/templates/classic/html/msg.item.html b/share/roundup/templates/classic/html/msg.item.html
index e755174da..eb125ec7e 100644
--- a/share/roundup/templates/classic/html/msg.item.html
+++ b/share/roundup/templates/classic/html/msg.item.html
@@ -2,7 +2,7 @@
 <tal:block metal:use-macro="templates/page/macros/icing">
 <title metal:fill-slot="head_title">
 <tal:block condition="context/id" i18n:translate=""
- >Message <span tal:replace="context/id" i18n:name="id"
+ >Message <tal:x tal:content="context/id" i18n:name="id"
  /> - <span tal:replace="config/TRACKER_NAME" i18n:name="tracker"
 /></tal:block>
 <tal:block condition="not:context/id" i18n:translate=""
diff --git a/share/roundup/templates/devel/html/_generic.collision.html b/share/roundup/templates/devel/html/_generic.collision.html
index a701c5868..4ccacf3d4 100644
--- a/share/roundup/templates/devel/html/_generic.collision.html
+++ b/share/roundup/templates/devel/html/_generic.collision.html
@@ -11,6 +11,6 @@
   There has been a collision. Another user updated this node
   while you were editing. Please <a href='${context}'>reload</a>
   the node and review your edits.
-"><span tal:replace="context/designator" i18n:name="context" />
+"><tal:x tal:content="context/designator" i18n:name="context" />
 </td>
 </tal:block>
diff --git a/share/roundup/templates/devel/html/bug.item.html b/share/roundup/templates/devel/html/bug.item.html
index 3ef539f05..e84e2b707 100644
--- a/share/roundup/templates/devel/html/bug.item.html
+++ b/share/roundup/templates/devel/html/bug.item.html
@@ -1,9 +1,9 @@
 <tal:block metal:use-macro="templates/page/macros/frame">
 <title metal:fill-slot="head_title">
 <tal:block condition="context/id" i18n:translate=""
- >Bug <span tal:replace="context/id" i18n:name="id"
- />: <span tal:replace="context/title" i18n:name="title"
- /> - <span tal:replace="config/TRACKER_NAME" i18n:name="tracker"
+ >Bug <tal:x tal:content="context/id" i18n:name="id"
+ />: <tal:x tal:content="context/title" i18n:name="title"
+ /> - <tal:x tal:content="config/TRACKER_NAME" i18n:name="tracker"
 /></tal:block>
 <tal:block condition="not:context/id" i18n:translate=""
  >New Bug report - <span tal:replace="config/TRACKER_NAME" i18n:name="tracker"
diff --git a/share/roundup/templates/devel/html/keyword.item.html b/share/roundup/templates/devel/html/keyword.item.html
index 22a5fd059..df12b67cc 100644
--- a/share/roundup/templates/devel/html/keyword.item.html
+++ b/share/roundup/templates/devel/html/keyword.item.html
@@ -3,8 +3,8 @@
 >
 <title metal:fill-slot="head_title">
 <tal:if condition="context/id" i18n:translate=""
- >Keyword <span tal:replace="context/id" i18n:name="id"
- />: <span tal:replace="context/name" i18n:name="title"
+ >Keyword <tal:x tal:content="context/id" i18n:name="id"
+ />: <tal:x tal:content="context/name" i18n:name="title"
  /> - <span tal:replace="config/TRACKER_NAME" i18n:name="tracker"
 /></tal:if>
 <tal:if condition="not:context/id" i18n:translate=""
diff --git a/share/roundup/templates/devel/html/milestone.item.html b/share/roundup/templates/devel/html/milestone.item.html
index 1ddb2d3fb..4b3393cbc 100644
--- a/share/roundup/templates/devel/html/milestone.item.html
+++ b/share/roundup/templates/devel/html/milestone.item.html
@@ -2,7 +2,7 @@
 
 <tal:block metal:use-macro="templates/page/macros/frame">
   <tal:block metal:fill-slot="body_title">
-    <p class="header">Milestone<span tal:replace="context/id" /> Editing</p>
+    <p class="header">Milestone<tal:x tal:content="context/id" /> Editing</p>
   </tal:block>
 
   <tal:block metal:fill-slot="content">
diff --git a/share/roundup/templates/devel/html/msg.item.html b/share/roundup/templates/devel/html/msg.item.html
index d19124803..e28ead875 100644
--- a/share/roundup/templates/devel/html/msg.item.html
+++ b/share/roundup/templates/devel/html/msg.item.html
@@ -1,7 +1,7 @@
 <tal:block metal:use-macro="templates/page/macros/frame">
 <title metal:fill-slot="head_title">
 <tal:block condition="context/id" i18n:translate=""
- >Message <span tal:replace="context/id" i18n:name="id"
+ >Message <tal:x tal:content="context/id" i18n:name="id"
  /> - <span tal:replace="config/TRACKER_NAME" i18n:name="tracker"
 /></tal:block>
 <tal:block condition="not:context/id" i18n:translate=""
diff --git a/share/roundup/templates/devel/html/page.html b/share/roundup/templates/devel/html/page.html
index 8f4f2a0c8..7a43b32b4 100644
--- a/share/roundup/templates/devel/html/page.html
+++ b/share/roundup/templates/devel/html/page.html
@@ -190,7 +190,7 @@ <h1><a href="/">Roundup Demo Tracker</a></h1>
       </form>
      </li>
      <li tal:condition="python:request.user.username != 'anonymous'" class="submenu">
-      <p class="label"><b tal:replace="request/user/username">username</b></p>
+      <p class="label"><b tal:replace="python:request.user.username.plain(escape=1)">username</b></p>
       <ul>
        <li>
         <a href="#" tal:attributes="href python:request.indexargs_url('bug', {
diff --git a/share/roundup/templates/devel/html/task.item.html b/share/roundup/templates/devel/html/task.item.html
index 0d832287a..55535f6cf 100644
--- a/share/roundup/templates/devel/html/task.item.html
+++ b/share/roundup/templates/devel/html/task.item.html
@@ -1,9 +1,9 @@
 <tal:block metal:use-macro="templates/page/macros/frame">
 <title metal:fill-slot="head_title">
 <tal:block condition="context/id" i18n:translate=""
- >Task <span tal:replace="context/id" i18n:name="id"
- />: <span tal:replace="context/title" i18n:name="title"
- /> - <span tal:replace="config/TRACKER_NAME" i18n:name="tracker"
+ >Task <tal:x tal:content="context/id" i18n:name="id"
+ />: <tal:x tal:content="context/title" i18n:name="title"
+ /> - <tal:x tal:content="config/TRACKER_NAME" i18n:name="tracker"
 /></tal:block>
 <tal:block condition="not:context/id" i18n:translate=""
  >New Task - <span tal:replace="config/TRACKER_NAME" i18n:name="tracker"
diff --git a/share/roundup/templates/devel/html/user.item.html b/share/roundup/templates/devel/html/user.item.html
index e53e28802..2132a8d13 100644
--- a/share/roundup/templates/devel/html/user.item.html
+++ b/share/roundup/templates/devel/html/user.item.html
@@ -3,8 +3,8 @@
 >
 <title metal:fill-slot="head_title">
 <tal:if condition="context/id" i18n:translate=""
- >User <span tal:replace="context/id" i18n:name="id"
- />: <span tal:replace="context/username" i18n:name="title"
+ >User <tal:x tal:content="context/id" i18n:name="id"
+ />: <tal:x tal:content="context/username" i18n:name="title"
  /> - <span tal:replace="config/TRACKER_NAME" i18n:name="tracker"
 /></tal:if>
 <tal:if condition="not:context/id" i18n:translate=""
diff --git a/share/roundup/templates/minimal/html/_generic.collision.html b/share/roundup/templates/minimal/html/_generic.collision.html
index 2a2768a3d..aa1fe4c66 100644
--- a/share/roundup/templates/minimal/html/_generic.collision.html
+++ b/share/roundup/templates/minimal/html/_generic.collision.html
@@ -11,6 +11,6 @@
   There has been a collision. Another user updated this node
   while you were editing. Please <a href='${context}'>reload</a>
   the node and review your edits.
-"><span tal:replace="context/designator" i18n:name="context" />
+"><tal:x tal:content="context/designator" i18n:name="context" />
 </td>
 </tal:block>
diff --git a/share/roundup/templates/responsive/html/_generic.collision.html b/share/roundup/templates/responsive/html/_generic.collision.html
index a701c5868..4ccacf3d4 100644
--- a/share/roundup/templates/responsive/html/_generic.collision.html
+++ b/share/roundup/templates/responsive/html/_generic.collision.html
@@ -11,6 +11,6 @@
   There has been a collision. Another user updated this node
   while you were editing. Please <a href='${context}'>reload</a>
   the node and review your edits.
-"><span tal:replace="context/designator" i18n:name="context" />
+"><tal:x tal:content="context/designator" i18n:name="context" />
 </td>
 </tal:block>
diff --git a/share/roundup/templates/responsive/html/bug.item.html b/share/roundup/templates/responsive/html/bug.item.html
index c5bc6f247..d036d96bd 100644
--- a/share/roundup/templates/responsive/html/bug.item.html
+++ b/share/roundup/templates/responsive/html/bug.item.html
@@ -1,9 +1,9 @@
 <tal:block metal:use-macro="templates/page/macros/frame">
 <title metal:fill-slot="head_title">
 <tal:block condition="context/id" i18n:translate=""
- >Bug <span tal:replace="context/id" i18n:name="id"
- />: <span tal:replace="context/title" i18n:name="title"
- /> - <span tal:replace="config/TRACKER_NAME" i18n:name="tracker"
+ >Bug <tal:x tal:content="context/id" i18n:name="id"
+ />: <tal:x tal:content="context/title" i18n:name="title"
+ /> - <tal:x tal:content="config/TRACKER_NAME" i18n:name="tracker"
 /></tal:block>
 <tal:block condition="not:context/id" i18n:translate=""
  >New Bug report - <span tal:replace="config/TRACKER_NAME" i18n:name="tracker"
diff --git a/share/roundup/templates/responsive/html/keyword.item.html b/share/roundup/templates/responsive/html/keyword.item.html
index 22a5fd059..df12b67cc 100644
--- a/share/roundup/templates/responsive/html/keyword.item.html
+++ b/share/roundup/templates/responsive/html/keyword.item.html
@@ -3,8 +3,8 @@
 >
 <title metal:fill-slot="head_title">
 <tal:if condition="context/id" i18n:translate=""
- >Keyword <span tal:replace="context/id" i18n:name="id"
- />: <span tal:replace="context/name" i18n:name="title"
+ >Keyword <tal:x tal:content="context/id" i18n:name="id"
+ />: <tal:x tal:content="context/name" i18n:name="title"
  /> - <span tal:replace="config/TRACKER_NAME" i18n:name="tracker"
 /></tal:if>
 <tal:if condition="not:context/id" i18n:translate=""
diff --git a/share/roundup/templates/responsive/html/milestone.item.html b/share/roundup/templates/responsive/html/milestone.item.html
index b27858853..8ca3eb5f7 100644
--- a/share/roundup/templates/responsive/html/milestone.item.html
+++ b/share/roundup/templates/responsive/html/milestone.item.html
@@ -1,6 +1,6 @@
 <tal:block metal:use-macro="templates/page/macros/frame">
   <tal:block metal:fill-slot="body_title">
-    <p class="header">Milestone<span tal:replace="context/id" /> Editing</p>
+    <p class="header">Milestone<tal:x tal:content="context/id" /> Editing</p>
   </tal:block>
 
   <tal:block metal:fill-slot="content">
diff --git a/share/roundup/templates/responsive/html/msg.item.html b/share/roundup/templates/responsive/html/msg.item.html
index bbc8ad9e1..47ff6e2b1 100644
--- a/share/roundup/templates/responsive/html/msg.item.html
+++ b/share/roundup/templates/responsive/html/msg.item.html
@@ -1,7 +1,7 @@
 <tal:block metal:use-macro="templates/page/macros/frame">
 <title metal:fill-slot="head_title">
 <tal:block condition="context/id" i18n:translate=""
- >Message <span tal:replace="context/id" i18n:name="id"
+ >Message <tal:x tal:content="context/id" i18n:name="id"
  /> - <span tal:replace="config/TRACKER_NAME" i18n:name="tracker"
 /></tal:block>
 <tal:block condition="not:context/id" i18n:translate=""
diff --git a/share/roundup/templates/responsive/html/page.html b/share/roundup/templates/responsive/html/page.html
index 1b2721ed3..7651c2af1 100644
--- a/share/roundup/templates/responsive/html/page.html
+++ b/share/roundup/templates/responsive/html/page.html
@@ -208,7 +208,7 @@
          </div>
          <div tal:condition="python:request.user.username != 'anonymous'" class="submenu">
           <ul class='nav nav-list'>
-            <li class="nav-header"><i class='icon-user'></i><b tal:replace="request/user/username">username</b></li>
+            <li class="nav-header"><i class='icon-user'></i><b tal:replace="python:request.user.username.plain(escape=1)">username</b></li>
             <li>
               <a href="#" tal:attributes="href python:request.indexargs_url('bug', {
                                          '@sort': '-activity',
diff --git a/share/roundup/templates/responsive/html/task.item.html b/share/roundup/templates/responsive/html/task.item.html
index 68a02bd88..67c3b295c 100644
--- a/share/roundup/templates/responsive/html/task.item.html
+++ b/share/roundup/templates/responsive/html/task.item.html
@@ -1,9 +1,9 @@
 <tal:block metal:use-macro="templates/page/macros/frame">
 <title metal:fill-slot="head_title">
 <tal:block condition="context/id" i18n:translate=""
- >Task <span tal:replace="context/id" i18n:name="id"
- />: <span tal:replace="context/title" i18n:name="title"
- /> - <span tal:replace="config/TRACKER_NAME" i18n:name="tracker"
+ >Task <tal:x tal:content="context/id" i18n:name="id"
+ />: <tal:x tal:content="context/title" i18n:name="title"
+ /> - <tal:x tal:content="config/TRACKER_NAME" i18n:name="tracker"
 /></tal:block>
 <tal:block condition="not:context/id" i18n:translate=""
  >New Task - <span tal:replace="config/TRACKER_NAME" i18n:name="tracker"
diff --git a/share/roundup/templates/responsive/html/user.item.html b/share/roundup/templates/responsive/html/user.item.html
index e53e28802..2132a8d13 100644
--- a/share/roundup/templates/responsive/html/user.item.html
+++ b/share/roundup/templates/responsive/html/user.item.html
@@ -3,8 +3,8 @@
 >
 <title metal:fill-slot="head_title">
 <tal:if condition="context/id" i18n:translate=""
- >User <span tal:replace="context/id" i18n:name="id"
- />: <span tal:replace="context/username" i18n:name="title"
+ >User <tal:x tal:content="context/id" i18n:name="id"
+ />: <tal:x tal:content="context/username" i18n:name="title"
  /> - <span tal:replace="config/TRACKER_NAME" i18n:name="tracker"
 /></tal:if>
 <tal:if condition="not:context/id" i18n:translate=""
diff --git a/website/issues/html/_generic.collision.html b/website/issues/html/_generic.collision.html
index 2a2768a3d..aa1fe4c66 100644
--- a/website/issues/html/_generic.collision.html
+++ b/website/issues/html/_generic.collision.html
@@ -11,6 +11,6 @@
   There has been a collision. Another user updated this node
   while you were editing. Please <a href='${context}'>reload</a>
   the node and review your edits.
-"><span tal:replace="context/designator" i18n:name="context" />
+"><tal:x tal:content="context/designator" i18n:name="context" />
 </td>
 </tal:block>
diff --git a/website/issues/html/issue.item.html b/website/issues/html/issue.item.html
index d9504abe5..92d1af6b9 100644
--- a/website/issues/html/issue.item.html
+++ b/website/issues/html/issue.item.html
@@ -1,9 +1,9 @@
 <tal:block metal:use-macro="templates/page/macros/icing">
 <title metal:fill-slot="head_title">
 <tal:block condition="context/id" i18n:translate=""
- >Issue <span tal:replace="context/id" i18n:name="id"
- />: <span tal:replace="context/title" i18n:name="title"
- /> - <span tal:replace="config/TRACKER_NAME" i18n:name="tracker"
+ >Issue <tal:x tal:content="context/id" i18n:name="id"
+ />: <tal:x tal:content="context/title" i18n:name="title"
+ /> - <tal:x tal:content="config/TRACKER_NAME" i18n:name="tracker"
 /></tal:block>
 <tal:block condition="not:context/id" i18n:translate=""
  >New Issue - <span tal:replace="config/TRACKER_NAME" i18n:name="tracker"
@@ -127,7 +127,7 @@
   </select>
  </td>
  <td tal:condition="not:context/assignee/is_edit_ok">
-  <span tal:replace="context/assignee/plain" />
+  <tal:x tal:content="context/assignee/plain" />
  </td>
  <th><label for="nosy" i18n:translate="">Nosy List</label>:
   <span tal:condition="context/nosy/is_edit_ok"
diff --git a/website/issues/html/msg.item.html b/website/issues/html/msg.item.html
index e96791321..f8f5d96b0 100644
--- a/website/issues/html/msg.item.html
+++ b/website/issues/html/msg.item.html
@@ -1,7 +1,8 @@
+<!-- dollarId: msg.item,v 1.3 2002/05/22 00:32:34 richard Exp dollar-->
 <tal:block metal:use-macro="templates/page/macros/icing">
 <title metal:fill-slot="head_title">
 <tal:block condition="context/id" i18n:translate=""
- >Message <span tal:replace="context/id" i18n:name="id"
+ >Message <tal:x tal:content="context/id" i18n:name="id"
  /> - <span tal:replace="config/TRACKER_NAME" i18n:name="tracker"
 /></tal:block>
 <tal:block condition="not:context/id" i18n:translate=""
diff --git a/website/issues/html/user.item.html b/website/issues/html/user.item.html
index 0d82dbee9..0ec5d2258 100644
--- a/website/issues/html/user.item.html
+++ b/website/issues/html/user.item.html
@@ -3,9 +3,9 @@
 >
 <title metal:fill-slot="head_title">
 <tal:if condition="context/id" i18n:translate=""
- >User <span tal:replace="context/id" i18n:name="id"
- />: <span tal:replace="context/username" i18n:name="title"
- /> - <span tal:replace="config/TRACKER_NAME" i18n:name="tracker"
+ >User <tal:x tal:content="context/id" i18n:name="id"
+ />: <tal:x tal:content="context/username" i18n:name="title"
+ /> - <tal:x tal:content="config/TRACKER_NAME" i18n:name="tracker"
 /></tal:if>
 <tal:if condition="not:context/id" i18n:translate=""
  >New User - <span tal:replace="config/TRACKER_NAME" i18n:name="tracker"

From 8d4819d4d2d598bf7f8054d684076ba80db04ea1 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Fri, 11 Jul 2025 22:19:35 -0400
Subject: [PATCH 225/398] chore: update locale files for release.

---
 locale/de.po       | 2 +-
 locale/en.po       | 2 +-
 locale/es.po       | 2 +-
 locale/fr.po       | 2 +-
 locale/hu.po       | 2 +-
 locale/it.po       | 2 +-
 locale/ja.po       | 2 +-
 locale/lt.po       | 2 +-
 locale/nb.po       | 2 +-
 locale/roundup.pot | 4 ++--
 locale/ru.po       | 2 +-
 locale/zh_CN.po    | 2 +-
 locale/zh_TW.po    | 2 +-
 13 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/locale/de.po b/locale/de.po
index 5ec70f049..7b94e3167 100644
--- a/locale/de.po
+++ b/locale/de.po
@@ -5,7 +5,7 @@
 #
 msgid ""
 msgstr ""
-"Project-Id-Version: Roundup 2.5.0b1\n"
+"Project-Id-Version: Roundup 2.5.0\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
 "POT-Creation-Date: 2025-06-11 16:02-0400\n"
 "PO-Revision-Date: 2016-04-11 09:13+0200\n"
diff --git a/locale/en.po b/locale/en.po
index dfa00c7bb..dbc009788 100644
--- a/locale/en.po
+++ b/locale/en.po
@@ -9,7 +9,7 @@
 #
 msgid ""
 msgstr ""
-"Project-Id-Version: Roundup 2.5.0b1\n"
+"Project-Id-Version: Roundup 2.5.0\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
 "POT-Creation-Date: 2025-06-11 16:02-0400\n"
 "PO-Revision-Date: 2004-11-20 13:47+0200\n"
diff --git a/locale/es.po b/locale/es.po
index 8c428b241..90b283994 100644
--- a/locale/es.po
+++ b/locale/es.po
@@ -5,7 +5,7 @@
 #
 msgid ""
 msgstr ""
-"Project-Id-Version: Roundup 2.5.0b1\n"
+"Project-Id-Version: Roundup 2.5.0\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
 "POT-Creation-Date: 2025-06-11 16:02-0400\n"
 "PO-Revision-Date: 2013-10-31 10:45+0100\n"
diff --git a/locale/fr.po b/locale/fr.po
index b6b0c25ed..69d6d98a8 100644
--- a/locale/fr.po
+++ b/locale/fr.po
@@ -8,7 +8,7 @@
 #
 msgid ""
 msgstr ""
-"Project-Id-Version: Roundup 2.5.0b1\n"
+"Project-Id-Version: Roundup 2.5.0\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
 "POT-Creation-Date: 2025-06-11 16:02-0400\n"
 "PO-Revision-Date: 2013-10-31 12:19+0100\n"
diff --git a/locale/hu.po b/locale/hu.po
index 91f2ebe4b..38f0919a0 100644
--- a/locale/hu.po
+++ b/locale/hu.po
@@ -6,7 +6,7 @@
 # kilo aka Gabor Kmetyko <kg_kilo@freemail.hu>, 2007.
 msgid ""
 msgstr ""
-"Project-Id-Version: Roundup 2.5.0b1\n"
+"Project-Id-Version: Roundup 2.5.0\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
 "POT-Creation-Date: 2025-06-11 16:02-0400\n"
 "PO-Revision-Date: 2013-10-31 12:19+0100\n"
diff --git a/locale/it.po b/locale/it.po
index eb8e85bb5..b8c2f9e61 100644
--- a/locale/it.po
+++ b/locale/it.po
@@ -5,7 +5,7 @@
 #
 msgid ""
 msgstr ""
-"Project-Id-Version: Roundup 2.5.0b1\n"
+"Project-Id-Version: Roundup 2.5.0\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
 "POT-Creation-Date: 2025-06-11 16:02-0400\n"
 "PO-Revision-Date: 2013-10-31 12:20+0100\n"
diff --git a/locale/ja.po b/locale/ja.po
index 43d38610e..4bf7f1dcd 100644
--- a/locale/ja.po
+++ b/locale/ja.po
@@ -5,7 +5,7 @@
 #
 msgid ""
 msgstr ""
-"Project-Id-Version: Roundup 2.5.0b1\n"
+"Project-Id-Version: Roundup 2.5.0\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
 "POT-Creation-Date: 2025-06-11 16:02-0400\n"
 "PO-Revision-Date: 2013-10-31 12:20+0100\n"
diff --git a/locale/lt.po b/locale/lt.po
index 5665ce4dd..42fbee1f3 100644
--- a/locale/lt.po
+++ b/locale/lt.po
@@ -5,7 +5,7 @@
 #
 msgid ""
 msgstr ""
-"Project-Id-Version: Roundup 2.5.0b1\n"
+"Project-Id-Version: Roundup 2.5.0\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
 "POT-Creation-Date: 2025-06-11 16:02-0400\n"
 "PO-Revision-Date: 2013-10-31 12:21+0100\n"
diff --git a/locale/nb.po b/locale/nb.po
index 14e26e50c..93d3a9c94 100644
--- a/locale/nb.po
+++ b/locale/nb.po
@@ -5,7 +5,7 @@
 #
 msgid ""
 msgstr ""
-"Project-Id-Version: Roundup 2.5.0b1\n"
+"Project-Id-Version: Roundup 2.5.0\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
 "POT-Creation-Date: 2025-06-11 16:02-0400\n"
 "PO-Revision-Date: 2013-10-31 12:21+0100\n"
diff --git a/locale/roundup.pot b/locale/roundup.pot
index fd2af050f..bb29ad757 100644
--- a/locale/roundup.pot
+++ b/locale/roundup.pot
@@ -6,9 +6,9 @@
 #, fuzzy
 msgid ""
 msgstr ""
-"Project-Id-Version: Roundup 2.5.0b1\n"
+"Project-Id-Version: Roundup 2.5.0\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
-"POT-Creation-Date: 2025-06-11 16:53-0400\n"
+"POT-Creation-Date: 2025-07-11 20:04-0400\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
diff --git a/locale/ru.po b/locale/ru.po
index bbc8bdc8e..dd02c6d7e 100644
--- a/locale/ru.po
+++ b/locale/ru.po
@@ -5,7 +5,7 @@
 #
 msgid ""
 msgstr ""
-"Project-Id-Version: Roundup 2.5.0b1\n"
+"Project-Id-Version: Roundup 2.5.0\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
 "POT-Creation-Date: 2025-06-11 16:02-0400\n"
 "PO-Revision-Date: 2013-10-31 12:21+0100\n"
diff --git a/locale/zh_CN.po b/locale/zh_CN.po
index 2e2b80191..489381930 100644
--- a/locale/zh_CN.po
+++ b/locale/zh_CN.po
@@ -6,7 +6,7 @@
 #
 msgid ""
 msgstr ""
-"Project-Id-Version: Roundup 2.5.0b1\n"
+"Project-Id-Version: Roundup 2.5.0\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
 "POT-Creation-Date: 2025-06-11 16:02-0400\n"
 "PO-Revision-Date: 2013-10-31 12:22+0100\n"
diff --git a/locale/zh_TW.po b/locale/zh_TW.po
index ab9087944..bb3943463 100644
--- a/locale/zh_TW.po
+++ b/locale/zh_TW.po
@@ -5,7 +5,7 @@
 #
 msgid ""
 msgstr ""
-"Project-Id-Version: Roundup 2.5.0b1\n"
+"Project-Id-Version: Roundup 2.5.0\n"
 "Report-Msgid-Bugs-To: roundup-devel@lists.sourceforge.net\n"
 "POT-Creation-Date: 2025-06-11 16:02-0400\n"
 "PO-Revision-Date: 2013-10-31 12:23+0100\n"

From 3b1f22f331d4798491bd4746dbaaa6cfbe972952 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Fri, 11 Jul 2025 22:22:08 -0400
Subject: [PATCH 226/398] doc: add XSS discoverer to ack

---
 doc/acknowledgements.txt | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/acknowledgements.txt b/doc/acknowledgements.txt
index ab6840b6f..13e871ca3 100644
--- a/doc/acknowledgements.txt
+++ b/doc/acknowledgements.txt
@@ -46,6 +46,8 @@ Randy - reported issue 2551396
 
 Tobias Herp - patch for issue 1895197
 
+4bug of ChaMd5 Security Team H1 Group - XSS vulnerability report
+
 2.4
 ---
 

From 96452cd38fc316f7aa41c825e36e5735bd19bd9b Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Fri, 11 Jul 2025 22:24:51 -0400
Subject: [PATCH 227/398] build - fix issue with secret_key substitution in
 tracker config.

The build system replaces the tracker config's etag key with a static
value to prevent churn every time the config is built.

The replacement wasn't working because of a missing character in the regexp.
---
 doc/format_config.awk | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/format_config.awk b/doc/format_config.awk
index 866ac2254..6886a6e35 100644
--- a/doc/format_config.awk
+++ b/doc/format_config.awk
@@ -6,8 +6,8 @@ NR < 9 {next}
 
 # To prevent new file generation from causing the secret_key to
 # change, we replace the secret key with a fixed value.
-/^# Default: [0-9A-z+=]{44}/ {sub(/[0-9A-z+=]{44}/, SECRET_KEY)}
-/^secret_key = [0-9A-z+=]{44}/ {sub(/[0-9A-z+=]{44}/, SECRET_KEY)}
+/^# Default: [0-9A-z+=/]{44}/ {sub(/[0-9A-z+=/]{44}/, SECRET_KEY)}
+/^secret_key = [0-9A-z+=/]{44}/ {sub(/[0-9A-Za-z+=/]{44}/, SECRET_KEY)}
 
 # When we see a section [label]:
 #  emit section index marker,

From d1b561317d301e48989f6d1b9322e3eb8013ed5c Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Fri, 11 Jul 2025 22:25:54 -0400
Subject: [PATCH 228/398] build: add autodoc to sphinx extension list

Build python class docs for packaged docs.
---
 doc/conf.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/conf.py b/doc/conf.py
index c46ccc021..7dc41f5d7 100644
--- a/doc/conf.py
+++ b/doc/conf.py
@@ -51,7 +51,7 @@
 # extensions coming with Sphinx (named 'sphinx.ext.*') or your custom
 # ones.
 #extensions = ['toctree']
-extensions = ['sphinx_tabs.tabs']
+extensions = ['sphinx_tabs.tabs', 'sphinx.ext.autodoc']
 
 sphinx_tabs_valid_builders = ['linkcheck']
 sphinx_tabs_disable_tab_closing = True

From 28af5af9ebbc8673ec5fbd3926709e2d90f29750 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Fri, 11 Jul 2025 22:26:46 -0400
Subject: [PATCH 229/398] doc: update/clarify verifcation directions.

---
 doc/security.txt | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/doc/security.txt b/doc/security.txt
index 819c8e05d..95efcfedd 100644
--- a/doc/security.txt
+++ b/doc/security.txt
@@ -164,10 +164,10 @@ You should see::
   gpg:          There is no indication that the signature belongs to the owner.
   Primary key fingerprint: 411E 354B 5D1A F261 25D6  2122 1F2D D0CB 756A 76D8
 
-which verifies the tarball integrity. The WARNING is expected and the
-date corresponds to the newest renewal of the Roundup key. As long as
-you see the output starting with "Good signature from" followed by the
-Key Info for your key, everything is OK.
+which verifies the tarball integrity. The WARNING is expected.
+The date should be close to the release date of the version of Roundup.
+As long as you see the output starting with "Good signature from"
+followed by the Key Info above, everything is OK.
 
 If something is wrong you will see::
 

From be9e1ffffe517c786dc31b2b49831135fe83dfa1 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Fri, 11 Jul 2025 22:27:18 -0400
Subject: [PATCH 230/398] doc: link to security page for link to formal CVE
 report.

---
 doc/upgrading.txt | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/doc/upgrading.txt b/doc/upgrading.txt
index 827fb3a5f..13cd1d4bd 100644
--- a/doc/upgrading.txt
+++ b/doc/upgrading.txt
@@ -119,6 +119,9 @@ There are actually two different issues under this heading.
      ``tal:content``
   2. use of ``tal:replace`` on unsafe input
 
+See the `security page for a link to CVE-2025-53865
+<security.html#cve-announcements>`_.
+
 In the discussion below, the :term:`html directory` means one or
 more directories listed in the ``templates`` key of your
 tracker's ``config.ini`` file.

From 517a354ef01cc36e2088374eef88b944fb6b3c01 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Fri, 11 Jul 2025 22:27:59 -0400
Subject: [PATCH 231/398] doc: rebuild man pages. No changes.

---
 doc/html_extra/man_pages/roundup-admin.1.html  | 2 +-
 doc/html_extra/man_pages/roundup-demo.1.html   | 2 +-
 doc/html_extra/man_pages/roundup-mailgw.1.html | 2 +-
 doc/html_extra/man_pages/roundup-server.1.html | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/doc/html_extra/man_pages/roundup-admin.1.html b/doc/html_extra/man_pages/roundup-admin.1.html
index 6a6b83b87..5704aea0c 100644
--- a/doc/html_extra/man_pages/roundup-admin.1.html
+++ b/doc/html_extra/man_pages/roundup-admin.1.html
@@ -1,5 +1,5 @@
 <!-- Creator     : groff version 1.22.4 -->
-<!-- CreationDate: Thu Oct 17 23:16:02 2024 -->
+<!-- CreationDate: Sat Jul 12 02:21:20 2025 -->
 <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
 "http://www.w3.org/TR/html4/loose.dtd">
 <html>
diff --git a/doc/html_extra/man_pages/roundup-demo.1.html b/doc/html_extra/man_pages/roundup-demo.1.html
index 9d763f470..a8044c140 100644
--- a/doc/html_extra/man_pages/roundup-demo.1.html
+++ b/doc/html_extra/man_pages/roundup-demo.1.html
@@ -1,5 +1,5 @@
 <!-- Creator     : groff version 1.22.4 -->
-<!-- CreationDate: Thu Oct 17 23:16:03 2024 -->
+<!-- CreationDate: Sat Jul 12 02:21:20 2025 -->
 <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
 "http://www.w3.org/TR/html4/loose.dtd">
 <html>
diff --git a/doc/html_extra/man_pages/roundup-mailgw.1.html b/doc/html_extra/man_pages/roundup-mailgw.1.html
index defa46519..833ceb08b 100644
--- a/doc/html_extra/man_pages/roundup-mailgw.1.html
+++ b/doc/html_extra/man_pages/roundup-mailgw.1.html
@@ -1,5 +1,5 @@
 <!-- Creator     : groff version 1.22.4 -->
-<!-- CreationDate: Thu Oct 17 23:16:02 2024 -->
+<!-- CreationDate: Sat Jul 12 02:21:20 2025 -->
 <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
 "http://www.w3.org/TR/html4/loose.dtd">
 <html>
diff --git a/doc/html_extra/man_pages/roundup-server.1.html b/doc/html_extra/man_pages/roundup-server.1.html
index f0468f2c1..c821050f8 100644
--- a/doc/html_extra/man_pages/roundup-server.1.html
+++ b/doc/html_extra/man_pages/roundup-server.1.html
@@ -1,5 +1,5 @@
 <!-- Creator     : groff version 1.22.4 -->
-<!-- CreationDate: Sun Jan 12 22:28:09 2025 -->
+<!-- CreationDate: Sat Jul 12 02:21:20 2025 -->
 <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
 "http://www.w3.org/TR/html4/loose.dtd">
 <html>

From 035e4b089024659ebb2c0b3604cca5c5bf8f8d3b Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Fri, 11 Jul 2025 22:28:57 -0400
Subject: [PATCH 232/398] doc: update to reflect changes 2.4.0 -> 2.5.0.

did have 2.3.0 -> 2.4.0.
---
 website/www/index.txt | 141 ++++++++++++++++++++++--------------------
 1 file changed, 73 insertions(+), 68 deletions(-)

diff --git a/website/www/index.txt b/website/www/index.txt
index f96621798..6173f1312 100644
--- a/website/www/index.txt
+++ b/website/www/index.txt
@@ -32,10 +32,10 @@ Roundup Issue Tracker
 
      <!-- supported python versions: <img src="https://shields.io/pypi/pyversions/roundup"> -->
      <!-- license: <img src="https://img.shields.io/pypi/l/roundup"> -->
-     <!-- changes since 2.4.0 <img src="https://img.shields.io/github/commits-since/roundup-tracker/roundup/2.4.0/master?sort=semver"> -->
+     <!-- changes since 2.5.0 <img src="https://img.shields.io/github/commits-since/roundup-tracker/roundup/2.5.0/master?sort=semver"> -->
      <!-- status beta, stable, mature.... <img src="https://img.shields.io/pypi/status/roundup"> -->
      <!-- mozilla observatory <img src="https://img.shields.io/mozilla-observatory/grade/www.roundup-tracker.org?publish"> -->
-     <!-- commits from last named release: <img alt="GitHub commits difference between two branches/tags/commits" src="https://img.shields.io/github/commits-difference/roundup-tracker/roundup?base=2.4.0&head=master">a -->
+     <!-- commits from last named release: <img alt="GitHub commits difference between two branches/tags/commits" src="https://img.shields.io/github/commits-difference/roundup-tracker/roundup?base=2.5.0&head=master">a -->
      <!-- newest tag by date - use for alpha/beta release notifications?
      <img alt="GitHub tag (latest by date)" src="https://img.shields.io/github/v/tag/roundup-tracker/roundup"> -->
 
@@ -79,10 +79,10 @@ in the Software Carpentry â€œTrackâ€ design competition.
 Roundup is highly customizable, allowing users to tailor the system to
 their specific needs and preferences.
 
-The latest stable version of Roundup is 2.4.0, which includes bug
-fixes and additional features compared to the previous 2.3.0 release.
+The latest stable version of Roundup is 2.5.0, which includes bug
+fixes and additional features compared to the previous 2.4.0 release.
 
-Roundup is compatible with Python 2.7.12+ or 3.6+.
+Roundup is compatible with Python 3.7+.
 
 .. admonition:: Python 2 Support
 
@@ -96,69 +96,74 @@ Roundup is compatible with Python 2.7.12+ or 3.6+.
 Release Highlights
 ==================
 
-Some improvements from the 2.3.0 release are:
-
-* three CVE's have been fixed. One requires changes to your
-  tracker's home directory. The other two are fixed by
-  installing 2.4.0.  See
-  https://www.roundup-tracker.org/docs/security.html for
-  details and instructions on how to fix these in 2.4.0 and
-  earlier releases.
-
-* new classhelper component thanks to a team of students
-  from CS682 at U-Mass Boston. This fixes many issues with
-  the old classhelper. It is implemented as a web-component
-  and needs REST interface access. It will fall back to the
-  classic classhelper if REST is not available or if the
-  browser does not support web-components.
-
-* fix Windows Python installation using pip. It used to go
-  into an infinite loop during install or download. Also fix
-  installation of shared files (templates) so roundup-admin
-  can find them.
-
-* using ``@current_user`` as a value in a search URL for a
-  user property will use the current logged in user. Now you
-  can share searches like: "My issues" as "my" will become
-  the current logged in user.
-
-* login failures to the REST/XML-RPC interfaces are now rate
-  limited to limit password guessing attacks.
-
-* utf8mb4 is the default charset for MySQL. This requires
-  migrating your database using the mysql client. You can
-  choose to keep the older character set in config.ini.
-
-* PostgreSQL services defined in pg_service.conf can be
-  used.  PostgreSQL schemas are supported to eliminate the
-  need for the roundup user to have database
-  creation/deletion privileges.
-
-* fix out of memory issue when importing larger trackers
-  into PostgreSQL.
-
-* multiple roundup-admin improvements: display protected
-  properties (like creation date), better formatting of
-  output, command history. Also on windows, pyreadline3 is
-  supported to provide an editable interactive command line.
-
-* an experimental wsgi performance improvement in 2.3.0 is
-  now now the default and is opt-out.
-
-* new template functions: utils.readfile and
-  utils.expandfile. Javascript that is included in the
-  Python core will be moved to external files and be able to
-  have values from Roundup substituted in the Javascript.
-
-* allow content-type of a template to be set from inside the
-  template.  This allows returning json or xml from a
-  template without a .json or .xml extention.
-
-* fix import/export on windows to use Unix style line
-  endings fixing export/import on Windows and making exports
-  portable across platforms.
-
-More info on the 79 changes can be found in the `change notes`_.
+Some improvements from the 2.4.0 release are:
+
+* **XSS vulnerability with devel and responsive templates fixed**
+
+  Just before release an XSS security issue with trackers based on
+  the devel or responsive templates was discovered. The `updating
+  directions`_ include instructions on fixing this issue with the
+  html templates from earlier releases. (CVE-2025-53865)
+
+  .. _`updating directions`: docs/upgrading.html#cve-2025-53865
+
+* **The property/field advanced search expression feature has been
+  enhanced and documented.**
+
+  Search expressions are usually built using the
+  expression editor on the search page. They can be built manually
+  by modifying the search URL but the RPN search expression format
+  was undocumented. Errors in expressions could return results that
+  didn't match the user's intent. This release documents the RPN
+  expression syntax, adds basic expression error detection, and
+  improves error reporting.
+
+* **The default hash method for password storage is more secure.**
+
+  We use PBKDF2 with SHA512 (was SHA1). With this change you can
+  lower the value of password_pbkdf2_default_rounds in your
+  tracker's config.ini. Check the upgrading documentation for more
+  info. (Note this may cause longer authentication times, the
+  upgrade doc describes how to downgrade the hash method if required.)
+
+* **Roundup's session token is now prefixed with the magic
+  ``__Secure__`` tag when using HTTPS.**
+
+  This adds another layer of protection in addition to the
+  existing ``Secure`` property that comes with the session cookie.
+
+* **Data authorization can be done at the database level speeding up
+  display of index pages.**
+
+  Roundup verifies the user's authorization for the data fetched
+  from the database after retrieving data from the database. A new
+  optional ``filter`` argument has been added to Permission
+  objects. When the administrator supplies a filter function, it
+  can boost performance with SQL server databases by pushing
+  selection criteria to the database. By offloading some
+  permission checks to the database, less data is retrieved from
+  the database. This leads to quicker display of index pages with
+  reduced CPU and network traffic.
+
+* **The REST endpoint can supply binary data (images, pdf, ...) to
+  its clients.**
+
+  Requesting binary data from a REST endpoint has been a
+  hassle. Since JSON can't handle binary data, images (and other
+  binary data) need to be encoded. This makes them significantly
+  larger. The workaround was to use a non-REST endpoint for fetching
+  non-text attachments. This update lets the REST endpoint return
+  raw message or file content data. You can utilize the
+  ``binary_content`` endpoint along with an appropriate ``Accept``
+  header (e.g. ``image/jpeg``) in your request.
+
+* **Extract translatable strings from your tracker easily.**
+
+  The ``roundup-gettext`` tool has been enhanced to extract
+  translatable strings from detectors and extensions. This will
+  simplify the process of translating your trackers.
+
+More info on the 42 changes can be found in the `change notes`_.
 
 Roundup Use Cases
 =================

From dcdbe649f54a463c62507bbca1c436671e89dbc9 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Fri, 11 Jul 2025 22:29:49 -0400
Subject: [PATCH 233/398] build: linkcheck tripping rate limits.

Tell linkcheck to respect rate limits by delaying by a server
specified delay.
---
 website/www/conf.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/website/www/conf.py b/website/www/conf.py
index a6afc70d6..a40777425 100644
--- a/website/www/conf.py
+++ b/website/www/conf.py
@@ -259,3 +259,6 @@
 ]
 
 linkcheck_timeout = 10  # seconds
+
+# getting 429 on www.gnu.org
+linkcheck_retry_on_rate_limit = True

From 9ebc71914f14289540a5f7a4cc902f126212b1be Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Fri, 11 Jul 2025 22:30:07 -0400
Subject: [PATCH 234/398] build: update roundup version string.

---
 scripts/Docker/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/Docker/Dockerfile b/scripts/Docker/Dockerfile
index e00350d10..7ab539823 100644
--- a/scripts/Docker/Dockerfile
+++ b/scripts/Docker/Dockerfile
@@ -233,7 +233,7 @@ ARG pip_mod
 LABEL "org.opencontainers.image.vendor"="Roundup Issue Tracker Team" \
       "org.opencontainers.image.title"="Roundup Issue Tracker" \
       "org.opencontainers.image.description"="Roundup Issue Tracker with multi-backend support installed via $source with python version $pythonversion" \
-      "org.opencontainers.image.version"="2.5.0beta1" \
+      "org.opencontainers.image.version"="2.5.0" \
       "org.opencontainers.image.authors"="roundup-devel@lists.sourceforge.net" \
       "org.opencontainers.image.licenses"="MIT AND ZPL-2.0 AND Python-2.0" \
       "org.opencontainers.image.documentation"="https://www.roundup-tracker.org/docs/installation.html" \

From 999679873a3cb10bf6912205a2afd05092bb7a47 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Fri, 11 Jul 2025 22:30:21 -0400
Subject: [PATCH 235/398] build: update roundup version string.

---
 roundup/__init__.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roundup/__init__.py b/roundup/__init__.py
index e4687d084..2e14b388a 100644
--- a/roundup/__init__.py
+++ b/roundup/__init__.py
@@ -67,6 +67,6 @@
 '''
 __docformat__ = 'restructuredtext'
 
-__version__ = '2.5.0b1'
+__version__ = '2.5.0'
 
 # vim: set filetype=python ts=4 sw=4 et si

From 89f7a4d859978870c2452b2c24119fbff5399da7 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Fri, 11 Jul 2025 22:31:07 -0400
Subject: [PATCH 236/398] doc: move XSS fix to top of fix report. Set
 date/version.

---
 CHANGES.txt | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index b41ffbdd5..79f85a64e 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -13,10 +13,12 @@ Roundup 2.0 supports Python 3.4 and later. Roundup 2.1.0 supports
 python 3.6 or newer (3.4/3.5 might work, but they are not tested).
 Roundup 2.4.0 is the last release to support Python 2.
 
-2025-XX-XX 2.5.0beta1
+2025-07-13 2.5.0
 
 Fixed:
 
+- XSS issue in devel and responsive templates. Reported by 4bug of
+  ChaMd5 Security Team H1 Group. (John Rouillard).
 - issue2551343 - Remove support for PySQLite. It is unmaintained
   and sqlite3 is used which is the default for a Python
   distribution.  (John Rouillard)
@@ -98,8 +100,6 @@ Fixed:
   Rouillard)
 - fix potential HTTP Response Splitting issue in
   roundup-server. Discovered by CodeQL in CI. (John Rouillard)
-- XSS issue in devel and responsive templates. Reported by 4bug of
-  ChaMd5 Security Team H1 Group. (John Rouillard).
 
 Features:
 

From 811415dd759cb68da1ff087dfcb27871b559e4eb Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Fri, 11 Jul 2025 22:32:15 -0400
Subject: [PATCH 237/398] build: remove python 2.x directions; other
 notes/clarifications

---
 RELEASE.txt | 20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/RELEASE.txt b/RELEASE.txt
index 6ba0e1f90..5a341a8c1 100644
--- a/RELEASE.txt
+++ b/RELEASE.txt
@@ -147,10 +147,10 @@ Roundup release checklist:
 
 11. Unpack the new tarball created in dist/roundup-<version>.tar.gz
     file in /tmp then
-      a) run tests using installed pytest run under python2 and
-         python3. (python2 -m pytest test/; python3 -m pytest test/)
+      a) run tests using installed pytest run under
+         python3. (python3 -m pytest test/)
       b) demo.py
-    with all available Python versions.
+    with all available Python 3 versions.
 11a. (TBD how to test wheel binary distribution before uploading.)
 
 11b. Generate GPG signature file
@@ -269,12 +269,26 @@ Roundup release checklist:
      You may need to explicitly update/refresh the scanners with:
      "docker pull anchore/grype:latest" and similarly for
      aquasec/trivy if used.
+
+     Note that some security issues may show up. If they are in the
+     underlying OS package we can't do anything but make sure the
+     latest python:3-alpine package is used to build the image. Look
+     at the index digest on the image release page and compare it to
+     the sha256 at the top of the Dockerfile.
+
 17d. test roundup in demo mode:
 
         docker run -it --rm -p 8917:8080 \
          -v $PWD/tracker:/usr/src/app/tracker \
          rounduptracker/roundup:2.4.0 demo
 
+     FIXME: right now the external port number (8917) in the above
+       command is hardcoded in DOCKER. It can be overridden usng
+       PORT_8080=9017 for example. However the host is always
+       localhost. Consider replacing PORT_8080 with ORIGIN="host:port"
+       or ORIGIN="port" so that the web URL can be made correct when
+       running docker on a remote server.
+
 17e. push to DockerHub login (login using 'docker login <username>'
      first and user must be member of rounduptracker org with ability
      to publish). Replace -N with the release number (e.g. -1, -2, -3...)

From 53c42292a52e524623d1f348eff5267b8dd23440 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Fri, 11 Jul 2025 22:33:07 -0400
Subject: [PATCH 238/398] build: prep for release.

set as production release.

remove python 2 references.
---
 setup.py | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/setup.py b/setup.py
index 9691796a7..87b0329fb 100755
--- a/setup.py
+++ b/setup.py
@@ -212,8 +212,8 @@ def main():
     setup(name='roundup',
           author="Richard Jones",
           author_email="richard@users.sourceforge.net",
-          classifiers=[#'Development Status :: 5 - Production/Stable',
-                       'Development Status :: 4 - Beta',
+          classifiers=['Development Status :: 5 - Production/Stable',
+                       #'Development Status :: 4 - Beta',
                        #'Development Status :: 3 - Alpha',
                        'Environment :: Console',
                        'Environment :: Web Environment',
@@ -230,8 +230,6 @@ def main():
                        'Operating System :: Microsoft :: Windows',
                        'Operating System :: POSIX',
                        'Programming Language :: Python',
-                       'Programming Language :: Python :: 2',
-                       'Programming Language :: Python :: 2.7',
                        'Programming Language :: Python :: 3',
                        'Programming Language :: Python :: 3.7',
                        'Programming Language :: Python :: 3.8',

From a7760c555fa10de93c96187ed0be551ec145c357 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Fri, 11 Jul 2025 23:18:42 -0400
Subject: [PATCH 239/398] doc: remove python 2.7 support reference.

---
 doc/features.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/features.txt b/doc/features.txt
index 880e20ef5..617424bec 100644
--- a/doc/features.txt
+++ b/doc/features.txt
@@ -18,7 +18,7 @@ from Ka-Ping Yee in the :index:`Software Carpentry` "Track" design competition.
   ``python demo.py`` or `a Docker container`_ in under 5 minutes. 
 - Choose from `five included templates`_ for your tracker.
 - `Customize`_ and use the demo as a template for your production tracker.
-- No need for additional support software, just Python (3.7+ or 2.7)
+- No need for additional support software, just Python (3.7+)
   to get started.
 - Basic installation (including a web interface) takes about 30 minutes.
 - Supports embedded databases like `SQLite`_ and dbm. Upgradable

From 6fdbeae69f2419096201af24b12dcef6b5adefec Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sat, 12 Jul 2025 10:49:52 -0400
Subject: [PATCH 240/398] test: test regular xmlrpc codepath even when
 defusedxml installed

This was a leftover from the defusedxml support addition.

When defusedxml was installed, the bomb test for regular xmlrpc was
skipped.

Now if defusedxml is installed, a context manager unpatches the xmlrpc
and runs the test for the regular xmlrpc which should result in a long
string.
---
 test/test_xmlrpc.py | 24 +++++++++++++++++-------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/test/test_xmlrpc.py b/test/test_xmlrpc.py
index c3709bf8b..48464f8f8 100644
--- a/test/test_xmlrpc.py
+++ b/test/test_xmlrpc.py
@@ -7,6 +7,8 @@
 from __future__ import print_function
 import unittest, os, shutil, errno, pytest, sys, difflib, re
 
+from contextlib import contextmanager 
+
 from roundup.anypy import xmlrpc_
 MultiCall = xmlrpc_.client.MultiCall
 from roundup.cgi.exceptions import *
@@ -26,14 +28,9 @@
 
 if client.defusedxml:
     skip_defusedxml = lambda func, *args, **kwargs: func
-
-    skip_defusedxml_used = mark_class(pytest.mark.skip(
-        reason='Skipping non-defusedxml tests: defusedxml library in use'))
 else:
     skip_defusedxml = mark_class(pytest.mark.skip(
         reason='Skipping defusedxml tests: defusedxml library not available'))
-    
-    skip_defusedxml_used = lambda func, *args, **kwargs: func
 
 if sys.version_info[0] > 2:
     skip_python2 = lambda func, *args, **kwargs: func
@@ -41,6 +38,19 @@
     skip_python2 = mark_class(pytest.mark.skip(
         reason='Skipping test under python 2'))
 
+@contextmanager
+def disable_defusedxml():
+    # if defusedxml not loaded, do nothing
+    if 'defusedxml' not in sys.modules:
+        yield
+        return
+
+    sys.modules['defusedxml'].xmlrpc.unmonkey_patch()
+    try:
+        yield
+    finally:
+        # restore normal defused xmlrpc functions
+        sys.modules['defusedxml'].xmlrpc.monkey_patch()
 
 class XmlrpcTest(object):
 
@@ -340,9 +350,9 @@ def testDefusedXmlBomb(self):
         self.XmlBomb(expectIn=b"defusedxml.common.EntitiesForbidden")
 
     @skip_python2
-    @skip_defusedxml_used
     def testNonDefusedXmlBomb(self):
-        self.XmlBomb(expectIn=b"1234567890"*511)
+        with disable_defusedxml():
+            self.XmlBomb(expectIn=b"1234567890"*511)
 
     def XmlBomb(self, expectIn=None):
 

From 8e002b0302834754f407b6d8940208870fd460ea Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sat, 12 Jul 2025 11:00:59 -0400
Subject: [PATCH 241/398] build: instruction updates/reorder

Try to make release more efficient.
---
 RELEASE.txt | 23 ++++++++++++++---------
 1 file changed, 14 insertions(+), 9 deletions(-)

diff --git a/RELEASE.txt b/RELEASE.txt
index 5a341a8c1..6ff06bf0d 100644
--- a/RELEASE.txt
+++ b/RELEASE.txt
@@ -72,13 +72,7 @@ Roundup release checklist:
 
       python3 setup.py check --restructuredtext --metadata --strict
    
-6.  Clean out all *.orig, *.rej, .#* files from the source.
-
-      find . -name '*.orig' -exec rm {} \;
-      find . -name '*.rej' -exec rm {} \;
-      find . -name '.#*' -exec rm {} \;
-
-6a. Rebuild .mo translation files in distribution
+6. Rebuild .mo translation files in distribution
 
       cd locale
       make
@@ -89,7 +83,15 @@ Roundup release checklist:
       python3 setup.py clean --all
       rm -rf build/share  # deletes locale .mo files
 
-    Build including new .mo files built in 6a.
+    Clean out all *.orig, *.rej, .#* files from the source.
+
+      find . -name '*.orig' -exec rm {} \;
+      find . -name '*.rej' -exec rm {} \;
+      find . -name '.#*' -exec rm {} \;
+
+7a.
+
+    Build including new .mo files built in 6.
 
       python3 setup.py build
 
@@ -99,6 +101,7 @@ Roundup release checklist:
 
       cd doc
       make
+      cd ..
 
     runs commands to turn man pages into html files and adds them to
     html_extra/man_pages subdir. Then it generates html text from
@@ -113,10 +116,11 @@ Roundup release checklist:
 
     (if you find sdist a little verbose, add "--quiet" to the end of the
      command)
+
 9a. 2021/04/17 skip this for now. Need to make sure that whl installs
     executable scripts properly and update these directions to test.
 
-       python2 setup.py bdist_wheel; python3 setup.py bdist_wheel
+       python3 setup.py bdist_wheel
 
     to create binary distributions in wheel format. (egg format is
     deprecated.)
@@ -143,6 +147,7 @@ Roundup release checklist:
 
     any file with a count of 2 or more needs to be removed from
     MANIFEST.in and possibly cleaned out of the build tree.
+
 10b: if you added/removed files rebuild starting at step 6a.
 
 11. Unpack the new tarball created in dist/roundup-<version>.tar.gz

From 6b064c5e7123759536e51b9a9e91e6538dab0b4f Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sat, 12 Jul 2025 17:07:50 -0400
Subject: [PATCH 242/398] doc: update doc on tal:replace and tal:content

Describe use of tal:replace for XSS and how to execute a replaced tag
with <tal:x> and tal:content.
---
 doc/reference.txt | 55 +++++++++++++++++++++++++++++++++++++++++------
 1 file changed, 48 insertions(+), 7 deletions(-)

diff --git a/doc/reference.txt b/doc/reference.txt
index 178f16688..afd4e0806 100644
--- a/doc/reference.txt
+++ b/doc/reference.txt
@@ -2480,23 +2480,60 @@ The basic TAL commands are:
 **tal:replace="expression"**
    Replace this tag with the result of the expression. For example::
 
-    <span tal:replace="request/user/realname" />
+    <span tal:replace="request/user/id" />
 
    The example would replace the <span> tag and its contents with the
-   user's realname. If the user's realname was "Bruce", then the
-   resultant output would be "Bruce".
+   user's id. If the user's id was "3" the resulting output would be
+   "3".
+
+   You need to be a little careful with ``tal:replace``. Unlike
+   ``tal:content``, it doesn't always escape the output. For example
+   if you used::
+
+      <tal:x tal:replace="request/user/realname" />
+
+   it would replace the contents with the value of the user's
+   realname. The realname is something the user can control. The user
+   could include something like::
+
+      Bruce<script>alert("hello there");</script>
+
+   This would result in an alert box popping up when the page was
+   loaded. Attackers could use this `XSS exploit`_ for malicious
+   purposes.
+
+   Generally you would use tal:replace when calling a utility function
+   using a :ref:`Python expression <python expression>` that generates
+   trusted HTML.
+
+   If you are inserting untrusted content, it is better to use
+   ``tal:content`` with tags that disappear as described below.
+
+   .. _`XSS exploit`: https://owasp.org/www-community/attacks/xss/
 
 **tal:content="expression"**
-   Replace the contents of this tag with the result of the expression.
-   For example::
+   Replace the contents of this tag (but not the tag itself) with the
+   result of the expression.  For example::
 
-    <span tal:content="request/user/realname">user's name appears here
-    </span>
+     <span tal:content="request/user/realname">user's name appears here
+     </span>
 
    This example would replace the contents of the ``<span>`` tag with the
    user's realname. If the user's realname was "Bruce" then the
    output will be ``<span>Bruce</span>``.
 
+   ``tal:content`` replaces special HTML claracters like ``<`` with an
+   HTML entitity ``&lt;``. This makes it safer to use when inserting
+   untrusted data. To have ``tal:content`` insert unescaped HTML, you
+   need to use the `structure modifier`_.
+
+   If the tag is an unknown ``tal:`` tag, TAL removes the tag. So
+   evaulating:
+
+         <tal:x tal:replace="request/user/realname" />
+
+   results in ``Bruce``.
+
 **tal:attributes="attribute expression; attribute expression; ..."**
    Set attributes on this tag to the results of expressions. For
    example::
@@ -2574,6 +2611,8 @@ attribute values may be one of the following forms:
    expression in the interpolation decorator ``${ ... }`` is a
    path expression as above.
 
+.. _`python expression`:
+
 **Python Expressions** - e.g. ``python: 1+1`` 
    These expressions give the full power of Python. All the "root level"
    variables are available, so ``python:item.status.checklist()`` is
@@ -2582,6 +2621,8 @@ attribute values may be one of the following forms:
 
 Modifiers:
 
+.. _`structure modifier`:
+
 **structure** - e.g. ``structure python:msg.content.plain(hyperlink=1)``
    The result of expressions are *escaped* to be safe for HTML
    display (all "<", ">" and "&" are replaced with entities

From afaf1c95bfa8c7ba6b76883f94159ed743812a38 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sat, 12 Jul 2025 17:25:03 -0400
Subject: [PATCH 243/398] doc: better document the template property in the
 request object.

---
 doc/glossary.txt  | 8 +++++++-
 doc/reference.txt | 5 ++++-
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/doc/glossary.txt b/doc/glossary.txt
index 946577d53..eb20ab8a6 100644
--- a/doc/glossary.txt
+++ b/doc/glossary.txt
@@ -81,13 +81,19 @@ Roundup Glossary
 
    template
 
-      this term has two meanings depending on context.
+      this term has three meanings depending on context.
 
       It refers to files that are processed by a templating engine to
       produce output suitable for machine or human consumption. For
       example a template could produce a html page that includes the
       name of the user.
 
+      It is an property of the request object in the templating
+      system. Templates that are used with a specific class (e.g.
+      ``issue.item.html``) will have this entry set to the middle
+      element (``item`` in this example). For templates like
+      ``home.html`` the element will be set to the empty string.
+
       It also can mean a **Tracker template**. This is a set of files
       used to install a new tracker. Tracker templates define a
       tracker with a particular look and feel, :term:`schema`,
diff --git a/doc/reference.txt b/doc/reference.txt
index afd4e0806..392339dcc 100644
--- a/doc/reference.txt
+++ b/doc/reference.txt
@@ -2735,7 +2735,10 @@ The following variables are available to templates.
   - "user" a HTMLItem instance for the current user
   - "language" as determined by the browser or configuration
   - "classname" the current classname (possibly None)
-  - "template" the current template (suffix, also possibly None)
+  - "template" the current template (e.g. for the ``issue.item.html``
+    template the template would be the ``item`` suffix on the
+    classname. It can also be the empty string (e.g. with the
+    ``home.html`` template).
 **config**
   This variable holds all the values defined in the tracker config.ini
   file (e.g. TRACKER_NAME, etc.)

From d7d760f170b2797696ee0d4e9f8769661e8f31dd Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sat, 12 Jul 2025 17:46:16 -0400
Subject: [PATCH 244/398] doc: missing :: at end of line before example code.

---
 roundup/cgi/templating.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roundup/cgi/templating.py b/roundup/cgi/templating.py
index c3ba4fae9..e5e8aba15 100644
--- a/roundup/cgi/templating.py
+++ b/roundup/cgi/templating.py
@@ -3758,7 +3758,7 @@ def readfile(self, name, optional=False):
            file where you can use linters/minifiers and other
            tools on it.
 
-           A TAL example:
+           A TAL example::
 
              <script tal:attributes="nonce request/client/client_nonce"
              tal:content="python:utils.readfile('mylibrary.js')"></script>

From 0f3f502d1d2f081e72ea722706ac990ca8547a3b Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sat, 12 Jul 2025 17:53:17 -0400
Subject: [PATCH 245/398] doc: formatting fix. Don't trigger description list.

---
 roundup/cgi/client.py | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/roundup/cgi/client.py b/roundup/cgi/client.py
index 5811eda85..d999037b4 100644
--- a/roundup/cgi/client.py
+++ b/roundup/cgi/client.py
@@ -298,10 +298,10 @@ class Client:
       should be sent to the client
     - "response_code" is the HTTP response code to send to the client
     - "translator" is TranslationService instance
-    - "client-nonce" is a unique value for this client connection. Can be
-       used as a nonce for CSP headers and to sign javascript code
-       presented to the browser. This is different from the CSRF nonces
-       and can not be used for anti-csrf measures.
+    - "clientnonce" is a unique value for this client connection. Can be
+      used as a nonce for CSP headers and to sign javascript code
+      presented to the browser. This is different from the CSRF nonces
+      and can not be used for anti-csrf measures.
 
     During the processing of a request, the following attributes are used:
 

From 58d8e63a54d443a23bfdd644966b7a5343bad885 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sat, 12 Jul 2025 17:59:27 -0400
Subject: [PATCH 246/398] doc: formatting fixes.

---
 roundup/cgi/templating.py | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/roundup/cgi/templating.py b/roundup/cgi/templating.py
index e5e8aba15..7fbda8a8f 100644
--- a/roundup/cgi/templating.py
+++ b/roundup/cgi/templating.py
@@ -3630,13 +3630,13 @@ def keywords_expressions(self, request):
     def html_calendar(self, request):
         """Generate a HTML calendar.
 
-        `request`  the roundup.request object
-                   - @template : name of the template
-                   - form      : name of the form to store back the date
-                   - property  : name of the property of the form to store
-                                 back the date
-                   - date      : current date
-                   - display   : when browsing, specifies year and month
+        `request` - the roundup.request object
+           - @template : name of the template
+           - form      : name of the form to store back the date
+           - property  : name of the property of the form to store
+             back the date
+           - date      : date marked as current value on calendar
+           - display   : when browsing, specifies year and month
 
         html will simply be a table.
         """

From df58adb891f6ea1ecdcb457bcb5fca3097ddcb37 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sat, 12 Jul 2025 18:00:45 -0400
Subject: [PATCH 247/398] doc: document request.template object in template
 glossary (3rd meaning)

---
 doc/glossary.txt | 33 +++++++++++++++++----------------
 1 file changed, 17 insertions(+), 16 deletions(-)

diff --git a/doc/glossary.txt b/doc/glossary.txt
index eb20ab8a6..cdaae7ff9 100644
--- a/doc/glossary.txt
+++ b/doc/glossary.txt
@@ -83,22 +83,23 @@ Roundup Glossary
 
       this term has three meanings depending on context.
 
-      It refers to files that are processed by a templating engine to
-      produce output suitable for machine or human consumption. For
-      example a template could produce a html page that includes the
-      name of the user.
-
-      It is an property of the request object in the templating
-      system. Templates that are used with a specific class (e.g.
-      ``issue.item.html``) will have this entry set to the middle
-      element (``item`` in this example). For templates like
-      ``home.html`` the element will be set to the empty string.
-
-      It also can mean a **Tracker template**. This is a set of files
-      used to install a new tracker. Tracker templates define a
-      tracker with a particular look and feel, :term:`schema`,
-      permissions model, and :term:`detectors`. Roundu ships with five
-      templates and people on the net `have produced other templates`_
+      1. files that are processed by a templating engine to
+         produce output suitable for machine or human consumption. For
+         example a template could produce a html page that includes the
+         name of the user.
+
+      2. a property of the request object in the templating
+         system. Templates that are used with a specific class (e.g.
+         ``issue.item.html``) will have this entry set to the middle
+         element (``item`` in this example). For templates like
+         ``home.html`` the element will be set to the empty string.
+
+      3. a **Tracker template**. This is a set of files
+	 used to install a new tracker. Tracker templates define a
+	 tracker with a particular look and feel, :term:`schema`,
+	 permissions model, and :term:`detectors`. Roundup ships with
+	 five templates and people on the net `have produced other
+	 templates`_
 
 
    tracker

From e0b624501897f78a621429b9c4c6715c82578a12 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sat, 12 Jul 2025 20:48:28 -0400
Subject: [PATCH 248/398] doc: correct acronym for * based access controls. Add
 links to wikipaedia.

---
 doc/features.txt | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/doc/features.txt b/doc/features.txt
index 617424bec..f01af758c 100644
--- a/doc/features.txt
+++ b/doc/features.txt
@@ -65,8 +65,12 @@ from Ka-Ping Yee in the :index:`Software Carpentry` "Track" design competition.
 - Your data remains on your servers.
 - You can choose if AI can access the data.
 - Can use HTTPS for security over the web.
-- Fine-grained authorization (ABAC, PEBAC) based on user and resource
-  properties.
+- Fine-grained authorization (`ABAC`_, `ReBAC`_, `RBAC`_) based on
+  user, resource, and external properties.
+
+.. _`ABAC`: https://en.wikipedia.org/wiki/Attribute-based_access_control 
+.. _`ReBAC`: https://en.wikipedia.org/wiki/Relationship-based_access_control
+.. _`RBAC`: https://en.wikipedia.org/wiki/Role-based_access_control
 
 **Documentation and User Management**
 

From c0522390dbdbdc5f6df0a4346788bf8255e9fbd9 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sat, 12 Jul 2025 20:52:30 -0400
Subject: [PATCH 249/398] doc: fix formatting, typos.

---
 doc/features.txt | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/doc/features.txt b/doc/features.txt
index f01af758c..383147a34 100644
--- a/doc/features.txt
+++ b/doc/features.txt
@@ -10,7 +10,8 @@ Roundup Features
 
 Roundup is an easy-to-use and -install issue-tracking system with
 web, e-mail and command-line interfaces. Based on the winning design
-from Ka-Ping Yee in the :index:`Software Carpentry` "Track" design competition.
+from Ka-Ping Yee in the :index:`Software Carpentry` "Track" design
+competition. 
 
 **Installation and Setup**
 
@@ -34,11 +35,11 @@ from Ka-Ping Yee in the :index:`Software Carpentry` "Track" design competition.
 
 - Manage your issues your way. Handle bugs, features, milestones, 
   user feedback, fleet maintenance, office issues etc.
+- Issues become a mini mailing list to keep everyone informed.
 - Searches on specific properties (e.g. open issues with a high
-  priority) can be saved and reused or shared with outer users.
+  priority) can be saved and reused or shared with other users.
 - Full Text Search for quick searches across messages.
 - Keeps a detailed history of issue changes.
-- Issues become a mini mailing list to keep everyone informed.
 - Email is a first class method for interacting with issues.
 
 **Scalability and Performance**
@@ -77,7 +78,7 @@ from Ka-Ping Yee in the :index:`Software Carpentry` "Track" design competition.
 - Users can sign up through the web interface or new user creation
   can be limited to admin users.
 - Can use an `external user database`_ (LDAP, password file)
-- Self-server password reset for users via email.
+- Self-serve password reset for users via email.
 
 **Email Integration and Automation**
 
@@ -97,9 +98,9 @@ from Ka-Ping Yee in the :index:`Software Carpentry` "Track" design competition.
 
 **Remote Access Interfaces**
 
+- `RESTful API`_ accessible with basic HTTP authentication or optional JWT.
 - `XMLRPC interface`_ for remote tracker access with basic
   HTTP authentication.
-- `RESTful API`_ accessible with basic HTTP authentication or optional JWT.
 - Configurable CORS support for third-party web pages.
 - Ability to generate and authenticate JSON Web Tokens (JWT).
 

From 5caad9225edd92c8b64c46b4072ab6df4230f7bf Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sat, 12 Jul 2025 20:57:56 -0400
Subject: [PATCH 250/398] doc: remove potentially, it is incorrect.

---
 doc/rest.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/rest.txt b/doc/rest.txt
index 3b0a47f8c..b9163e0a7 100644
--- a/doc/rest.txt
+++ b/doc/rest.txt
@@ -2190,7 +2190,7 @@ value, and replace the ``times`` value.
 
 Note that the json returned after the operation will include the new
 value of the ``times`` value so your code can verify that it worked.
-This does potentially leak info about the previous id's in the field.
+This leaks info about the previous id's in the field.
 
 Create rest endpoints
 ~~~~~~~~~~~~~~~~~~~~~

From 6ac651669fa124ff699e3cfa02075bf5e656b1ce Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sat, 12 Jul 2025 20:58:22 -0400
Subject: [PATCH 251/398] doc: add link to JWT endpoint doc in rest.txt.

---
 doc/features.txt | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/doc/features.txt b/doc/features.txt
index 383147a34..a55da90ee 100644
--- a/doc/features.txt
+++ b/doc/features.txt
@@ -102,7 +102,8 @@ competition.
 - `XMLRPC interface`_ for remote tracker access with basic
   HTTP authentication.
 - Configurable CORS support for third-party web pages.
-- Ability to generate and authenticate JSON Web Tokens (JWT).
+- Ability to `generate and authenticate JSON Web Tokens (JWT)
+  <rest.html#changing-access-roles-with-json-web-tokens>`_.
 
 .. _`auditors and reactors`: reference.html#auditor-or-reactor
 .. _`customize`: customizing.html

From 3915132b3a8da9ae1ca17885c9a430b964ab32a5 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sat, 12 Jul 2025 22:55:39 -0400
Subject: [PATCH 252/398] build: remove extra <p></p> generated by blank lines.

---
 roundup/admin.py | 68 ++++++++++++++++++++++++++++++------------------
 1 file changed, 42 insertions(+), 26 deletions(-)

diff --git a/roundup/admin.py b/roundup/admin.py
index 093d66c32..5fd1394bb 100644
--- a/roundup/admin.py
+++ b/roundup/admin.py
@@ -261,20 +261,32 @@ def help_commands_html(self, indent_re=indent_re):
         for command in commands:
             h = _(command.__doc__).split('\n')
             name = command.__name__[3:]
-            usage = h[0].replace('<','&lt;').replace('>','&gt;')[7:]
+            #  first line is "<name> <params and stuff>
+            usage = h[0][len(name) + 1:].replace('<','&lt;').replace('>','&gt;')[7:]
             print("""
 <tr><td valign=top><strong>%(name)s</strong></td>
-    <td><tt>- %(usage)s</tt>
-<pre>""" % locals())
+    <td><p><tt>%(usage)s</tt></p>
+""" % locals())
             indent = indent_re.match(h[1])
             if indent: indent = len(indent.group(1))  # noqa: E701
-            for line in h[1:]:
+            lines_to_process = len(h[1:])
+            print('<p>')
+            for lineno, line in enumerate(h[1:]):
                 line = line.replace('<','&lt;').replace('>','&gt;')
                 if indent:
-                    print(line[indent:])
+                    clean_line = line[indent:]
                 else:
-                    print(line)
-            print('</pre></td></tr>\n')
+                    clean_line = line
+                if not clean_line:
+                    print('</p><p>')
+                    continue
+                if clean_line.startswith('    '): # indented example line
+                    print("<pre>%s</pre>" % clean_line)
+                else:
+                    print(clean_line)
+                if lineno == lines_to_process:
+                    print('</p>')
+            print('</td></tr>\n')
         print("</table>")
 
     def help_all(self):
@@ -857,6 +869,7 @@ def do_find(self, args):
     def do_genconfig(self, args, update=False):
         ''"""Usage: genconfig filename
         Create a new tracker config file with default values in filename.
+        See also updateconfig.
         """
         if len(args) < 1:
             raise UsageError(_('Not enough arguments supplied'))
@@ -1211,10 +1224,13 @@ def do_import(self, args, import_files=True):
         The files used in the import are:
 
         <class>.csv
-          This must define the same properties as the class (including
-          having a "header" line with those property names.)
+          This must define the same properties as the class
+          (including having a "header" line with those
+          property names.)
+
         <class>-journals.csv
-          This defines the journals for the items being imported.
+         This defines the journals for the items
+         being imported.
 
         The imported nodes will have the same nodeid as defined in the
         import file, thus replacing any existing content.
@@ -1597,10 +1613,10 @@ def do_pack(self, args):
         A period is specified using the suffixes "y", "m", and "d". The
         suffix "w" (for "week") means 7 days.
 
-              "3y" means three years
-              "2y 1m" means two years and one month
-              "1m 25d" means one month and 25 days
-              "2w 3d" means two weeks and three days
+            "3y" means three years
+            "2y 1m" means two years and one month
+            "1m 25d" means one month and 25 days
+            "2w 3d" means two weeks and three days
 
         Date format is "YYYY-MM-DD" eg:
             2001-01-01
@@ -2086,22 +2102,22 @@ def do_table(self, args):
         explicitly defined by defining the property as "name:width".
         For example::
 
-          roundup> table priority id,name:10
-          Id Name
-          1  fatal-bug
-          2  bug
-          3  usability
-          4  feature
+            roundup> table priority id,name:10
+            Id Name
+            1  fatal-bug
+            2  bug
+            3  usability
+            4  feature
 
         Also to make the width of the column the width of the label,
         leave a trailing : without a width on the property. For example::
 
-          roundup> table priority id,name:
-          Id Name
-          1  fata
-          2  bug
-          3  usab
-          4  feat
+            roundup> table priority id,name:
+            Id Name
+            1  fata
+            2  bug
+            3  usab
+            4  feat
 
         will result in a the 4 character wide "Name" column.
         """

From f51fd80969fe583475789db8b901fe7f470671a2 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sat, 12 Jul 2025 22:56:16 -0400
Subject: [PATCH 253/398] doc: commit new generated admin help output.

---
 doc/admin_help.html | 470 ++++++++++++++++++++++++--------------------
 1 file changed, 252 insertions(+), 218 deletions(-)

diff --git a/doc/admin_help.html b/doc/admin_help.html
index 082abc354..c5ff743a9 100644
--- a/doc/admin_help.html
+++ b/doc/admin_help.html
@@ -1,496 +1,530 @@
 <table>
 
 <tr><td valign=top><strong>commit</strong></td>
-    <td><tt>- commit</tt>
-<pre>
-Commit changes made to the database during an interactive session.
+    <td><p><tt></tt></p>
 
+<p>
+Commit changes made to the database during an interactive session.
+</p><p>
 The changes made during an interactive session are not
 automatically written to the database - they must be committed
 using this command.
-
+</p><p>
 One-off commands on the command-line are automatically committed if
 they are successful.
-
-</pre></td></tr>
+</p><p>
+</td></tr>
 
 
 <tr><td valign=top><strong>create</strong></td>
-    <td><tt>- create classname property=value ...</tt>
-<pre>
-Create a new entry of a given class.
+    <td><p><tt>classname property=value ...</tt></p>
 
+<p>
+Create a new entry of a given class.
+</p><p>
 This creates a new entry of the given class using the property
 name=value arguments provided on the command line after the "create"
 command.
-
-</pre></td></tr>
+</p><p>
+</td></tr>
 
 
 <tr><td valign=top><strong>display</strong></td>
-    <td><tt>- display designator[,designator]*</tt>
-<pre>
-Show the property values for the given node(s).
+    <td><p><tt>designator[,designator]*</tt></p>
 
+<p>
+Show the property values for the given node(s).
+</p><p>
 A designator is a classname and a nodeid concatenated,
 eg. bug1, user10, ...
-
+</p><p>
 This lists the properties and their associated values
 for the given node.
-
-</pre></td></tr>
+</p><p>
+</td></tr>
 
 
 <tr><td valign=top><strong>export</strong></td>
-    <td><tt>- export [[-]class[,class]] export_dir</tt>
-<pre>
-Export the database and file content.
+    <td><p><tt>[[-]class[,class]] export_dir</tt></p>
 
+<p>
+Export the database and file content.
+</p><p>
 Database content is exported to colon separated files.
 To exclude the files (e.g. for the msg or file class),
 use the exporttables command.
-
+</p><p>
 Optionally limit the export to just the named classes
 or exclude the named classes, if the 1st argument
 starts with '-'.
-
+</p><p>
 This action exports the current data from the database into
 colon-separated-value files that are placed in the nominated
 export_dir directory.
-
-</pre></td></tr>
+</p><p>
+</td></tr>
 
 
 <tr><td valign=top><strong>exporttables</strong></td>
-    <td><tt>- exporttables [[-]class[,class]] export_dir</tt>
-<pre>
-Export only the database to files, no file content.
+    <td><p><tt>[[-]class[,class]] export_dir</tt></p>
 
+<p>
+Export only the database to files, no file content.
+</p><p>
 Database content is exported to colon separated files.
 The files below $TRACKER_HOME/db/files/ (which can be
 archived separately) are not part of the export.
 To include the files, use the export command.
-
+</p><p>
 Optionally limit the export to just the named classes
 or exclude the named classes, if the 1st argument
 starts with '-'.
-
+</p><p>
 This action exports the current data from the database into
 colon-separated-value files that are placed in the export_dir
 destination directory.
-
-</pre></td></tr>
+</p><p>
+</td></tr>
 
 
 <tr><td valign=top><strong>filter</strong></td>
-    <td><tt>- filter classname propname=value ...</tt>
-<pre>
-Find the nodes of the given class with a given property value.
+    <td><p><tt>classname propname=value ...</tt></p>
 
+<p>
+Find the nodes of the given class with a given property value.
+</p><p>
 Find the nodes of the given class with a given property value.
 Multiple values can be specified by separating them with commas.
 If property is a string, all values must match. I.E. it's an
 'and' operation. If the property is a link/multilink any value
 matches. I.E. an 'or' operation.
-
-</pre></td></tr>
+</p><p>
+</td></tr>
 
 
 <tr><td valign=top><strong>find</strong></td>
-    <td><tt>- find classname propname=value ...</tt>
-<pre>
-Find the nodes of the given class with a given link property value.
+    <td><p><tt>classname propname=value ...</tt></p>
 
+<p>
+Find the nodes of the given class with a given link property value.
+</p><p>
 Find the nodes of the given class with a given link property value.
 The value may be either the nodeid of the linked node, or its key
 value.
-
-</pre></td></tr>
+</p><p>
+</td></tr>
 
 
 <tr><td valign=top><strong>genconfig</strong></td>
-    <td><tt>- genconfig filename</tt>
-<pre>
-Create a new tracker config file with default values in filename.
+    <td><p><tt>filename</tt></p>
 
-</pre></td></tr>
+<p>
+Create a new tracker config file with default values in filename.
+See also updateconfig.
+</p><p>
+</td></tr>
 
 
 <tr><td valign=top><strong>get</strong></td>
-    <td><tt>- get property designator[,designator]*</tt>
-<pre>
-Get the given property of one or more designator(s).
+    <td><p><tt>property designator[,designator]*</tt></p>
 
+<p>
+Get the given property of one or more designator(s).
+</p><p>
 A designator is a classname and a nodeid concatenated,
 eg. bug1, user10, ...
-
+</p><p>
 Retrieves the property value of the nodes specified
 by the designators.
-
-</pre></td></tr>
+</p><p>
+</td></tr>
 
 
 <tr><td valign=top><strong>help</strong></td>
-    <td><tt>- help topic</tt>
-<pre>
-Give help about topic.
+    <td><p><tt>topic</tt></p>
 
+<p>
+Give help about topic.
+</p><p>
 commands  -- list commands
 &lt;command&gt; -- help specific to a command
 initopts  -- init command options
 all       -- all available help
-
-</pre></td></tr>
+</p><p>
+</td></tr>
 
 
 <tr><td valign=top><strong>history</strong></td>
-    <td><tt>- history designator [skipquiet] [raw]</tt>
-<pre>
-Show the history entries of a designator.
+    <td><p><tt>designator [skipquiet] [raw]</tt></p>
 
+<p>
+Show the history entries of a designator.
+</p><p>
 A designator is a classname and a nodeid concatenated,
 eg. bug1, user10, ...
-
+</p><p>
 Lists the journal entries viewable by the user for the node
 identified by the designator. If skipquiet is added, journal
 entries for quiet properties are not shown. If raw is added,
 the output is the raw representation of the journal entries.
-
-</pre></td></tr>
+</p><p>
+</td></tr>
 
 
 <tr><td valign=top><strong>import</strong></td>
-    <td><tt>- import import_dir</tt>
-<pre>
-Import a database and file contents from the directory.
+    <td><p><tt>import_dir</tt></p>
 
+<p>
+Import a database and file contents from the directory.
+</p><p>
 The directory should have the same format as one containing
 the output of export. There are two files imported per class.
 The files used in the import are:
-
+</p><p>
 &lt;class&gt;.csv
-  This must define the same properties as the class (including
-  having a "header" line with those property names.)
+  This must define the same properties as the class
+  (including having a "header" line with those
+  property names.)
+</p><p>
 &lt;class&gt;-journals.csv
-  This defines the journals for the items being imported.
-
+ This defines the journals for the items
+ being imported.
+</p><p>
 The imported nodes will have the same nodeid as defined in the
 import file, thus replacing any existing content.
-
+</p><p>
 The new nodes are added to the existing database - if you want to
 create a new database using the imported data, then create a new
 database (or, tediously, retire all the old data.)
-
-</pre></td></tr>
+</p><p>
+</td></tr>
 
 
 <tr><td valign=top><strong>importtables</strong></td>
-    <td><tt>- importtables export_dir</tt>
-<pre>
-This imports the database tables exported using exporttables.
+    <td><p><tt>export_dir</tt></p>
 
+<p>
+This imports the database tables exported using exporttables.
+</p><p>
 It does not import the content of files like msgs and files.
-
-</pre></td></tr>
+</p><p>
+</td></tr>
 
 
 <tr><td valign=top><strong>initialise</strong></td>
-    <td><tt>- initialise [adminpw]</tt>
-<pre>
-Initialise a new Roundup tracker.
+    <td><p><tt>[adminpw]</tt></p>
 
+<p>
+Initialise a new Roundup tracker.
+</p><p>
 The administrator details will be set at this step.
-
+</p><p>
 Execute the tracker's initialisation function dbinit.init()
-
-</pre></td></tr>
+</p><p>
+</td></tr>
 
 
 <tr><td valign=top><strong>install</strong></td>
-    <td><tt>- install [template [backend [key=val[,key=val]]]]</tt>
-<pre>
-Install a new Roundup tracker.
+    <td><p><tt>[template [backend [key=val[,key=val]]]]</tt></p>
 
+<p>
+Install a new Roundup tracker.
+</p><p>
 The command will prompt for the tracker home directory
 (if not supplied through TRACKER_HOME or the -i option).
 The template and backend may be specified on the command-line
 as arguments, in that order.
-
+</p><p>
 Command line arguments following the backend allows you to
 pass initial values for config options.  For example, passing
 "web_http_auth=no,rdbms_user=dinsdale" will override defaults
 for options http_auth in section [web] and user in section [rdbms].
 Please be careful to not use spaces in this argument! (Enclose
 whole argument in quotes if you need spaces in option value).
-
+</p><p>
 The initialise command must be called after this command in order
 to initialise the tracker's database. You may edit the tracker's
 initial database contents before running that command by editing
 the tracker's dbinit.py module init() function.
-
+</p><p>
 See also initopts help.
-
-</pre></td></tr>
+</p><p>
+</td></tr>
 
 
 <tr><td valign=top><strong>list</strong></td>
-    <td><tt>- list classname [property]</tt>
-<pre>
-List the instances of a class.
+    <td><p><tt>classname [property]</tt></p>
 
+<p>
+List the instances of a class.
+</p><p>
 Lists all instances of the given class. If the property is not
 specified, the  "label" property is used. The label property is
 tried in order: the key, "name", "title" and then the first
 property, alphabetically.
-
+</p><p>
 With -c, -S or -s print a list of item id's if no property
 specified.  If property specified, print list of that property
 for every class instance.
-
-</pre></td></tr>
+</p><p>
+</td></tr>
 
 
 <tr><td valign=top><strong>migrate</strong></td>
-    <td><tt>- migrate</tt>
-<pre>
+    <td><p><tt></tt></p>
+
+<p>
 Update a tracker's database to be compatible with the Roundup
 codebase.
-
+</p><p>
 You should run the "migrate" command for your tracker once
 you've installed the latest codebase.
-
+</p><p>
 Do this before you use the web, command-line or mail interface
 and before any users access the tracker.
-
+</p><p>
 This command will respond with either "Tracker updated" (if
 you've not previously run it on an RDBMS backend) or "No
 migration action required" (if you have run it, or have used
 another interface to the tracker, or possibly because you are
 using anydbm).
-
+</p><p>
 It's safe to run this even if it's not required, so just get
 into the habit.
-
-</pre></td></tr>
+</p><p>
+</td></tr>
 
 
 <tr><td valign=top><strong>pack</strong></td>
-    <td><tt>- pack period | date</tt>
-<pre>
-Remove journal entries older than the date/period.
+    <td><p><tt>period | date</tt></p>
 
+<p>
+Remove journal entries older than the date/period.
+</p><p>
 A period is specified using the suffixes "y", "m", and "d". The
 suffix "w" (for "week") means 7 days.
-
-      "3y" means three years
-      "2y 1m" means two years and one month
-      "1m 25d" means one month and 25 days
-      "2w 3d" means two weeks and three days
-
+</p><p>
+<pre>    "3y" means three years</pre>
+<pre>    "2y 1m" means two years and one month</pre>
+<pre>    "1m 25d" means one month and 25 days</pre>
+<pre>    "2w 3d" means two weeks and three days</pre>
+</p><p>
 Date format is "YYYY-MM-DD" eg:
-    2001-01-01
-
-
-</pre></td></tr>
+<pre>    2001-01-01</pre>
+</p><p>
+</p><p>
+</td></tr>
 
 
 <tr><td valign=top><strong>perftest</strong></td>
-    <td><tt>- perftest [mode] [arguments]*</tt>
-<pre>
-Time operations in Roundup.
+    <td><p><tt>[mode] [arguments]*</tt></p>
 
+<p>
+Time operations in Roundup.
+</p><p>
 Supported arguments:
-
-    [password] [rounds=&lt;integer&gt;] [scheme=&lt;scheme&gt;]
-
+</p><p>
+<pre>    [password] [rounds=&lt;integer&gt;] [scheme=&lt;scheme&gt;]</pre>
+</p><p>
 'password' is the default mode.  The tracker's config.ini
 setting for 'password_pbkdf2_default_rounds' is the default
 value for 'rounds'. On the command line, 'rounds' can include
 thousands separator of ',' or '.'.  'scheme' is the default
 coded into Roundup. List supported schemes by using 'scheme='.
-
-
-</pre></td></tr>
+</p><p>
+</p><p>
+</td></tr>
 
 
 <tr><td valign=top><strong>pragma</strong></td>
-    <td><tt>- pragma setting=value | 'list'</tt>
-<pre>
-Set internal admin settings to a value.
+    <td><p><tt>setting=value | 'list'</tt></p>
 
+<p>
+Set internal admin settings to a value.
+</p><p>
 For example:
-
-    pragma verbose=True
-    pragma verbose=yes
-    pragma verbose=on
-    pragma verbose=1
-
+</p><p>
+<pre>    pragma verbose=True</pre>
+<pre>    pragma verbose=yes</pre>
+<pre>    pragma verbose=on</pre>
+<pre>    pragma verbose=1</pre>
+</p><p>
  will turn on verbose mode for roundup-admin.
-
-    pragma list
-
+</p><p>
+<pre>    pragma list</pre>
+</p><p>
  will show all settings and their current values. If verbose
  is enabled hidden settings and descriptions will be shown.
-
-</pre></td></tr>
+</p><p>
+</td></tr>
 
 
 <tr><td valign=top><strong>reindex</strong></td>
-    <td><tt>- reindex [classname|classname:#-#|designator]*</tt>
-<pre>
-Re-generate a tracker's search indexes.
+    <td><p><tt>[classname|classname:#-#|designator]*</tt></p>
 
+<p>
+Re-generate a tracker's search indexes.
+</p><p>
 This will re-generate the search indexes for a tracker.
 This will typically happen automatically.
-
+</p><p>
 You can incrementally reindex using an argument like:
-
-    reindex issue:23-1000
-
+</p><p>
+<pre>    reindex issue:23-1000</pre>
+</p><p>
 to reindex issue class items 23-1000. Missing items
 are reported but do not stop indexing of the range.
-
-</pre></td></tr>
+</p><p>
+</td></tr>
 
 
 <tr><td valign=top><strong>restore</strong></td>
-    <td><tt>- restore designator[,designator]*</tt>
-<pre>
-Restore the retired node specified by designator.
+    <td><p><tt>designator[,designator]*</tt></p>
 
+<p>
+Restore the retired node specified by designator.
+</p><p>
 A designator is a classname and a nodeid concatenated,
 eg. bug1, user10, ...
-
+</p><p>
 The given nodes will become available for users again.
-
-</pre></td></tr>
+</p><p>
+</td></tr>
 
 
 <tr><td valign=top><strong>retire</strong></td>
-    <td><tt>- retire designator[,designator]*</tt>
-<pre>
-Retire the node specified by designator.
+    <td><p><tt>designator[,designator]*</tt></p>
 
+<p>
+Retire the node specified by designator.
+</p><p>
 A designator is a classname and a nodeid concatenated,
 eg. bug1, user10, ...
-
+</p><p>
 This action indicates that a particular node is not to be retrieved
 by the list or find commands, and its key value may be re-used.
-
-</pre></td></tr>
+</p><p>
+</td></tr>
 
 
 <tr><td valign=top><strong>rollback</strong></td>
-    <td><tt>- rollback</tt>
-<pre>
-Undo all changes that are pending commit to the database.
+    <td><p><tt></tt></p>
 
+<p>
+Undo all changes that are pending commit to the database.
+</p><p>
 The changes made during an interactive session are not
 automatically written to the database - they must be committed
 manually. This command undoes all those changes, so a commit
 immediately after would make no changes to the database.
-
-</pre></td></tr>
+</p><p>
+</td></tr>
 
 
 <tr><td valign=top><strong>security</strong></td>
-    <td><tt>- security [Role name]</tt>
-<pre>
-Display the Permissions available to one or all Roles.
+    <td><p><tt>[Role name]</tt></p>
 
+<p>
+Display the Permissions available to one or all Roles.
+</p><p>
 Also validates that any properties defined in a
 permission are valid.
-
+</p><p>
 Run this after changing your permissions to catch
 typos.
-
-</pre></td></tr>
+</p><p>
+</td></tr>
 
 
 <tr><td valign=top><strong>set</strong></td>
-    <td><tt>- set items property=value [property=value ...]</tt>
-<pre>
-Set the given properties of one or more items(s).
+    <td><p><tt>items property=value [property=value ...]</tt></p>
 
+<p>
+Set the given properties of one or more items(s).
+</p><p>
 The items are specified as a class or as a comma-separated
 list of item designators (ie "designator[,designator,...]").
-
+</p><p>
 A designator is a classname and a nodeid concatenated,
 eg. bug1, user10, ...
-
+</p><p>
 This command sets the properties to the values for all
 designators given. If a class is used, the property will be
 set for all items in the class. If the value is missing
 (ie. "property=") then the property is un-set. If the property
 is a multilink, you specify the linked ids for the multilink
 as comma-separated numbers (ie "1,2,3").
-
-
-</pre></td></tr>
+</p><p>
+</p><p>
+</td></tr>
 
 
 <tr><td valign=top><strong>specification</strong></td>
-    <td><tt>- specification classname</tt>
-<pre>
-Show the properties for a classname.
+    <td><p><tt>classname</tt></p>
 
+<p>
+Show the properties for a classname.
+</p><p>
 This lists the properties for a given class.
-
-</pre></td></tr>
+</p><p>
+</td></tr>
 
 
 <tr><td valign=top><strong>table</strong></td>
-    <td><tt>- table classname [property[,property]*]</tt>
-<pre>
-List the instances of a class in tabular form.
+    <td><p><tt>classname [property[,property]*]</tt></p>
 
+<p>
+List the instances of a class in tabular form.
+</p><p>
 Lists all instances of the given class. If the properties are not
 specified, all properties are displayed. By default, the column
 widths are the width of the largest value. The width may be
 explicitly defined by defining the property as "name:width".
 For example::
-
-  roundup&gt; table priority id,name:10
-  Id Name
-  1  fatal-bug
-  2  bug
-  3  usability
-  4  feature
-
+</p><p>
+<pre>    roundup&gt; table priority id,name:10</pre>
+<pre>    Id Name</pre>
+<pre>    1  fatal-bug</pre>
+<pre>    2  bug</pre>
+<pre>    3  usability</pre>
+<pre>    4  feature</pre>
+</p><p>
 Also to make the width of the column the width of the label,
 leave a trailing : without a width on the property. For example::
-
-  roundup&gt; table priority id,name:
-  Id Name
-  1  fata
-  2  bug
-  3  usab
-  4  feat
-
+</p><p>
+<pre>    roundup&gt; table priority id,name:</pre>
+<pre>    Id Name</pre>
+<pre>    1  fata</pre>
+<pre>    2  bug</pre>
+<pre>    3  usab</pre>
+<pre>    4  feat</pre>
+</p><p>
 will result in a the 4 character wide "Name" column.
-
-</pre></td></tr>
+</p><p>
+</td></tr>
 
 
 <tr><td valign=top><strong>templates</strong></td>
-    <td><tt>- templates [trace_search]</tt>
-<pre>
-List templates and their installed directories.
+    <td><p><tt>[trace_search]</tt></p>
 
+<p>
+List templates and their installed directories.
+</p><p>
 With trace_search also list all directories that are
 searched for templates.
-
-</pre></td></tr>
+</p><p>
+</td></tr>
 
 
 <tr><td valign=top><strong>updateconfig</strong></td>
-    <td><tt>- updateconfig &lt;filename&gt;</tt>
-<pre>
-Merge existing tracker config with new settings.
+    <td><p><tt>&lt;filename&gt;</tt></p>
 
+<p>
+Merge existing tracker config with new settings.
+</p><p>
 Output the updated config file to &lt;filename&gt;. Use current
 settings from existing roundup tracker in tracker home.
-
-</pre></td></tr>
+</p><p>
+</td></tr>
 
 </table>

From 3682c9e442a707ecda2165aa0bfb47010567880f Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sat, 12 Jul 2025 23:22:14 -0400
Subject: [PATCH 254/398] build: 2.5.0 release checkin. Tag to come.

---
 RELEASE.txt                                     |  4 ++--
 doc/security.txt                                |  1 +
 website/www/signatures/roundup-2.5.0.tar.gz.asc | 16 ++++++++++++++++
 3 files changed, 19 insertions(+), 2 deletions(-)
 create mode 100644 website/www/signatures/roundup-2.5.0.tar.gz.asc

diff --git a/RELEASE.txt b/RELEASE.txt
index 6ff06bf0d..9410a721b 100644
--- a/RELEASE.txt
+++ b/RELEASE.txt
@@ -167,10 +167,10 @@ Roundup release checklist:
      can add  --local=roundup-devel@lists.sourceforge.net.
      This will create a file by the name <filename>.tar.gz.asc.
 
-     Move file to website/www/signature directory
+     Move file to website/www/signatures directory
 
        mv <filename>.tar.gz.asc ../website/www/signatures/.
-       hg add ../website/www/signature/<filename>.tar.gz.asc
+       hg add ../website/www/signatures/<filename>.tar.gz.asc
        # commiting the file will be done in step 12
        cd ..
 
diff --git a/doc/security.txt b/doc/security.txt
index 95efcfedd..11aaaf558 100644
--- a/doc/security.txt
+++ b/doc/security.txt
@@ -139,6 +139,7 @@ with 1.6.0 have been moved and are linked below:
 
 .. rst-class:: multicol
 
+* `2.5.0 <../signatures/roundup-2.5.0.tar.gz.asc>`_
 * `2.4.0 <../signatures/roundup-2.4.0.tar.gz.asc>`_
 * `2.4.0b2 <../signatures/roundup-2.4.0b2.tar.gz.asc>`_
 * `2.3.0 <../signatures/roundup-2.3.0.tar.gz.asc>`_
diff --git a/website/www/signatures/roundup-2.5.0.tar.gz.asc b/website/www/signatures/roundup-2.5.0.tar.gz.asc
new file mode 100644
index 000000000..6a80a8b19
--- /dev/null
+++ b/website/www/signatures/roundup-2.5.0.tar.gz.asc
@@ -0,0 +1,16 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQIzBAABCgAdFiEEQR41S10a8mEl1iEiHy3Qy3VqdtgFAmhzJOwACgkQHy3Qy3Vq
+dti+9Q/8CeUL1AUMUuZjB+KZeHSr41wtyFZ0q0gLfHdSYQBHjilDjE/oGKN2qK3j
+/15EZSULAaBt2pyE549jYAVk3lIgEksKsfkDVque7r2NmhTP+ig5Z/o/NL4z/O22
+w5Q5hG7NbttLy9n+7EeCf2BM1kePR9mW8Sk/Zva64TN1+WYkT64rQGL9Fnp0mbfO
++SiD8k7HInc1PcvHB75oLT4n5r4e18VC49f5rzQagMfMc5Ss+/QMKvw7wjB5RGgM
+UQnu73jaEBbeNKFTpSy6mcfEvhp5GWdEMeHK0T+gaq/jNAV+ejn2cRqZSHu5JdEg
+6y0AcleA3x9mmaRx6daLBoVgFbjHhmwBrSgkh3BWux72Dp5TKge0ClbVVJmnXoiC
+rMJ8rtwtXo1TMvzsCMH7PYT/4U4WZ1QjRS2pMNxkEJaqr+HmB7xNSl2eiNIQbGhc
+xnDURGmicNyuij8YYtJzEDYpLIJc8yr1ucboOogziOIX/cFHc3eSIeHy0hNxuFkt
+EZxbJXM3h5MV1t4JaGiteX8l2IgGcVPbJPncI/qmlwZGAkEGjgweZX23tgGGZiqx
+6blTKjXk8Ht33s6Fp2LJChONllSmageV6waqdIq1qYZA/Cd5nCWw06o6a/ljtKAB
+g0DWjD7ntuHAI+1TdAUQwOLF3Ac1C8GDYWBjnGvfKzW7FAKZFn4=
+=uMSK
+-----END PGP SIGNATURE-----

From d66df4491882eda8388904d06616d1f5075b9ba0 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sat, 12 Jul 2025 23:22:50 -0400
Subject: [PATCH 255/398] Added tag 2.5.0 for changeset c7a2e01793cd

---
 .hgtags | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.hgtags b/.hgtags
index 82dc7c4cb..e0d4f7130 100644
--- a/.hgtags
+++ b/.hgtags
@@ -155,3 +155,4 @@ a377590eba34724c5d30d80692257e5ae68aab13 2.4.0b0
 c10df5dfed95dc37e8092861886bf66614b77062 2.4.0b1
 4dfc07ee489ad000c8ffe7ee97b506c94fae6774 2.4.0
 3bf6ad421347c87ae3a6bebe288f8f1dfa7bd6ba 2.5.0b1
+c7a2e01793cdb5228d44df085e3b2f8a73e51c28 2.5.0

From 32f850713e197ad98572ace3156d77e0469e8bba Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 13 Jul 2025 01:36:13 -0400
Subject: [PATCH 256/398] build: exclude sending .buildinfo to sourceforge in
 rsync of docs.

---
 website/www/Makefile | 1 +
 1 file changed, 1 insertion(+)

diff --git a/website/www/Makefile b/website/www/Makefile
index 02e6c333d..a087116a8 100644
--- a/website/www/Makefile
+++ b/website/www/Makefile
@@ -63,6 +63,7 @@ sourceforge_dev_sync:  ## sync html directory to sourceforce /dev_docs subdir
         # IS NOT (and must not be) SET
 	read -p "sync to dev_docs y/N? " resp; echo "$$resp" | grep -i "^y"
 	rsync -av --no-times --delete --exclude 'docs_backup*' \
+              --exclude '.buildinfo' \
               --backup --backup-dir docs_backup-`date --iso-8601=seconds` \
               html/. \
               web.sourceforge.net:/home/project-web/roundup/htdocs/dev_docs/.

From 63ea698cb1e3e61fc88dcb83770726caff1a495a Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 13 Jul 2025 01:38:15 -0400
Subject: [PATCH 257/398] doc: record loss of all files in project directory
 except the website.

Lost the log file we were using for coordinating, the cgi-bin directory
that redirected old wiki links. The venv for processing the
documentation (althogh it was old and they only support python2).
---
 website/README.txt | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/website/README.txt b/website/README.txt
index 5cdf371a5..328496c94 100644
--- a/website/README.txt
+++ b/website/README.txt
@@ -39,6 +39,11 @@ http://web.archive.org/web/20140618231150/http://sourceforge.net/apps/trac/sourc
     cd ${project_home}
     vim logbuch.txt
 
+[ Note: all the files in the project home except htdocs that make up
+  the website were gone. I created a new logbuch.txt file. We need to
+  build the docs outside the sourceforge envirnment and rsync them in
+  as there is no longer a working sphinx environment. ]
+
 If you get a "not trusting" error the problem is that the .hg files in
 use are not owned by you and hg won't use them. Add this to your
 ~/.hgrc file (create file if needed)

From bdabfd02b33b588e1064872a062812fee1016d93 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 16 Jul 2025 20:00:07 -0400
Subject: [PATCH 258/398] doc: add waitress wsgi serve docs

Waitress is a pure python wsgi server. Seems to work under windows.
Added doc that worked for me to spin up a wsgi.py file with
waitress in a venv.
---
 doc/installation.txt | 57 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 57 insertions(+)

diff --git a/doc/installation.txt b/doc/installation.txt
index 7ba0a2688..14d5b0087 100644
--- a/doc/installation.txt
+++ b/doc/installation.txt
@@ -1442,6 +1442,63 @@ nginx configuration below.
 If you are customizing a docker continer to use gunicorn, see
 https://pythonspeed.com/articles/gunicorn-in-docker/.
 
+.. index:: pair: web interface; Waitress
+   single: wsgi; Waitress
+
+Waitress Installation
+~~~~~~~~~~~~~~~~~~~~~
+
+Waitress is a pure Python WSGI server. It runs on Windows and you
+could use IIS or other web server to reverse proxy HTTP to it.
+
+You can use Waitress to serve Roundup without a proxy. It's not
+recommended, but it can be used on a local network where roundup can't
+be accessed from the internet.
+
+Assuming you have installed Roundup in a virtual environment (venv),
+install ``waitress`` and ``paste`` into the same venv using
+pip. ``paste`` is optional, but it provides logging middleware that
+produces standard combined format HTTP connection logs. You need to
+modify the file wsgi.py (obtained from ``frontends/wsgi.py``) to
+invoke waitress. It will look like::
+
+    # If you installed roundup to the system locations
+    # using pip you don't need to change this
+    # section. If you installed roundup in a custom
+    # location, uncomment these lines and change the
+    # path in the append() method to your custom path.
+    #import sys
+    #sys.path.append('/custom/location/where/roundup/is/installed')
+
+    # Obtain the WSGI request dispatcher
+    from roundup.cgi.wsgi_handler import RequestDispatcher
+
+    # Set the path to tracker home.
+    tracker_home = 'demo'
+
+    # Definition signature for app: app(environ, start_response):
+    # If using apache mod_wsgi change app to application.
+    app =  RequestDispatcher(tracker_home)
+
+    from waitress import serve
+    # Optional replaced TransLogger(app) with app if not installed
+    from paste.translogger import TransLogger
+    serve(TransLogger(app),
+	  host='0.0.0.0',
+	  port=8917,
+	  url_prefix=f"/{tracker_home}/")
+
+This will make Roundup available to any host on your local network at
+port 8917 under the ``/demo/`` path. Run it with ``python wsgi.py``.
+If you want to run just on the local loopback interface, replace
+``0.0.0.0`` with ``127.0.0.1``
+
+`See the Waitress docs`_ for more info on configuring waitress
+including putting it behind a proxy, IPV6 support etc.
+
+.. _`See the Waitress docs`:
+   https://docs.pylonsproject.org/projects/waitress/en/stable/
+
 .. index:: pair: web interface; uWSGI
    single: wsgi; uWSGI
 

From 292dabf3ef3a04b41a8976af8a6ea89a4c2523c5 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 16 Jul 2025 20:02:11 -0400
Subject: [PATCH 259/398] doc: move #target a 2em from top of viewport.

Make sure there is a little space between top of viewport and the
element selected with a #fragment. This looks cleaner.
---
 doc/_static/style.css         | 4 ++++
 website/www/_static/style.css | 5 +++++
 2 files changed, 9 insertions(+)

diff --git a/doc/_static/style.css b/doc/_static/style.css
index 92cfa2620..ef5215caf 100644
--- a/doc/_static/style.css
+++ b/doc/_static/style.css
@@ -512,3 +512,7 @@ aside.footnote > span + p { margin-block-start: unset; }
 }
 */
 
+/* move the target off the top of the viewport by a little */
+:target {
+  scroll-margin-block-start: 2em;
+}
diff --git a/website/www/_static/style.css b/website/www/_static/style.css
index a8516d195..aa319c4b2 100644
--- a/website/www/_static/style.css
+++ b/website/www/_static/style.css
@@ -512,6 +512,11 @@ aside.footnote > span + p { margin-block-start: unset; }
 }
 */
 
+/* move the target off the top of the viewport by a little */
+:target {
+  scroll-margin-block-start: 2em;
+}
+
 /* website only */
 /* assume desktop reader for local html files, also no contact
    page for local doc files */

From 7aa071d6062f1fa87910e8398bd4ee9618e198f9 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sat, 9 Aug 2025 20:30:51 -0400
Subject: [PATCH 260/398] fix: perf improvement for session clean() and warning
 added

Replaced a subtraction and comparison operation an inner loop with a
comparison against a threhold. This mimics the session_rdbms code that
uses a constant value for the timestamp threshold.

Also added a log warning messge if clean() takes more than 3 seconds.

It took me a while to track down the cause of an increasing delay in
CGI response. Turns out it was cleaning the dbm otks database with
1.5k entries.
---
 roundup/backends/sessions_dbm.py | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/roundup/backends/sessions_dbm.py b/roundup/backends/sessions_dbm.py
index 02828ed29..5eca055a4 100644
--- a/roundup/backends/sessions_dbm.py
+++ b/roundup/backends/sessions_dbm.py
@@ -203,15 +203,18 @@ def clean(self):
         ''' Remove session records that haven't been used for a week. '''
         now = time.time()
         week = 60*60*24*7
+        a_week_ago = now - week
         for sessid in self.list():
             sess = self.get(sessid, '__timestamp', None)
             if sess is None:
                 self.updateTimestamp(sessid)
                 continue
-            interval = now - sess
-            if interval > week:
+            if a_week_ago > sess:
                 self.destroy(sessid)
 
+        run_time = time.time() - now
+        if run_time > 3:
+            self.log_warning("clean() took %.2fs", run_time)
 
 class Sessions(BasicDatabase):
     name = 'sessions'

From ce73dd2aee2860da3e4590c3cfcfbb661c49e8fc Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sat, 9 Aug 2025 21:43:44 -0400
Subject: [PATCH 261/398] doc: fix missing '>'

---
 doc/customizing.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/customizing.txt b/doc/customizing.txt
index 060a5bd2a..35ea1d02f 100644
--- a/doc/customizing.txt
+++ b/doc/customizing.txt
@@ -1892,7 +1892,7 @@ To edit the status of all items in the item index view, edit the
    and at the bottom of that table add::
 
      </table>
-    </form
+    </form>
 
    making sure you match the ``</table>`` from the list table, not the
    navigation table or the subsequent form table.

From 34f7ac54a136e2f11075a108edeff97beec2e699 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 10 Aug 2025 20:18:30 -0400
Subject: [PATCH 262/398] fix: replace incorrect attributions on roundup issue
 tracker.

Remove digital ocean reference replace url to roundup with canonical
not sourceforge url.
---
 website/issues/html/page.html | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/website/issues/html/page.html b/website/issues/html/page.html
index f4e798316..c5a9403b7 100644
--- a/website/issues/html/page.html
+++ b/website/issues/html/page.html
@@ -214,11 +214,9 @@ <h1 id="breadcrumb"><span metal:define-slot="body_title">body title</span></h1>
 <div class="footer">
 <div id="credits">
   <p>
-    Hosted on <a href="https://m.do.co/c/783434964889" title="Hosted on DigitalOcean">DigitalOcean</a>,
-    <br>
     Supported by <a href="https://www.python.org/psf-landing/" title="The Python Software Foundation">The Python Software Foundation</a>,
     <br>
-    Powered by <a href="https://roundup.sourceforge.io" title="Powered by the Roundup Issue Tracker">Roundup</a>
+    Powered by <a href="https://www.roundup-tracker.org" title="Powered by the Roundup Issue Tracker">Roundup</a>
   </p>
 </div> <!-- credits -->
 <!-- Created: Wed Jan 14 11:55:38 EST 2009 -->

From 4d00d1cac6d15eebdec57143ad96b4139301b42e Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 10 Aug 2025 20:23:02 -0400
Subject: [PATCH 263/398] fix: remove unclosed opening form tag.

Same form tag is duplicated later in document.
---
 website/issues/html/_generic.help-list.html | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/website/issues/html/_generic.help-list.html b/website/issues/html/_generic.help-list.html
index ee96842d7..92293f8d3 100644
--- a/website/issues/html/_generic.help-list.html
+++ b/website/issues/html/_generic.help-list.html
@@ -25,7 +25,6 @@
 
   <tal:if condition="context/is_view_ok">
   <tal:def define="batch request/batch;">
-  <form name=dummyform>
     <table width="100%"
       tal:define="template string:help-list"
       metal:use-macro="templates/help/macros/batch_navi"
@@ -42,7 +41,7 @@
       </tr>
      </table>
 
-  <form name=dummyform>
+  <form name="dummyform">
   <table class="classhelp"
     tal:define="
        props python:request.form['properties'].value.split(',');

From 378e849de7ea6246cac55b717ae7d14277254437 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 10 Aug 2025 20:31:16 -0400
Subject: [PATCH 264/398] perf: lazy evaluate debug logger command.

---
 roundup/backends/back_anydbm.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/roundup/backends/back_anydbm.py b/roundup/backends/back_anydbm.py
index 6f5eedcbb..ca02f1717 100644
--- a/roundup/backends/back_anydbm.py
+++ b/roundup/backends/back_anydbm.py
@@ -296,7 +296,8 @@ def opendb(self, name, mode):
         if not db_type or hasattr(anydbm, 'whichdb'):
             if __debug__:
                 logging.getLogger('roundup.hyperdb.backend').debug(
-                    "opendb anydbm.open(%r, 'c')" % path)
+                    "opendb anydbm.open(%(path)r, 'c')",
+                    {"path": path,})
             return anydbm.open(path, 'c')
 
         # in Python <3 it anydbm was a little dumb so manually open the

From fbbe2b0ca2e9c220c8316f64b4e9680a0fa7a2df Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 10 Aug 2025 20:57:57 -0400
Subject: [PATCH 265/398] Doc: add docstrings to http exceptions

---
 roundup/cgi/exceptions.py | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/roundup/cgi/exceptions.py b/roundup/cgi/exceptions.py
index e1c69f307..386f5746b 100644
--- a/roundup/cgi/exceptions.py
+++ b/roundup/cgi/exceptions.py
@@ -15,22 +15,29 @@ class RoundupCGIException(RoundupException):
 
 
 class HTTPException(RoundupCGIException):
+    """Base exception for all HTTP error codes."""
     pass
 
 
 class Redirect(HTTPException):
+    """HTTP 302 status code"""
     pass
 
 
 class NotFound(HTTPException):
+    """HTTP 404 status code unless self.response_code is set to
+       400 prior to raising exception.
+    """
     pass
 
 
 class NotModified(HTTPException):
+    """HTTP 304 status code"""
     pass
 
 
 class PreconditionFailed(HTTPException):
+    """HTTP 412 status code"""
     pass
 
 

From f324c8427f67e24761334d8baef022eeae5673b9 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 10 Aug 2025 21:27:06 -0400
Subject: [PATCH 266/398] refactor: move RateLimitExceeded to
 roundup.cgi.exceptions

RateLimitExceeded is an HTTP exception that raises code 429. Move it
to roundup.cgi.exceptions where all the other exceptions that result
in http status codes are located. Also make it inherit from
HTTPException since it is one.

Also add docstrings for all HTTP exceptions and order HTTPExceptions
by status code.

BREAKING CHANGE: if somebody is importing RateLimitExceeded they will
need to change their import. I consider it unlikely anybody is using
RateLimitExceeded. Detectors and extensions are unlikely to raise
RateLimitExceeded. So I am leaving it out of the upgrading doc. Just
doc in change log.
---
 CHANGES.txt               | 13 +++++++++++++
 roundup/cgi/actions.py    |  3 ++-
 roundup/cgi/client.py     |  2 +-
 roundup/cgi/exceptions.py | 13 +++++++++----
 roundup/exceptions.py     |  4 ----
 5 files changed, 25 insertions(+), 10 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index 79f85a64e..0762fecd7 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -13,6 +13,19 @@ Roundup 2.0 supports Python 3.4 and later. Roundup 2.1.0 supports
 python 3.6 or newer (3.4/3.5 might work, but they are not tested).
 Roundup 2.4.0 is the last release to support Python 2.
 
+2026-XX-XX 2.6.0
+
+Fixed:
+
+- performance improvement to session_dbm.py:clean(). Also add warning
+  log message if clean takes longer than 3 seconds. (John Rouillard)
+- move RateLimitExceeded exception from roundup.exceptions to
+  roundup.cgi.exceptions. Also it now inherits from HTTPException
+  rather than Exception since it is an HTTP exception. (John
+  Rouillard)
+
+Features:
+
 2025-07-13 2.5.0
 
 Fixed:
diff --git a/roundup/cgi/actions.py b/roundup/cgi/actions.py
index 0aa9cb064..832eb6c7c 100644
--- a/roundup/cgi/actions.py
+++ b/roundup/cgi/actions.py
@@ -11,8 +11,9 @@
 from roundup.anypy.html import html_escape
 from roundup.anypy.strings import StringIO
 from roundup.cgi import exceptions, templating
+from roundup.cgi.exceptions import RateLimitExceeded
 from roundup.cgi.timestamp import Timestamped
-from roundup.exceptions import RateLimitExceeded, Reject, RejectRaw
+from roundup.exceptions import Reject, RejectRaw
 from roundup.i18n import _
 from roundup.mailgw import uidFromAddress
 from roundup.rate_limit import Gcra, RateLimit
diff --git a/roundup/cgi/client.py b/roundup/cgi/client.py
index d999037b4..829160c04 100644
--- a/roundup/cgi/client.py
+++ b/roundup/cgi/client.py
@@ -40,6 +40,7 @@ class SysCallError(Exception):
     IndexerQueryError,
     NotFound,
     NotModified,
+    RateLimitExceeded,
     Redirect,
     SendFile,
     SendStaticFile,
@@ -48,7 +49,6 @@ class SysCallError(Exception):
 from roundup.cgi.form_parser import FormParser
 from roundup.exceptions import (
     LoginError,
-    RateLimitExceeded,
     Reject,
     RejectRaw,
     Unauthorised,
diff --git a/roundup/cgi/exceptions.py b/roundup/cgi/exceptions.py
index 386f5746b..762201c4a 100644
--- a/roundup/cgi/exceptions.py
+++ b/roundup/cgi/exceptions.py
@@ -24,6 +24,11 @@ class Redirect(HTTPException):
     pass
 
 
+class NotModified(HTTPException):
+    """HTTP 304 status code"""
+    pass
+
+
 class NotFound(HTTPException):
     """HTTP 404 status code unless self.response_code is set to
        400 prior to raising exception.
@@ -31,13 +36,13 @@ class NotFound(HTTPException):
     pass
 
 
-class NotModified(HTTPException):
-    """HTTP 304 status code"""
+class PreconditionFailed(HTTPException):
+    """HTTP 412 status code"""
     pass
 
 
-class PreconditionFailed(HTTPException):
-    """HTTP 412 status code"""
+class RateLimitExceeded(HTTPException):
+    """HTTP 429 error code"""
     pass
 
 
diff --git a/roundup/exceptions.py b/roundup/exceptions.py
index ee4c82794..a90d927e8 100644
--- a/roundup/exceptions.py
+++ b/roundup/exceptions.py
@@ -12,10 +12,6 @@ class LoginError(RoundupException):
     pass
 
 
-class RateLimitExceeded(Exception):
-    pass
-
-
 class Unauthorised(RoundupException):
     pass
 

From 36e651384e815f5ee85e1916034f1cb635ef5e5a Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 10 Aug 2025 22:04:03 -0400
Subject: [PATCH 267/398] refactor! move RateLimitExceeded to
 roundup.cgi.exceptions - test

forgot to commit the change to the test as well
---
 test/test_actions.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/test/test_actions.py b/test/test_actions.py
index aa00fc255..765dc4238 100644
--- a/test/test_actions.py
+++ b/test/test_actions.py
@@ -5,8 +5,8 @@
 from roundup.date import Date, Interval
 from roundup.cgi.actions import *
 from roundup.cgi.client import add_message
-from roundup.cgi.exceptions import Redirect, Unauthorised, SeriousError, FormError
-from roundup.exceptions import RateLimitExceeded, Reject
+from roundup.cgi.exceptions import RateLimitExceeded, Redirect, Unauthorised, SeriousError, FormError
+from roundup.exceptions import Reject
 
 from roundup.anypy.cgi_ import FieldStorage, MiniFieldStorage
 from roundup.anypy.cmp_ import NoneAndDictComparable

From 72d453ab3e28a67a800d2d37dc45046725a97b62 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 11 Aug 2025 02:37:49 -0400
Subject: [PATCH 268/398] build: dependabot anchore scan upgrade to 6.5.1

---
 .github/workflows/anchore.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/anchore.yml b/.github/workflows/anchore.yml
index f033f1361..7eff99f17 100644
--- a/.github/workflows/anchore.yml
+++ b/.github/workflows/anchore.yml
@@ -43,7 +43,7 @@ jobs:
     - name: List the Docker image
       run: docker image ls
     - name: Run the Anchore scan action itself with GitHub Advanced Security code scanning integration enabled
-      uses: anchore/scan-action@be7a22da4f22dde446c4c4c099887ff5b256526c # 6.3.0
+      uses: anchore/scan-action@1638637db639e0ade3258b51db49a9a137574c3e # 6.5.1
       id: scan
       with:
         image: "localbuild/testimage:latest"

From 7db4be69a3902d4a1eac00641d6352e9a8fd3e16 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 11 Aug 2025 14:01:12 -0400
Subject: [PATCH 269/398] feat(security): Add user confirmation/reauth for
 sensitive changes

Auditors can raise Reauth(reason) exception to require the user to
enter a token (e.g. account password) to verify the user is performing
the change.

Naming is subject to change.

actions.py: New ReauthAction class handler and verifyPassword() method
 for overriding if needed.

client.py: Handle Reauth exception by calling Client:reauth() method.
 Default client:reauth method.  Add 'reauth' action declaration.

exceptions.py: Define and document Reauth exception as a subclass of
 RoundupCGIException.

templating.py: Define method utils.embed_form_fields().

   The original form making a change to the database has a lot of form
   fields. These need to be resubmitted to Roundup as part of the form
   submission that verifies the user's password.

   This method turns all non file form fields into type=hidden inputs.
   It escapes the names and values to prevent XSS.

   For file form fields, it base64 encodes the contents and puts them
   in hidden pre blocks. The pre blocks have data attributes for the
   filename, filetype and the original field name. (Note the original
   field name is not used.)

   This stops the file content data (maybe binary e.g. jpegs) from
   breaking the html page. The reauth template runs JavaScript that
   turns the encoded data inside the pre tags back into a file. Then
   it adds a multiple file input control to the page and attaches all
   the files to it. This file input is submitted with the rest of the
   fields.

_generic.reauth.html (multiple tracker templates): Generates a form
 with id=reauth_form to:

   display any message from the Reauth exception to the user (e.g. why
   user is asked to auth).

   get the user's password

   submit the form

   embed all the form data that triggered the reauth

   recreate any file data that was submitted as part of the form and
   generate a new file input to push the data to the back end

 It has the JavaScript routine (as an IIFE) that regenerates a file
 input without user intervention.

 All the TAL based tracker templates use the same form. There is also
 one for the jinja2 template. The JavaScript for both is the same.

reference.txt: document embed_form_fields utility method.

upgrading.txt: initial upgrading docs.

TODO:

Finalize naming. I am leaning toward ConfirmID rather than Reauth.
Still looking for a standard name for this workflow.

Externalize the javascript in _generic.reauth.html to a seperate file
and use utils.readfile() to embed it or change the script to load it
from a @@file url.

Clean up upgrading.txt with just steps to implement and less feature
detail/internals.

Document internals/troubleshooting in reference.txt.

Add tests using live server.
---
 CHANGES.txt                                   |   4 +
 doc/reference.txt                             |   5 +
 doc/upgrading.txt                             |  65 +++++++++
 roundup/cgi/actions.py                        | 131 +++++++++++++++++-
 roundup/cgi/client.py                         |  42 ++++++
 roundup/cgi/exceptions.py                     |  21 +++
 roundup/cgi/templating.py                     | 109 ++++++++++++++-
 .../classic/html/_generic.reauth.html         | 124 +++++++++++++++++
 .../templates/devel/html/_generic.reauth.html | 124 +++++++++++++++++
 .../jinja2/html/_generic.reauth.html          | 124 +++++++++++++++++
 .../minimal/html/_generic.reauth.html         | 124 +++++++++++++++++
 .../responsive/html/_generic.reauth.html      | 124 +++++++++++++++++
 12 files changed, 995 insertions(+), 2 deletions(-)
 create mode 100644 share/roundup/templates/classic/html/_generic.reauth.html
 create mode 100644 share/roundup/templates/devel/html/_generic.reauth.html
 create mode 100644 share/roundup/templates/jinja2/html/_generic.reauth.html
 create mode 100644 share/roundup/templates/minimal/html/_generic.reauth.html
 create mode 100644 share/roundup/templates/responsive/html/_generic.reauth.html

diff --git a/CHANGES.txt b/CHANGES.txt
index 0762fecd7..122e83527 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -26,6 +26,10 @@ Fixed:
 
 Features:
 
+- add support for authorized changes. User can be prompted to enter
+  their password to authorize a change. If the user's password is
+  properly entered, the change is committed. (John Rouillard)
+
 2025-07-13 2.5.0
 
 Fixed:
diff --git a/doc/reference.txt b/doc/reference.txt
index 392339dcc..e792623d1 100644
--- a/doc/reference.txt
+++ b/doc/reference.txt
@@ -3577,6 +3577,11 @@ be added to the variable by using extensions_.
      - set_http_response sets the HTTP response code for the request.
    * - :meth:`url_quote <roundup.cgi.templating.TemplatingUtils.url_quote>`
      - quote some text as safe for a URL (ie. space, %, ...)
+   * - :meth:`embed_form_fields <roundup.cgi.templating.TemplatingUtils.embed_form_fields>`
+     - Creates a hidden input for each of the client's form fields. It
+       also embeds base64 encoded file contents into pre tags and
+       processes that informtion back into a file input control.
+
 
 -----
 
diff --git a/doc/upgrading.txt b/doc/upgrading.txt
index 13cd1d4bd..40ef3c243 100644
--- a/doc/upgrading.txt
+++ b/doc/upgrading.txt
@@ -103,6 +103,71 @@ your database.
 
   </details>
 
+.. index:: Upgrading; 2.5.0 to 2.6.0
+
+Migrating from 2.5.0 to 2.6.0
+=============================
+
+Support authorized changes in your tracker (optional)
+-----------------------------------------------------
+
+An auditor can require change verification with user's password.
+
+When changing sensitive information (e.g. passwords) it is
+useful to ask for a validated authorization. This makes sure
+that the user is present by typing their password.
+
+In an auditor adding::
+
+   from roundup.cgi.exceptions import Reauth
+
+   if 'password' in newvalues and not getattr(db, 'reauth_done', False):
+      raise Reauth('Add an optional message to the user')
+
+will present the user with a authorization page and optional message
+when the password is changed.  The page is generated from the
+``_generic.reauth.html`` template by default.
+
+Once the user enters their password and submits the page, the
+password will be verified using:
+
+    roundup.cgi.actions:LoginAction::verifyPassword()
+
+If the password is correct the original change is done.
+
+To prevent the auditor from trigering another Reauth, the
+attribute ``reauth_done`` is added to the db object. As a result,
+the getattr call will return True and not raise Reauth.
+
+You get one reauth for a submitted change. Note you cannot Reauth
+multiple properties separately. If you need to auth multiple
+properties separately, you need to reject the change and force the
+user to submit each sensitive property separately.  For example::
+
+   if 'password' in newvalues and 'realname' in newvalues:
+      raise Reject('Changing the username and the realname '
+		   'at the same time is not allowed. Please '
+		   'submit two changes.')
+
+   if 'password' in newvalues and not getattr(db, 'reauth_done', False):
+      raise Reauth()
+
+   if 'realname' in newvalues and not getattr(db, 'reauth_done', False):
+      raise Reauth()
+
+See also: client.py:Client:reauth(self, exception) which can be changed
+using interfaces.py in your tracker.
+
+You should copy ``_generic.reauth.html`` into your tracker's html
+subdirectory. See the classic template directory for a copy. If you
+are using jinja2, see the jinja2 template directory.  Then you can
+raise a Reauth exception and have the proper page displayed.
+
+Also javascript *MUST* be turned on if this is used with a file
+input. If JavaScript is not turned on, attached files are lost during
+the reauth step. Information from other types of inputs (password,
+date, text etc.) do not need JavaScript to work.
+
 .. index:: Upgrading; 2.4.0 to 2.5.0
 
 Migrating from 2.4.0 to 2.5.0
diff --git a/roundup/cgi/actions.py b/roundup/cgi/actions.py
index 832eb6c7c..68e96e175 100644
--- a/roundup/cgi/actions.py
+++ b/roundup/cgi/actions.py
@@ -23,7 +23,8 @@
            'SearchAction',
            'EditCSVAction', 'EditItemAction', 'PassResetAction',
            'ConfRegoAction', 'RegisterAction', 'LoginAction', 'LogoutAction',
-           'NewItemAction', 'ExportCSVAction', 'ExportCSVWithIdAction']
+           'NewItemAction', 'ExportCSVAction', 'ExportCSVWithIdAction',
+           'ReauthAction']
 
 
 class Action:
@@ -1843,6 +1844,134 @@ def handle(self):
 
         return '\n'
 
+class ReauthAction(Action):
+    '''Allow an auditor to require change verification with user's password.
+
+       When changing sensitive information (e.g. passwords) it is
+       useful to ask for a validated authorization. This makes sure
+       that the user is present by typing their password.
+
+       In an auditor adding::
+
+          if 'password' in newvalues and not getattr(db, 'reauth_done', False):
+             raise Reauth()
+
+       will present the user with a authorization page when the
+       password is changed.  The page is generated from the
+       _generic.reauth.html template by default.
+
+       Once the user enters their password and submits the page, the
+       password will be verified using:
+       roundup.cgi.actions:LoginAction::verifyPassword().  If the
+       password is correct the original change is done.
+
+       To prevent the auditor from trigering another Reauth, the
+       attribute "reauth_done" is added to the db object. As a result,
+       the getattr call will return True and not raise Reauth.
+
+       You get one reauth for the submitted change. Note you cannot
+       Reauth multiple properties separately. If you need to auth
+       multiple properties separately, you need to reject the change
+       and force the user to submit each sensitive property separately.
+       For example::
+
+          if 'password' in newvalues and 'realname' in newvalues:
+             raise Reject('Changing the username and the realname '
+                          'at the same time is not allowed. Please '
+                          'submit two changes.')
+
+          if 'password' in newvalues and not getattr(db, 'reauth_done', False):
+             raise Reauth()
+
+          if 'realname' in newvalues and not getattr(db, 'reauth_done', False):
+             raise Reauth()
+
+        Limitations: It can not handle file input fields.
+
+        See also: client.py:Client:reauth() which can be changed
+        using interfaces.py in your tracker.
+    '''
+
+    def handle(self):
+        ''' Handle a form with a reauth request.
+        '''
+
+        if self.client.env['REQUEST_METHOD'] != 'POST':
+            raise Reject(self._('Invalid request'))
+
+        if '@reauth_password' not in self.form:
+            self.client.add_error_message(self._('Password incorrect.'))
+            return
+
+        # Verify password
+        login = self.client.get_action_class('login')(self.client)
+        if not self.verifyPassword():
+            self.client.add_error_message(self._("Password incorrect."))
+            self.client.template = "reauth"
+
+            # Strip fields that are added by the template. All
+            # the rest of the fields in self.form.list are added
+            # as hidden fields by the reauth template.
+            self.form.list = [ x for x in self.form.list
+                               if x.name not in (
+                                       '@action',
+                                       '@csrf',
+                                       '@reauth_password',
+                                       '@template',
+                                       'submit'
+                               )
+                              ]
+            return
+
+        # extract the info we need to preserve/reinject into
+        # the next action.
+        
+        if '@next_action' not in self.form: # required to look up next action
+            self.client.add_error_message(
+                self._('Missing action to be authorized.'))
+            return
+
+        action = self.form['@next_action'].value.lower()
+
+        next_template = None;  # optional
+        if '@next_template' in self.form:
+            next_template = self.form['@next_template'].value
+
+        # rewrite the form for redisplay
+        # remove all the reauth_form_fields leaving just the original
+        # form fields from the form that trigered the reauth.
+        # We extracted @next_* above to route to the original action
+        # and template.
+
+        reauth_form_fields = ('@reauth_password', '@template',
+                              '@next_template', '@action',
+                              '@next_action', '@csrf', 'submit')
+
+        self.form.list = [ x for x in self.form.list
+                              if x.name not in reauth_form_fields
+                          ]
+
+        try:
+            action_klass = self.client.get_action_class(action)
+
+            # set the template to go back to
+            # use "" not None as this value gets encoded and None is invalid
+            self.client.template = next_template if next_template else ""
+            # use this in detector (to skip reauth
+            self.client.db.reauth_done = True
+            
+            # should raise exception Redirect
+            action_klass(self.client).execute()
+
+        except (ValueError, Reject) as err:
+            escape = not isinstance(err, RejectRaw)
+            self.add_error_message(str(err), escape=escape)
+
+    def verifyPassword(self):
+        login = self.client.get_action_class('login')(self.client)
+        return login.verifyPassword(self.userid,
+                                    self.form['@reauth_password'].value)
+
 
 class Bridge(BaseAction):
     """Make roundup.actions.Action executable via CGI request.
diff --git a/roundup/cgi/client.py b/roundup/cgi/client.py
index 829160c04..af5d2500a 100644
--- a/roundup/cgi/client.py
+++ b/roundup/cgi/client.py
@@ -41,6 +41,7 @@ class SysCallError(Exception):
     NotFound,
     NotModified,
     RateLimitExceeded,
+    Reauth,
     Redirect,
     SendFile,
     SendStaticFile,
@@ -960,6 +961,8 @@ def inner_main(self):
 
         except SeriousError as message:
             self.write_html(str(message))
+        except Reauth as e:
+            self.reauth(e)
         except Redirect as url:
             # let's redirect - if the url isn't None, then we need to do
             # the headers, otherwise the headers have been set before the
@@ -1916,6 +1919,44 @@ def determine_context(self, dre=dre_url):
         if template_override is not None:
             self.template = template_override
 
+    def reauth(self, exception):
+        """Processing for a Reauth exception raised from an auditor.
+
+           Can be overridden by code in tracker's interfaces.py.
+        """
+        
+        from roundup.anypy.vendored.cgi import MiniFieldStorage
+
+        original_action = self.form['@action'].value if '@action' \
+            in self.form else ""
+        original_template = self.template
+
+        self.template = 'reauth'
+        self.form.list = [ x for x in self.form.list
+                           if x.name not in ('@action',
+                                             '@csrf',
+                                             '@template'
+                                             )]
+
+        # save the action and template used when the Reauth as
+        # triggered. Will be used to resolve the change by the reauth
+        # action when when reauth password verified.
+        if '@next_action' not in self.form.list:
+            self.form.list.append(MiniFieldStorage('@next_action',
+                                                   original_action))
+        if '@next_template' not in self.form.list:
+            self.form.list.append(MiniFieldStorage('@next_template',
+                                                   original_template))
+
+        if exception.args and "@reauth_message" not in self.form.list:
+            self.form.list.append(
+                MiniFieldStorage('@reauth_message',
+                                 html_escape(exception.args[0])
+                )
+            )
+
+        self.write_html(self.renderContext())
+
     # re for splitting designator, see also dre_url above this one
     # doesn't strip leading 0's from the id. Why not??
     dre = re.compile(r'([^\d]+)(\d+)')
@@ -2365,6 +2406,7 @@ def renderError(self, error, response_code=400, use_template=True):
         ('show',        actions.ShowAction),  # noqa: E241
         ('export_csv',  actions.ExportCSVAction),  # noqa: E241
         ('export_csv_id',  actions.ExportCSVWithIdAction),  # noqa: E241
+        ('reauth',      actions.ReauthAction),  # noqa: E241
     )
 
     def handle_action(self):
diff --git a/roundup/cgi/exceptions.py b/roundup/cgi/exceptions.py
index 762201c4a..c06b8dd2f 100644
--- a/roundup/cgi/exceptions.py
+++ b/roundup/cgi/exceptions.py
@@ -14,6 +14,27 @@ class RoundupCGIException(RoundupException):
     pass
 
 
+class Reauth(RoundupCGIException):
+    """Raised by auditor, to trigger password verification before commit.
+
+       Before committing changes to sensitive fields, triggers the
+       following workflow:
+
+         1. user is presented with a page to enter his/her password
+         2. page is submitted to reauth action
+         3. password is verified by LoginAction.verifyPassword
+         4. change is committed to database.
+
+         If 3 fails, restart at step 1.
+
+         Client.reauth() method is used to handle step 1. Should be
+         able to be overridden in interfaces.py. Step 2 is done by
+         _generic.reauth.html. Steps 3 and 4 (and cycle back to 1) is
+         done by cgi/actions.py:Reauth action.
+    """
+    pass
+
+
 class HTTPException(RoundupCGIException):
     """Base exception for all HTTP error codes."""
     pass
diff --git a/roundup/cgi/templating.py b/roundup/cgi/templating.py
index 7fbda8a8f..3edea6651 100644
--- a/roundup/cgi/templating.py
+++ b/roundup/cgi/templating.py
@@ -31,7 +31,7 @@
 from roundup.anypy import urllib_
 from roundup.anypy.cgi_ import cgi
 from roundup.anypy.html import html_escape
-from roundup.anypy.strings import StringIO, is_us, s2u, u2s, us2s
+from roundup.anypy.strings import StringIO, b2s, bs2b, is_us, s2u, u2s, us2s
 from roundup.cgi import TranslationService, ZTUtils
 from roundup.cgi.timestamp import pack_timestamp
 from roundup.exceptions import RoundupException
@@ -3615,6 +3615,113 @@ def html_quote(self, html):
         """HTML-quote the supplied text."""
         return html_escape(html)
 
+    def embed_form_fields(self, excluded_fields=None):
+        """Used to create a hidden input field for each client.form element
+
+           :param: excluded_fields string or something with
+                   __contains__ dunder method (tuple, list, set...).
+
+           Limitations: It ignores file input fields.
+        """
+        if excluded_fields is None:
+            excluded_fields = ()
+        elif isinstance(excluded_fields, str):
+            excluded_fields = (excluded_fields,)
+        elif hasattr(excluded_fields, '__contains__'):
+            pass
+        else:
+            raise ValueError(self._(
+                'The excluded_fields parameter is invalid.'
+                'It must have a __contains__ method.')
+            )
+
+        rtn = []
+
+        for field in self.client.form.list:
+            if field.name in excluded_fields:
+                continue
+
+            if field.filename is not None:
+                import base64
+                # FIXME if possible
+                rtn.append(
+                    '<pre hidden data-name="%s" data-filename="%s" data-mimetype="%s">%s</pre>' %
+                    (
+                        html_escape(field.name, quote=True),
+                        html_escape(field.filename, quote=True),
+                        html_escape(field.type, quote=True),
+                        b2s(base64.b64encode(bs2b(field.value))),
+                    )
+                )
+                continue
+
+            hidden_input = (
+                """<input type="hidden" name="%s" value="%s">""" %
+	        (
+                    html_escape(field.name, quote=True),
+                    html_escape(field.value, quote=True)
+                )
+            )
+
+            rtn.append(hidden_input)
+
+        return "\n".join(rtn)
+
+
+    """
+    Possible solution to file retention issue:
+    From: https://stackoverflow.com/questions/16365668/pre-populate-html-form-f
+
+    const transfer = new DataTransfer();
+    transfer.items.add(new File(['file 1 content'], 'file 1.txt'));
+    transfer.items.add(new File(['file 2 content'], 'file 2.txt'));
+    document.querySelector('input').files = transfer.files;
+
+    document.querySelector('form').addEventListener('submit', e => {
+         e.preventDefault();
+         console.log(...new FormData(e.target));
+    });
+
+    <form>
+      <input name="files" type="file" multiple /> <br />
+      <button>Submit</button>
+    </form>
+
+    Name would be @file for Roundup.
+
+    see also: https://developer.mozilla.org/en-US/docs/Web/API/File/File
+
+    open question: how to make sure the file contents are safely encoded
+    in javascript and yet still are saved properly on the server when
+    the form is submitted.
+
+    maybe base64? https://developer.mozilla.org/en-US/docs/Glossary/Base64
+    size increase may be an issue.
+    <pre id="file1-contents"
+         style="display: none">base64datastartshere...</pre>
+    then atob(pre.text) as file content?
+
+    const transfer = new DataTransfer();
+    file_list = document.querySelectorAll('pre[data-mimetype]');
+    file_list.forEach( file => 
+        transfer.items.add(
+           new File([window.atob(file.textContent)],
+           file.dataset.filename,
+           {"type": file.dataset.mimetype})
+        )
+    )
+
+    form = document.querySelector("form")
+    file_input = document.createElement('input')
+    file_input.setAttribute("hidden", "")
+    file_input = form.appendChild(file_input)
+    file_input.setAttribute("type", "file")
+    file_input.setAttribute("name", "@file")
+    file_input.setAttribute("multiple", "")
+    file_input.files = transfer.files
+
+    """
+
     def __getattr__(self, name):
         """Try the tracker's templating_utils."""
         if not hasattr(self.client.instance, 'templating_utils'):
diff --git a/share/roundup/templates/classic/html/_generic.reauth.html b/share/roundup/templates/classic/html/_generic.reauth.html
new file mode 100644
index 000000000..699e15db8
--- /dev/null
+++ b/share/roundup/templates/classic/html/_generic.reauth.html
@@ -0,0 +1,124 @@
+<tal:block metal:use-macro="templates/page/macros/icing">
+<title metal:fill-slot="head_title" i18n:translate="">Authorize - <span
+ i18n:name="tracker" tal:replace="config/TRACKER_NAME" /></title>
+<span metal:fill-slot="body_title" tal:omit-tag="python:1"
+ i18n:translate="">Authorize Change</span>
+<td class="content" metal:fill-slot="content">
+
+  <h2>Authorization required</h2>
+
+  <p tal:condition="python:'@reauth_message' in request.client.form"
+     tal:content="request/client/form/@reauth_message/value"></p>
+
+  <p i18n:translate="">The action you requested needs to be
+    authorized.</p>
+  <p i18n:translate="">Please enter your password to continue with
+    your change.</p>
+
+  <form id="reauth_form" method="POST" enctype="multipart/form-data">
+    <input name="@reauth_password" type="password" autofocus>
+    <input type="hidden" name="@action" value="reauth">
+    <input type="submit" name="submit" value=" Authorize Change "
+	   i18n:attributes="value">
+    <input name="@csrf" type="hidden"
+           tal:attributes="value python:utils.anti_csrf_nonce()">
+
+      
+    <tal:comment tal:replace="nothing">
+      Embed all fields from the original form as hidden
+      fields. Once the reauth is done, these fields will be
+      processed to make the change that was requested.
+
+      Standard fields like: @action, @csrf and @template are stripped
+      by the code that handles Reauth requests. But there can be a few
+      fields that still need to be stripped based on the template that
+      generated the reauth process.
+
+      Use the templating function to make this easier and safer.
+
+        utils:embed_form_fields(excluded_fields=('fieldname1', 'fieldname2'))
+
+      excluded_fields can be any object with a __contains__ dunder
+      method: lists, set, tuple...
+
+      embed_form_fields encodes values and names safely even if a user
+      uses a name like '"><script>alert("hello")</script>''
+
+      It also base64 encodes the contents of file inputs into pre blocks.
+      The textContent of these blocks is then processed by javascript
+      to recreate a file input.
+    </tal:comment>
+    <tal:x tal:content="structure
+			python:utils.embed_form_fields(('submit',))" />
+  </form>
+
+<script tal:attributes="nonce request/client/client_nonce">
+/* This IIFE decodes the base64 file contents in the pre blocks,
+   creates a new file blob for each one. Then adds a multiple file
+   input and attaches all the files to it.
+
+   I am not crazy about the base64 encoding since it increases size by
+   1/3. But it is included in all browsers natively.
+*/
+
+'use strict';
+
+(function attach_file_data() {
+
+    const pre_file_list = document.querySelectorAll('pre[data-mimetype]');
+    /* if no files, skip all this. */
+    if (! pre_file_list.length) return;
+
+
+    function base64ToUint8Array(base64String) {
+	// source: google search AI: "turn atob into uint8array javascript"
+
+	// Decode the Base64 string
+	const binaryString = window.atob(base64String);
+
+	// Create a Uint8Array with the same length as the binary string
+	const uint8Array = new Uint8Array(binaryString.length);
+	
+	// Populate the Uint8Array with the character codes
+	for (let i = 0; i < binaryString.length; i++) {
+	    uint8Array[i] = binaryString.charCodeAt(i);
+	}
+
+	return uint8Array;
+    }
+
+    const transfer = new DataTransfer();
+
+    pre_file_list.forEach( file => 
+	transfer.items.add(
+	    new File([base64ToUint8Array(file.textContent)],
+		     file.dataset.filename,
+		     {"type": file.dataset.mimetype}
+		    )
+	)
+    )
+
+    const form = document.querySelector("#reauth_form")
+    if (!form) alert("Unable to find form with id=reauth_form on page.\n\n" +
+                     "Please notify your administrator")
+    let file_input = document.createElement('input')
+    /* make it hidden first so no flash on screen */
+    file_input.setAttribute("hidden", "")
+    file_input = form.appendChild(file_input)
+    /* Set the rest of the attributes now that is in the DOM.
+       One report said some attributes only worked once it
+       was added to the	DOM.
+    */
+    file_input.setAttribute("type", "file")
+    file_input.setAttribute("name", "@file")
+    /* Put all the files on one file input rather than
+       separate inputs. AFAICT there is no benefit to
+       creating a bunch of single file inputs and assigning
+       the files one by one.
+    */
+    file_input.setAttribute("multiple", "")
+    file_input.files = transfer.files
+})()
+</script>
+</td>
+</tal:block>
diff --git a/share/roundup/templates/devel/html/_generic.reauth.html b/share/roundup/templates/devel/html/_generic.reauth.html
new file mode 100644
index 000000000..699e15db8
--- /dev/null
+++ b/share/roundup/templates/devel/html/_generic.reauth.html
@@ -0,0 +1,124 @@
+<tal:block metal:use-macro="templates/page/macros/icing">
+<title metal:fill-slot="head_title" i18n:translate="">Authorize - <span
+ i18n:name="tracker" tal:replace="config/TRACKER_NAME" /></title>
+<span metal:fill-slot="body_title" tal:omit-tag="python:1"
+ i18n:translate="">Authorize Change</span>
+<td class="content" metal:fill-slot="content">
+
+  <h2>Authorization required</h2>
+
+  <p tal:condition="python:'@reauth_message' in request.client.form"
+     tal:content="request/client/form/@reauth_message/value"></p>
+
+  <p i18n:translate="">The action you requested needs to be
+    authorized.</p>
+  <p i18n:translate="">Please enter your password to continue with
+    your change.</p>
+
+  <form id="reauth_form" method="POST" enctype="multipart/form-data">
+    <input name="@reauth_password" type="password" autofocus>
+    <input type="hidden" name="@action" value="reauth">
+    <input type="submit" name="submit" value=" Authorize Change "
+	   i18n:attributes="value">
+    <input name="@csrf" type="hidden"
+           tal:attributes="value python:utils.anti_csrf_nonce()">
+
+      
+    <tal:comment tal:replace="nothing">
+      Embed all fields from the original form as hidden
+      fields. Once the reauth is done, these fields will be
+      processed to make the change that was requested.
+
+      Standard fields like: @action, @csrf and @template are stripped
+      by the code that handles Reauth requests. But there can be a few
+      fields that still need to be stripped based on the template that
+      generated the reauth process.
+
+      Use the templating function to make this easier and safer.
+
+        utils:embed_form_fields(excluded_fields=('fieldname1', 'fieldname2'))
+
+      excluded_fields can be any object with a __contains__ dunder
+      method: lists, set, tuple...
+
+      embed_form_fields encodes values and names safely even if a user
+      uses a name like '"><script>alert("hello")</script>''
+
+      It also base64 encodes the contents of file inputs into pre blocks.
+      The textContent of these blocks is then processed by javascript
+      to recreate a file input.
+    </tal:comment>
+    <tal:x tal:content="structure
+			python:utils.embed_form_fields(('submit',))" />
+  </form>
+
+<script tal:attributes="nonce request/client/client_nonce">
+/* This IIFE decodes the base64 file contents in the pre blocks,
+   creates a new file blob for each one. Then adds a multiple file
+   input and attaches all the files to it.
+
+   I am not crazy about the base64 encoding since it increases size by
+   1/3. But it is included in all browsers natively.
+*/
+
+'use strict';
+
+(function attach_file_data() {
+
+    const pre_file_list = document.querySelectorAll('pre[data-mimetype]');
+    /* if no files, skip all this. */
+    if (! pre_file_list.length) return;
+
+
+    function base64ToUint8Array(base64String) {
+	// source: google search AI: "turn atob into uint8array javascript"
+
+	// Decode the Base64 string
+	const binaryString = window.atob(base64String);
+
+	// Create a Uint8Array with the same length as the binary string
+	const uint8Array = new Uint8Array(binaryString.length);
+	
+	// Populate the Uint8Array with the character codes
+	for (let i = 0; i < binaryString.length; i++) {
+	    uint8Array[i] = binaryString.charCodeAt(i);
+	}
+
+	return uint8Array;
+    }
+
+    const transfer = new DataTransfer();
+
+    pre_file_list.forEach( file => 
+	transfer.items.add(
+	    new File([base64ToUint8Array(file.textContent)],
+		     file.dataset.filename,
+		     {"type": file.dataset.mimetype}
+		    )
+	)
+    )
+
+    const form = document.querySelector("#reauth_form")
+    if (!form) alert("Unable to find form with id=reauth_form on page.\n\n" +
+                     "Please notify your administrator")
+    let file_input = document.createElement('input')
+    /* make it hidden first so no flash on screen */
+    file_input.setAttribute("hidden", "")
+    file_input = form.appendChild(file_input)
+    /* Set the rest of the attributes now that is in the DOM.
+       One report said some attributes only worked once it
+       was added to the	DOM.
+    */
+    file_input.setAttribute("type", "file")
+    file_input.setAttribute("name", "@file")
+    /* Put all the files on one file input rather than
+       separate inputs. AFAICT there is no benefit to
+       creating a bunch of single file inputs and assigning
+       the files one by one.
+    */
+    file_input.setAttribute("multiple", "")
+    file_input.files = transfer.files
+})()
+</script>
+</td>
+</tal:block>
diff --git a/share/roundup/templates/jinja2/html/_generic.reauth.html b/share/roundup/templates/jinja2/html/_generic.reauth.html
new file mode 100644
index 000000000..699e15db8
--- /dev/null
+++ b/share/roundup/templates/jinja2/html/_generic.reauth.html
@@ -0,0 +1,124 @@
+<tal:block metal:use-macro="templates/page/macros/icing">
+<title metal:fill-slot="head_title" i18n:translate="">Authorize - <span
+ i18n:name="tracker" tal:replace="config/TRACKER_NAME" /></title>
+<span metal:fill-slot="body_title" tal:omit-tag="python:1"
+ i18n:translate="">Authorize Change</span>
+<td class="content" metal:fill-slot="content">
+
+  <h2>Authorization required</h2>
+
+  <p tal:condition="python:'@reauth_message' in request.client.form"
+     tal:content="request/client/form/@reauth_message/value"></p>
+
+  <p i18n:translate="">The action you requested needs to be
+    authorized.</p>
+  <p i18n:translate="">Please enter your password to continue with
+    your change.</p>
+
+  <form id="reauth_form" method="POST" enctype="multipart/form-data">
+    <input name="@reauth_password" type="password" autofocus>
+    <input type="hidden" name="@action" value="reauth">
+    <input type="submit" name="submit" value=" Authorize Change "
+	   i18n:attributes="value">
+    <input name="@csrf" type="hidden"
+           tal:attributes="value python:utils.anti_csrf_nonce()">
+
+      
+    <tal:comment tal:replace="nothing">
+      Embed all fields from the original form as hidden
+      fields. Once the reauth is done, these fields will be
+      processed to make the change that was requested.
+
+      Standard fields like: @action, @csrf and @template are stripped
+      by the code that handles Reauth requests. But there can be a few
+      fields that still need to be stripped based on the template that
+      generated the reauth process.
+
+      Use the templating function to make this easier and safer.
+
+        utils:embed_form_fields(excluded_fields=('fieldname1', 'fieldname2'))
+
+      excluded_fields can be any object with a __contains__ dunder
+      method: lists, set, tuple...
+
+      embed_form_fields encodes values and names safely even if a user
+      uses a name like '"><script>alert("hello")</script>''
+
+      It also base64 encodes the contents of file inputs into pre blocks.
+      The textContent of these blocks is then processed by javascript
+      to recreate a file input.
+    </tal:comment>
+    <tal:x tal:content="structure
+			python:utils.embed_form_fields(('submit',))" />
+  </form>
+
+<script tal:attributes="nonce request/client/client_nonce">
+/* This IIFE decodes the base64 file contents in the pre blocks,
+   creates a new file blob for each one. Then adds a multiple file
+   input and attaches all the files to it.
+
+   I am not crazy about the base64 encoding since it increases size by
+   1/3. But it is included in all browsers natively.
+*/
+
+'use strict';
+
+(function attach_file_data() {
+
+    const pre_file_list = document.querySelectorAll('pre[data-mimetype]');
+    /* if no files, skip all this. */
+    if (! pre_file_list.length) return;
+
+
+    function base64ToUint8Array(base64String) {
+	// source: google search AI: "turn atob into uint8array javascript"
+
+	// Decode the Base64 string
+	const binaryString = window.atob(base64String);
+
+	// Create a Uint8Array with the same length as the binary string
+	const uint8Array = new Uint8Array(binaryString.length);
+	
+	// Populate the Uint8Array with the character codes
+	for (let i = 0; i < binaryString.length; i++) {
+	    uint8Array[i] = binaryString.charCodeAt(i);
+	}
+
+	return uint8Array;
+    }
+
+    const transfer = new DataTransfer();
+
+    pre_file_list.forEach( file => 
+	transfer.items.add(
+	    new File([base64ToUint8Array(file.textContent)],
+		     file.dataset.filename,
+		     {"type": file.dataset.mimetype}
+		    )
+	)
+    )
+
+    const form = document.querySelector("#reauth_form")
+    if (!form) alert("Unable to find form with id=reauth_form on page.\n\n" +
+                     "Please notify your administrator")
+    let file_input = document.createElement('input')
+    /* make it hidden first so no flash on screen */
+    file_input.setAttribute("hidden", "")
+    file_input = form.appendChild(file_input)
+    /* Set the rest of the attributes now that is in the DOM.
+       One report said some attributes only worked once it
+       was added to the	DOM.
+    */
+    file_input.setAttribute("type", "file")
+    file_input.setAttribute("name", "@file")
+    /* Put all the files on one file input rather than
+       separate inputs. AFAICT there is no benefit to
+       creating a bunch of single file inputs and assigning
+       the files one by one.
+    */
+    file_input.setAttribute("multiple", "")
+    file_input.files = transfer.files
+})()
+</script>
+</td>
+</tal:block>
diff --git a/share/roundup/templates/minimal/html/_generic.reauth.html b/share/roundup/templates/minimal/html/_generic.reauth.html
new file mode 100644
index 000000000..699e15db8
--- /dev/null
+++ b/share/roundup/templates/minimal/html/_generic.reauth.html
@@ -0,0 +1,124 @@
+<tal:block metal:use-macro="templates/page/macros/icing">
+<title metal:fill-slot="head_title" i18n:translate="">Authorize - <span
+ i18n:name="tracker" tal:replace="config/TRACKER_NAME" /></title>
+<span metal:fill-slot="body_title" tal:omit-tag="python:1"
+ i18n:translate="">Authorize Change</span>
+<td class="content" metal:fill-slot="content">
+
+  <h2>Authorization required</h2>
+
+  <p tal:condition="python:'@reauth_message' in request.client.form"
+     tal:content="request/client/form/@reauth_message/value"></p>
+
+  <p i18n:translate="">The action you requested needs to be
+    authorized.</p>
+  <p i18n:translate="">Please enter your password to continue with
+    your change.</p>
+
+  <form id="reauth_form" method="POST" enctype="multipart/form-data">
+    <input name="@reauth_password" type="password" autofocus>
+    <input type="hidden" name="@action" value="reauth">
+    <input type="submit" name="submit" value=" Authorize Change "
+	   i18n:attributes="value">
+    <input name="@csrf" type="hidden"
+           tal:attributes="value python:utils.anti_csrf_nonce()">
+
+      
+    <tal:comment tal:replace="nothing">
+      Embed all fields from the original form as hidden
+      fields. Once the reauth is done, these fields will be
+      processed to make the change that was requested.
+
+      Standard fields like: @action, @csrf and @template are stripped
+      by the code that handles Reauth requests. But there can be a few
+      fields that still need to be stripped based on the template that
+      generated the reauth process.
+
+      Use the templating function to make this easier and safer.
+
+        utils:embed_form_fields(excluded_fields=('fieldname1', 'fieldname2'))
+
+      excluded_fields can be any object with a __contains__ dunder
+      method: lists, set, tuple...
+
+      embed_form_fields encodes values and names safely even if a user
+      uses a name like '"><script>alert("hello")</script>''
+
+      It also base64 encodes the contents of file inputs into pre blocks.
+      The textContent of these blocks is then processed by javascript
+      to recreate a file input.
+    </tal:comment>
+    <tal:x tal:content="structure
+			python:utils.embed_form_fields(('submit',))" />
+  </form>
+
+<script tal:attributes="nonce request/client/client_nonce">
+/* This IIFE decodes the base64 file contents in the pre blocks,
+   creates a new file blob for each one. Then adds a multiple file
+   input and attaches all the files to it.
+
+   I am not crazy about the base64 encoding since it increases size by
+   1/3. But it is included in all browsers natively.
+*/
+
+'use strict';
+
+(function attach_file_data() {
+
+    const pre_file_list = document.querySelectorAll('pre[data-mimetype]');
+    /* if no files, skip all this. */
+    if (! pre_file_list.length) return;
+
+
+    function base64ToUint8Array(base64String) {
+	// source: google search AI: "turn atob into uint8array javascript"
+
+	// Decode the Base64 string
+	const binaryString = window.atob(base64String);
+
+	// Create a Uint8Array with the same length as the binary string
+	const uint8Array = new Uint8Array(binaryString.length);
+	
+	// Populate the Uint8Array with the character codes
+	for (let i = 0; i < binaryString.length; i++) {
+	    uint8Array[i] = binaryString.charCodeAt(i);
+	}
+
+	return uint8Array;
+    }
+
+    const transfer = new DataTransfer();
+
+    pre_file_list.forEach( file => 
+	transfer.items.add(
+	    new File([base64ToUint8Array(file.textContent)],
+		     file.dataset.filename,
+		     {"type": file.dataset.mimetype}
+		    )
+	)
+    )
+
+    const form = document.querySelector("#reauth_form")
+    if (!form) alert("Unable to find form with id=reauth_form on page.\n\n" +
+                     "Please notify your administrator")
+    let file_input = document.createElement('input')
+    /* make it hidden first so no flash on screen */
+    file_input.setAttribute("hidden", "")
+    file_input = form.appendChild(file_input)
+    /* Set the rest of the attributes now that is in the DOM.
+       One report said some attributes only worked once it
+       was added to the	DOM.
+    */
+    file_input.setAttribute("type", "file")
+    file_input.setAttribute("name", "@file")
+    /* Put all the files on one file input rather than
+       separate inputs. AFAICT there is no benefit to
+       creating a bunch of single file inputs and assigning
+       the files one by one.
+    */
+    file_input.setAttribute("multiple", "")
+    file_input.files = transfer.files
+})()
+</script>
+</td>
+</tal:block>
diff --git a/share/roundup/templates/responsive/html/_generic.reauth.html b/share/roundup/templates/responsive/html/_generic.reauth.html
new file mode 100644
index 000000000..699e15db8
--- /dev/null
+++ b/share/roundup/templates/responsive/html/_generic.reauth.html
@@ -0,0 +1,124 @@
+<tal:block metal:use-macro="templates/page/macros/icing">
+<title metal:fill-slot="head_title" i18n:translate="">Authorize - <span
+ i18n:name="tracker" tal:replace="config/TRACKER_NAME" /></title>
+<span metal:fill-slot="body_title" tal:omit-tag="python:1"
+ i18n:translate="">Authorize Change</span>
+<td class="content" metal:fill-slot="content">
+
+  <h2>Authorization required</h2>
+
+  <p tal:condition="python:'@reauth_message' in request.client.form"
+     tal:content="request/client/form/@reauth_message/value"></p>
+
+  <p i18n:translate="">The action you requested needs to be
+    authorized.</p>
+  <p i18n:translate="">Please enter your password to continue with
+    your change.</p>
+
+  <form id="reauth_form" method="POST" enctype="multipart/form-data">
+    <input name="@reauth_password" type="password" autofocus>
+    <input type="hidden" name="@action" value="reauth">
+    <input type="submit" name="submit" value=" Authorize Change "
+	   i18n:attributes="value">
+    <input name="@csrf" type="hidden"
+           tal:attributes="value python:utils.anti_csrf_nonce()">
+
+      
+    <tal:comment tal:replace="nothing">
+      Embed all fields from the original form as hidden
+      fields. Once the reauth is done, these fields will be
+      processed to make the change that was requested.
+
+      Standard fields like: @action, @csrf and @template are stripped
+      by the code that handles Reauth requests. But there can be a few
+      fields that still need to be stripped based on the template that
+      generated the reauth process.
+
+      Use the templating function to make this easier and safer.
+
+        utils:embed_form_fields(excluded_fields=('fieldname1', 'fieldname2'))
+
+      excluded_fields can be any object with a __contains__ dunder
+      method: lists, set, tuple...
+
+      embed_form_fields encodes values and names safely even if a user
+      uses a name like '"><script>alert("hello")</script>''
+
+      It also base64 encodes the contents of file inputs into pre blocks.
+      The textContent of these blocks is then processed by javascript
+      to recreate a file input.
+    </tal:comment>
+    <tal:x tal:content="structure
+			python:utils.embed_form_fields(('submit',))" />
+  </form>
+
+<script tal:attributes="nonce request/client/client_nonce">
+/* This IIFE decodes the base64 file contents in the pre blocks,
+   creates a new file blob for each one. Then adds a multiple file
+   input and attaches all the files to it.
+
+   I am not crazy about the base64 encoding since it increases size by
+   1/3. But it is included in all browsers natively.
+*/
+
+'use strict';
+
+(function attach_file_data() {
+
+    const pre_file_list = document.querySelectorAll('pre[data-mimetype]');
+    /* if no files, skip all this. */
+    if (! pre_file_list.length) return;
+
+
+    function base64ToUint8Array(base64String) {
+	// source: google search AI: "turn atob into uint8array javascript"
+
+	// Decode the Base64 string
+	const binaryString = window.atob(base64String);
+
+	// Create a Uint8Array with the same length as the binary string
+	const uint8Array = new Uint8Array(binaryString.length);
+	
+	// Populate the Uint8Array with the character codes
+	for (let i = 0; i < binaryString.length; i++) {
+	    uint8Array[i] = binaryString.charCodeAt(i);
+	}
+
+	return uint8Array;
+    }
+
+    const transfer = new DataTransfer();
+
+    pre_file_list.forEach( file => 
+	transfer.items.add(
+	    new File([base64ToUint8Array(file.textContent)],
+		     file.dataset.filename,
+		     {"type": file.dataset.mimetype}
+		    )
+	)
+    )
+
+    const form = document.querySelector("#reauth_form")
+    if (!form) alert("Unable to find form with id=reauth_form on page.\n\n" +
+                     "Please notify your administrator")
+    let file_input = document.createElement('input')
+    /* make it hidden first so no flash on screen */
+    file_input.setAttribute("hidden", "")
+    file_input = form.appendChild(file_input)
+    /* Set the rest of the attributes now that is in the DOM.
+       One report said some attributes only worked once it
+       was added to the	DOM.
+    */
+    file_input.setAttribute("type", "file")
+    file_input.setAttribute("name", "@file")
+    /* Put all the files on one file input rather than
+       separate inputs. AFAICT there is no benefit to
+       creating a bunch of single file inputs and assigning
+       the files one by one.
+    */
+    file_input.setAttribute("multiple", "")
+    file_input.files = transfer.files
+})()
+</script>
+</td>
+</tal:block>

From 1be00834dbbf98df9c0589da05cbbbf73019f1b8 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 13 Aug 2025 23:52:49 -0400
Subject: [PATCH 270/398] feat: finish reauth docs, enhance code.

Decided to keep name Reauth for now.

admin_guide.txt:
  add reference mark to roundup admin help. Used for template command
  reference in upgrading.txt.

customizing.txt:
  added worked example of adding a reauth auditor for address and password.
  Also links to OWASP recommendations.

  Added link to example code in design.doc on detectors.

glossary.txt:
  reference using roundup-admin template command in def for tracker
  templates.

pydoc.txt:
  Added methods for Client class.

  Added class and methods for (cgi) Action, LoginAction and ReauthAction.

reference.txt
  Edited and restructured detector section.

  Added section on registering a detector and priority use/execution order.
     (reference to design doc was used before).

  Added/enhanced description of exception an auditor can
     raise (includes Reauth).

  Added section on Reauth implementation and use (Confirming the User).
    Also has paragraph on future ideas.

upgrading.txt
  Stripped down the original section. Moved a lot to reference.txt.

  Referenced customizing example, mention installation of
  _generic.reauth.html and reference reference.txt.

cgi/actions.py:
  fixed bad ReST that was breaking pydoc.txt processing

  changed doc on limitations of Reauth code.

  added docstring for Reauth::verifyPassword

cgi/client.py:
  fix ReST for a method breaking pydoc.py processing

cgi/templating.py:
  fix docstring on embed_form_fields

templates/*/html/_generic.reauth.html
  disable spelling for password field

  add timing info to the javascript function that processes file data.

  reformat javascript IIFE

templates/jinja2/html/_generic.reauth.html
  create a valid jinja2 template. Looks like my original jinja
    template got overwritten and committed.

  feature parity with the other reauth templates.

test/test_liveserver.py
  add test case for Reauth workflow.

Makefile
  add doc.
---
 doc/admin_guide.txt                           |   2 +
 doc/customizing.txt                           |  58 ++++
 doc/glossary.txt                              |   4 +-
 doc/pydoc.txt                                 |  25 ++
 doc/reference.txt                             | 275 ++++++++++++++++--
 doc/upgrading.txt                             |  53 +---
 roundup/cgi/actions.py                        |  25 +-
 roundup/cgi/client.py                         |  10 +-
 roundup/cgi/templating.py                     |  14 +-
 .../classic/html/_generic.reauth.html         | 100 ++++---
 .../templates/devel/html/_generic.reauth.html | 100 ++++---
 .../jinja2/html/_generic.reauth.html          | 179 ++++++------
 .../minimal/html/_generic.reauth.html         | 100 ++++---
 .../responsive/html/_generic.reauth.html      | 100 ++++---
 test/test_liveserver.py                       | 189 ++++++++++++
 website/www/Makefile                          |   2 +-
 16 files changed, 863 insertions(+), 373 deletions(-)

diff --git a/doc/admin_guide.txt b/doc/admin_guide.txt
index d97c83a82..538ad8fbe 100644
--- a/doc/admin_guide.txt
+++ b/doc/admin_guide.txt
@@ -1729,6 +1729,8 @@ IMAPS_OAUTH:
    single: roundup-admin; man page reference
    pair: roundup-admin; designator
 
+.. _`roundup-admin templates`:
+
 Using roundup-admin
 ===================
 
diff --git a/doc/customizing.txt b/doc/customizing.txt
index 35ea1d02f..62faac188 100644
--- a/doc/customizing.txt
+++ b/doc/customizing.txt
@@ -1815,6 +1815,60 @@ Some simple javascript might help in the last step. If you have high volume
 you could search for all currently-Pending users and do a bulk edit of all
 their roles at once (again probably with some simple javascript help).
 
+.. _sensitive_changes:
+
+Confirming Users Making Sensitive Account Changes
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Some changes to account data: user passwords or email addresses are
+particularly sensitive. The `OWASP Authentication`_ recommendations
+include asking for a re-authentication or confirmation step when making
+these changes. This can be easily implemented using an auditor.
+
+Create a file in your detectors directory with the following
+contents::
+
+    from roundup.cgi.exceptions import Reauth
+
+    def confirmid(db, cl, nodeid, newvalues):
+
+        if hasattr(db, 'reauth_done'):
+           # the user has confirmed their identity
+           return
+
+        # if the password or email are changing, require id confirmation
+        if 'password' in newvalues:
+            raise Reauth('Add an optional message to the user')
+
+        if 'address' in newvalues:
+            raise Reauth('Add an optional message to the user')
+
+    def init(db):
+        db.user.audit('set', confirmid, priority=110)
+
+If a change is made to any user's password or address fields, the user
+making the change will be shown a page where they have to enter an
+identity verifier (by default the invoking user's account password).
+If the verifier is successfully verified it will set the
+``reauth_done`` attribute on the db object and reprocess the change.
+
+The default auditor priority is 100. This auditor is set to run
+**after** most other auditors. This allows the user to correct any
+failing information on the form before being asked to confirm their
+identity. Once they confirm their identity the change is expected to
+be committed without issue. See :ref:`Confirming the User` for
+details on customizing the verification operation.
+
+Also you could use an existing auditor and add::
+
+      if 'someproperty' in newvalues and not hasattr(db, 'reauth_done'):
+        raise Reauth('Need verification before changing someproperty')
+
+at the end of the auditor (after all checks are done) to force user
+verification. Just make sure you import Reauth at the top of the file.
+
+.. _`OWASP Authentication`:
+   https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#require-re-authentication-for-sensitive-features
 
 Changes to the Web User Interface
 ---------------------------------
@@ -2436,6 +2490,10 @@ The `reference document`_ also has examples:
   <reference.html#extending-the-configuration-file>`_.
 * `Adding a new Permission <reference.html#adding-a-new-permission>`_
 
+as does the design document:
+
+* `detector examples <design.html#detector-example>`_
+
 Examples on the Wiki
 ====================
 
diff --git a/doc/glossary.txt b/doc/glossary.txt
index cdaae7ff9..ab0721b31 100644
--- a/doc/glossary.txt
+++ b/doc/glossary.txt
@@ -99,7 +99,9 @@ Roundup Glossary
 	 tracker with a particular look and feel, :term:`schema`,
 	 permissions model, and :term:`detectors`. Roundup ships with
 	 five templates and people on the net `have produced other
-	 templates`_
+	 templates`_. You can find the installed location of the
+	 standard Roundup templates using the :ref:`roundup-admin
+	 templates <roundup-admin templates>` command.
 
 
    tracker
diff --git a/doc/pydoc.txt b/doc/pydoc.txt
index 49d076657..ef7bf849b 100644
--- a/doc/pydoc.txt
+++ b/doc/pydoc.txt
@@ -9,7 +9,32 @@ Client class
 ============
 
 .. autoclass:: roundup.cgi.client::Client
+   :members:
+   
+CGI Action class
+================
+
+Action class and selected derived classes.
+
+Action
+------
+.. autoclass:: roundup.cgi.actions::Action
+   :members:
+
+LoginAction
+------------
 
+.. autoclass:: roundup.cgi.actions::LoginAction
+   :members:
+
+.. _`ReauthAction_pydoc`:
+
+ReauthAction
+------------
+
+.. autoclass:: roundup.cgi.actions::ReauthAction
+   :members:
+   
 Templating Utils class
 ======================
 
diff --git a/doc/reference.txt b/doc/reference.txt
index e792623d1..9713ae283 100644
--- a/doc/reference.txt
+++ b/doc/reference.txt
@@ -888,7 +888,7 @@ Examples of adding to your schema
 
 See :ref:`CustomExamples` for examples.
 
-The Roundup wiki CategorySchema`_ provides a list of additional
+The `Roundup wiki CategorySchema`_ provides a list of additional
 examples of how to customize schemas to add new functionality.
 
 .. _Roundup wiki CategorySchema:
@@ -948,11 +948,36 @@ directory. You are free to add and remove them any time, even after
 the database is initialised via the ``roundup-admin initialise``
 command.
 
-Detectors in your tracker are run *before* (**auditors**) and *after*
-(**reactors**) changes to the contents of your database. You will have
-some installed by default - have a look. You can write new detectors
-or modify the existing ones. The existing detectors installed for you
-are:
+There are two types of detectors:
+
+ 1. *auditors* are run before changes are made to the database
+ 2. *reactors* are run after the change has been committed to the database
+
+.. index:: auditors; rules for use
+   single: reactors; rules for use
+
+Auditor or Reactor?
+-------------------
+
+Generally speaking, you should observe the following rules:
+
+**Auditors**
+  Are used for `vetoing creation of or changes to items`_. They might
+  also make automatic changes to item properties. They can raise the
+  ``Reject`` or ``CheckId`` exceptions to control database changes.
+**Reactors**
+  Detect changes in the database and react accordingly. They should avoid
+  making changes to the database where possible, as this could create
+  detector loops.
+
+
+Detectors Installed by Default
+------------------------------
+
+You will have some detectors installed by default - have a look in the
+``detectors`` subdirectory of your tracker home. You can write new
+detectors or modify the existing ones. The existing detectors
+installed for you are:
 
 .. index:: detectors; installed
 
@@ -962,6 +987,13 @@ are:
   to issues. The nosy auditor (``updatenosy``) fires when issues are
   changed, and figures out what changes need to be made to the nosy list
   (such as adding new authors, etc.)
+
+  If you are running a tracker started with ``roundup-demo`` or the
+  ``demo.py`` script, this detector will be missing.This is
+  intentional to prevent email from being sent from a demo
+  tracker. You can find the nosyreaction.py detector in the
+  :term:`template directory (meaning 3) <template>` and copy it into
+  your tracker if you want email to be sent.
 **statusauditor.py**
   This provides the ``chatty`` auditor which changes the issue status
   from ``unread`` or ``closed`` to ``chatting`` if new messages appear.
@@ -978,13 +1010,61 @@ are:
 If you don't want this default behaviour, you are completely free to change
 or remove these detectors.
 
-See the detectors section in the `design document`__ for details of the
-interface for detectors.
+The rest of this section includes much of the information from the
+`detectors section in the design document`_. But there are some
+details of the detector interface that are only in the design
+document. Also the design document `includes examples`_ of a project
+that requires three approvals before it can be processed and rejecting
+an email to create an issue if it doesn't have an attached patch.
+
+.. _`detectors section in the design document`: design.html#detector-interface
+
+.. _`includes examples`:  design.html#detector-example
+
+Registering Detectors
+---------------------
+
+Detectors are registered using the ``audit`` or ``react`` methods of a
+database schema class. Each detector file must define an ``init(db)``
+function. This function is run to register the detectors. For example
+this registers two auditors for changes made to the user class in the
+database::
 
-__ design.html
+  def init(db):
+      # fire before changes are made
+      db.user.audit('set', audit_user_fields)
+      db.user.audit('create', audit_user_fields)
 
+while this registers two auditors and two reactors for the issue
+class::
+
+  def init(db):
+      db.issue.react('create', nosyreaction)
+      db.issue.react('set', nosyreaction)
+      db.issue.audit('create', updatenosy)
+      db.issue.audit('set', updatenosy)
+
+The arguments for ``audit`` and ``react`` are the same:
+
+  * operation - one of ``create``, ``set``, ``retire``, or ``restore``
+  * function name - use the function name without ``()`` after
+    it. (You want the function name not the result of calling the
+    function.)
+  * priority - (optional default 100) the priority allows you to order
+    the application order of the detectors.
+
+    A detector with a priority of 110 will run after a detector with
+    the default priority of 100. A detector with a priority of 90 will
+    run before a detector with the default priority of 100.
+
+    Detectors with the same priority are run in an undefined
+    order. All the examples above use the default priority of 100.
+
+If no auditor raises an exception, the changes are committed to the
+database. Then all the reactors registered for the operation are run.
 
 .. index:: detectors; writing api
+.. _detector_api:
 
 Detector API
 ------------
@@ -996,7 +1076,7 @@ Detector API
 
 Auditors are called with the arguments::
 
-    audit(db, cl, itemid, newdata)
+    an_auditor(db, cl, itemid, newdata)
 
 where ``db`` is the database, ``cl`` is an instance of Class or
 IssueClass within the database, and ``newdata`` is a dictionary mapping
@@ -1018,7 +1098,7 @@ For a ``retire()`` or ``restore()`` operation, ``newdata`` is None.
 
 Reactors are called with the arguments::
 
-    react(db, cl, itemid, olddata)
+    a_reactor(db, cl, itemid, olddata)
 
 where ``db`` is the database, ``cl`` is an instance of Class or
 IssueClass within the database, and ``olddata`` is a dictionary mapping
@@ -1033,6 +1113,27 @@ values of properties that were changed.
 For a ``retire()`` or ``restore()`` operation, ``itemid`` is the id of
 the retired or restored item and ``olddata`` is None.
 
+Your auditor can raise one of two exceptions:
+
+``Reject('Reason for rejection')``
+  indicates that the change is rejected. The user should see the same
+  page they used to make the change with a the 'Reason for rejection'
+  message displayed in the error feedback section of the page. See
+  :ref:`vetoing creation of or changes to items` for an example.
+``Reauth('Reason for confirmation')``
+  indicates that the user needs to enter their password or other
+  identity confirming information (e.g. a one time key) before the
+  change will be committed. This can be used when a user's password or
+  email address are changed. This can prevent an attacker from changing
+  the information by providing confirmation of the person making the
+  change. This addition confirmation step is recommended in the `OWASP
+  Authentication Cheat Sheet`_. An example can be found at
+  :ref:`sensitive_changes`. See :ref:`Confirming the User` for details
+  and warnings.
+
+.. _`OWASP Authentication Cheat Sheet`:
+   https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#require-re-authentication-for-sensitive-features
+
 .. index:: detectors; additional
 
 Additional Detectors Ready For Use
@@ -1069,22 +1170,7 @@ to use one, copy it to the ``'detectors'`` of your tracker instance:
   information, see the detector code - it has a lengthy explanation.
 
 
-.. index:: auditors; rules for use
-   single: reactors; rules for use
-
-Auditor or Reactor?
--------------------
-
-Generally speaking, you should observe the following rules:
-
-**Auditors**
-  Are used for `vetoing creation of or changes to items`_. They might
-  also make automatic changes to item properties.
-**Reactors**
-  Detect changes in the database and react accordingly. They should avoid
-  making changes to the database where possible, as this could create
-  detector loops.
-
+.. _`Vetoing creation of or changes to items`:
 
 Vetoing creation of or changes to items
 ---------------------------------------
@@ -1109,6 +1195,141 @@ error message to the user without performing any HTML escaping
 the ``RejectRaw`` should be used. All security implications
 should be carefully considering before using ``RejectRaw``.
 
+.. _`Confirming the User`:
+
+Confirming the User
+-------------------
+
+Being able to add a user confirmation step in a workflow is useful.
+In an auditor adding::
+
+   from roundup.cgi.exceptions import Reauth
+
+at the top of the file and then adding::
+
+   if 'password' in newvalues and not hasattr(db, 'reauth_done'):
+      raise Reauth('Add an optional message to the user')
+
+will present the user with an authorization page. The optional message
+will be shown at the top of the page. The user will enter their
+password (or other verification token) and submit the page to commit
+the change. This section describes the mechanism used.
+
+The ``Reauth`` exception is handled by the core code in the
+``Client.reauth()`` method. It modifies the current request's context
+cleaning up some fields and saving the current action and template for
+later use. Then it sets the template to ``reauth`` which is used to
+render the next page.
+
+The page is rendered using the standard template mechanism.  You can
+create a ``user.reauth.html`` template that is displayed when
+requiring reauth for a user. However most users will probably just use
+the default ``_generic.reauth.html`` template provided with Roundup.
+
+Look at the generic template to understand what has to be in a new
+template. The basic idea is to get the password from the user into the
+``@reauth_password`` input field. Also the form that is generated
+embeds a bunch of hidden fields that record the information that
+triggered the reauth request.
+
+If you are not using reauth in a workflow that can upload files, you
+are all set. The embedding of the hidden fields just works.
+
+If you need to support reauth on a form that allows file uploads, the
+generic template supports handling file uploads. It requires
+JavaScript in the browser to support files. Since browsers don't allow
+a server to assign values to a file input, the template uses a
+workaround. The reauth template encodes the contents of each uploaded
+file as a base64 encoded string. It then embeds this string inside a
+hidden ``<pre>`` tag. This encoded string is about 1/3 larger than the
+size of the original file(s).
+
+When the page is loaded, a Javascript function runs and turns the
+tagged base64 strings back into file objects with their original
+content. It then creates a file input element and assigns these files
+to it. This allows the files to be submitted with the rest of the
+form. If JavaScript is not enabled, these files will not be submitted
+to the server.
+
+**Future ideas for handling disabled JavaScript** - The `server could
+detect disabled JavaScript on the browser
+<https://wiki.roundup-tracker.org/IsJavascriptAvailable>`_ and
+generate a warning. Alternatively, allowing the browser to submit all
+the file data by replacing the ``<pre>`` tag with a ``<textarea>`` tag
+and a name attribute like ``@filecontents-1``,
+``@filecontents-2``. Along with this, the current ``data-``
+attributes on the ``<pre>`` tag need to move to hidden inputs with
+names like: ``@filecontents-1.mimetype``,
+``@filecontents-1.filename``. Submitting the form will include all
+this data that Roundup could use to pretend the files were submitted
+as a proper file input.
+
+When the reauth page is submitted, it invokes the ``reauth`` action
+(using the ``@action`` parameter). Verification is done by the
+:ref:`ReauthAction <ReauthAction_pydoc>` class in
+``roundup.cgi.actions``. By default
+``ReauthAction.verifyPassword()`` calls::
+
+    roundup.cgi.actions:LoginAction::verifyPassword()
+
+to verify the user's password against the one stored in the database.
+
+You can change the verification command using `interfaces.py`_. Adding
+the following code to ``interfaces.py``::
+
+    from roundup.cgi.actions import ReauthAction
+
+    old_verify = ReauthAction.verifyPassword
+
+    def new_verify_password(self):
+	if self.form['@reauth_password'].value == 'LetMeIn':
+	    return True
+
+	return old_verify(self)
+
+    ReauthAction.verifyPassword = new_verify_password
+      
+will accept the passphrase ``LetMeIn`` as well as the user's
+password. This example (which you should not use as is) could be
+adapted to verify a `Time-based One-Time Password (TOTP)`_. An example
+of `implementing a TOTP for Roundup is available on the wiki`_.
+
+.. _`Time-based One-Time Password (TOTP)`:
+   https://en.wikipedia.org/wiki/Time-based_One-Time_Password
+
+.. _`implementing a TOTP for Roundup is available on the wiki`:
+   https://wiki.roundup-tracker.org/OneTimePasswords
+
+If the verification succeeds, the original action (e.g. edit) is
+invoked on the data sent with the reauth request. To prevent the
+auditor from triggering another Reauth, the attribute ``reauth_done``
+is added to the db object. As a result, the ``hasattr`` call shown
+above will return True and the Reauth exception is not raised. (Note
+that the value of the ``reauth_done`` attribute is True, so
+``getattr(db, "reauth_done", False)`` will return True when reauth is
+done and the defaul value of False if the attribute is missing. If the
+default is not set, `getattr` raises an ``AttributeError`` which might
+be useful for flow control.)
+
+There is only one reauth for a submitted change. You cannot Reauth
+multiple properties separately. If you need to reauth multiple
+properties separately, you need to reject the change and force the
+user to submit each sensitive property separately.  For example::
+
+   if 'password' in newvalues and 'realname' in newvalues:
+      raise Reject('Changing the username and the realname '
+		   'at the same time is not allowed. Please '
+		   'submit two changes.')
+
+   if 'password' in newvalues and not hasattr(db, 'reauth_done'):
+      raise Reauth()
+
+   if 'realname' in newvalues and not hasattr(db, 'reauth_done'):
+      raise Reauth()
+
+See also: client.py:Client:reauth(self, exception) which can be
+changed using interfaces.py in your tracker if you have some special
+handling that must be done.
 
 Generating email from Roundup
 -----------------------------
diff --git a/doc/upgrading.txt b/doc/upgrading.txt
index 40ef3c243..66faca566 100644
--- a/doc/upgrading.txt
+++ b/doc/upgrading.txt
@@ -117,57 +117,22 @@ When changing sensitive information (e.g. passwords) it is
 useful to ask for a validated authorization. This makes sure
 that the user is present by typing their password.
 
-In an auditor adding::
+You can add this to your auditors using the example
+:ref:`sensitive_changes`.
 
-   from roundup.cgi.exceptions import Reauth
-
-   if 'password' in newvalues and not getattr(db, 'reauth_done', False):
-      raise Reauth('Add an optional message to the user')
-
-will present the user with a authorization page and optional message
-when the password is changed.  The page is generated from the
-``_generic.reauth.html`` template by default.
-
-Once the user enters their password and submits the page, the
-password will be verified using:
-
-    roundup.cgi.actions:LoginAction::verifyPassword()
-
-If the password is correct the original change is done.
-
-To prevent the auditor from trigering another Reauth, the
-attribute ``reauth_done`` is added to the db object. As a result,
-the getattr call will return True and not raise Reauth.
-
-You get one reauth for a submitted change. Note you cannot Reauth
-multiple properties separately. If you need to auth multiple
-properties separately, you need to reject the change and force the
-user to submit each sensitive property separately.  For example::
-
-   if 'password' in newvalues and 'realname' in newvalues:
-      raise Reject('Changing the username and the realname '
-		   'at the same time is not allowed. Please '
-		   'submit two changes.')
-
-   if 'password' in newvalues and not getattr(db, 'reauth_done', False):
-      raise Reauth()
-
-   if 'realname' in newvalues and not getattr(db, 'reauth_done', False):
-      raise Reauth()
-
-See also: client.py:Client:reauth(self, exception) which can be changed
-using interfaces.py in your tracker.
-
-You should copy ``_generic.reauth.html`` into your tracker's html
-subdirectory. See the classic template directory for a copy. If you
-are using jinja2, see the jinja2 template directory.  Then you can
-raise a Reauth exception and have the proper page displayed.
+To use this, you must copy ``_generic.reauth.html`` into your
+tracker's html subdirectory. See the classic template directory for a
+copy. If you are using jinja2, see the jinja2 template directory.
+Then you can raise a Reauth exception and have the proper page
+displayed.
 
 Also javascript *MUST* be turned on if this is used with a file
 input. If JavaScript is not turned on, attached files are lost during
 the reauth step. Information from other types of inputs (password,
 date, text etc.) do not need JavaScript to work.
 
+See :ref:`Confirming the User` in the reference manual for details.
+
 .. index:: Upgrading; 2.4.0 to 2.5.0
 
 Migrating from 2.4.0 to 2.5.0
diff --git a/roundup/cgi/actions.py b/roundup/cgi/actions.py
index 68e96e175..7d12af4a6 100644
--- a/roundup/cgi/actions.py
+++ b/roundup/cgi/actions.py
@@ -75,18 +75,18 @@ def examine_url(self, url):
         validates:
 
         For each component, Appendix A of RFC 3986 says the following
-        are allowed:
+        are allowed::
 
-        pchar         = unreserved / pct-encoded / sub-delims / ":" / "@"
-        query         = *( pchar / "/" / "?" )
-        unreserved    = ALPHA / DIGIT / "-" / "." / "_" / "~"
-        pct-encoded   = "%" HEXDIG HEXDIG
-        sub-delims    = "!" / "$" / "&" / "'" / "(" / ")"
-                         / "*" / "+" / "," / ";" / "="
+          pchar         = unreserved / pct-encoded / sub-delims / ":" / "@"
+          query         = *( pchar / "/" / "?" )
+          unreserved    = ALPHA / DIGIT / "-" / "." / "_" / "~"
+          pct-encoded   = "%" HEXDIG HEXDIG
+          sub-delims    = "!" / "$" / "&" / "'" / "(" / ")"
+                           / "*" / "+" / "," / ";" / "="
 
         Checks all parts with a regexp that matches any run of 0 or
         more allowed characters. If the component doesn't validate,
-        raise ValueError. Don't attempt to urllib_.quote it. Either
+        raise ValueError. Don't attempt to ``urllib_.quote`` it. Either
         it's correct as it comes in or it's a ValueError.
 
         Finally paste the whole thing together and return the new url.
@@ -1886,7 +1886,7 @@ class ReauthAction(Action):
           if 'realname' in newvalues and not getattr(db, 'reauth_done', False):
              raise Reauth()
 
-        Limitations: It can not handle file input fields.
+        Limitations: Handling file inputs requires JavaScript on the browser.
 
         See also: client.py:Client:reauth() which can be changed
         using interfaces.py in your tracker.
@@ -1968,6 +1968,13 @@ def handle(self):
             self.add_error_message(str(err), escape=escape)
 
     def verifyPassword(self):
+        """Verify the reauth password/token
+
+           This can be overridden using interfaces.py.
+
+           The default implementation uses the
+           LoginAction::verifyPassword() method.
+        """
         login = self.client.get_action_class('login')(self.client)
         return login.verifyPassword(self.userid,
                                     self.form['@reauth_password'].value)
diff --git a/roundup/cgi/client.py b/roundup/cgi/client.py
index af5d2500a..ed091c507 100644
--- a/roundup/cgi/client.py
+++ b/roundup/cgi/client.py
@@ -1406,10 +1406,12 @@ def is_origin_header_ok(self, api=False, credentials=False):
 
            Header is ok (return True) if ORIGIN is missing and it is a GET.
            Header is ok if ORIGIN matches the base url.
-           If this is a API call:
-             Header is ok if ORIGIN matches an element of allowed_api_origins.
-             Header is ok if allowed_api_origins includes '*' as first
-               element and credentials is False.
+           If this is an API call:
+
+           * Header is ok if ORIGIN matches an element of allowed_api_origins.
+           * Header is ok if allowed_api_origins includes '*' as first
+             element and credentials is False.
+
            Otherwise header is not ok.
 
            In a credentials context, if we match * we will return
diff --git a/roundup/cgi/templating.py b/roundup/cgi/templating.py
index 3edea6651..b0b53f62b 100644
--- a/roundup/cgi/templating.py
+++ b/roundup/cgi/templating.py
@@ -3618,10 +3618,18 @@ def html_quote(self, html):
     def embed_form_fields(self, excluded_fields=None):
         """Used to create a hidden input field for each client.form element
 
-           :param: excluded_fields string or something with
-                   __contains__ dunder method (tuple, list, set...).
+           :param excluded_fields:
+              these fields will not have a hidden field created for them.
+              Value can be a string or multiple strings contained in
+              something with a __contains__ dunder method:
+              tuple, list, set....
+
+           File input fields are represented by a <pre> tag with
+           base64 encoded contents and attributes to store the
+           filename and mimetype.  It requires JavaScript on the
+           browser to turn these <pre> tags back into files that can
+           be submitted with the form.
 
-           Limitations: It ignores file input fields.
         """
         if excluded_fields is None:
             excluded_fields = ()
diff --git a/share/roundup/templates/classic/html/_generic.reauth.html b/share/roundup/templates/classic/html/_generic.reauth.html
index 699e15db8..2e8351ff7 100644
--- a/share/roundup/templates/classic/html/_generic.reauth.html
+++ b/share/roundup/templates/classic/html/_generic.reauth.html
@@ -16,7 +16,7 @@ <h2>Authorization required</h2>
     your change.</p>
 
   <form id="reauth_form" method="POST" enctype="multipart/form-data">
-    <input name="@reauth_password" type="password" autofocus>
+    <input name="@reauth_password" type="password" spellcheck="false" autofocus>
     <input type="hidden" name="@action" value="reauth">
     <input type="submit" name="submit" value=" Authorize Change "
 	   i18n:attributes="value">
@@ -64,61 +64,67 @@ <h2>Authorization required</h2>
 'use strict';
 
 (function attach_file_data() {
+  console.time('reattach_files');
 
-    const pre_file_list = document.querySelectorAll('pre[data-mimetype]');
-    /* if no files, skip all this. */
-    if (! pre_file_list.length) return;
+  /* skip file entries without a name (created by empty file input) */
+  const pre_file_list = document.querySelectorAll(
+    'pre[data-filename]:not([data-filename=""]');
+  /* if no files, skip all this. */
+  if (! pre_file_list.length) {
+    console.timeEnd('reattach_files');
+    return;
+  }
 
+  function base64ToUint8Array(base64String) {
+    // source: google search AI: "turn atob into uint8array javascript"
 
-    function base64ToUint8Array(base64String) {
-	// source: google search AI: "turn atob into uint8array javascript"
+    // Decode the Base64 string
+    const binaryString = window.atob(base64String);
 
-	// Decode the Base64 string
-	const binaryString = window.atob(base64String);
+    // Create a Uint8Array with the same length as the binary string
+    const uint8Array = new Uint8Array(binaryString.length);
 
-	// Create a Uint8Array with the same length as the binary string
-	const uint8Array = new Uint8Array(binaryString.length);
-	
-	// Populate the Uint8Array with the character codes
-	for (let i = 0; i < binaryString.length; i++) {
-	    uint8Array[i] = binaryString.charCodeAt(i);
-	}
-
-	return uint8Array;
+    // Populate the Uint8Array with the character codes
+    for (let i = 0; i < binaryString.length; i++) {
+      uint8Array[i] = binaryString.charCodeAt(i);
     }
+    return uint8Array;
+  }
 
-    const transfer = new DataTransfer();
+  const transfer = new DataTransfer();
 
-    pre_file_list.forEach( file => 
-	transfer.items.add(
-	    new File([base64ToUint8Array(file.textContent)],
-		     file.dataset.filename,
-		     {"type": file.dataset.mimetype}
-		    )
-	)
+  pre_file_list.forEach( file =>
+    transfer.items.add(
+      new File([base64ToUint8Array(file.textContent)],
+	       file.dataset.filename,
+	       {"type": file.dataset.mimetype}
+	      )
     )
-
-    const form = document.querySelector("#reauth_form")
-    if (!form) alert("Unable to find form with id=reauth_form on page.\n\n" +
-                     "Please notify your administrator")
-    let file_input = document.createElement('input')
-    /* make it hidden first so no flash on screen */
-    file_input.setAttribute("hidden", "")
-    file_input = form.appendChild(file_input)
-    /* Set the rest of the attributes now that is in the DOM.
-       One report said some attributes only worked once it
-       was added to the	DOM.
-    */
-    file_input.setAttribute("type", "file")
-    file_input.setAttribute("name", "@file")
-    /* Put all the files on one file input rather than
-       separate inputs. AFAICT there is no benefit to
-       creating a bunch of single file inputs and assigning
-       the files one by one.
-    */
-    file_input.setAttribute("multiple", "")
-    file_input.files = transfer.files
-})()
+  )
+
+  const form = document.querySelector("#reauth_form")
+  if (!form) alert("Unable to find form with id=reauth_form on page.\n\n" +
+                   "Please notify your administrator")
+  let file_input = document.createElement('input')
+  /* make it hidden first so no flash on screen */
+  file_input.setAttribute("hidden", "")
+  file_input = form.appendChild(file_input)
+  /* Set the rest of the attributes now that is in the DOM.
+     One report said some attributes only worked once it
+     was added to the	DOM.
+  */
+  file_input.setAttribute("type", "file")
+  file_input.setAttribute("name", "@file")
+  /* Put all the files on one file input rather than
+     separate inputs. AFAICT there is no benefit to
+     creating a bunch of single file inputs and assigning
+     the files one by one.
+  */
+  file_input.setAttribute("multiple", "")
+  file_input.files = transfer.files
+
+  console.timeEnd('reattach_files');
+})()	
 </script>
 </td>
 </tal:block>
diff --git a/share/roundup/templates/devel/html/_generic.reauth.html b/share/roundup/templates/devel/html/_generic.reauth.html
index 699e15db8..2e8351ff7 100644
--- a/share/roundup/templates/devel/html/_generic.reauth.html
+++ b/share/roundup/templates/devel/html/_generic.reauth.html
@@ -16,7 +16,7 @@ <h2>Authorization required</h2>
     your change.</p>
 
   <form id="reauth_form" method="POST" enctype="multipart/form-data">
-    <input name="@reauth_password" type="password" autofocus>
+    <input name="@reauth_password" type="password" spellcheck="false" autofocus>
     <input type="hidden" name="@action" value="reauth">
     <input type="submit" name="submit" value=" Authorize Change "
 	   i18n:attributes="value">
@@ -64,61 +64,67 @@ <h2>Authorization required</h2>
 'use strict';
 
 (function attach_file_data() {
+  console.time('reattach_files');
 
-    const pre_file_list = document.querySelectorAll('pre[data-mimetype]');
-    /* if no files, skip all this. */
-    if (! pre_file_list.length) return;
+  /* skip file entries without a name (created by empty file input) */
+  const pre_file_list = document.querySelectorAll(
+    'pre[data-filename]:not([data-filename=""]');
+  /* if no files, skip all this. */
+  if (! pre_file_list.length) {
+    console.timeEnd('reattach_files');
+    return;
+  }
 
+  function base64ToUint8Array(base64String) {
+    // source: google search AI: "turn atob into uint8array javascript"
 
-    function base64ToUint8Array(base64String) {
-	// source: google search AI: "turn atob into uint8array javascript"
+    // Decode the Base64 string
+    const binaryString = window.atob(base64String);
 
-	// Decode the Base64 string
-	const binaryString = window.atob(base64String);
+    // Create a Uint8Array with the same length as the binary string
+    const uint8Array = new Uint8Array(binaryString.length);
 
-	// Create a Uint8Array with the same length as the binary string
-	const uint8Array = new Uint8Array(binaryString.length);
-	
-	// Populate the Uint8Array with the character codes
-	for (let i = 0; i < binaryString.length; i++) {
-	    uint8Array[i] = binaryString.charCodeAt(i);
-	}
-
-	return uint8Array;
+    // Populate the Uint8Array with the character codes
+    for (let i = 0; i < binaryString.length; i++) {
+      uint8Array[i] = binaryString.charCodeAt(i);
     }
+    return uint8Array;
+  }
 
-    const transfer = new DataTransfer();
+  const transfer = new DataTransfer();
 
-    pre_file_list.forEach( file => 
-	transfer.items.add(
-	    new File([base64ToUint8Array(file.textContent)],
-		     file.dataset.filename,
-		     {"type": file.dataset.mimetype}
-		    )
-	)
+  pre_file_list.forEach( file =>
+    transfer.items.add(
+      new File([base64ToUint8Array(file.textContent)],
+	       file.dataset.filename,
+	       {"type": file.dataset.mimetype}
+	      )
     )
-
-    const form = document.querySelector("#reauth_form")
-    if (!form) alert("Unable to find form with id=reauth_form on page.\n\n" +
-                     "Please notify your administrator")
-    let file_input = document.createElement('input')
-    /* make it hidden first so no flash on screen */
-    file_input.setAttribute("hidden", "")
-    file_input = form.appendChild(file_input)
-    /* Set the rest of the attributes now that is in the DOM.
-       One report said some attributes only worked once it
-       was added to the	DOM.
-    */
-    file_input.setAttribute("type", "file")
-    file_input.setAttribute("name", "@file")
-    /* Put all the files on one file input rather than
-       separate inputs. AFAICT there is no benefit to
-       creating a bunch of single file inputs and assigning
-       the files one by one.
-    */
-    file_input.setAttribute("multiple", "")
-    file_input.files = transfer.files
-})()
+  )
+
+  const form = document.querySelector("#reauth_form")
+  if (!form) alert("Unable to find form with id=reauth_form on page.\n\n" +
+                   "Please notify your administrator")
+  let file_input = document.createElement('input')
+  /* make it hidden first so no flash on screen */
+  file_input.setAttribute("hidden", "")
+  file_input = form.appendChild(file_input)
+  /* Set the rest of the attributes now that is in the DOM.
+     One report said some attributes only worked once it
+     was added to the	DOM.
+  */
+  file_input.setAttribute("type", "file")
+  file_input.setAttribute("name", "@file")
+  /* Put all the files on one file input rather than
+     separate inputs. AFAICT there is no benefit to
+     creating a bunch of single file inputs and assigning
+     the files one by one.
+  */
+  file_input.setAttribute("multiple", "")
+  file_input.files = transfer.files
+
+  console.timeEnd('reattach_files');
+})()	
 </script>
 </td>
 </tal:block>
diff --git a/share/roundup/templates/jinja2/html/_generic.reauth.html b/share/roundup/templates/jinja2/html/_generic.reauth.html
index 699e15db8..ac2295f99 100644
--- a/share/roundup/templates/jinja2/html/_generic.reauth.html
+++ b/share/roundup/templates/jinja2/html/_generic.reauth.html
@@ -1,58 +1,39 @@
-<tal:block metal:use-macro="templates/page/macros/icing">
-<title metal:fill-slot="head_title" i18n:translate="">Authorize - <span
- i18n:name="tracker" tal:replace="config/TRACKER_NAME" /></title>
-<span metal:fill-slot="body_title" tal:omit-tag="python:1"
- i18n:translate="">Authorize Change</span>
-<td class="content" metal:fill-slot="content">
+{% extends 'layout/page.html' %}
 
-  <h2>Authorization required</h2>
+{% block head_title %}
+  {% trans %}Authorize{% endtrans %} - {{ config.TRACKER_NAME }}
+{% endblock %}
 
-  <p tal:condition="python:'@reauth_message' in request.client.form"
-     tal:content="request/client/form/@reauth_message/value"></p>
+{% block page_header %}
+  {% trans %}Authorize Change{% endtrans %}
+{% endblock %}
 
-  <p i18n:translate="">The action you requested needs to be
-    authorized.</p>
-  <p i18n:translate="">Please enter your password to continue with
-    your change.</p>
+{% block content %}
+
+  {% include 'layout/permission.html' %}
+
+  {% if '@reauth_message' in request.client.form %}
+    <p> {{ request.client.form['@reauth_message'].value }} </p>
+  {% endif %}
+  <p> {% trans %}The action you requested needs to be
+      authorized.{% endtrans %}</p>
+  <p> {% trans %}Please enter your password to continue with your
+      change. {% endtrans %}</p>
 
   <form id="reauth_form" method="POST" enctype="multipart/form-data">
-    <input name="@reauth_password" type="password" autofocus>
-    <input type="hidden" name="@action" value="reauth">
-    <input type="submit" name="submit" value=" Authorize Change "
-	   i18n:attributes="value">
-    <input name="@csrf" type="hidden"
-           tal:attributes="value python:utils.anti_csrf_nonce()">
-
-      
-    <tal:comment tal:replace="nothing">
-      Embed all fields from the original form as hidden
-      fields. Once the reauth is done, these fields will be
-      processed to make the change that was requested.
-
-      Standard fields like: @action, @csrf and @template are stripped
-      by the code that handles Reauth requests. But there can be a few
-      fields that still need to be stripped based on the template that
-      generated the reauth process.
-
-      Use the templating function to make this easier and safer.
-
-        utils:embed_form_fields(excluded_fields=('fieldname1', 'fieldname2'))
-
-      excluded_fields can be any object with a __contains__ dunder
-      method: lists, set, tuple...
-
-      embed_form_fields encodes values and names safely even if a user
-      uses a name like '"><script>alert("hello")</script>''
-
-      It also base64 encodes the contents of file inputs into pre blocks.
-      The textContent of these blocks is then processed by javascript
-      to recreate a file input.
-    </tal:comment>
-    <tal:x tal:content="structure
-			python:utils.embed_form_fields(('submit',))" />
+      <input name="@reauth_password" type="password"
+	     spellcheck="false" autofocus class="form-control">
+  <input type="hidden" name="@action" value="reauth">
+  <input type="submit" name="submit"
+	 value="{% trans %} Authorize Change {% endtrans %}">
+  <input name="@csrf" type="hidden"
+	 value="{{ python:utils.anti_csrf_nonce() }}">
+
+  {{ utils.embed_form_fields(('submit',)) }}
+
   </form>
 
-<script tal:attributes="nonce request/client/client_nonce">
+<script nonce="{{ request.client.client_nonce() }}">
 /* This IIFE decodes the base64 file contents in the pre blocks,
    creates a new file blob for each one. Then adds a multiple file
    input and attaches all the files to it.
@@ -64,61 +45,67 @@ <h2>Authorization required</h2>
 'use strict';
 
 (function attach_file_data() {
+  console.time('reattach_files');
 
-    const pre_file_list = document.querySelectorAll('pre[data-mimetype]');
-    /* if no files, skip all this. */
-    if (! pre_file_list.length) return;
-
+  /* skip file entries without a name (created by empty file input) */
+  const pre_file_list = document.querySelectorAll(
+    'pre[data-filename]:not([data-filename=""]');
+  /* if no files, skip all this. */
+  if (! pre_file_list.length) {
+    console.timeEnd('reattach_files');
+    return;
+  }
 
-    function base64ToUint8Array(base64String) {
-	// source: google search AI: "turn atob into uint8array javascript"
+  function base64ToUint8Array(base64String) {
+    // source: google search AI: "turn atob into uint8array javascript"
 
-	// Decode the Base64 string
-	const binaryString = window.atob(base64String);
+    // Decode the Base64 string
+    const binaryString = window.atob(base64String);
 
-	// Create a Uint8Array with the same length as the binary string
-	const uint8Array = new Uint8Array(binaryString.length);
-	
-	// Populate the Uint8Array with the character codes
-	for (let i = 0; i < binaryString.length; i++) {
-	    uint8Array[i] = binaryString.charCodeAt(i);
-	}
+    // Create a Uint8Array with the same length as the binary string
+    const uint8Array = new Uint8Array(binaryString.length);
 
-	return uint8Array;
+    // Populate the Uint8Array with the character codes
+    for (let i = 0; i < binaryString.length; i++) {
+      uint8Array[i] = binaryString.charCodeAt(i);
     }
+    return uint8Array;
+  }
 
-    const transfer = new DataTransfer();
+  const transfer = new DataTransfer();
 
-    pre_file_list.forEach( file => 
-	transfer.items.add(
-	    new File([base64ToUint8Array(file.textContent)],
-		     file.dataset.filename,
-		     {"type": file.dataset.mimetype}
-		    )
-	)
+  pre_file_list.forEach( file =>
+    transfer.items.add(
+      new File([base64ToUint8Array(file.textContent)],
+	       file.dataset.filename,
+	       {"type": file.dataset.mimetype}
+	      )
     )
-
-    const form = document.querySelector("#reauth_form")
-    if (!form) alert("Unable to find form with id=reauth_form on page.\n\n" +
-                     "Please notify your administrator")
-    let file_input = document.createElement('input')
-    /* make it hidden first so no flash on screen */
-    file_input.setAttribute("hidden", "")
-    file_input = form.appendChild(file_input)
-    /* Set the rest of the attributes now that is in the DOM.
-       One report said some attributes only worked once it
-       was added to the	DOM.
-    */
-    file_input.setAttribute("type", "file")
-    file_input.setAttribute("name", "@file")
-    /* Put all the files on one file input rather than
-       separate inputs. AFAICT there is no benefit to
-       creating a bunch of single file inputs and assigning
-       the files one by one.
-    */
-    file_input.setAttribute("multiple", "")
-    file_input.files = transfer.files
-})()
+  )
+
+  const form = document.querySelector("#reauth_form")
+  if (!form) alert("Unable to find form with id=reauth_form on page.\n\n" +
+                   "Please notify your administrator")
+  let file_input = document.createElement('input')
+  /* make it hidden first so no flash on screen */
+  file_input.setAttribute("hidden", "")
+  file_input = form.appendChild(file_input)
+  /* Set the rest of the attributes now that is in the DOM.
+     One report said some attributes only worked once it
+     was added to the	DOM.
+  */
+  file_input.setAttribute("type", "file")
+  file_input.setAttribute("name", "@file")
+  /* Put all the files on one file input rather than
+     separate inputs. AFAICT there is no benefit to
+     creating a bunch of single file inputs and assigning
+     the files one by one.
+  */
+  file_input.setAttribute("multiple", "")
+  file_input.files = transfer.files
+
+  console.timeEnd('reattach_files');
+})()	
 </script>
-</td>
-</tal:block>
+    
+{% endblock %}
diff --git a/share/roundup/templates/minimal/html/_generic.reauth.html b/share/roundup/templates/minimal/html/_generic.reauth.html
index 699e15db8..2e8351ff7 100644
--- a/share/roundup/templates/minimal/html/_generic.reauth.html
+++ b/share/roundup/templates/minimal/html/_generic.reauth.html
@@ -16,7 +16,7 @@ <h2>Authorization required</h2>
     your change.</p>
 
   <form id="reauth_form" method="POST" enctype="multipart/form-data">
-    <input name="@reauth_password" type="password" autofocus>
+    <input name="@reauth_password" type="password" spellcheck="false" autofocus>
     <input type="hidden" name="@action" value="reauth">
     <input type="submit" name="submit" value=" Authorize Change "
 	   i18n:attributes="value">
@@ -64,61 +64,67 @@ <h2>Authorization required</h2>
 'use strict';
 
 (function attach_file_data() {
+  console.time('reattach_files');
 
-    const pre_file_list = document.querySelectorAll('pre[data-mimetype]');
-    /* if no files, skip all this. */
-    if (! pre_file_list.length) return;
+  /* skip file entries without a name (created by empty file input) */
+  const pre_file_list = document.querySelectorAll(
+    'pre[data-filename]:not([data-filename=""]');
+  /* if no files, skip all this. */
+  if (! pre_file_list.length) {
+    console.timeEnd('reattach_files');
+    return;
+  }
 
+  function base64ToUint8Array(base64String) {
+    // source: google search AI: "turn atob into uint8array javascript"
 
-    function base64ToUint8Array(base64String) {
-	// source: google search AI: "turn atob into uint8array javascript"
+    // Decode the Base64 string
+    const binaryString = window.atob(base64String);
 
-	// Decode the Base64 string
-	const binaryString = window.atob(base64String);
+    // Create a Uint8Array with the same length as the binary string
+    const uint8Array = new Uint8Array(binaryString.length);
 
-	// Create a Uint8Array with the same length as the binary string
-	const uint8Array = new Uint8Array(binaryString.length);
-	
-	// Populate the Uint8Array with the character codes
-	for (let i = 0; i < binaryString.length; i++) {
-	    uint8Array[i] = binaryString.charCodeAt(i);
-	}
-
-	return uint8Array;
+    // Populate the Uint8Array with the character codes
+    for (let i = 0; i < binaryString.length; i++) {
+      uint8Array[i] = binaryString.charCodeAt(i);
     }
+    return uint8Array;
+  }
 
-    const transfer = new DataTransfer();
+  const transfer = new DataTransfer();
 
-    pre_file_list.forEach( file => 
-	transfer.items.add(
-	    new File([base64ToUint8Array(file.textContent)],
-		     file.dataset.filename,
-		     {"type": file.dataset.mimetype}
-		    )
-	)
+  pre_file_list.forEach( file =>
+    transfer.items.add(
+      new File([base64ToUint8Array(file.textContent)],
+	       file.dataset.filename,
+	       {"type": file.dataset.mimetype}
+	      )
     )
-
-    const form = document.querySelector("#reauth_form")
-    if (!form) alert("Unable to find form with id=reauth_form on page.\n\n" +
-                     "Please notify your administrator")
-    let file_input = document.createElement('input')
-    /* make it hidden first so no flash on screen */
-    file_input.setAttribute("hidden", "")
-    file_input = form.appendChild(file_input)
-    /* Set the rest of the attributes now that is in the DOM.
-       One report said some attributes only worked once it
-       was added to the	DOM.
-    */
-    file_input.setAttribute("type", "file")
-    file_input.setAttribute("name", "@file")
-    /* Put all the files on one file input rather than
-       separate inputs. AFAICT there is no benefit to
-       creating a bunch of single file inputs and assigning
-       the files one by one.
-    */
-    file_input.setAttribute("multiple", "")
-    file_input.files = transfer.files
-})()
+  )
+
+  const form = document.querySelector("#reauth_form")
+  if (!form) alert("Unable to find form with id=reauth_form on page.\n\n" +
+                   "Please notify your administrator")
+  let file_input = document.createElement('input')
+  /* make it hidden first so no flash on screen */
+  file_input.setAttribute("hidden", "")
+  file_input = form.appendChild(file_input)
+  /* Set the rest of the attributes now that is in the DOM.
+     One report said some attributes only worked once it
+     was added to the	DOM.
+  */
+  file_input.setAttribute("type", "file")
+  file_input.setAttribute("name", "@file")
+  /* Put all the files on one file input rather than
+     separate inputs. AFAICT there is no benefit to
+     creating a bunch of single file inputs and assigning
+     the files one by one.
+  */
+  file_input.setAttribute("multiple", "")
+  file_input.files = transfer.files
+
+  console.timeEnd('reattach_files');
+})()	
 </script>
 </td>
 </tal:block>
diff --git a/share/roundup/templates/responsive/html/_generic.reauth.html b/share/roundup/templates/responsive/html/_generic.reauth.html
index 699e15db8..2e8351ff7 100644
--- a/share/roundup/templates/responsive/html/_generic.reauth.html
+++ b/share/roundup/templates/responsive/html/_generic.reauth.html
@@ -16,7 +16,7 @@ <h2>Authorization required</h2>
     your change.</p>
 
   <form id="reauth_form" method="POST" enctype="multipart/form-data">
-    <input name="@reauth_password" type="password" autofocus>
+    <input name="@reauth_password" type="password" spellcheck="false" autofocus>
     <input type="hidden" name="@action" value="reauth">
     <input type="submit" name="submit" value=" Authorize Change "
 	   i18n:attributes="value">
@@ -64,61 +64,67 @@ <h2>Authorization required</h2>
 'use strict';
 
 (function attach_file_data() {
+  console.time('reattach_files');
 
-    const pre_file_list = document.querySelectorAll('pre[data-mimetype]');
-    /* if no files, skip all this. */
-    if (! pre_file_list.length) return;
+  /* skip file entries without a name (created by empty file input) */
+  const pre_file_list = document.querySelectorAll(
+    'pre[data-filename]:not([data-filename=""]');
+  /* if no files, skip all this. */
+  if (! pre_file_list.length) {
+    console.timeEnd('reattach_files');
+    return;
+  }
 
+  function base64ToUint8Array(base64String) {
+    // source: google search AI: "turn atob into uint8array javascript"
 
-    function base64ToUint8Array(base64String) {
-	// source: google search AI: "turn atob into uint8array javascript"
+    // Decode the Base64 string
+    const binaryString = window.atob(base64String);
 
-	// Decode the Base64 string
-	const binaryString = window.atob(base64String);
+    // Create a Uint8Array with the same length as the binary string
+    const uint8Array = new Uint8Array(binaryString.length);
 
-	// Create a Uint8Array with the same length as the binary string
-	const uint8Array = new Uint8Array(binaryString.length);
-	
-	// Populate the Uint8Array with the character codes
-	for (let i = 0; i < binaryString.length; i++) {
-	    uint8Array[i] = binaryString.charCodeAt(i);
-	}
-
-	return uint8Array;
+    // Populate the Uint8Array with the character codes
+    for (let i = 0; i < binaryString.length; i++) {
+      uint8Array[i] = binaryString.charCodeAt(i);
     }
+    return uint8Array;
+  }
 
-    const transfer = new DataTransfer();
+  const transfer = new DataTransfer();
 
-    pre_file_list.forEach( file => 
-	transfer.items.add(
-	    new File([base64ToUint8Array(file.textContent)],
-		     file.dataset.filename,
-		     {"type": file.dataset.mimetype}
-		    )
-	)
+  pre_file_list.forEach( file =>
+    transfer.items.add(
+      new File([base64ToUint8Array(file.textContent)],
+	       file.dataset.filename,
+	       {"type": file.dataset.mimetype}
+	      )
     )
-
-    const form = document.querySelector("#reauth_form")
-    if (!form) alert("Unable to find form with id=reauth_form on page.\n\n" +
-                     "Please notify your administrator")
-    let file_input = document.createElement('input')
-    /* make it hidden first so no flash on screen */
-    file_input.setAttribute("hidden", "")
-    file_input = form.appendChild(file_input)
-    /* Set the rest of the attributes now that is in the DOM.
-       One report said some attributes only worked once it
-       was added to the	DOM.
-    */
-    file_input.setAttribute("type", "file")
-    file_input.setAttribute("name", "@file")
-    /* Put all the files on one file input rather than
-       separate inputs. AFAICT there is no benefit to
-       creating a bunch of single file inputs and assigning
-       the files one by one.
-    */
-    file_input.setAttribute("multiple", "")
-    file_input.files = transfer.files
-})()
+  )
+
+  const form = document.querySelector("#reauth_form")
+  if (!form) alert("Unable to find form with id=reauth_form on page.\n\n" +
+                   "Please notify your administrator")
+  let file_input = document.createElement('input')
+  /* make it hidden first so no flash on screen */
+  file_input.setAttribute("hidden", "")
+  file_input = form.appendChild(file_input)
+  /* Set the rest of the attributes now that is in the DOM.
+     One report said some attributes only worked once it
+     was added to the	DOM.
+  */
+  file_input.setAttribute("type", "file")
+  file_input.setAttribute("name", "@file")
+  /* Put all the files on one file input rather than
+     separate inputs. AFAICT there is no benefit to
+     creating a bunch of single file inputs and assigning
+     the files one by one.
+  */
+  file_input.setAttribute("multiple", "")
+  file_input.files = transfer.files
+
+  console.timeEnd('reattach_files');
+})()	
 </script>
 </td>
 </tal:block>
diff --git a/test/test_liveserver.py b/test/test_liveserver.py
index 3db518550..62016d4b6 100644
--- a/test/test_liveserver.py
+++ b/test/test_liveserver.py
@@ -9,6 +9,7 @@
 from roundup.cgi.wsgi_handler import RequestDispatcher
 from .wsgi_liveserver import LiveServerTestCase
 from . import db_test_base
+from textwrap import dedent
 from time import sleep
 from .test_postgresql import skip_postgresql
 
@@ -109,6 +110,20 @@ def setup_class(cls):
         # set up and open a tracker
         cls.instance = db_test_base.setupTracker(cls.dirname, cls.backend)
 
+        # add an auditor that triggers a Reauth
+        with open("%s/detectors/reauth.py" % cls.dirname, "w") as f:
+            auditor = dedent("""
+              from roundup.cgi.exceptions import Reauth
+
+              def trigger_reauth(db, cl, nodeid, newvalues):
+                  if 'realname' in newvalues and not hasattr(db, 'reauth_done'):
+                      raise Reauth('Add an optional message to the user')
+
+              def init(db):
+                  db.user.audit('set', trigger_reauth, priority=110)
+             """)
+            f.write(auditor)
+
         # open the database
         cls.db = cls.instance.open('admin')
 
@@ -116,6 +131,12 @@ def setup_class(cls):
         cls.db.user.create(username="fred", roles='User',
             password=password.Password('sekrit'), address='fred@example.com')
 
+        # add a user for reauth tests
+        cls.db.user.create(username="reauth",
+                           realname="reauth test user",
+                           password=password.Password("reauth"),
+                           address="reauth@example.com", roles="User")
+
         # set the url the test instance will run at.
         cls.db.config['TRACKER_WEB'] = cls.tracker_web
         # set up mailhost so errors get reported to debuging capture file
@@ -123,6 +144,9 @@ def setup_class(cls):
         cls.db.config.MAIL_HOST = "localhost"
         cls.db.config.MAIL_DEBUG = "../_test_tracker_mail.log"
 
+        # also report it in the web.
+        cls.db.config.WEB_DEBUG = "yes"
+
         # added to enable csrf forgeries/CORS to be tested
         cls.db.config.WEB_CSRF_ENFORCE_HEADER_ORIGIN = "required"
         cls.db.config.WEB_ALLOWED_API_ORIGINS = "https://client.com"
@@ -336,6 +360,171 @@ class BaseTestCases(WsgiSetup, ClientSetup):
        wsgi server is started with various feature flags
     """
 
+    def test_reauth_workflow(self):
+        """as admin user:
+             change reauth user realname include all fields on the form
+                 also add a dummy file to the submitted request.
+             get back a reauth page/template (look for id="reauth_form")
+             verify hidden input for realname
+             verify hidden input for roles
+             verify the base 64 file content are on the page.
+        
+             submit form with bad password
+             verify error reported
+             verify hidden input for realname
+             (note the file contents will be gone because
+               preserving that requires javascript)
+        
+             enter good password
+             verify on user page (look for
+                              "(the default is 0)" hint for timezone)
+             verify new name present
+             verify success banner
+        """
+        from html.parser import HTMLParser
+        class HTMLExtractForm(HTMLParser):
+            """Custom parser to extract input fields from a form.
+
+               Set the form_label to extract inputs only inside a form
+               with a name or id matching form_label. Default is
+               "reauth_form".
+
+               Set names to a tuple/list/set with the names of the
+               inputs you are interested in. Defalt is None which
+               extracts all inputs on the page with a name property.
+            """
+            def __init__(self, names=None, form_label="reauth_form"):
+                super().__init__()
+                self.fields = {}
+                self.names = names
+                self.form_label = form_label
+                self._inside_form = False
+                
+            def handle_starttag(self, tag, attrs):
+                if tag == 'form':
+                    for attr, value in attrs:
+                        if attr in ('id', 'name') and value == self.form_label:
+                            self._inside_form = True
+                            return
+
+                if not self._inside_form: return
+                
+                if tag == 'input':
+                    field_name = None
+                    field_value = None
+                    for attr, value in attrs:
+                        if attr == 'name':
+                            field_name = value
+                        if attr == 'value':
+                            field_value = value
+
+                    # skip input type="submit" without name
+                    if not field_name: return
+                    
+                    if self.names is None:
+                        self.fields[field_name] = field_value
+                    elif field_name in self.names:
+                        self.fields[field_name] = field_value
+
+            def handle_endtag(self, tag):
+                if tag == "form":
+                    self._inside_form = False
+                    
+            def get_fields(self):
+                return self.fields
+
+
+        user_url = "%s/user%s" % (self.url_base(),
+                                  self.db.user.lookup('reauth'))
+
+        session, _response = self.create_login_session()
+        
+        user_page = session.get(user_url)
+        
+        self.assertEqual(user_page.status_code, 200)
+        self.assertTrue(b'reauth' in user_page.content)
+
+        parser = HTMLExtractForm(('@lastactivity', '@csrf'), 'itemSynopsis')
+        parser.feed(user_page.text)
+                                 
+        change = {"realname": "reauth1",
+                  "username": "reauth",
+                  "password": "",
+                  "@confirm@password": "",
+                  "phone": "",
+                  "organisation": "",
+                  "roles": "User",
+                  "timezone": "",
+                  "address": "reauth@example.com",
+                  "alternate_addresses": "",
+                  "@template": "item",
+                  "@required": "username,address",
+                  "@submit_button": "Submit Changes",
+                  "@action": "edit",
+                  **parser.get_fields()
+                  }
+        lastactivity = parser.get_fields()['@lastactivity']
+
+        # make the simple name/value dict into a name/tuple dict
+        # setting tuple[0] to None to indicate pulre string
+        # value. Then we use change2 with file to trigger
+        # multipart/form-data form encoding which preserves fields
+        # with empty values. application/x-www-form-urlencoded forms
+        # have fields with empty values dropped by cgi by default.
+        userpage_change = {key: (None, value) for key, value in change.items()}
+        userpage_change.update({"@file": ("filename.txt", "this is some text")})
+        
+        on_reauth = session.post(user_url, files=userpage_change)
+
+        self.assertIn(b'id="reauth_form"', on_reauth.content)
+        self.assertIn(b'Please enter your password to continue with',
+                      on_reauth.content)
+        # make sure the base64 encoded content for @file is present on
+        # the page. Because we are not running a javascript capable
+        # browser, it is not converted into an actual file input.
+        # But this check shows that a file generated by reauth is trying
+        # to maintain the file input.
+        self.assertIn(b'dGhpcyBpcyBzb21lIHRleHQ=', on_reauth.content)
+
+        parser = HTMLExtractForm()
+        parser.feed(on_reauth.text)
+        fields = parser.get_fields()
+        self.assertEqual(fields["@lastactivity"], lastactivity)
+        self.assertEqual(fields["@next_action"], "edit")
+        self.assertEqual(fields["@action"], "reauth")
+        self.assertEqual(fields["address"], "reauth@example.com")
+        self.assertEqual(fields["phone"], "")
+        self.assertEqual(fields["roles"], "User")
+        self.assertEqual(fields["realname"], "reauth1")
+
+        reauth_fields = {
+            "@reauth_password": (None, "sekret not right"),
+            "submit": (None, " Authorize Change "),
+            }
+        reauth_submit = {key: (None, value) for key, value in fields.items()}
+        reauth_submit.update(reauth_fields)
+
+        fail_reauth = session.post(user_url,
+                                   files=reauth_submit)
+        self.assertIn(b'id="reauth_form"', fail_reauth.content)
+        self.assertIn(b'Please enter your password to continue with',
+                      fail_reauth.content)
+        self.assertIn(b'Password incorrect', fail_reauth.content)
+
+        parser = HTMLExtractForm(('@csrf',))
+        parser.feed(fail_reauth.text)
+        # remeber we are logged in as admin - use admin pw.
+        reauth_submit.update({"@reauth_password": (None, "sekrit"),
+                              "@csrf":
+                                (None, parser.get_fields()['@csrf'])})
+        pass_reauth = session.post(user_url,
+                                   files=reauth_submit)
+        self.assertNotIn(b'id="reauth_form"', pass_reauth.content)
+        self.assertNotIn(b'Please enter your password to continue with',
+                      pass_reauth.content)
+        self.assertIn(b'user 4 realname edited ok', pass_reauth.content)
+        self.assertIn(b'(the default is 0)', pass_reauth.content)
+        
     def test_cookie_attributes(self):
         session, _response = self.create_login_session()
 
diff --git a/website/www/Makefile b/website/www/Makefile
index a087116a8..e239eab7d 100644
--- a/website/www/Makefile
+++ b/website/www/Makefile
@@ -12,7 +12,7 @@ help:
 # after upgrade to sphinx 1.8.5, search.html is missing load of searchtools.
 # fix that in postprocess
 # also sed index.html to properly format meta og:... entries.
-html: doc_links  ## make standalone HTML files
+html: doc_links  ## make standalone HTML files (KEEP_HTML=1 speeds build)
 	if [ -z "${KEEP_HTML}" ]; then rm -rf html; fi
 	rm -f html/robots.txt  # otherwise sphinx errors
 	mkdir -p $(TMP)/doctrees $(HTML)

From cf71c107aab7bad91fc124da4771a607c95d4264 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 14 Aug 2025 00:31:44 -0400
Subject: [PATCH 271/398] feat: fix jinja2 template

remove expression type marker left over from tal conversion.

filter function output for hiddent fields to unicode and mark as safe.

client_nonce is not a callable.
---
 share/roundup/templates/jinja2/html/_generic.reauth.html | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/share/roundup/templates/jinja2/html/_generic.reauth.html b/share/roundup/templates/jinja2/html/_generic.reauth.html
index ac2295f99..f4038f7ef 100644
--- a/share/roundup/templates/jinja2/html/_generic.reauth.html
+++ b/share/roundup/templates/jinja2/html/_generic.reauth.html
@@ -27,13 +27,13 @@
   <input type="submit" name="submit"
 	 value="{% trans %} Authorize Change {% endtrans %}">
   <input name="@csrf" type="hidden"
-	 value="{{ python:utils.anti_csrf_nonce() }}">
+	 value="{{ utils.anti_csrf_nonce() }}">
 
-  {{ utils.embed_form_fields(('submit',)) }}
+  {{ utils.embed_form_fields(('submit',))|u|safe }}
 
   </form>
 
-<script nonce="{{ request.client.client_nonce() }}">
+<script nonce="{{ request.client.client_nonce }}">
 /* This IIFE decodes the base64 file contents in the pre blocks,
    creates a new file blob for each one. Then adds a multiple file
    input and attaches all the files to it.

From cc82d467e71d46e2eeaf8666b90b0c0d2983e65b Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 14 Aug 2025 10:34:40 -0400
Subject: [PATCH 272/398] feat: fix tests under postgresql.

Wierd issue. Calling self.db.user.lookup('reauth') fails under
posttgresql with a cursor closed error. This same call works with
anydbm.

I tried adding a setup/teardown to open the tracker
(self.instance.open('admin') ...etc. But that made the wasgi server
fail to shut down for some reason.

So I hard coded the id for the reauth user.

Also for the postgresql test case, the reauth triggering auditor and
user setup weren't done. I tried to reuse the WsgiSetup.setup_class
and then add in the few extra things I needed, but it failed.
So I copypastaed the code and modified it.

Also corrected docstring for one of the test classes.
---
 test/test_liveserver.py | 58 ++++++++++++++++++++++++++++++++++++-----
 1 file changed, 51 insertions(+), 7 deletions(-)

diff --git a/test/test_liveserver.py b/test/test_liveserver.py
index 62016d4b6..4bec62b27 100644
--- a/test/test_liveserver.py
+++ b/test/test_liveserver.py
@@ -5,7 +5,7 @@
 from roundup import date as rdate
 from roundup import i18n
 from roundup import password
-from roundup.anypy.strings import b2s
+from roundup.anypy.strings import b2s, s2b
 from roundup.cgi.wsgi_handler import RequestDispatcher
 from .wsgi_liveserver import LiveServerTestCase
 from . import db_test_base
@@ -377,7 +377,7 @@ def test_reauth_workflow(self):
         
              enter good password
              verify on user page (look for
-                              "(the default is 0)" hint for timezone)
+                              "(the default is" hint for timezone)
              verify new name present
              verify success banner
         """
@@ -434,8 +434,16 @@ def get_fields(self):
                 return self.fields
 
 
+        # for some reason the lookup works with anydbm but
+        # returns a cursor closed error under postgresql.
+        # adding setup/teardown to TestPostgresWsgiServer
+        # with self.db = self.instance.open('admin') looks like
+        # it caused the wsgi server to hang. So hardcode the id.
+        #  self.db.user.lookup('reauth')
+        reauth_id = '4'
+
         user_url = "%s/user%s" % (self.url_base(),
-                                  self.db.user.lookup('reauth'))
+                                  reauth_id)
 
         session, _response = self.create_login_session()
         
@@ -522,8 +530,9 @@ def get_fields(self):
         self.assertNotIn(b'id="reauth_form"', pass_reauth.content)
         self.assertNotIn(b'Please enter your password to continue with',
                       pass_reauth.content)
-        self.assertIn(b'user 4 realname edited ok', pass_reauth.content)
-        self.assertIn(b'(the default is 0)', pass_reauth.content)
+        self.assertIn(b'user %s realname edited ok' % s2b(reauth_id),
+                      pass_reauth.content)
+        self.assertIn(b'(the default is', pass_reauth.content)
         
     def test_cookie_attributes(self):
         session, _response = self.create_login_session()
@@ -1831,6 +1840,20 @@ def setup_class(cls):
         # set up and open a tracker
         cls.instance = db_test_base.setupTracker(cls.dirname, cls.backend)
 
+        # add an auditor that triggers a Reauth
+        with open("%s/detectors/reauth.py" % cls.dirname, "w") as f:
+            auditor = dedent("""
+              from roundup.cgi.exceptions import Reauth
+
+              def trigger_reauth(db, cl, nodeid, newvalues):
+                  if 'realname' in newvalues and not hasattr(db, 'reauth_done'):
+                      raise Reauth('Add an optional message to the user')
+
+              def init(db):
+                  db.user.audit('set', trigger_reauth, priority=110)
+             """)
+            f.write(auditor)
+
         # open the database
         cls.db = cls.instance.open('admin')
 
@@ -1838,6 +1861,12 @@ def setup_class(cls):
         cls.db.user.create(username="fred", roles='User',
             password=password.Password('sekrit'), address='fred@example.com')
 
+        # add a user for reauth tests
+        cls.db.user.create(username="reauth",
+                           realname="reauth test user",
+                           password=password.Password("reauth"),
+                           address="reauth@example.com", roles="User")
+
         # set the url the test instance will run at.
         cls.db.config['TRACKER_WEB'] = cls.tracker_web
         # set up mailhost so errors get reported to debuging capture file
@@ -1845,11 +1874,15 @@ def setup_class(cls):
         cls.db.config.MAIL_HOST = "localhost"
         cls.db.config.MAIL_DEBUG = "../_test_tracker_mail.log"
 
+        # also report it in the web.
+        cls.db.config.WEB_DEBUG = "yes"
+
         # added to enable csrf forgeries/CORS to be tested
         cls.db.config.WEB_CSRF_ENFORCE_HEADER_ORIGIN = "required"
         cls.db.config.WEB_ALLOWED_API_ORIGINS = "https://client.com"
         cls.db.config['WEB_CSRF_ENFORCE_HEADER_X-REQUESTED-WITH'] = "required"
 
+        # use native indexer
         cls.db.config.INDEXER = "native-fts"
 
         # disable web login rate limiting. The fast rate of tests
@@ -1867,6 +1900,8 @@ def setup_class(cls):
         # re-open the database to get the updated INDEXER
         cls.db = cls.instance.open('admin')
 
+        # add an issue to allow testing retrieval.
+        # also used for text searching.
         result = cls.db.issue.create(title="foo bar RESULT")
 
         # add a message to allow retrieval
@@ -1875,6 +1910,16 @@ def setup_class(cls):
                                    date=rdate.Date(),
                                    messageid="test-msg-id")
 
+        # add a query using @current_user
+        result = cls.db.query.create(
+            klass="issue",
+            name="I created",
+            private_for=None,
+            url=("@columns=title,id,activity,status,assignedto&"
+                 "@sort=activity&@group=priority&@filter=creator&"
+                 "@pagesize=50&@startwith=0&creator=%40current_user")
+            )
+
         cls.db.commit()
         cls.db.close()
         
@@ -1899,8 +1944,7 @@ def test_native_fts(self):
 
 @skip_requests
 class TestApiRateLogin(WsgiSetup):
-    """Class to run test in BaseTestCases with the cache_tracker
-       feature flag enabled when starting the wsgi server
+    """Test api rate limiting on login use sqlite db.
     """
 
     backend = 'sqlite'

From de46b0bf6bc995678dd688ed1dd69f10ddb0595e Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 17 Aug 2025 16:18:53 -0400
Subject: [PATCH 273/398] close branch


From bb19835178949bb40bc47e30917b812c969f93dd Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 17 Aug 2025 16:35:46 -0400
Subject: [PATCH 274/398] close duplicate head caused by identical merge in two
 working copies


From 13134bd4631ff1f97372177cfb906504d98dd1c4 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 17 Aug 2025 16:44:22 -0400
Subject: [PATCH 275/398] document the repo cleanups and duplicate merge to get
 things cleaned up

---
 CHANGES.txt | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/CHANGES.txt b/CHANGES.txt
index 122e83527..b181e066d 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -23,6 +23,9 @@ Fixed:
   roundup.cgi.exceptions. Also it now inherits from HTTPException
   rather than Exception since it is an HTTP exception. (John
   Rouillard)
+- cleaned up repo. Close obsolete branches and close a split head due
+  to an identical merge intwo different workicng copies. (John
+  Rouillard)
 
 Features:
 

From 28b5642f812659cf5de1051a741c05f99ceebe7b Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Tue, 19 Aug 2025 22:32:46 -0400
Subject: [PATCH 276/398] feat: add support for using dictConfig to configure
 logging.

Basic logging config (one level and one output file non-rotating) was
always possible from config.ini. However the LOGGING_CONFIG setting
could be used to load an ini fileConfig style file to set various
channels (e.g. roundup.hyperdb) (also called qualname or tags) with
their own logging level, destination (rotating file, socket,
/dev/null) and log format.

This is now a deprecated method in newer logging modules. The
dictConfig format is preferred and allows disabiling other loggers as
well as invoking new loggers in local code. This commit adds support
for it reading the dict from a .json file. It also implements a
comment convention so you can document the dictConfig.

configuration.py:
 new code

test_config.py:
 test added for the new code.

admin_guide.txt, upgrading.txt CHANGES.txt:
  docs added upgrading references the section in admin_guid.
---
 CHANGES.txt              |   2 +
 doc/admin_guide.txt      | 275 +++++++++++++++++++++++++++++++++++++--
 doc/upgrading.txt        |  15 +++
 roundup/configuration.py |  95 +++++++++++++-
 test/test_config.py      | 195 +++++++++++++++++++++++++++
 5 files changed, 570 insertions(+), 12 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index b181e066d..ac2c54224 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -32,6 +32,8 @@ Features:
 - add support for authorized changes. User can be prompted to enter
   their password to authorize a change. If the user's password is
   properly entered, the change is committed. (John Rouillard)
+- add support for dictConfig style logging configuration. Ini/File
+  style configs will still be supported. (John Rouillard)
 
 2025-07-13 2.5.0
 
diff --git a/doc/admin_guide.txt b/doc/admin_guide.txt
index 538ad8fbe..42e73e299 100644
--- a/doc/admin_guide.txt
+++ b/doc/admin_guide.txt
@@ -47,31 +47,284 @@ There's two "installations" that we talk about when using Roundup:
    in the tracker's config.ini.
 
 
-Configuring Roundup's Logging of Messages For Sysadmins
-=======================================================
+Configuring Roundup Message Logging
+===================================
 
-You may configure where Roundup logs messages in your tracker's config.ini
-file. Roundup will use the standard Python (2.3+) logging implementation.
+You can control how Roundup logs messages using your tracker's
+config.ini file. Roundup uses the standard Python (2.3+) logging
+implementation.  The config file and ``roundup-server`` provide very
+basic control over logging.
 
-Configuration for standard "logging" module:
- - tracker configuration file specifies the location of a logging
-   configration file as ``logging`` -> ``config``
- - ``roundup-server`` specifies the location of a logging configuration
-   file on the command line
 Configuration for "BasicLogging" implementation:
  - tracker configuration file specifies the location of a log file
    ``logging`` -> ``filename``
  - tracker configuration file specifies the level to log to as
    ``logging`` -> ``level``
+ - tracker configuration file lets you disable other loggers
+   (e.g. when running under a wsgi framework) with
+   ``logging`` -> ``disable_loggers``.
  - ``roundup-server`` specifies the location of a log file on the command
    line
- - ``roundup-server`` specifies the level to log to on the command line
+ - ``roundup-server`` enable  using the standard python logger with
+    the tag/channel ``roundup.http`` on the command line
+
+By supplying a standard log config file in ini or json (dictionary)
+format, you get more control over the logs. You can set different
+levels for logs (e.g. roundup.hyperdb can be set to WARNING while
+other Roundup log channels are set to INFO and roundup.mailgw logs at
+DEBUG level). You can also send the logs for roundup.mailgw to syslog,
+and other roundup logs go to an automatically rotating log file, or
+are submitted to your log aggregator over https.
 
-(``roundup-mailgw`` always logs to the tracker's log file)
+Configuration for standard "logging" module:
+ - tracker configuration file specifies the location of a logging
+   configuration file as ``logging`` -> ``config``.
 
 In both cases, if no logfile is specified then logging will simply be sent
 to sys.stderr with only logging of ERROR messages.
 
+Standard Logging Setup
+----------------------
+
+You can specify your log configs in one of two formats:
+
+  * `fileConfig format
+    <https://docs.python.org/3/library/logging.config.html#logging.config.fileConfig>`_
+    in ini style
+  * `dictConfig format
+    <https://docs.python.org/3/library/logging.config.html#logging.config.dictConfig>`_
+    using json with comment support
+
+The dictConfig allows more control over configuration including
+loading your own log handlers and disabling existing handlers. If you
+use the fileConfig format, the ``logging`` -> ``disable_loggers`` flag
+in the tracker's config is used to enable/disable pre-existing loggers
+as there is no way to do this in the logging config file.
+
+.. _`dictLogConfig`:
+
+dictConfig Based Logging Config
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+dictConfigs are specified in JSON format with support for comments.
+The file name in the tracker's config for the ``logging`` -> ``config``
+setting must end with ``.json`` to choose the correct processing.
+
+Comments have to be in one of two forms:
+
+1. A ``#`` with preceding white space is considered a comment and is
+   stripped from the file before being passed to the json parser. This
+   is a "block comment".
+
+2. A ``#`` preceded by at least three
+   white space characters is stripped from the end of the line before
+   begin passed to the json parser. This is an "inline comment".
+
+Other than this the file is a standard json file that matches the
+`Configuration dictionary schema
+<https://docs.python.org/3/library/logging.config.html#configuration-dictionary-schema>`_
+defined in the Python documentation.
+
+
+Example dictConfig Logging Config
+.................................
+
+Note that this file is not actually JSON format as it include comments.
+So you can not use tools that expect JSON (linters, formatters) to
+work with it.
+
+The config below works with the `Waitress wsgi server
+<https://github.com/Pylons/waitress>`_ configured to use the
+roundup.wsgi channel. It also controls the `TransLogger middleware
+<https://github.com/pasteorg/paste>`_ configured to use
+roundup.wsgi.translogger, to produce httpd style combined logs. The
+log file is specified relative to the current working directory not
+the tracker home. The tracker home is the subdirectory demo under the
+current working directory. The commented config is::
+
+  {
+    "version": 1,   # only supported version
+    "disable_existing_loggers": false,      # keep the wsgi loggers
+
+    "formatters": {
+      # standard format for Roundup messages
+      "standard": {
+        "format": "%(asctime)s %(levelname)s %(name)s:%(module)s %(msg)s"
+      },
+      # used for waitress wsgi server to produce httpd style logs
+      "http": {
+	"format": "%(message)s"
+      }
+    },
+    "handlers": {
+      # create an access.log style http log file
+      "access": {
+	"level": "INFO",
+	"formatter": "http",
+	"class": "logging.FileHandler",
+	"filename": "demo/access.log"
+      },
+      # logging for roundup.* loggers
+      "roundup": {
+	"level": "DEBUG",
+	"formatter": "standard",
+	"class": "logging.FileHandler",
+	"filename": "demo/roundup.log"
+      },
+      # print to stdout - fall through for other logging
+      "default": {
+	"level": "DEBUG",
+	"formatter": "standard",
+	"class": "logging.StreamHandler",
+	"stream": "ext://sys.stdout"
+      }
+  },
+    "loggers": {
+      "": {
+	"handlers": [
+	  "default"
+	],
+	"level": "DEBUG",
+	"propagate": false
+      },
+      # used by roundup.* loggers
+      "roundup": {
+	"handlers": [
+	  "roundup"
+	],
+	"level": "DEBUG",
+	"propagate": false   # note pytest testing with caplog requires
+			     # this to be true
+      },
+      "roundup.hyperdb": {
+	"handlers": [
+	  "roundup"
+	],
+	"level": "INFO",    # can be a little noisy use INFO for production
+	"propagate": false
+      },
+     "roundup.wsgi": {    # using the waitress framework
+	"handlers": [
+	  "roundup"
+	],
+	"level": "DEBUG",
+	"propagate": false
+      },
+     "roundup.wsgi.translogger": {   # httpd style logging
+	"handlers": [
+	  "access"
+	],
+	"level": "DEBUG",
+	"propagate": false
+      },
+     "root": {
+	"handlers": [
+	  "default"
+	],
+	"level": "DEBUG",
+	"propagate": false
+      }
+    }
+  }
+
+fileConfig Based Logging Config
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The file config is an older and more limited method of configuring
+logging. It is described by the `Configuration file format
+<https://docs.python.org/3/library/logging.config.html#configuration-file-format>`_
+in the Python documentation. The file name in the tracker's config for
+the ``logging`` -> ``config`` setting must end with ``.ini`` to choose
+the correct processing.
+
+Example fileConfig LoggingConfig
+................................
+
+This is an example .ini used with roundup-server configured to use
+``roundup.http`` channel. It also includes some custom logging
+qualnames/tags/channels for logging schema/permission detector and
+extension output::
+
+  [loggers]
+  #other keys: roundup.hyperdb.backend
+  keys=root,roundup,roundup.http,roundup.hyperdb,actions,schema,extension,detector
+
+  [logger_root]
+  #also for root where channlel is not set (NOTSET) aka all
+  level=DEBUG
+  handlers=rotate
+
+  [logger_roundup]
+  # logger for all roundup.* not otherwise configured
+  level=DEBUG
+  handlers=rotate
+  qualname=roundup
+  propagate=0
+
+  [logger_roundup.http]
+  level=INFO
+  handlers=rotate_weblog
+  qualname=roundup.http
+  propagate=0
+
+  [logger_roundup.hyperdb]
+  level=WARNING
+  handlers=rotate
+  qualname=roundup.hyperdb
+  propagate=0
+
+  [logger_actions]
+  level=INFO
+  handlers=rotate
+  qualname=actions
+  propagate=0
+
+  [logger_detector]
+  level=INFO
+  handlers=rotate
+  qualname=detector
+  propagate=0
+
+  [logger_schema]
+  level=DEBUG
+  handlers=rotate
+  qualname=schema
+  propagate=0
+
+  [logger_extension]
+  level=INFO
+  handlers=rotate
+  qualname=extension
+  propagate=0
+
+  [handlers]
+  keys=basic,rotate,rotate_weblog
+
+  [handler_basic]
+  class=StreamHandler
+  args=(sys.stderr,)
+  formatter=basic
+
+  [handler_rotate]
+  class=logging.handlers.RotatingFileHandler
+  args=('roundup.log','a', 5120000, 2)
+  formatter=basic
+
+  [handler_rotate_weblog]
+  class=logging.handlers.RotatingFileHandler
+  args=('httpd.log','a', 1024000, 2)
+  formatter=plain
+
+  [formatters]
+  keys=basic,plain
+
+  [formatter_basic]
+  format=%(asctime)s %(process)d %(name)s:%(module)s.%(funcName)s,%(levelname)s: %(message)s
+  datefmt=%Y-%m-%d %H:%M:%S
+
+  [formatter_plain]
+  format=%(process)d %(message)s
+
 
 Configuring roundup-server
 ==========================
diff --git a/doc/upgrading.txt b/doc/upgrading.txt
index 66faca566..ac919a5b2 100644
--- a/doc/upgrading.txt
+++ b/doc/upgrading.txt
@@ -133,6 +133,21 @@ date, text etc.) do not need JavaScript to work.
 
 See :ref:`Confirming the User` in the reference manual for details.
 
+Support for dictConfig Logging Configuration (optional)
+-------------------------------------------------------
+
+Roundup's basic log configuration via config.ini has always had the
+ability to use an ini style logging configuration to set levels per
+log channel, control output file rotation etc.
+
+With Roundup 2.6 you can use a JSON like file to configure logging
+using `dictConfig
+<https://docs.python.org/3/library/logging.config.html#logging.config.dictConfig>`_. The
+JSON file format as been enhanced to support comments that are
+stripped before being processed by the logging system.
+
+You can read about the details in the :ref:`admin manual <dictLogConfig>`.
+
 .. index:: Upgrading; 2.4.0 to 2.5.0
 
 Migrating from 2.4.0 to 2.5.0
diff --git a/roundup/configuration.py b/roundup/configuration.py
index 421d91bcd..51df14bd2 100644
--- a/roundup/configuration.py
+++ b/roundup/configuration.py
@@ -43,6 +43,16 @@ def __str__(self):
         return self.args[0]
 
 
+class LoggingConfigError(ConfigurationError):
+    def __init__(self, message, **attrs):
+        super().__init__(message)
+        for key, value in attrs.items():
+            self.__setattr__(key, value)
+
+    def __str__(self):
+        return self.args[0]
+
+
 class NoConfigError(ConfigurationError):
 
     """Raised when configuration loading fails
@@ -2330,14 +2340,97 @@ def reset(self):
             self.detectors.reset()
         self.init_logging()
 
+    def load_config_dict_from_json_file(self, filename):
+        import json
+        comment_re = re.compile(
+            r"""^\s*\#.*  # comment at beginning of line possibly indented.
+            |  # or
+            ^(.*)\s\s\s\#.*  # comment char preceeded by at least three spaces.
+            """, re.VERBOSE)
+
+        config_list = []
+        with open(filename) as config_file:
+            for line in config_file:
+                match = comment_re.search(line)
+                if match:
+                    if match.lastindex:
+                        config_list.append(match.group(1) + "\n")
+                    else:
+                        # insert blank line for comment line to
+                        # keep line numbers in sync.
+                        config_list.append("\n")
+                    continue
+                config_list.append(line)
+
+        try:
+            config_dict = json.loads("".join(config_list))
+        except json.decoder.JSONDecodeError as e:
+            error_at_doc_line = e.lineno
+            # subtract 1 - zero index on config_list
+            # remove '\n' for display
+            line = config_list[error_at_doc_line - 1][:-1]
+
+            hint = ""
+            if line.find('#') != -1:
+                hint = "\nMaybe bad inline comment, 3 spaces needed before #."
+
+            raise LoggingConfigError(
+                'Error parsing json logging dict (%(file)s) '
+                'near \n\n  %(line)s\n\n'
+                '%(msg)s: line %(lineno)s column %(colno)s.%(hint)s' %
+                {"file": filename,
+                 "line": line,
+                 "msg": e.msg,
+                 "lineno": error_at_doc_line,
+                 "colno": e.colno,
+                 "hint": hint},
+                config_file=self.filepath,
+                source="json.loads"
+            )
+
+        return config_dict
+
     def init_logging(self):
         _file = self["LOGGING_CONFIG"]
-        if _file and os.path.isfile(_file):
+        if _file and os.path.isfile(_file) and _file.endswith(".ini"):
             logging.config.fileConfig(
                 _file,
                 disable_existing_loggers=self["LOGGING_DISABLE_LOGGERS"])
             return
 
+        if _file and os.path.isfile(_file) and _file.endswith(".json"):
+            config_dict = self.load_config_dict_from_json_file(_file)
+            try:
+                logging.config.dictConfig(config_dict)
+            except ValueError as e:
+                # docs say these exceptions:
+                #    ValueError, TypeError, AttributeError, ImportError
+                # could be raised, but
+                # looking through the code, it looks like
+                # configure() maps all exceptions (including
+                # ImportError, TypeError) raised by functions to
+                # ValueError.
+                context = "No additional information available."
+                if hasattr(e, '__context__') and e.__context__:
+                    # get additional error info. E.G. if INFO
+                    # is replaced by MANGO, context is:
+                    #    ValueError("Unknown level: 'MANGO'")
+                    # while str(e) is "Unable to configure handler 'access'"
+                    context = e.__context__
+
+                raise LoggingConfigError(
+                    'Error loading logging dict from %(file)s.\n'
+                    '%(msg)s\n%(context)s\n' % {
+                        "file": _file,
+                        "msg": type(e).__name__ + ": " + str(e),
+                        "context": context
+                    },
+                    config_file=self.filepath,
+                    source="dictConfig"
+                )
+
+            return
+
         _file = self["LOGGING_FILENAME"]
         # set file & level on the roundup logger
         logger = logging.getLogger('roundup')
diff --git a/test/test_config.py b/test/test_config.py
index aa3bb968a..f7e630a76 100644
--- a/test/test_config.py
+++ b/test/test_config.py
@@ -25,6 +25,7 @@
 import unittest
 
 from os.path import normpath
+from textwrap import dedent
 
 from roundup import configuration
 from roundup.backends import get_backend, have_backend
@@ -1046,3 +1047,197 @@ def testInvalidIndexerValue(self):
         print(string_rep)
         self.assertIn("nati", string_rep)
         self.assertIn("'whoosh'", string_rep)
+
+    def testDictLoggerConfigViaJson(self):
+
+        # test case broken, comment on version line misformatted
+        config1 = dedent("""
+           {
+              "version": 1,   # only supported version
+              "disable_existing_loggers": false,      # keep the wsgi loggers
+
+              "formatters": {
+                # standard Roundup formatter including context id.
+                  "standard": {
+                    "format": "%(asctime)s %(levelname)s %(name)s:%(module)s %(msg)s"
+                },
+                # used for waitress wsgi server to produce httpd style logs
+                "http": {
+                  "format": "%(message)s"
+                }
+              },
+              "handlers": {
+                # create an access.log style http log file
+                "access": {
+                  "level": "INFO",
+                  "formatter": "http",
+                  "class": "logging.FileHandler",
+                  "filename": "demo/access.log"
+                },
+                # logging for roundup.* loggers
+                "roundup": {
+                  "level": "DEBUG",
+                  "formatter": "standard",
+                  "class": "logging.FileHandler",
+                  "filename": "demo/roundup.log"
+                },
+                # print to stdout - fall through for other logging
+                "default": {
+                  "level": "DEBUG",
+                  "formatter": "standard",
+                  "class": "logging.StreamHandler",
+                  "stream": "ext://sys.stdout"
+                }
+            },
+              "loggers": {
+                "": {
+                  "handlers": [
+                    "default"     # used by wsgi/usgi
+                  ],
+                  "level": "DEBUG",
+                  "propagate": false
+                },
+                # used by roundup.* loggers
+                "roundup": {
+                  "handlers": [
+                    "roundup"
+                  ],
+                  "level": "DEBUG",
+                  "propagate": false   # note pytest testing with caplog requires
+                                       # this to be true
+                },
+                "roundup.hyperdb": {
+                  "handlers": [
+                    "roundup"
+                  ],
+                  "level": "INFO",    # can be a little noisy INFO for production
+                  "propagate": false
+                },
+               "roundup.wsgi": {    # using the waitress framework
+                  "handlers": [
+                    "roundup"
+                  ],
+                  "level": "DEBUG",
+                  "propagate": false
+                },
+               "roundup.wsgi.translogger": {   # httpd style logging
+                  "handlers": [
+                    "access"
+                  ],
+                  "level": "DEBUG",
+                  "propagate": false
+                },
+               "root": {
+                  "handlers": [
+                    "default"
+                  ],
+                  "level": "DEBUG",
+                  "propagate": false
+                }
+              }
+            }
+        """)
+
+        log_config_filename = self.instance.tracker_home \
+            + "/_test_log_config.json"
+
+        # happy path
+        with open(log_config_filename, "w") as log_config_file:
+            log_config_file.write(config1)
+            
+        config = self.db.config.load_config_dict_from_json_file(
+            log_config_filename)
+        self.assertIn("version", config)
+        self.assertEqual(config['version'], 1)
+
+        # broken inline comment misformatted
+        test_config = config1.replace(": 1,   #", ": 1, #")
+        with open(log_config_filename, "w") as log_config_file:
+            log_config_file.write(test_config)
+
+        with self.assertRaises(configuration.LoggingConfigError) as cm:
+            config = self.db.config.load_config_dict_from_json_file(
+                log_config_filename)
+        self.assertEqual(
+            cm.exception.args[0],
+            ('Error parsing json logging dict '
+             '(_test_instance/_test_log_config.json) near \n\n     '
+             '"version": 1, # only supported version\n\nExpecting '
+             'property name enclosed in double quotes: line 3 column 18.\n'
+             'Maybe bad inline comment, 3 spaces needed before #.')
+        )
+
+        # broken trailing , on last dict element
+        test_config = config1.replace(' "ext://sys.stdout"',
+                                      ' "ext://sys.stdout",'
+                                      )
+        with open(log_config_filename, "w") as log_config_file:
+            log_config_file.write(test_config)
+            
+        with self.assertRaises(configuration.LoggingConfigError) as cm:
+            config = self.db.config.load_config_dict_from_json_file(
+                log_config_filename)
+        self.assertEqual(
+            cm.exception.args[0],
+            ('Error parsing json logging dict '
+             '(_test_instance/_test_log_config.json) near \n\n'
+             '       }\n\nExpecting property name enclosed in double '
+             'quotes: line 37 column 6.')
+        )
+
+        # happy path for init_logging()
+
+        # verify preconditions
+        logger = logging.getLogger("roundup")
+        self.assertEqual(logger.level, 40) # error default from config.ini
+        self.assertEqual(logger.filters, [])
+
+        with open(log_config_filename, "w") as log_config_file:
+            log_config_file.write(config1)
+
+        # file is made relative to tracker dir.
+        self.db.config["LOGGING_CONFIG"] = '_test_log_config.json'
+        config = self.db.config.init_logging()
+        self.assertIs(config, None)
+
+        logger = logging.getLogger("roundup")
+        self.assertEqual(logger.level, 10) # debug
+        self.assertEqual(logger.filters, [])
+        
+        # broken invalid format type (int not str)
+        test_config = config1.replace('"format": "%(message)s"',
+                                      '"format": 1234',)
+        with open(log_config_filename, "w") as log_config_file:
+            log_config_file.write(test_config)
+
+        # file is made relative to tracker dir.
+        self.db.config["LOGGING_CONFIG"] = '_test_log_config.json'
+        with self.assertRaises(configuration.LoggingConfigError) as cm:
+            config = self.db.config.init_logging()
+        self.assertEqual(
+            cm.exception.args[0],
+            ('Error loading logging dict from '
+             '_test_instance/_test_log_config.json.\n'
+             "ValueError: Unable to configure formatter 'http'\n"
+             'expected string or bytes-like object\n')
+        )
+
+        # broken invalid level MANGO
+        test_config = config1.replace(
+            ': "INFO",    # can',
+            ': "MANGO",    # can')
+        with open(log_config_filename, "w") as log_config_file:
+            log_config_file.write(test_config)
+
+        # file is made relative to tracker dir.
+        self.db.config["LOGGING_CONFIG"] = '_test_log_config.json'
+        with self.assertRaises(configuration.LoggingConfigError) as cm:
+            config = self.db.config.init_logging()
+        self.assertEqual(
+            cm.exception.args[0],
+            ("Error loading logging dict from "
+             "_test_instance/_test_log_config.json.\nValueError: "
+             "Unable to configure logger 'roundup.hyperdb'\nUnknown level: "
+             "'MANGO'\n")
+
+        )

From ab9a37b30a0520653e3751a00605dfd6a1fed5e7 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 20 Aug 2025 11:17:23 -0400
Subject: [PATCH 277/398] test: fix testDictLoggerConfigViaJson

The path to the log file in the config did not exist. Change to use
the tracker home.


Also add a test where the log file directory does not exist. This
reports the full path, so have to edit the full path in the error
message before comparison.
---
 test/test_config.py | 31 +++++++++++++++++++++++++++++--
 1 file changed, 29 insertions(+), 2 deletions(-)

diff --git a/test/test_config.py b/test/test_config.py
index f7e630a76..80c469c52 100644
--- a/test/test_config.py
+++ b/test/test_config.py
@@ -20,6 +20,7 @@
 import logging
 import os
 import pytest
+import re
 import shutil
 import sys
 import unittest
@@ -1072,14 +1073,14 @@ def testDictLoggerConfigViaJson(self):
                   "level": "INFO",
                   "formatter": "http",
                   "class": "logging.FileHandler",
-                  "filename": "demo/access.log"
+                  "filename": "_test_instance/access.log"
                 },
                 # logging for roundup.* loggers
                 "roundup": {
                   "level": "DEBUG",
                   "formatter": "standard",
                   "class": "logging.FileHandler",
-                  "filename": "demo/roundup.log"
+                  "filename": "_test_instance/roundup.log"
                 },
                 # print to stdout - fall through for other logging
                 "default": {
@@ -1241,3 +1242,29 @@ def testDictLoggerConfigViaJson(self):
              "'MANGO'\n")
 
         )
+
+        # broken invalid output directory
+        test_config = config1.replace(
+            ' "_test_instance/access.log"',
+            ' "not_a_test_instance/access.log"')
+        with open(log_config_filename, "w") as log_config_file:
+            log_config_file.write(test_config)
+
+        # file is made relative to tracker dir.
+        self.db.config["LOGGING_CONFIG"] = '_test_log_config.json'
+        with self.assertRaises(configuration.LoggingConfigError) as cm:
+            config = self.db.config.init_logging()
+
+        # error includes full path which is different on different
+        # CI and dev platforms. So munge the path using re.sub.
+        self.assertEqual(
+            re.sub("directory: \'/.*not_a", 'directory: not_a' ,
+                   cm.exception.args[0]),
+            ("Error loading logging dict from "
+             "_test_instance/_test_log_config.json.\n"
+             "ValueError: Unable to configure handler 'access'\n"
+             "[Errno 2] No such file or directory: "
+             "not_a_test_instance/access.log'\n"
+            )
+        )
+

From d510304e215d551d0be60536a04ff382b83c817e Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 20 Aug 2025 11:23:39 -0400
Subject: [PATCH 278/398] chore: bump actions/checkout as reported by
 dependabot.

---
 .github/workflows/anchore.yml         | 2 +-
 .github/workflows/build-xapian.yml    | 2 +-
 .github/workflows/ci-test.yml         | 2 +-
 .github/workflows/codeql-analysis.yml | 2 +-
 .github/workflows/ossf-scorecard.yml  | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/anchore.yml b/.github/workflows/anchore.yml
index 7eff99f17..3ab5b7cf5 100644
--- a/.github/workflows/anchore.yml
+++ b/.github/workflows/anchore.yml
@@ -37,7 +37,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout the code
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
     - name: Build the Docker image
       run: docker pull python:3-alpine; docker build . --file scripts/Docker/Dockerfile --tag localbuild/testimage:latest
     - name: List the Docker image
diff --git a/.github/workflows/build-xapian.yml b/.github/workflows/build-xapian.yml
index 4d6edf6dc..00e6fe099 100644
--- a/.github/workflows/build-xapian.yml
+++ b/.github/workflows/build-xapian.yml
@@ -42,7 +42,7 @@ jobs:
         # if: {{ false }}
           # continue running if step fails
         # continue-on-error: true
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
         # Setup version of Python to use
       - name: Set Up Python 3.13
diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index 8e88da76c..c0a66398f 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -116,7 +116,7 @@ jobs:
         # if: {{ false }}
           # continue running if step fails
         # continue-on-error: true
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       # Setup version of Python to use
       - name: Set Up Python ${{ matrix.python-version }}
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 0b214cc78..d5a708504 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -49,7 +49,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
diff --git a/.github/workflows/ossf-scorecard.yml b/.github/workflows/ossf-scorecard.yml
index c6a5547e3..28075031e 100644
--- a/.github/workflows/ossf-scorecard.yml
+++ b/.github/workflows/ossf-scorecard.yml
@@ -35,7 +35,7 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
 

From 797154675cdfd8457c19bde09f83dc90d616b8f4 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 20 Aug 2025 12:53:14 -0400
Subject: [PATCH 279/398] test: more fixes for variations among python
 versions.

reset logging. The loggers I installed are bleeding through to tests
in other modules.

Then handle recogniton of:

   trailing comma in json reporting line with comma not following line

   incorrect type value in dictConfig int where string should be
     3.7 fils to detect. 3.10+ add "got 'int'" to reason.
---
 test/test_config.py | 68 +++++++++++++++++++++++++++++++++------------
 1 file changed, 51 insertions(+), 17 deletions(-)

diff --git a/test/test_config.py b/test/test_config.py
index 80c469c52..ded20d23b 100644
--- a/test/test_config.py
+++ b/test/test_config.py
@@ -1051,7 +1051,7 @@ def testInvalidIndexerValue(self):
 
     def testDictLoggerConfigViaJson(self):
 
-        # test case broken, comment on version line misformatted
+        # good base test case
         config1 = dedent("""
            {
               "version": 1,   # only supported version
@@ -1178,13 +1178,30 @@ def testDictLoggerConfigViaJson(self):
         with self.assertRaises(configuration.LoggingConfigError) as cm:
             config = self.db.config.load_config_dict_from_json_file(
                 log_config_filename)
-        self.assertEqual(
-            cm.exception.args[0],
-            ('Error parsing json logging dict '
-             '(_test_instance/_test_log_config.json) near \n\n'
-             '       }\n\nExpecting property name enclosed in double '
-             'quotes: line 37 column 6.')
-        )
+        #pre 3.12??
+        # FIXME check/remove when 3.13. is min supported version
+        if "property name" in cm.exception.args[0]:
+            self.assertEqual(
+                cm.exception.args[0],
+                ('Error parsing json logging dict '
+                 '(_test_instance/_test_log_config.json) near \n\n'
+                 '       }\n\nExpecting property name enclosed in double '
+                 'quotes: line 37 column 6.')
+            )
+
+        # 3.13+ diags FIXME
+        print('FINDME')
+        print(cm.exception.args[0])
+        _junk = '''
+        if "property name" not in cm.exception.args[0]:
+            self.assertEqual(
+                cm.exception.args[0],
+                ('Error parsing json logging dict '
+                 '(_test_instance/_test_log_config.json) near \n\n'
+                 '       }\n\nExpecting property name enclosed in double '
+                 'quotes: line 37 column 6.')
+            )
+        '''
 
         # happy path for init_logging()
 
@@ -1213,15 +1230,25 @@ def testDictLoggerConfigViaJson(self):
 
         # file is made relative to tracker dir.
         self.db.config["LOGGING_CONFIG"] = '_test_log_config.json'
-        with self.assertRaises(configuration.LoggingConfigError) as cm:
-            config = self.db.config.init_logging()
-        self.assertEqual(
-            cm.exception.args[0],
-            ('Error loading logging dict from '
-             '_test_instance/_test_log_config.json.\n'
-             "ValueError: Unable to configure formatter 'http'\n"
-             'expected string or bytes-like object\n')
-        )
+
+
+        # different versions of python have different errors
+        # (or no error for this case in 3.7)
+        # FIXME remove version check post 3.7 as minimum version
+        if sys.version_info > (3,7):
+            with self.assertRaises(configuration.LoggingConfigError) as cm:
+                config = self.db.config.init_logging()
+
+                # mangle args[0] to add got 'int'
+                # FIXME: remove mangle after 3.12 min version
+                self.assertEqual(
+                    cm.exception.args[0].replace(
+                        "object\n", "object, got 'int'\n"),
+                    ('Error loading logging dict from '
+                     '_test_instance/_test_log_config.json.\n'
+                     "ValueError: Unable to configure formatter 'http'\n"
+                     "expected string or bytes-like object, got 'int'\n")
+                )
 
         # broken invalid level MANGO
         test_config = config1.replace(
@@ -1268,3 +1295,10 @@ def testDictLoggerConfigViaJson(self):
             )
         )
 
+        # rip down all the loggers leaving the root logger reporting to stdout.
+        # otherwise logger config is leaking to other tests
+
+        from importlib import reload
+        logging.shutdown()
+        reload(logging)
+

From 24b82e46659ba007e5a588e42a35fa8e4be9e294 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 20 Aug 2025 16:13:52 -0400
Subject: [PATCH 280/398] test: more fun with logger leakage.

I have disabled all calls to dictConfig. I can't see how to stop this
from leaking.

I even tried storing the root and roundup logger state (copying lists)
before running anything and restoring afterwards.

the funny part is if I removae all dictConfig calls and keep the state
saving and logger reset and restoring code it sill fails.

It passes if I don't restore the handler state for the root logger.

However the test will fail even when I comment out the root logger
config in the dict if I apply the dict. ????
---
 test/test_config.py | 55 ++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 54 insertions(+), 1 deletion(-)

diff --git a/test/test_config.py b/test/test_config.py
index ded20d23b..a7f4a6ee7 100644
--- a/test/test_config.py
+++ b/test/test_config.py
@@ -1139,6 +1139,20 @@ def testDictLoggerConfigViaJson(self):
             }
         """)
 
+        # save roundup logger state
+        loggernames = ("", "roundup")
+        logger_state = {}
+        for name in loggernames:
+            logger_state[name] = {}
+
+            roundup_logger = logging.getLogger("roundup")
+            for i in ("filters", "handlers", "level", "propagate"):
+                attr = getattr(roundup_logger, i)
+                if isinstance(attr, list):
+                    logger_state[name][i] = attr.copy()
+                else:
+                    logger_state[name][i] = getattr(roundup_logger, i)
+
         log_config_filename = self.instance.tracker_home \
             + "/_test_log_config.json"
 
@@ -1203,6 +1217,16 @@ def testDictLoggerConfigViaJson(self):
             )
         '''
 
+        '''
+        # comment out as it breaks the logging config for caplog
+        # on test_rest.py:testBadFormAttributeErrorException
+        # for all rdbms backends.
+        # the log ERROR check never gets any info
+
+        # commenting out root logger in config doesn't make it work.
+        # storing root logger and roundup logger state and restoring it
+        # still fails.
+
         # happy path for init_logging()
 
         # verify preconditions
@@ -1295,9 +1319,38 @@ def testDictLoggerConfigViaJson(self):
             )
         )
 
-        # rip down all the loggers leaving the root logger reporting to stdout.
+        '''
+        # rip down all the loggers leaving the root logger reporting
+        # to stdout.
         # otherwise logger config is leaking to other tests
 
+        roundup_loggers = [logging.getLogger(name) for name in
+                   logging.root.manager.loggerDict
+                   if name.startswith("roundup")]
+
+        # cribbed from configuration.py:init_loggers
+        hdlr = logging.StreamHandler(sys.stdout)
+        formatter = logging.Formatter(
+            '%(asctime)s %(levelname)s %(message)s')
+        hdlr.setFormatter(formatter)
+
+        for logger in roundup_loggers:
+            # no logging API to remove all existing handlers!?!
+            for h in logger.handlers:
+                h.close()
+                logger.removeHandler(h)
+            logger.handlers = [hdlr]
+            logger.setLevel("DEBUG")
+            logger.propagate = True
+
+        for name in loggernames:
+            local_logger = logging.getLogger(name)
+            for attr in logger_state[name]:
+                # if I restore handlers state for root logger
+                # I break the test referenced above. -- WHY????
+                if attr == "handlers" and name == "": continue
+                setattr(local_logger, attr, logger_state[name][attr])
+                
         from importlib import reload
         logging.shutdown()
         reload(logging)

From bf02f353d19be24dcf8ad7ee6ed2bb2aac7d19ad Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 20 Aug 2025 21:04:56 -0400
Subject: [PATCH 281/398] test: test dictLoggerConfig - working logging reset
 and windows

Finally figured out why things weren't being restored. Bug in the
code.

Created a class fixture that stores and restores the logging config.

Also using os.path.join and other machinations to make the tests run
under windows and linux correctly.
---
 test/test_config.py | 187 ++++++++++++++++++++++++--------------------
 1 file changed, 101 insertions(+), 86 deletions(-)

diff --git a/test/test_config.py b/test/test_config.py
index a7f4a6ee7..7d1ed541e 100644
--- a/test/test_config.py
+++ b/test/test_config.py
@@ -415,8 +415,71 @@ def testOctalNumberOption(self):
         print(type(config._get_option('UMASK')))
 
 
+@pytest.mark.usefixtures("save_restore_logging")
 class TrackerConfig(unittest.TestCase):
 
+    @pytest.fixture(scope="class")
+    def save_restore_logging(self):
+        """Save logger state and try to restore it after all tests in
+           this class have finished.
+
+           The primary test is testDictLoggerConfigViaJson which
+           can change the loggers and break tests that depend on caplog
+        """
+        # Save logger state for root and roundup top level logger
+        loggernames = ("", "roundup")
+
+        # The state attributes to save. Lists are shallow copied
+        state_to_save = ("filters", "handlers", "level", "propagate")
+
+        logger_state = {}
+        for name in loggernames:
+            logger_state[name] = {}
+            roundup_logger = logging.getLogger(name)
+
+            for i in state_to_save:
+                attr = getattr(roundup_logger, i)
+                if isinstance(attr, list):
+                    logger_state[name][i] = attr.copy()
+                else:
+                    logger_state[name][i] = getattr(roundup_logger, i)
+
+        # run all class tests here
+        yield
+
+        # rip down all the loggers leaving the root logger reporting
+        # to stdout.
+        # otherwise logger config is leaking to other tests
+        roundup_loggers = [logging.getLogger(name) for name in
+                           logging.root.manager.loggerDict
+                   if name.startswith("roundup")]
+
+        # cribbed from configuration.py:init_loggers
+        hdlr = logging.StreamHandler(sys.stdout)
+        formatter = logging.Formatter(
+            '%(asctime)s %(levelname)s %(message)s')
+        hdlr.setFormatter(formatter)
+
+        for logger in roundup_loggers:
+            # no logging API to remove all existing handlers!?!
+            for h in logger.handlers:
+                h.close()
+                logger.removeHandler(h)
+            logger.handlers = [hdlr]
+            logger.setLevel("WARNING")
+            logger.propagate = True  # important as caplog requires this
+
+        # Restore the info we stored before running tests
+        for name in loggernames:
+            local_logger = logging.getLogger(name)
+            for attr in logger_state[name]:
+                setattr(local_logger, attr, logger_state[name][attr])
+
+        # reset logging as well
+        from importlib import reload
+        logging.shutdown()
+        reload(logging)
+
     backend = 'anydbm'
 
     def setUp(self):
@@ -1139,22 +1202,8 @@ def testDictLoggerConfigViaJson(self):
             }
         """)
 
-        # save roundup logger state
-        loggernames = ("", "roundup")
-        logger_state = {}
-        for name in loggernames:
-            logger_state[name] = {}
-
-            roundup_logger = logging.getLogger("roundup")
-            for i in ("filters", "handlers", "level", "propagate"):
-                attr = getattr(roundup_logger, i)
-                if isinstance(attr, list):
-                    logger_state[name][i] = attr.copy()
-                else:
-                    logger_state[name][i] = getattr(roundup_logger, i)
-
-        log_config_filename = self.instance.tracker_home \
-            + "/_test_log_config.json"
+        log_config_filename = os.path.join(self.instance.tracker_home,
+                                           "_test_log_config.json")
 
         # happy path
         with open(log_config_filename, "w") as log_config_file:
@@ -1176,10 +1225,11 @@ def testDictLoggerConfigViaJson(self):
         self.assertEqual(
             cm.exception.args[0],
             ('Error parsing json logging dict '
-             '(_test_instance/_test_log_config.json) near \n\n     '
+             '(%s) near \n\n     '
              '"version": 1, # only supported version\n\nExpecting '
              'property name enclosed in double quotes: line 3 column 18.\n'
-             'Maybe bad inline comment, 3 spaces needed before #.')
+             'Maybe bad inline comment, 3 spaces needed before #.' %
+             log_config_filename)
         )
 
         # broken trailing , on last dict element
@@ -1198,9 +1248,10 @@ def testDictLoggerConfigViaJson(self):
             self.assertEqual(
                 cm.exception.args[0],
                 ('Error parsing json logging dict '
-                 '(_test_instance/_test_log_config.json) near \n\n'
-                 '       }\n\nExpecting property name enclosed in double '
-                 'quotes: line 37 column 6.')
+                 '(%s) near \n\n'
+                 '       }\n\n'
+                 'Expecting property name enclosed in double '
+                 'quotes: line 37 column 6.' % log_config_filename)
             )
 
         # 3.13+ diags FIXME
@@ -1211,22 +1262,12 @@ def testDictLoggerConfigViaJson(self):
             self.assertEqual(
                 cm.exception.args[0],
                 ('Error parsing json logging dict '
-                 '(_test_instance/_test_log_config.json) near \n\n'
-                 '       }\n\nExpecting property name enclosed in double '
-                 'quotes: line 37 column 6.')
+                 '(%s) near \n\n'
+                 '       "stream": "ext://sys.stdout"\n\n'
+                 'Expecting property name enclosed in double '
+                 'quotes: line 37 column 6.' % log_config_filename)
             )
         '''
-
-        '''
-        # comment out as it breaks the logging config for caplog
-        # on test_rest.py:testBadFormAttributeErrorException
-        # for all rdbms backends.
-        # the log ERROR check never gets any info
-
-        # commenting out root logger in config doesn't make it work.
-        # storing root logger and roundup logger state and restoring it
-        # still fails.
-
         # happy path for init_logging()
 
         # verify preconditions
@@ -1269,9 +1310,10 @@ def testDictLoggerConfigViaJson(self):
                     cm.exception.args[0].replace(
                         "object\n", "object, got 'int'\n"),
                     ('Error loading logging dict from '
-                     '_test_instance/_test_log_config.json.\n'
+                     '%s.\n'
                      "ValueError: Unable to configure formatter 'http'\n"
-                     "expected string or bytes-like object, got 'int'\n")
+                     "expected string or bytes-like object, got 'int'\n" %
+                     log_config_filename)
                 )
 
         # broken invalid level MANGO
@@ -1288,9 +1330,9 @@ def testDictLoggerConfigViaJson(self):
         self.assertEqual(
             cm.exception.args[0],
             ("Error loading logging dict from "
-             "_test_instance/_test_log_config.json.\nValueError: "
+             "%s.\nValueError: "
              "Unable to configure logger 'roundup.hyperdb'\nUnknown level: "
-             "'MANGO'\n")
+             "'MANGO'\n" % log_config_filename)
 
         )
 
@@ -1298,6 +1340,8 @@ def testDictLoggerConfigViaJson(self):
         test_config = config1.replace(
             ' "_test_instance/access.log"',
             ' "not_a_test_instance/access.log"')
+        access_filename = os.path.join("not_a_test_instance", "access.log")
+
         with open(log_config_filename, "w") as log_config_file:
             log_config_file.write(test_config)
 
@@ -1307,51 +1351,22 @@ def testDictLoggerConfigViaJson(self):
             config = self.db.config.init_logging()
 
         # error includes full path which is different on different
-        # CI and dev platforms. So munge the path using re.sub.
-        self.assertEqual(
-            re.sub("directory: \'/.*not_a", 'directory: not_a' ,
-                   cm.exception.args[0]),
-            ("Error loading logging dict from "
-             "_test_instance/_test_log_config.json.\n"
-             "ValueError: Unable to configure handler 'access'\n"
-             "[Errno 2] No such file or directory: "
-             "not_a_test_instance/access.log'\n"
-            )
-        )
-
-        '''
-        # rip down all the loggers leaving the root logger reporting
-        # to stdout.
-        # otherwise logger config is leaking to other tests
-
-        roundup_loggers = [logging.getLogger(name) for name in
-                   logging.root.manager.loggerDict
-                   if name.startswith("roundup")]
-
-        # cribbed from configuration.py:init_loggers
-        hdlr = logging.StreamHandler(sys.stdout)
-        formatter = logging.Formatter(
-            '%(asctime)s %(levelname)s %(message)s')
-        hdlr.setFormatter(formatter)
-
-        for logger in roundup_loggers:
-            # no logging API to remove all existing handlers!?!
-            for h in logger.handlers:
-                h.close()
-                logger.removeHandler(h)
-            logger.handlers = [hdlr]
-            logger.setLevel("DEBUG")
-            logger.propagate = True
-
-        for name in loggernames:
-            local_logger = logging.getLogger(name)
-            for attr in logger_state[name]:
-                # if I restore handlers state for root logger
-                # I break the test referenced above. -- WHY????
-                if attr == "handlers" and name == "": continue
-                setattr(local_logger, attr, logger_state[name][attr])
-                
-        from importlib import reload
-        logging.shutdown()
-        reload(logging)
+        # CI and dev platforms. So munge the path using re.sub and
+        # replace. Windows needs replace as the full path for windows
+        # to the file has '\\\\' not '\\' when taken from __context__.
+        # E.G.
+        # ("Error loading logging dict from '
+        # '_test_instance\\_test_log_config.json.\nValueError: '
+        # "Unable to configure handler 'access'\n[Errno 2] No such file "
+        # "or directory: "
+        # "'C:\\\\tracker\\\\path\\\\not_a_test_instance\\\\access.log'\n")
+        # sigh.....
+        output = re.sub("directory: \'.*not_a", 'directory: not_a' ,
+                   cm.exception.args[0].replace(r'\\','\\'))
+        target = ("Error loading logging dict from "
+                  "%s.\n"
+                  "ValueError: Unable to configure handler 'access'\n"
+                  "[Errno 2] No such file or directory: "
+                  "%s'\n" % (log_config_filename, access_filename))
+        self.assertEqual(output, target)
 

From 4c31c3931097fa9b2927a968f5443d6d81f12bd7 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 21 Aug 2025 09:53:32 -0400
Subject: [PATCH 282/398] test: fix code that does not run a test on 3.7

---
 test/test_config.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/test_config.py b/test/test_config.py
index 7d1ed541e..17ed0ba65 100644
--- a/test/test_config.py
+++ b/test/test_config.py
@@ -1300,7 +1300,7 @@ def testDictLoggerConfigViaJson(self):
         # different versions of python have different errors
         # (or no error for this case in 3.7)
         # FIXME remove version check post 3.7 as minimum version
-        if sys.version_info > (3,7):
+        if sys.version_info >= (3, 8, 0):
             with self.assertRaises(configuration.LoggingConfigError) as cm:
                 config = self.db.config.init_logging()
 

From 22da3e23c1b0bc1b59169fcf3b97a71e9d9732f2 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 25 Aug 2025 20:30:51 -0400
Subject: [PATCH 283/398] doc: add check for db.tx_Source to Reauth examples

Otherwise it triggers on roundup-admin et al
---
 doc/customizing.txt | 6 ++++++
 doc/reference.txt   | 6 ++++++
 2 files changed, 12 insertions(+)

diff --git a/doc/customizing.txt b/doc/customizing.txt
index 62faac188..c3aa5fb29 100644
--- a/doc/customizing.txt
+++ b/doc/customizing.txt
@@ -1836,6 +1836,12 @@ contents::
            # the user has confirmed their identity
            return
 
+	if db.tx_Source not in ("web"):
+	   # the user is using rest, xmlrpc, command line,
+	   # email (unlikely) which don't support interactive
+	   # verification
+	   return
+	   
         # if the password or email are changing, require id confirmation
         if 'password' in newvalues:
             raise Reauth('Add an optional message to the user')
diff --git a/doc/reference.txt b/doc/reference.txt
index 9713ae283..5d26493fa 100644
--- a/doc/reference.txt
+++ b/doc/reference.txt
@@ -1321,6 +1321,12 @@ user to submit each sensitive property separately.  For example::
 		   'at the same time is not allowed. Please '
 		   'submit two changes.')
 
+   if db.tx_Source not in ("web"):
+      # the user is using rest, xmlrpc, command line,
+      # email (unlikely) which don't support interactive
+      # verification
+      return
+
    if 'password' in newvalues and not hasattr(db, 'reauth_done'):
       raise Reauth()
 

From 0bc1ea3d4e4668dfa914780168b1afe2591b98b7 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 25 Aug 2025 20:32:14 -0400
Subject: [PATCH 284/398] doc: reformat markdown-note footnote

---
 doc/upgrading.txt | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/doc/upgrading.txt b/doc/upgrading.txt
index ac919a5b2..718a01148 100644
--- a/doc/upgrading.txt
+++ b/doc/upgrading.txt
@@ -949,9 +949,9 @@ bug. Splitting the large script into two parts:
 allows use of ``structure`` on the script with no replaced
 strings should it be required for your tracker.
 
-.. [#markdown-note] If you are using markdown formatting for your tracker's notes,
-   the user will see the markdown label rather than the long
-   (suspicious) URL. You may want to add something like::
+.. [#markdown-note] If you are using markdown formatting for your
+   tracker's notes, the user will see the markdown label rather than
+   the long (suspicious) URL. You may want to add something like::
 
      a[href*=\@template]::after {
          content: ' [' attr(href) ']';

From 98ef0037b4eff7f1254c1397077338c359700f7b Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 25 Aug 2025 20:44:42 -0400
Subject: [PATCH 285/398] doc: add disable saving roundup-admin history file
 for password changes

---
 doc/admin_guide.txt |  9 ++++++---
 doc/upgrading.txt   | 10 +++++++++-
 2 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/doc/admin_guide.txt b/doc/admin_guide.txt
index 42e73e299..c94ac59be 100644
--- a/doc/admin_guide.txt
+++ b/doc/admin_guide.txt
@@ -2151,13 +2151,16 @@ you can put the initialise command and password on the command
 line. But this allows others on the host to see the password (using
 the ps command). To initialise a tracker non-interactively without
 exposing the password, create a file (e.g init_tracker) set to mode
-600 (so only the owner can read it) with the contents:
+600 (so only the owner can read it) with the contents::
 
    initialise admin_password
 
-and feed it to roundup-admin on standard input. E.G.
+and feed it to roundup-admin on standard input. E.G.::
 
-  cat init_tracker | roundup-admin -i tracker_dir
+  cat init_tracker | roundup-admin -i tracker_dir -P history_features=2
+
+setting the pragma ``history_features=2`` prevents storing the command
+in the user's history file.
 
 (for more details see https://issues.roundup-tracker.org/issue2550789.)
 
diff --git a/doc/upgrading.txt b/doc/upgrading.txt
index 718a01148..e814a6352 100644
--- a/doc/upgrading.txt
+++ b/doc/upgrading.txt
@@ -2188,7 +2188,7 @@ running::
     roundup-admin -i <tracker_home> table password,id,username
 
 Look for lines starting with ``{CRYPT}``. You can reset the user's
-password using::
+password using [#history-pragma]_ ::
 
     roundup-admin -i <tracker_home>
     roundup> set user16 password=somenewpassword
@@ -2199,6 +2199,14 @@ prompt). This prevents the new password from showing up in the output
 of ps or shell history. The new password will be encrypted using the
 default encryption method (usually pbkdf2).
 
+.. [#history-pragma] If your version of roundup-admin provides history
+  support, you should add ``-P history_features=2`` to the command
+  line or run ``pragma history_features=2`` at the ``roundup>``
+  prompt. This will prevent the command line (and password) from being
+  saved to your history file (usually ``.roundup_admin_history`` in
+  your user's home directory.  You can use ``roundup-admin -i
+  <tracker_home> pragma list`` to see if pragmas are supported.
+
 Enable performance improvement for wsgi mode (optional)
 -------------------------------------------------------
 

From 0c1dcc3ed37f8d78631526c218bc2d48a06c944d Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Tue, 26 Aug 2025 22:24:00 -0400
Subject: [PATCH 286/398] feat: change comment in dictConfig json file to //
 from #

Emacs json mode at least will properly indent when using // as a
comment character and not #.
---
 doc/admin_guide.txt      | 54 ++++++++++++++++++++++------------------
 roundup/configuration.py |  8 +++---
 test/test_config.py      | 38 ++++++++++++++--------------
 3 files changed, 53 insertions(+), 47 deletions(-)

diff --git a/doc/admin_guide.txt b/doc/admin_guide.txt
index c94ac59be..7228023d1 100644
--- a/doc/admin_guide.txt
+++ b/doc/admin_guide.txt
@@ -110,15 +110,18 @@ dictConfigs are specified in JSON format with support for comments.
 The file name in the tracker's config for the ``logging`` -> ``config``
 setting must end with ``.json`` to choose the correct processing.
 
-Comments have to be in one of two forms:
+Comments have to be in one of two forms based on javascript line
+comments:
 
-1. A ``#`` with preceding white space is considered a comment and is
-   stripped from the file before being passed to the json parser. This
-   is a "block comment".
+1. A ``//`` possibly indented with whitespace on a line is considereda
+   a comment and is stripped from the file before being passed to the
+   json parser. This is a "line comment".
 
-2. A ``#`` preceded by at least three
-   white space characters is stripped from the end of the line before
-   begin passed to the json parser. This is an "inline comment".
+2. A ``//` with at least three white space characters before it is
+   stripped from the end of the line before begin passed to the json
+   parser. This is an "inline comment".
+
+Block style comments are not supported.
 
 Other than this the file is a standard json file that matches the
 `Configuration dictionary schema
@@ -129,9 +132,12 @@ defined in the Python documentation.
 Example dictConfig Logging Config
 .................................
 
-Note that this file is not actually JSON format as it include comments.
-So you can not use tools that expect JSON (linters, formatters) to
-work with it.
+Note that this file is not actually JSON format as it include
+comments.  However by using javascript style comments, some tools that
+expect JSON (editors, linters, formatters) might work with it.  A
+command like ``sed -e 's#^\s*//.*##' -e 's#\s*\s\s\s//.*##'
+logging.json`` can be used to strip comments for programs that need
+it.
 
 The config below works with the `Waitress wsgi server
 <https://github.com/Pylons/waitress>`_ configured to use the
@@ -143,35 +149,35 @@ the tracker home. The tracker home is the subdirectory demo under the
 current working directory. The commented config is::
 
   {
-    "version": 1,   # only supported version
-    "disable_existing_loggers": false,      # keep the wsgi loggers
+    "version": 1,   // only supported version
+    "disable_existing_loggers": false,      // keep the wsgi loggers
 
     "formatters": {
-      # standard format for Roundup messages
+      // standard format for Roundup messages
       "standard": {
-        "format": "%(asctime)s %(levelname)s %(name)s:%(module)s %(msg)s"
+        "format": "%(asctime)s %(ctx_id)s %(levelname)s %(name)s:%(module)s %(msg)s"
       },
-      # used for waitress wsgi server to produce httpd style logs
+      // used for waitress wsgi server to produce httpd style logs
       "http": {
 	"format": "%(message)s"
       }
     },
     "handlers": {
-      # create an access.log style http log file
+      // create an access.log style http log file
       "access": {
 	"level": "INFO",
 	"formatter": "http",
 	"class": "logging.FileHandler",
 	"filename": "demo/access.log"
       },
-      # logging for roundup.* loggers
+      // logging for roundup.* loggers
       "roundup": {
 	"level": "DEBUG",
 	"formatter": "standard",
 	"class": "logging.FileHandler",
 	"filename": "demo/roundup.log"
       },
-      # print to stdout - fall through for other logging
+      // print to stdout - fall through for other logging
       "default": {
 	"level": "DEBUG",
 	"formatter": "standard",
@@ -187,30 +193,30 @@ current working directory. The commented config is::
 	"level": "DEBUG",
 	"propagate": false
       },
-      # used by roundup.* loggers
+      // used by roundup.* loggers
       "roundup": {
 	"handlers": [
 	  "roundup"
 	],
 	"level": "DEBUG",
-	"propagate": false   # note pytest testing with caplog requires
-			     # this to be true
+	"propagate": false   // note pytest testing with caplog requires
+			     // this to be true
       },
       "roundup.hyperdb": {
 	"handlers": [
 	  "roundup"
 	],
-	"level": "INFO",    # can be a little noisy use INFO for production
+	"level": "INFO",    // can be a little noisy use INFO for production
 	"propagate": false
       },
-     "roundup.wsgi": {    # using the waitress framework
+     "roundup.wsgi": {    // using the waitress framework
 	"handlers": [
 	  "roundup"
 	],
 	"level": "DEBUG",
 	"propagate": false
       },
-     "roundup.wsgi.translogger": {   # httpd style logging
+     "roundup.wsgi.translogger": {   // httpd style logging
 	"handlers": [
 	  "access"
 	],
diff --git a/roundup/configuration.py b/roundup/configuration.py
index 51df14bd2..fe37240f3 100644
--- a/roundup/configuration.py
+++ b/roundup/configuration.py
@@ -2343,9 +2343,9 @@ def reset(self):
     def load_config_dict_from_json_file(self, filename):
         import json
         comment_re = re.compile(
-            r"""^\s*\#.*  # comment at beginning of line possibly indented.
+            r"""^\s*//#.*  # comment at beginning of line possibly indented.
             |  # or
-            ^(.*)\s\s\s\#.*  # comment char preceeded by at least three spaces.
+            ^(.*)\s\s\s\//.*  # comment char preceeded by at least three spaces.
             """, re.VERBOSE)
 
         config_list = []
@@ -2371,8 +2371,8 @@ def load_config_dict_from_json_file(self, filename):
             line = config_list[error_at_doc_line - 1][:-1]
 
             hint = ""
-            if line.find('#') != -1:
-                hint = "\nMaybe bad inline comment, 3 spaces needed before #."
+            if line.find('//') != -1:
+                hint = "\nMaybe bad inline comment, 3 spaces needed before //."
 
             raise LoggingConfigError(
                 'Error parsing json logging dict (%(file)s) '
diff --git a/test/test_config.py b/test/test_config.py
index 17ed0ba65..1c2834c54 100644
--- a/test/test_config.py
+++ b/test/test_config.py
@@ -1117,35 +1117,35 @@ def testDictLoggerConfigViaJson(self):
         # good base test case
         config1 = dedent("""
            {
-              "version": 1,   # only supported version
-              "disable_existing_loggers": false,      # keep the wsgi loggers
+              "version": 1,   // only supported version
+              "disable_existing_loggers": false,      // keep the wsgi loggers
 
               "formatters": {
-                # standard Roundup formatter including context id.
+                // standard Roundup formatter including context id.
                   "standard": {
                     "format": "%(asctime)s %(levelname)s %(name)s:%(module)s %(msg)s"
                 },
-                # used for waitress wsgi server to produce httpd style logs
+                // used for waitress wsgi server to produce httpd style logs
                 "http": {
                   "format": "%(message)s"
                 }
               },
               "handlers": {
-                # create an access.log style http log file
+                // create an access.log style http log file
                 "access": {
                   "level": "INFO",
                   "formatter": "http",
                   "class": "logging.FileHandler",
                   "filename": "_test_instance/access.log"
                 },
-                # logging for roundup.* loggers
+                // logging for roundup.* loggers
                 "roundup": {
                   "level": "DEBUG",
                   "formatter": "standard",
                   "class": "logging.FileHandler",
                   "filename": "_test_instance/roundup.log"
                 },
-                # print to stdout - fall through for other logging
+                // print to stdout - fall through for other logging
                 "default": {
                   "level": "DEBUG",
                   "formatter": "standard",
@@ -1156,35 +1156,35 @@ def testDictLoggerConfigViaJson(self):
               "loggers": {
                 "": {
                   "handlers": [
-                    "default"     # used by wsgi/usgi
+                    "default"     // used by wsgi/usgi
                   ],
                   "level": "DEBUG",
                   "propagate": false
                 },
-                # used by roundup.* loggers
+                // used by roundup.* loggers
                 "roundup": {
                   "handlers": [
                     "roundup"
                   ],
                   "level": "DEBUG",
-                  "propagate": false   # note pytest testing with caplog requires
-                                       # this to be true
+                  "propagate": false   // note pytest testing with caplog requires
+                                       // this to be true
                 },
                 "roundup.hyperdb": {
                   "handlers": [
                     "roundup"
                   ],
-                  "level": "INFO",    # can be a little noisy INFO for production
+                  "level": "INFO",    // can be a little noisy INFO for production
                   "propagate": false
                 },
-               "roundup.wsgi": {    # using the waitress framework
+               "roundup.wsgi": {    // using the waitress framework
                   "handlers": [
                     "roundup"
                   ],
                   "level": "DEBUG",
                   "propagate": false
                 },
-               "roundup.wsgi.translogger": {   # httpd style logging
+               "roundup.wsgi.translogger": {   // httpd style logging
                   "handlers": [
                     "access"
                   ],
@@ -1215,7 +1215,7 @@ def testDictLoggerConfigViaJson(self):
         self.assertEqual(config['version'], 1)
 
         # broken inline comment misformatted
-        test_config = config1.replace(": 1,   #", ": 1, #")
+        test_config = config1.replace(": 1,   //", ": 1, //")
         with open(log_config_filename, "w") as log_config_file:
             log_config_file.write(test_config)
 
@@ -1226,9 +1226,9 @@ def testDictLoggerConfigViaJson(self):
             cm.exception.args[0],
             ('Error parsing json logging dict '
              '(%s) near \n\n     '
-             '"version": 1, # only supported version\n\nExpecting '
+             '"version": 1, // only supported version\n\nExpecting '
              'property name enclosed in double quotes: line 3 column 18.\n'
-             'Maybe bad inline comment, 3 spaces needed before #.' %
+             'Maybe bad inline comment, 3 spaces needed before //.' %
              log_config_filename)
         )
 
@@ -1318,8 +1318,8 @@ def testDictLoggerConfigViaJson(self):
 
         # broken invalid level MANGO
         test_config = config1.replace(
-            ': "INFO",    # can',
-            ': "MANGO",    # can')
+            ': "INFO",    // can',
+            ': "MANGO",    // can')
         with open(log_config_filename, "w") as log_config_file:
             log_config_file.write(test_config)
 

From 50a8b0069a7ab16313d90c9dca11cdef1a13d4c0 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Tue, 26 Aug 2025 23:06:40 -0400
Subject: [PATCH 287/398] refactor: also error on missing file or invalid
 extension

Refactored the code to reuse check that logging config file is set and
that the file exists.

Now throws error and exits if file name does not end in .ini or .json.

Now throws error if file doesn't exist. Before it would just configure
default logging as though file wasn't specified.

Added tests for these two cases.
---
 roundup/configuration.py | 85 +++++++++++++++++++++++-----------------
 test/test_config.py      | 38 ++++++++++++++++++
 2 files changed, 86 insertions(+), 37 deletions(-)

diff --git a/roundup/configuration.py b/roundup/configuration.py
index fe37240f3..d170eeed3 100644
--- a/roundup/configuration.py
+++ b/roundup/configuration.py
@@ -2392,45 +2392,56 @@ def load_config_dict_from_json_file(self, filename):
 
     def init_logging(self):
         _file = self["LOGGING_CONFIG"]
-        if _file and os.path.isfile(_file) and _file.endswith(".ini"):
-            logging.config.fileConfig(
-                _file,
-                disable_existing_loggers=self["LOGGING_DISABLE_LOGGERS"])
-            return
-
-        if _file and os.path.isfile(_file) and _file.endswith(".json"):
-            config_dict = self.load_config_dict_from_json_file(_file)
-            try:
-                logging.config.dictConfig(config_dict)
-            except ValueError as e:
-                # docs say these exceptions:
-                #    ValueError, TypeError, AttributeError, ImportError
-                # could be raised, but
-                # looking through the code, it looks like
-                # configure() maps all exceptions (including
-                # ImportError, TypeError) raised by functions to
-                # ValueError.
-                context = "No additional information available."
-                if hasattr(e, '__context__') and e.__context__:
-                    # get additional error info. E.G. if INFO
-                    # is replaced by MANGO, context is:
-                    #    ValueError("Unknown level: 'MANGO'")
-                    # while str(e) is "Unable to configure handler 'access'"
-                    context = e.__context__
-
-                raise LoggingConfigError(
-                    'Error loading logging dict from %(file)s.\n'
-                    '%(msg)s\n%(context)s\n' % {
-                        "file": _file,
-                        "msg": type(e).__name__ + ": " + str(e),
-                        "context": context
-                    },
-                    config_file=self.filepath,
-                    source="dictConfig"
-                )
-
+        if _file and os.path.isfile(_file):
+            if _file.endswith(".ini"):
+                logging.config.fileConfig(
+                    _file,
+                    disable_existing_loggers=self["LOGGING_DISABLE_LOGGERS"])
+            elif _file.endswith(".json"):
+                config_dict = self.load_config_dict_from_json_file(_file)
+                try:
+                    logging.config.dictConfig(config_dict)
+                except ValueError as e:
+                    # docs say these exceptions:
+                    #    ValueError, TypeError, AttributeError, ImportError
+                    # could be raised, but
+                    # looking through the code, it looks like
+                    # configure() maps all exceptions (including
+                    # ImportError, TypeError) raised by functions to
+                    # ValueError.
+                    context = "No additional information available."
+                    if hasattr(e, '__context__') and e.__context__:
+                        # get additional error info. E.G. if INFO
+                        # is replaced by MANGO, context is:
+                        #    ValueError("Unknown level: 'MANGO'")
+                        # while str(e) is "Unable to configure handler 'access'"
+                        context = e.__context__
+
+                    raise LoggingConfigError(
+                        'Error loading logging dict from %(file)s.\n'
+                        '%(msg)s\n%(context)s\n' % {
+                            "file": _file,
+                            "msg": type(e).__name__ + ": " + str(e),
+                            "context": context
+                        },
+                        config_file=self.filepath,
+                        source="dictConfig"
+                    )
+            else:
+                raise OptionValueError(
+                    self.options['LOGGING_CONFIG'],
+                    _file,
+                    "Unable to load logging config file. "
+                    "File extension must be '.ini' or '.json'.\n"
+                    )
+                
             return
 
+        if _file:
+            raise OptionValueError(self.options['LOGGING_CONFIG'],
+                                   _file,
+                                   "Unable to find logging config file.")
+        
         _file = self["LOGGING_FILENAME"]
         # set file & level on the roundup logger
         logger = logging.getLogger('roundup')
diff --git a/test/test_config.py b/test/test_config.py
index 1c2834c54..130c9c412 100644
--- a/test/test_config.py
+++ b/test/test_config.py
@@ -1370,3 +1370,41 @@ def testDictLoggerConfigViaJson(self):
                   "%s'\n" % (log_config_filename, access_filename))
         self.assertEqual(output, target)
 
+    def test_missing_logging_config_file(self):
+        saved_config = self.db.config['LOGGING_CONFIG']
+        
+        self.db.config['LOGGING_CONFIG'] = 'logging.json'
+        
+        with self.assertRaises(configuration.OptionValueError) as cm:
+            self.db.config.init_logging()
+
+        self.assertEqual(cm.exception.args[1], "_test_instance/logging.json")
+        self.assertEqual(cm.exception.args[2],
+                         "Unable to find logging config file.")
+
+        self.db.config['LOGGING_CONFIG'] = 'logging.ini'
+
+        with self.assertRaises(configuration.OptionValueError) as cm:
+            self.db.config.init_logging()
+
+        self.assertEqual(cm.exception.args[1], "_test_instance/logging.ini")
+        self.assertEqual(cm.exception.args[2],
+                         "Unable to find logging config file.")
+
+        self.db.config['LOGGING_CONFIG'] = saved_config
+        
+    def test_unknown_logging_config_file_type(self):
+        saved_config = self.db.config['LOGGING_CONFIG']
+
+        self.db.config['LOGGING_CONFIG'] = 'schema.py'
+
+        
+        with self.assertRaises(configuration.OptionValueError) as cm:
+            self.db.config.init_logging()
+
+        self.assertEqual(cm.exception.args[1], "_test_instance/schema.py")
+        self.assertEqual(cm.exception.args[2],
+                         "Unable to load logging config file. "
+                         "File extension must be '.ini' or '.json'.\n")
+
+        self.db.config['LOGGING_CONFIG'] = saved_config

From 0c3458bac0cbd3cab34cfb3a9d7e9feee91c34ad Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Tue, 26 Aug 2025 23:37:42 -0400
Subject: [PATCH 288/398] feat: add 'q' as alias to quit to exit interactive
 roundup-admin

Also require no arguments to 'q', 'quit' or 'exit' before exiting.
Now typing 'quit a' will get an unknown command error.

Add to admin-guide how to get out of interactive mode.

Also test 'q' and 'exit' commands.

No upgrading docs added. Not that big a feature. Just noted in
CHANGES. Reporting error if argument provided is unlikely to be an
issue IMO, so no upgrading.txt entry.
---
 CHANGES.txt         | 2 ++
 doc/admin_guide.txt | 3 +++
 roundup/admin.py    | 3 ++-
 test/test_admin.py  | 4 ++--
 4 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index ac2c54224..f3d7cea36 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -34,6 +34,8 @@ Features:
   properly entered, the change is committed. (John Rouillard)
 - add support for dictConfig style logging configuration. Ini/File
   style configs will still be supported. (John Rouillard)
+- add 'q' as alias for quit in roundup-admin interactive mode. (John
+  Rouillard)
 
 2025-07-13 2.5.0
 
diff --git a/doc/admin_guide.txt b/doc/admin_guide.txt
index 7228023d1..bcd5101f4 100644
--- a/doc/admin_guide.txt
+++ b/doc/admin_guide.txt
@@ -2067,6 +2067,9 @@ The basic usage is:
  Commands may be abbreviated as long as the abbreviation
  matches only one command, e.g. l == li == lis == list.
 
+In interactive mode entering: ``q``, ``quit``, or ``exit`` alone on a
+line will exit the program.
+
 One thing to note, The ``-u user`` setting does not currently operate
 like a user logging in via the web. The user running roundup-admin
 must have read access to the tracker home directory. As a result the
diff --git a/roundup/admin.py b/roundup/admin.py
index 5fd1394bb..f52aaa261 100644
--- a/roundup/admin.py
+++ b/roundup/admin.py
@@ -2415,7 +2415,8 @@ def interactive(self):
             except ValueError:
                 continue        # Ignore invalid quoted token
             if not args: continue  # noqa: E701
-            if args[0] in ('quit', 'exit'): break   # noqa: E701
+            if args[0] in ('q', 'quit', 'exit') and len(args) == 1:
+                break   # noqa: E701
             self.run_command(args)
 
         # exit.. check for transactions
diff --git a/test/test_admin.py b/test/test_admin.py
index e6387098e..97018453c 100644
--- a/test/test_admin.py
+++ b/test/test_admin.py
@@ -150,7 +150,7 @@ def testBasicInteractive(self):
         expected = 'ready for input.\nType "help" for help.'
         self.assertEqual(expected, out[-1*len(expected):])
 
-        inputs = iter(["list user", "quit"])
+        inputs = iter(["list user", "q"])
 
         AdminTool.my_input = lambda _self, _prompt: next(inputs)
 
@@ -1067,7 +1067,7 @@ def testPragma_reopen_tracker(self):
 
         # must set verbose to see _reopen_tracker hidden setting.
         # and to get "Reopening tracker" verbose log output
-        inputs = iter(["pragma verbose=true", "pragma list", "quit"])
+        inputs = iter(["pragma verbose=true", "pragma list", "exit"])
         AdminTool.my_input = lambda _self, _prompt: next(inputs)
 
         self.install_init()

From 87adb70dca81d4f2e0e4a538799fa825638a2d7b Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 28 Aug 2025 11:13:24 -0400
Subject: [PATCH 289/398] build(chore): update bump codecov/codecov-action from
 5.4.3 to 5.5.0

https://github.com/roundup-tracker/roundup/pull/61 by dependabot
---
 .github/workflows/ci-test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index c0a66398f..35a5a948b 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -323,7 +323,7 @@ jobs:
         
       - name: Upload coverage to Codecov
         # see: https://github.com/codecov/codecov-action#usage
-        uses: codecov/codecov-action@18283e04ce6e62d37312384ff67231eb8fd56d24 # v5.4.3
+        uses: codecov/codecov-action@fdcc8476540edceab3de004e990f80d881c6cc00 # v5.5.0
         with:
           verbose: true
           token: ${{ secrets.CODECOV_TOKEN }}

From 8547740c034d54225f47d507b9d76c7d551c270d Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 28 Aug 2025 11:30:11 -0400
Subject: [PATCH 290/398] chore: update sha256 index for latest pyhton:3-alpine
 image.

---
 scripts/Docker/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/Docker/Dockerfile b/scripts/Docker/Dockerfile
index 7ab539823..b3424cd1b 100644
--- a/scripts/Docker/Dockerfile
+++ b/scripts/Docker/Dockerfile
@@ -26,7 +26,7 @@ ARG source=local
 # Note this is the index digest for the image, not the manifest digest.
 # The index digest is shared across archetectures (amd64, arm64 etc.)
 # while the manifest digest is unique per platform/arch.
-ARG SHA256=9b4929a72599b6c6389ece4ecbf415fd1355129f22bb92bb137eea098f05e975
+ARG SHA256=9ba6d8cbebf0fb6546ae71f2a1c14f6ffd2fdab83af7fa5669734ef30ad48844
 
 # Set to any non-empty value to enable shell debugging for troubleshooting
 ARG VERBOSE=

From 2bdcc6b84772a00373fded524452760bfb299087 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 28 Aug 2025 12:39:38 -0400
Subject: [PATCH 291/398] test - fix parsing of integer param values

CI broke on the string '1\r#' expecting a 400 but got a 200 in
test_element_url_param_accepting_integer_values().

The #, & characters mark a url fragment or start of another parameter
and not part of the value. In a couple of tests, I parse the
hypothesis generated value to remove a # or & and anything after. Then
I set the value to the preceding string.  If the string starts with #
or &, the value is set to "0" as the server ignores the parameter and
returns 200. "0" is a value that asserts that status is 200.

The code doing this parsing was different (and broken) between

   test_element_url_param_accepting_integer_values
and
   test_class_url_param_accepting_integer_values

It's now consistent and if it finds a & or #, it actually tests the
resulting value/status rather than skipping the test.
---
 test/test_liveserver.py | 26 ++++++++++++++++++++++----
 1 file changed, 22 insertions(+), 4 deletions(-)

diff --git a/test/test_liveserver.py b/test/test_liveserver.py
index 4bec62b27..884439b08 100644
--- a/test/test_liveserver.py
+++ b/test/test_liveserver.py
@@ -256,6 +256,7 @@ class FuzzGetUrls(WsgiSetup, ClientSetup):
 
     @given(sampled_from(['@verbose', '@page_size', '@page_index']),
            text(min_size=1))
+    @example("@verbose", "0\r#")
     @example("@verbose", "1#")
     @example("@verbose", "#1stuff")
     @example("@verbose", "0 #stuff")
@@ -271,10 +272,18 @@ def test_class_url_param_accepting_integer_values(self, param, value):
         f = session.get(url, params=query)
         try:
             # test case '0 #', '0#', '12345#stuff' '12345&stuff'
-            match = re.match(r'(^[0-9]*\s*)[#&]', value)
+            # Normalize like a server does by breaking value at
+            # # or & as these mark a fragment or subsequent
+            # query arg and are not part of the value.
+            match = re.match(r'^(.*)[#&]', value)
             if match is not None:
                 value = match[1]
-            elif int(value) >= 0:
+                # parameter is ignored by server if empty.
+                # so set it to 0 to force 200 status code.
+                if value == "":
+                    value = "0"
+
+            if int(value) >= 0:
                 self.assertEqual(f.status_code, 200)
         except ValueError:
             # test case '#' '#0', '&', '&anything here really'
@@ -285,6 +294,7 @@ def test_class_url_param_accepting_integer_values(self, param, value):
                 self.assertEqual(f.status_code, 400)
 
     @given(sampled_from(['@verbose']), text(min_size=1))
+    @example("@verbose", "0\r#")
     @example("@verbose", "10#")
     @example("@verbose", u'Ã˜\U000dd990')
     @settings(max_examples=_max_examples,
@@ -298,10 +308,18 @@ def test_element_url_param_accepting_integer_values(self, param, value):
         f = session.get(url, params=query)
         try:
             # test case '0#' '12345#stuff' '12345&stuff'
-            match = re.match('(^[0-9]*)[#&]', value)
+            # Normalize like a server does by breaking value at
+            # # or & as these mark a fragment or subsequent
+            # query arg and are not part of the value.
+            match = re.match(r'^(.*)[#&]', value)
             if match is not None:
                 value = match[1]
-            elif int(value) >= 0:
+                # parameter is ignored by server if empty.
+                # so set it to 0 to force 200 status code.
+                if value == "":
+                    value = "0"
+
+            if int(value) >= 0:
                 self.assertEqual(f.status_code, 200)
         except ValueError:
             # test case '#' '#0', '&', '&anything here really'

From c53b5cd6602edf1996a917f06bd5794668f566e8 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 31 Aug 2025 16:54:17 -0400
Subject: [PATCH 292/398] feat: add support for ! history and readline command
 in roundup-admin

Ad support to change input mode emacs/vi using new 'readline'
roundup-admin command. Also bind keys to command/input strings, List
numbered history and allow rerunning a command with !<number> or allow
user to edit it using !<number>:p.

admin_guide.txt:
Added docs.

admin.py:

add functionality. Reconcile import commands to standard. Replace
IOError with FileNotFoundError no that we have removed python 2.7
support. Add support for identifying backend used to supply line
editing/history functions. Add support for saving commands sent on
stdin to history to allow preloading of history.

test_admin.py:

Test code. Can't test mode changes as lack of pty when driving command
line turns off line editing in readline/pyreadline3. Similarly can't
test key bindings/settings.

Some refactoring of test conditions that had to change because of
additional output reporting backend library.
---
 CHANGES.txt         |   3 +
 doc/admin_guide.txt |  51 +++++++
 roundup/admin.py    | 205 ++++++++++++++++++++++++--
 test/test_admin.py  | 350 +++++++++++++++++++++++++++++++++++++++++++-
 4 files changed, 586 insertions(+), 23 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index f3d7cea36..645983f52 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -36,6 +36,9 @@ Features:
   style configs will still be supported. (John Rouillard)
 - add 'q' as alias for quit in roundup-admin interactive mode. (John
   Rouillard)
+- add readline command to roundup-admin to list history, control input
+  mode etc. Also support bang (!) commands to rerun commands in history
+  or put them in the input buffer for editing. (John Rouillard)
 
 2025-07-13 2.5.0
 
diff --git a/doc/admin_guide.txt b/doc/admin_guide.txt
index bcd5101f4..c08fee981 100644
--- a/doc/admin_guide.txt
+++ b/doc/admin_guide.txt
@@ -2202,6 +2202,57 @@ https://pythonhosted.org/pyreadline/usage.html#configuration-file.
 History is saved to the file ``.roundup_admin_history`` in your home
 directory (for windows usually ``\Users\<username>``.
 
+In Roundup 2.6.0 and newer, you can use the ``readline`` command to
+make changes on the fly.
+
+* ``readline vi`` - change input mode to use vi key binding when
+  editing. It starts in entry mode.
+* ``readline emacs`` - change input mode to emacs key bindings when
+  editing. This is also the default.
+* ``readline reload`` - reloads the ``~/.roundup_admin_rlrc`` file so
+  you can test and use changes.
+* ``readline history`` - dumps the history buffer and numbers all
+  commands.
+* ``readline .inputrc_command_line`` can be used to make on the fly
+  key and key sequence bindings to readline commands. It can also be
+  used to change the internal readline settings using a set
+  command. For example::
+
+    readline set bell-style none
+
+  will turn off a ``visible`` or ``audible`` bell. Single character
+  keybindings::
+
+    readline Control-o: dump-variables
+
+  to list all the variables that can be set are supported. As are
+  multi-character bindings::
+
+    readline "\C-o1": "commit"
+
+  will put "commit" on the input line when you type Control-o followed
+  by 1. See the `readline manual for details
+  <https://tiswww.cwru.edu/php/chet/readline/rluserman.html#Readline-Init-File-Syntax-1>`_
+  on the command lines that can be used.
+
+Also a limited form of ``!`` (bang) history reference was added. The
+reference must be at the start of the line. Typing ``!23`` will rerun
+command number 23 from your history.
+
+Typing ``!23:p`` will load command 23 into the buffer so you can edit
+and submit it. Using the bang feature will append the command to the
+end of the history list.
+
+Pyreadline3 users can use ``readline history`` and the
+bang commands (including ``:p``). Single character bindings can be
+done. For example::
+
+    readline Control-w: history-search-backward
+
+The commands that are available are limited compared to Unix's
+readline or libedit. Setting variables or entry mode (emacs,
+vi) switching do not work in testing.
+
 Using with the shell
 --------------------
 
diff --git a/roundup/admin.py b/roundup/admin.py
index f52aaa261..2778c6b76 100644
--- a/roundup/admin.py
+++ b/roundup/admin.py
@@ -34,8 +34,8 @@
 
 import roundup.instance
 from roundup import __version__ as roundup_version
-from roundup import date, hyperdb, init, password, token_r
-from roundup.anypy import scandir_
+from roundup import date, hyperdb, init, password, support, token_r
+from roundup.anypy import scandir_  # noqa: F401 define os.scandir
 from roundup.anypy.my_input import my_input
 from roundup.anypy.strings import repr_export
 from roundup.configuration import (
@@ -49,7 +49,6 @@
 )
 from roundup.exceptions import UsageError
 from roundup.i18n import _, get_translation
-from roundup import support
 
 try:
     from UserDict import UserDict
@@ -93,6 +92,13 @@ class AdminTool:
         Additional help may be supplied by help_*() methods.
     """
 
+    # import here to make AdminTool.readline accessible or
+    # mockable from tests.
+    try:
+        import readline   # noqa: I001, PLC0415
+    except ImportError:
+        readline = None
+
     # Make my_input a property to allow overriding in testing.
     # my_input is imported in other places, so just set it from
     # the imported value rather than moving def here.
@@ -1815,6 +1821,111 @@ def do_pragma(self, args):
                              type(self.settings[setting]).__name__)
         self.settings[setting] = value
 
+    def do_readline(self, args):
+        ''"""Usage: readline initrc_line | 'emacs' | 'history' | 'reload' | 'vi'
+
+        Using 'reload' will reload the file ~/.roundup_admin_rlrc.
+        'history' will show (and number) all commands in the history.
+
+        You can change input mode using the 'emacs' or 'vi' parameters.
+        The default is emacs. This is the same as using::
+
+           readline set editing-mode emacs
+
+        or::
+
+           readline set editing-mode vi
+
+        Any command that can be placed in a readline .inputrc file can
+        be executed using the readline command. You can assign
+        dump-variables to control O using::
+
+           readline Control-o: dump-variables
+
+        Assigning multi-key values also works.
+
+        pyreadline3 support on windows:
+
+          Mode switching doesn't work, emacs only.
+
+          Binding single key commands works with::
+
+            readline Control-w: history-search-backward
+
+          Multiple key sequences don't work.
+
+          Setting values may work. Difficult to tell because the library
+          has no way to view the live settings.
+
+        """
+
+        # TODO: allow history 20 # most recent 20 commands
+        #    history 100-200 # show commands 100-200
+
+        if not self.readline:
+            print(_("Readline support is not available."))
+            return
+        # The if test allows pyreadline3 settings like:
+        #   bind_exit_key("Control-z") get through to
+        #   parse_and_bind(). It is not obvious that this form of
+        #   command is supported. Pyreadline3 is supposed to parse
+        #   readline style commands, so we use those for emacs/vi.
+        #   Trying set-mode(...) as in the pyreadline3 init file
+        #   didn't work in testing.
+
+        if len(args) == 1 and args[0].find('(') == -1:
+            if args[0] == "vi":
+                self.readline.parse_and_bind("set editing-mode vi")
+                print(_("Enabled vi mode."))
+            elif args[0] == "emacs":
+                self.readline.parse_and_bind("set editing-mode emacs")
+                print(_("Enabled emacs mode."))
+            elif args[0] == "history":
+                print("history size",
+                      self.readline.get_current_history_length())
+                print('\n'.join([
+                    str("%3d " % (i + 1) +
+                        self.readline.get_history_item(i + 1))
+                    for i in range(
+                            self.readline.get_current_history_length())
+                ]))
+            elif args[0] == "reload":
+                try:
+                    # readline is a singleton. In testing previous
+                    # tests using read_init_file are loading from ~
+                    # not the test directory because it doesn't
+                    # matter.  But for reload we want to test with the
+                    # init file under the test directory. Calling
+                    # read_init_file() calls with the ~/.. init
+                    # location and I can't seem to reset it
+                    # or the readline state.
+                    # So call with explicit file here.
+                    self.readline.read_init_file(
+                        self.get_readline_init_file())
+                except FileNotFoundError as e:
+                    # If user invoked reload explicitly, report
+                    # if file not found.
+                    #
+                    # DOES NOT WORK with pyreadline3. Exception
+                    # is not raised if file is missing.
+                    #
+                    # Also e.filename is None under cygwin. A
+                    # simple test case does set e.filename
+                    # correctly?? sigh.  So I just call
+                    # get_readline_init_file again to get
+                    # filename.
+                    fn = e.filename or self.get_readline_init_file()
+                    print(_("Init file %s not found.") % fn)
+                else:
+                    print(_("File %s reloaded.") %
+                          self.get_readline_init_file())
+            else:
+                print(_("Unknown readline parameter %s") % args[0])
+            return
+
+        self.readline.parse_and_bind(" ".join(args))
+        return
+
     designator_re = re.compile('([A-Za-z]+)([0-9]+)$')
     designator_rng = re.compile('([A-Za-z]+):([0-9]+)-([0-9]+)$')
 
@@ -2365,29 +2476,34 @@ def history_features(self, feature):
         # setting the bit disables the feature, so use not.
         return not self.settings['history_features'] & features[feature]
 
+    def get_readline_init_file(self):
+        return os.path.join(os.path.expanduser("~"),
+                                ".roundup_admin_rlrc")
+
     def interactive(self):
         """Run in an interactive mode
         """
         print(_('Roundup %s ready for input.\nType "help" for help.')
                 % roundup_version)
 
-        initfile = os.path.join(os.path.expanduser("~"),
-                                ".roundup_admin_rlrc")
+        initfile = self.get_readline_init_file()
         histfile = os.path.join(os.path.expanduser("~"),
                                 ".roundup_admin_history")
 
-        try:
-            import readline
+        if self.readline:
+            # clear any history that might be left over from caller
+            # when reusing AdminTool from tests or program.
+            self.readline.clear_history()
             try:
                 if self.history_features('load_rc'):
-                    readline.read_init_file(initfile)
-            except IOError: # FileNotFoundError under python3
+                    self.readline.read_init_file(initfile)
+            except FileNotFoundError:
                 # file is optional
                 pass
 
             try:
                 if self.history_features('load_history'):
-                    readline.read_history_file(histfile)
+                    self.readline.read_history_file(histfile)
             except IOError:  # FileNotFoundError under python3
                 # no history file yet
                 pass
@@ -2397,19 +2513,75 @@ def interactive(self):
             # Pragma history_length allows setting on a per
             #   invocation basis at startup
             if self.settings['history_length'] != -1:
-                readline.set_history_length(
+                self.readline.set_history_length(
                     self.settings['history_length'])
-        except ImportError:
-            readline = None
-            print(_('Note: command history and editing not available'))
 
+            if hasattr(self.readline, 'backend'):
+                # FIXME after min 3.13 version; no backend prints pyreadline3
+                print(_("Readline enabled using %s.") % self.readline.backend)
+            else:
+                print(_("Readline enabled using unknown library."))
+                      
+        else:
+            print(_('Command history and line editing not available'))
+
+        autosave_enabled = sys.stdin.isatty() and sys.stdout.isatty()
         while 1:
             try:
                 command = self.my_input('roundup> ')
+                # clear an input hook in case it was used to prefill
+                # buffer.
+                self.readline.set_pre_input_hook()
             except EOFError:
                 print(_('exit...'))
                 break
             if not command: continue  # noqa: E701
+            if command.startswith('!'):  # Pull numbered command from history
+                print_only = command.endswith(":p")
+                try:
+                    hist_num = int(command[1:]) \
+                        if not print_only else int(command[1:-2])
+                    command = self.readline.get_history_item(hist_num)
+                except ValueError:
+                    # pass the unknown command
+                    pass
+                else:
+                    if autosave_enabled and \
+                       hasattr(self.readline, "replace_history_item"):
+                        # history has the !23 input. Replace it if possible.
+                        # replace_history_item not supported by pyreadline3
+                        # so !23 will show up in history not the command.
+                        self.readline.replace_history_item(
+                            self.readline.get_current_history_length() - 1,
+                            command)
+
+                    if print_only:
+                        # fill the edit buffer with the command
+                        # the user selected.
+
+                        # from https://stackoverflow.com/questions/8505163/is-it-possible-to-prefill-a-input-in-python-3s-command-line-interface
+                        # This triggers:
+                        #   B023 Function definition does not bind loop variable
+                        #   `command`
+                        # in ruff. command will be the value of the command
+                        # variable at the time the function is run.
+                        # Not the value at define time. This is ok since
+                        # hook is run before command is changed by the
+                        # return from (readline) input.
+                        def hook():
+                            self.readline.insert_text(command)  # noqa: B023
+                            self.readline.redisplay()
+                        self.readline.set_pre_input_hook(hook)
+                        # we clear the hook after the next line is read.
+                        continue
+
+            if not autosave_enabled:
+                # needed to make testing work and also capture
+                # commands received on stdin from file/other command
+                # output. Disable saving with pragma on command line:
+                #    -P history_features=2.
+                self.readline.add_history(command)
+
             try:
                 args = token_r.token_split(command)
             except ValueError:
@@ -2426,8 +2598,9 @@ def interactive(self):
                 self.db.commit()
 
         # looks like histfile is saved with mode 600
-        if readline and self.history_features('save_history'):
-                readline.write_history_file(histfile)
+        if self.readline and self.history_features('save_history'):
+                self.readline.write_history_file(histfile)
+
         return 0
 
     def main(self):  # noqa: PLR0912, PLR0911
diff --git a/test/test_admin.py b/test/test_admin.py
index 97018453c..9380115dc 100644
--- a/test/test_admin.py
+++ b/test/test_admin.py
@@ -5,8 +5,17 @@
 #
 
 from __future__ import print_function
+import difflib
+import errno
 import fileinput
-import unittest, os, shutil, errno, sys, difflib, re
+import io
+import os
+import platform
+import pytest
+import re
+import shutil
+import sys
+import unittest
 
 from roundup.admin import AdminTool
 
@@ -82,6 +91,10 @@ class AdminTest(object):
     def setUp(self):
         self.dirname = '_test_admin'
 
+    @pytest.fixture(autouse=True)
+    def inject_fixtures(self, monkeypatch):
+        self._monkeypatch = monkeypatch
+
     def tearDown(self):
         try:
             shutil.rmtree(self.dirname)
@@ -148,7 +161,9 @@ def testBasicInteractive(self):
         print(ret)
         self.assertTrue(ret == 0)
         expected = 'ready for input.\nType "help" for help.'
-        self.assertEqual(expected, out[-1*len(expected):])
+        # back up by 30 to make sure 'ready for input' in slice.
+        self.assertIn(expected,
+                      "\n".join(out.split('\n')[-3:-1]))
 
         inputs = iter(["list user", "q"])
 
@@ -161,8 +176,10 @@ def testBasicInteractive(self):
         
         print(ret)
         self.assertTrue(ret == 0)
-        expected = 'help.\n   1: admin\n   2: anonymous'
-        self.assertEqual(expected, out[-1*len(expected):])
+        expected = '   1: admin\n   2: anonymous'
+
+        self.assertEqual(expected,
+                         "\n".join(out.split('\n')[-2:]))
 
 
         AdminTool.my_input = orig_input
@@ -1104,7 +1121,7 @@ def testPragma_reopen_tracker(self):
         
         print(ret)
         self.assertTrue(ret == 0)
-        self.assertEqual('Reopening tracker', out[2])
+        self.assertEqual('Reopening tracker', out[3])
         expected = '   _reopen_tracker=True'
         self.assertIn(expected, out)
 
@@ -1133,7 +1150,7 @@ def testPragma(self):
                 ret = self.admin.main()
 
             out = out.getvalue().strip().split('\n')
-        
+
             print(ret)
             self.assertTrue(ret == 0)
             expected = '   verbose=True'
@@ -1155,7 +1172,7 @@ def testPragma(self):
                 ret = self.admin.main()
 
             out = out.getvalue().strip().split('\n')
-        
+
             print(ret)
             self.assertTrue(ret == 0)
             expected = '   verbose=False'
@@ -1810,6 +1827,325 @@ def testSetOnClass(self):
         self.assertEqual(out, expected)
         self.assertEqual(len(err), 0)
 
+    def testReadline(self):
+        ''' Note the tests will fail if you run this under pdb.
+            the context managers capture the pdb prompts and this screws
+            up the stdout strings with (pdb) prefixed to the line.
+        '''
+
+        '''history didn't work when testing. The commands being
+           executed aren't being sent into the history
+           buffer. Failed under both windows and linux.
+
+           Explicitly using: readline.set_auto_history(True) in
+           roundup-admin setup had no effect.
+
+           Looks like monkeypatching stdin is the issue since:
+        
+              printf... | roundup-admin | tee
+
+           doesn't work either when printf uses
+
+              "readline vi\nreadline emacs\nreadline history\nquit\n"
+
+           Added explicit readline.add_history() if stdin or
+           stdout are not a tty to admin.py:interactive().
+
+           Still no way to drive editing with control/escape
+           chars to verify editing mode, check keybindings. Need
+           to trick Admintool to believe it's running on a
+           tty/pty/con in linux/windows to remove my hack.
+        '''
+
+        # Put the init file in the tracker test directory so
+        # we don't clobber user's actual init file.
+        original_home = None
+        if 'HOME' in os.environ:
+            original_home = os.environ['HOME']
+            os.environ['HOME'] = self.dirname
+
+        # same but for windows.
+        original_userprofile = None
+        if 'USERPROFILE' in os.environ:
+            # windows
+            original_userprofile = os.environ['USERPROFILE']
+            os.environ['USERPROFILE'] = self.dirname
+
+        inputs = ["readline vi", "readline emacs", "readline reload", "quit"]
+        
+        self._monkeypatch.setattr(
+            'sys.stdin',
+            io.StringIO("\n".join(inputs)))
+
+        self.install_init()
+        self.admin=AdminTool()
+
+        # disable loading and saving history
+        self.admin.settings['history_features'] = 3
+
+        # verify correct init file is being
+        self.assertIn(os.path.join(os.path.expanduser("~"),
+                                   ".roundup_admin_rlrc"),
+                      self.admin.get_readline_init_file())
+
+        # No exception is raised for missing file
+        # under pyreadline3. Detect pyreadline3 looking for:
+        #   readline.Readline
+        pyreadline = hasattr(self.admin.readline, "Readline")
+
+        sys.argv=['main', '-i', self.dirname]
+
+        with captured_output() as (out, err):
+            ret = self.admin.main()
+            out = out.getvalue().strip().split('\n')
+            
+        print(ret)
+        self.assertTrue(ret == 0)
+
+        expected = 'roundup> Enabled vi mode.'
+        self.assertIn(expected, out)
+
+        expected = 'roundup> Enabled emacs mode.'
+        self.assertIn(expected, out)
+
+        if not pyreadline:
+            expected = ('roundup> Init file %s '
+                        'not found.' % self.admin.get_readline_init_file())
+            self.assertIn(expected, out)
+
+        # --- test 2
+        
+        inputs = ["readline reload", "q"]
+        
+        self._monkeypatch.setattr(
+            'sys.stdin',
+            io.StringIO("\n".join(inputs)))
+
+        self.install_init()
+        self.admin=AdminTool()
+
+        with open(self.admin.get_readline_init_file(),
+                  "w") as config_file:
+            # there is no config line that works for all
+            # pyreadline3 (windows), readline(*nix), or editline
+            # (mac). So write empty file.
+            config_file.write("")
+
+        # disable loading and saving history
+        self.admin.settings['history_features'] = 3
+        sys.argv=['main', '-i', self.dirname]
+        
+        with captured_output() as (out, err):
+            ret = self.admin.main()
+            out = out.getvalue().strip().split('\n')
+            
+        print(ret)
+        self.assertTrue(ret == 0)
+
+        expected = ('roundup> File %s reloaded.' %
+                    self.admin.get_readline_init_file())
+        
+        self.assertIn(expected, out)
+
+        # === cleanup
+        if original_home:
+            os.environ['HOME'] = original_home
+        if original_userprofile:
+            os.environ['USERPROFILE'] = original_userprofile
+
+    def test_admin_history_save_load(self):
+        # To prevent overwriting/reading user's actual history,
+        # change HOME enviroment var.
+        original_home = None
+        if 'HOME' in os.environ:
+            original_home = os.environ['HOME']
+            os.environ['HOME'] = self.dirname
+        os.environ['HOME'] = self.dirname
+
+        # same idea but windows
+        original_userprofile = None
+        if 'USERPROFILE' in os.environ:
+            # windows
+            original_userprofile = os.environ['USERPROFILE']
+            os.environ['USERPROFILE'] = self.dirname
+
+        # -- history test
+        inputs = ["readline history", "q"]
+        
+        self._monkeypatch.setattr(
+            'sys.stdin',
+            io.StringIO("\n".join(inputs)))
+
+        self.install_init()
+        self.admin=AdminTool()
+
+        # use defaults load/save history
+        self.admin.settings['history_features'] = 0
+        
+        sys.argv=['main', '-i', self.dirname]
+        
+        with captured_output() as (out, err):
+            ret = self.admin.main()
+        out = out.getvalue().strip().split('\n')
+        
+        print(ret)
+        self.assertTrue(ret == 0)
+
+        expected = 'roundup> history size 1'
+        self.assertIn(expected, out)
+
+        expected = '  1 readline history'
+        self.assertIn(expected, out)
+
+        # -- history test 3 reruns readline vi
+        inputs = ["readline vi", "readline history", "!3",
+                  "readline history", "!23s", "q"]
+        
+        self._monkeypatch.setattr(
+            'sys.stdin',
+            io.StringIO("\n".join(inputs)))
+
+        # preserve directory self.install_init()
+        self.admin=AdminTool()
+
+        # default use all features
+        #self.admin.settings['history_features'] = 3
+        sys.argv=['main', '-i', self.dirname]
+        
+        with captured_output() as (out, err):
+            ret = self.admin.main()
+        out = out.getvalue().strip().split('\n')
+        
+        print(ret)
+        self.assertTrue(ret == 0)
+
+        # 4 includes 2 commands in saved history
+        expected = 'roundup> history size 4'
+        self.assertIn(expected, out)
+
+        expected = '  4 readline history'
+        self.assertIn(expected, out)
+
+        # Shouldn't work on windows.
+        if platform.system() != "Windows":
+            expected = '  5 readline vi'
+            self.assertIn(expected, out)
+        else:
+            # PYREADLINE UNDER WINDOWS
+            # py3readline on windows can't replace
+            # command strings in history when connected
+            # to a console. (Console triggers autosave and
+            # I have to turn !3 into it's substituted value.)
+            # but in testing autosave is disabled so
+            # I don't get the !number but the actual command
+            # It should have 
+            #
+            #             expected = '  5 !3'
+            #
+            # but it is the same as the unix case.
+            expected = '  5 readline vi'
+            self.assertIn(expected, out)
+
+        expected = ('roundup> Unknown command "!23s" ("help commands" '
+                    'for a list)')
+        self.assertIn(expected, out)
+        
+        print(out)
+        # can't test !#:p mode as readline editing doesn't work
+        # if not in a tty.
+        
+        # === cleanup
+        if original_home:
+            os.environ['HOME'] = original_home
+        if original_userprofile:
+            os.environ['USERPROFILE'] = original_userprofile
+        
+    def test_admin_readline_history(self):
+        original_home = os.environ['HOME']
+        # To prevent overwriting/reading user's actual history,
+        # change HOME enviroment var.
+        os.environ['HOME'] = self.dirname
+
+        original_userprofile = None
+        if 'USERPROFILE' in os.environ:
+            # windows
+            original_userprofile = os.environ['USERPROFILE']
+            os.environ['USERPROFILE'] = self.dirname
+
+        # -- history test
+        inputs = ["readline history", "q"]
+        
+        self._monkeypatch.setattr(
+            'sys.stdin',
+            io.StringIO("\n".join(inputs)))
+
+        self.install_init()
+        self.admin=AdminTool()
+
+        # disable loading, but save history
+        self.admin.settings['history_features'] = 3
+        sys.argv=['main', '-i', self.dirname]
+        
+        with captured_output() as (out, err):
+            ret = self.admin.main()
+        out = out.getvalue().strip().split('\n')
+        
+        print(ret)
+        self.assertTrue(ret == 0)
+
+        expected = 'roundup> history size 1'
+        self.assertIn(expected, out)
+
+        expected = '  1 readline history'
+        self.assertIn(expected, out)
+
+        # -- history test
+        inputs = ["readline vi", "readline history", "!1", "!2", "q"]
+        
+        self._monkeypatch.setattr(
+            'sys.stdin',
+            io.StringIO("\n".join(inputs)))
+
+        self.install_init()
+        self.admin=AdminTool()
+
+        # disable loading, but save history
+        self.admin.settings['history_features'] = 3
+        sys.argv=['main', '-i', self.dirname]
+        
+        with captured_output() as (out, err):
+            ret = self.admin.main()
+        out = out.getvalue().strip().split('\n')
+        
+        print(ret)
+        self.assertTrue(ret == 0)
+
+        expected = 'roundup> history size 2'
+        self.assertIn(expected, out)
+
+        expected = '  2 readline history'
+        self.assertIn(expected, out)
+
+        # doesn't work on windows.
+        if platform.system() != "Windows":
+            expected = '  4 readline history'
+            self.assertIn(expected, out)
+        else:
+            # See 
+            # PYREADLINE UNDER WINDOWS
+            # elsewhere in this file for why I am not checking for
+            #  expected = '  4 !2'
+            expected = '  4 readline history'
+            self.assertIn(expected, out)
+
+        # can't test !#:p mode as readline editing doesn't work
+        # if not in a tty.
+        
+        # === cleanup
+        os.environ['HOME'] = original_home
+        if original_userprofile:
+            os.environ['USERPROFILE'] = original_userprofile
+
     def testSpecification(self):
         ''' Note the tests will fail if you run this under pdb.
             the context managers capture the pdb prompts and this screws

From 55857ec2b20495bd3f3940658f4df13311f3b2db Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 31 Aug 2025 20:59:04 -0400
Subject: [PATCH 293/398] bug, refactor, test: make pragma history_length work
 interactively

history_length could be set interactively, but it was never used to set
readline/pyreadline3's internal state. Using the pragma setting on the
roundup-admin command line did set readline's state.

Also refactored 2 calls to self.readline.get_current_history_length()
into one call and storing in a variable. Also changed method for
creating history strings for printing.

Tests added for history_length pragma on cli and interactive use.

Added test for exiting roundup-admin with EOF on input.

Added test for 'readline nosuchdirective' error case.

Added test to readline with a command directive to set an internal
variable. This last one has no real test to see if it was successful
because I can't emulate a real keyboard/tty which is needed to test.
---
 CHANGES.txt        |   3 +
 roundup/admin.py   |  14 +++--
 test/test_admin.py | 139 +++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 151 insertions(+), 5 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index 645983f52..fb3b06d3f 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -26,6 +26,9 @@ Fixed:
 - cleaned up repo. Close obsolete branches and close a split head due
   to an identical merge intwo different workicng copies. (John
   Rouillard)
+- in roundup-admin, using 'pragma history_length interactively now
+  sets readline history length. Using -P history_length=10 on the
+  command line always worked. (John Rouillard)
 
 Features:
 
diff --git a/roundup/admin.py b/roundup/admin.py
index 2778c6b76..eb717b736 100644
--- a/roundup/admin.py
+++ b/roundup/admin.py
@@ -1821,6 +1821,11 @@ def do_pragma(self, args):
                              type(self.settings[setting]).__name__)
         self.settings[setting] = value
 
+        # history_length has to be pushed to readline to have any effect.
+        if setting == "history_length":
+            self.readline.set_history_length(
+                self.settings['history_length'])
+
     def do_readline(self, args):
         ''"""Usage: readline initrc_line | 'emacs' | 'history' | 'reload' | 'vi'
 
@@ -1881,13 +1886,12 @@ def do_readline(self, args):
                 self.readline.parse_and_bind("set editing-mode emacs")
                 print(_("Enabled emacs mode."))
             elif args[0] == "history":
-                print("history size",
-                      self.readline.get_current_history_length())
+                history_size = self.readline.get_current_history_length()
+                print("history size", history_size)
                 print('\n'.join([
-                    str("%3d " % (i + 1) +
+                    "%3d %s" % ((i + 1),
                         self.readline.get_history_item(i + 1))
-                    for i in range(
-                            self.readline.get_current_history_length())
+                    for i in range(history_size)
                 ]))
             elif args[0] == "reload":
                 try:
diff --git a/test/test_admin.py b/test/test_admin.py
index 9380115dc..74266d17f 100644
--- a/test/test_admin.py
+++ b/test/test_admin.py
@@ -184,6 +184,31 @@ def testBasicInteractive(self):
 
         AdminTool.my_input = orig_input
 
+        # test EOF exit
+        inputs = ["help"]
+        
+        self._monkeypatch.setattr(
+            'sys.stdin',
+            io.StringIO("\n".join(inputs)))
+
+        # preserve directory self.install_init()
+        self.admin=AdminTool()
+
+        # disable all features
+        self.admin.settings['history_features'] = 7
+        sys.argv=['main', '-i', self.dirname]
+        
+        with captured_output() as (out, err):
+            ret = self.admin.main()
+        out = out.getvalue().strip().split('\n')
+        
+        print(ret)
+        self.assertTrue(ret == 0)
+
+        # 4 includes 2 commands in saved history
+        expected = 'roundup> exit...'
+        self.assertIn(expected, out)
+
     def testGet(self):
         ''' Note the tests will fail if you run this under pdb.
             the context managers capture the pdb prompts and this screws
@@ -1947,6 +1972,120 @@ def testReadline(self):
         
         self.assertIn(expected, out)
 
+        # --- test 3,4 - make sure readline gets history_length pragma.
+        #   test CLI and interactive.
+        
+        inputs = ["pragma list", "q"]
+        
+        self._monkeypatch.setattr(
+            'sys.stdin',
+            io.StringIO("\n".join(inputs)))
+
+        self.install_init()
+        self.admin=AdminTool()
+
+        # disable all config/history
+        self.admin.settings['history_features'] = 7
+        sys.argv=['main', '-i', self.dirname, '-P', 'history_length=11']
+        
+        with captured_output() as (out, err):
+            ret = self.admin.main()
+            out = out.getvalue().strip().split('\n')
+            
+        print(ret)
+        self.assertTrue(ret == 0)
+        self.assertEqual(self.admin.readline.get_history_length(),
+                         11)
+
+        # 4
+        inputs = ["pragma history_length=17", "q"]
+        
+        self._monkeypatch.setattr(
+            'sys.stdin',
+            io.StringIO("\n".join(inputs)))
+
+        self.install_init()
+        self.admin=AdminTool()
+
+        # disable all config/history
+        self.admin.settings['history_features'] = 7
+        # keep pragma in CLI. Make sure it's overridden by interactive
+        sys.argv=['main', '-i', self.dirname, '-P', 'history_length=11']
+        
+        with captured_output() as (out, err):
+            ret = self.admin.main()
+            out = out.getvalue().strip().split('\n')
+            
+        print(ret)
+        self.assertTrue(ret == 0)
+        # should not be 11.
+        self.assertEqual(self.admin.readline.get_history_length(),
+                         17)
+
+        # --- test 5 invalid single word parameter
+        
+        inputs = ["readline nosuchdirective", "q"]
+        
+        self._monkeypatch.setattr(
+            'sys.stdin',
+            io.StringIO("\n".join(inputs)))
+
+        self.install_init()
+        self.admin=AdminTool()
+
+        # disable loading and saving history
+        self.admin.settings['history_features'] = 3
+        sys.argv=['main', '-i', self.dirname]
+        
+        with captured_output() as (out, err):
+            ret = self.admin.main()
+            out = out.getvalue().strip().split('\n')
+            
+        print(ret)
+        self.assertTrue(ret == 0)
+
+        expected = ('roundup> Unknown readline parameter nosuchdirective')
+        
+        self.assertIn(expected, out)
+
+        # --- test 6 set keystroke command.
+        # FIXME: unable to test key binding/setting actually works.
+        #
+        #        No errors seem to come back from readline or
+        #        pyreadline3 even when the keybinding makes no
+        #        sense. Errors are only reported when reading
+        #        from init file. Using "set answer 42" does print
+        #        'readline: answer: unknown variable name' when
+        #        attached to tty/pty and interactive, but not
+        #        inside test case. Pyreadline3 doesn't
+        #        report errors at all.
+        #
+        #        Even if I set a keybidning, I can't invoke it
+        #        because I am not running inside a pty, so
+        #        editing is disabled and I have no way to
+        #        simulate keyboard keystrokes for readline to act
+        #        upon.
+        
+        inputs = ['readline set meaning 42', "q"]
+        
+        self._monkeypatch.setattr(
+            'sys.stdin',
+            io.StringIO("\n".join(inputs)))
+
+        self.install_init()
+        self.admin=AdminTool()
+
+        # disable loading and saving history
+        self.admin.settings['history_features'] = 3
+        sys.argv=['main', '-i', self.dirname]
+        
+        with captured_output() as (out, err):
+            ret = self.admin.main()
+            out = out.getvalue().strip().split('\n')
+            
+        print(ret)
+        self.assertTrue(ret == 0)
+
         # === cleanup
         if original_home:
             os.environ['HOME'] = original_home

From 882c577fa3876bbe9345adeacdde15f33ad88eb1 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 1 Sep 2025 17:48:57 -0400
Subject: [PATCH 294/398] doc: fix typos.

---
 CHANGES.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index fb3b06d3f..68aa8d846 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -24,7 +24,7 @@ Fixed:
   rather than Exception since it is an HTTP exception. (John
   Rouillard)
 - cleaned up repo. Close obsolete branches and close a split head due
-  to an identical merge intwo different workicng copies. (John
+  to an identical merge in two different working copies. (John
   Rouillard)
 - in roundup-admin, using 'pragma history_length interactively now
   sets readline history length. Using -P history_length=10 on the

From b8e186c852121e3051a68a52c03f381973a420b5 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 1 Sep 2025 20:35:54 -0400
Subject: [PATCH 295/398] fix missing formatting

---
 doc/admin_guide.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/admin_guide.txt b/doc/admin_guide.txt
index c08fee981..bebf7402c 100644
--- a/doc/admin_guide.txt
+++ b/doc/admin_guide.txt
@@ -117,7 +117,7 @@ comments:
    a comment and is stripped from the file before being passed to the
    json parser. This is a "line comment".
 
-2. A ``//` with at least three white space characters before it is
+2. A ``//`` with at least three white space characters before it is
    stripped from the end of the line before begin passed to the json
    parser. This is an "inline comment".
 

From 27162c67396915f228b414031bed0afb045e37a9 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 1 Sep 2025 21:54:48 -0400
Subject: [PATCH 296/398] feat: allow admin to set logging format from
 config.ini

This is prep work for adding a per thread logging variable that can be
used to tie all logs for a single request together.

This uses the same default logging format as before, just moves it to
config.ini.

Also because of configparser, the logging format has to have doubled %
signs. So use:

  %%(asctime)s

not '%(asctime)s' as configparser tries to interpolate that string and
asctime is not defined in the configparser's scope. Using %%(asctime)s
is not interpolated by configparser and is passed into Roundup.
---
 CHANGES.txt              |  2 ++
 doc/admin_guide.txt      | 20 +++++++++++++++-
 roundup/configuration.py | 52 +++++++++++++++++++++++++++++++++++++---
 test/test_config.py      | 37 ++++++++++++++++++++++++++++
 4 files changed, 107 insertions(+), 4 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index 68aa8d846..4ec37e17a 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -42,6 +42,8 @@ Features:
 - add readline command to roundup-admin to list history, control input
   mode etc. Also support bang (!) commands to rerun commands in history
   or put them in the input buffer for editing. (John Rouillard)
+- add format to logging section in config.ini. Used to set default
+  logging format. (John Rouillard)
 
 2025-07-13 2.5.0
 
diff --git a/doc/admin_guide.txt b/doc/admin_guide.txt
index bebf7402c..ad92a94a7 100644
--- a/doc/admin_guide.txt
+++ b/doc/admin_guide.txt
@@ -63,6 +63,8 @@ Configuration for "BasicLogging" implementation:
  - tracker configuration file lets you disable other loggers
    (e.g. when running under a wsgi framework) with
    ``logging`` -> ``disable_loggers``.
+ - tracker configuration file can set the log format using
+   ``logging`` -> ``format``. See :ref:`logFormat` for more info.
  - ``roundup-server`` specifies the location of a log file on the command
    line
  - ``roundup-server`` enable  using the standard python logger with
@@ -83,10 +85,26 @@ Configuration for standard "logging" module:
 In both cases, if no logfile is specified then logging will simply be sent
 to sys.stderr with only logging of ERROR messages.
 
+.. _logFormat:
+
+Defining the Log Format
+-----------------------
+
+Starting with Roundup 2.6 you can specify the logging format. In the
+``logging`` -> ``format`` setting of config.ini you can use any of the
+`standard logging LogRecord attributes
+<https://docs.python.org/3/library/logging.html#logrecord-attributes>`_.
+However you must double any ``%`` format markers. The default value
+is::
+
+  %%(asctime)s %%(levelname)s %%(message)s
+
 Standard Logging Setup
 ----------------------
 
-You can specify your log configs in one of two formats:
+If the settings in config.ini are not sufficient for your logging
+requirements, you can specify a full logging configuration in one of
+two formats:
 
   * `fileConfig format
     <https://docs.python.org/3/library/logging.config.html#logging.config.fileConfig>`_
diff --git a/roundup/configuration.py b/roundup/configuration.py
index d170eeed3..6da56200f 100644
--- a/roundup/configuration.py
+++ b/roundup/configuration.py
@@ -273,7 +273,8 @@ def load_ini(self, config):
         try:
             if config.has_option(self.section, self.setting):
                 self.set(config.get(self.section, self.setting))
-        except configparser.InterpolationSyntaxError as e:
+        except (configparser.InterpolationSyntaxError,
+                configparser.InterpolationMissingOptionError) as e:
             raise ParsingOptionError(
                 _("Error in %(filepath)s with section [%(section)s] at "
                   "option %(option)s: %(message)s") % {
@@ -575,6 +576,48 @@ def get(self):
             return None
 
 
+class LoggingFormatOption(Option):
+    """Replace escaped % (as %%) with single %.
+
+       Config file parsing allows variable interpolation using
+       %(keyname)s.  However this is exactly the format that we need
+       for creating a logging format string. So we tell the user to
+       quote the string using %%(...). Then we turn %%( -> %( when
+       retrieved.
+    """
+
+    class_description = ("Allowed value: Python logging module named "
+                         "attributes with % sign doubled.")
+
+    def str2value(self, value):
+        """Check format of unquoted string looking for missing specifiers.
+
+           This does a dirty check to see if a token is missing a
+           specifier. So "%(ascdate)s %(level) " would fail because of
+           the 's' missing after 'level)'. But "%(ascdate)s %(level)s"
+           would pass.
+
+           Note that %(foo)s generates a error from the ini parser
+           with a less than wonderful message.
+        """
+        unquoted_val = value.replace("%%(", "%(")
+
+        # regexp matches all current logging record object attribute names.
+        scanned_result = re.sub(r'%\([A-Za-z_]+\)\S','', unquoted_val )
+        if scanned_result.find('%(') != -1:
+            raise OptionValueError(
+                self, unquoted_val,
+                "Check that all substitution tokens have a format "
+                "specifier after the ). Unrecognized use of %%(...) in: "
+                "%s" % scanned_result)
+
+        return str(unquoted_val)
+
+    def _value2str(self, value):
+        """Replace %( with %%( to quote the format substitution param.
+        """
+        return value.replace("%(", "%%(")
+
 class OriginHeadersListOption(Option):
 
     """List of space seperated origin header values.
@@ -1614,6 +1657,10 @@ def str2value(self, value):
             "Minimal severity level of messages written to log file.\n"
             "If above 'config' option is set, this option has no effect.\n"
             "Allowed values: DEBUG, INFO, WARNING, ERROR"),
+        (LoggingFormatOption, "format",
+         "%(asctime)s %(levelname)s %(message)s",
+            "Format of the logging messages with all '%' signs\n"
+            "doubled so they are not interpreted by the config file."),
         (BooleanOption, "disable_loggers", "no",
             "If set to yes, only the loggers configured in this section will\n"
             "be used. Yes will disable gunicorn's --access-logfile.\n"),
@@ -2448,8 +2495,7 @@ def init_logging(self):
         hdlr = logging.FileHandler(_file) if _file else \
             logging.StreamHandler(sys.stdout)
 
-        formatter = logging.Formatter(
-            '%(asctime)s %(levelname)s %(message)s')
+        formatter = logging.Formatter(self["LOGGING_FORMAT"])
         hdlr.setFormatter(formatter)
         # no logging API to remove all existing handlers!?!
         for h in logger.handlers:
diff --git a/test/test_config.py b/test/test_config.py
index 130c9c412..b3547cdf2 100644
--- a/test/test_config.py
+++ b/test/test_config.py
@@ -1112,6 +1112,43 @@ def testInvalidIndexerValue(self):
         self.assertIn("nati", string_rep)
         self.assertIn("'whoosh'", string_rep)
 
+    def testLoggerFormat(self):
+        config = configuration.CoreConfig()
+
+        # verify config is initalized to defaults
+        self.assertEqual(config['LOGGING_FORMAT'],
+                         '%(asctime)s %(levelname)s %(message)s')
+
+        # load config
+        config.load(self.dirname)
+        self.assertEqual(config['LOGGING_FORMAT'],
+                         '%(asctime)s %(levelname)s %(message)s')
+
+        # break config using an incomplete format specifier (no trailing 's')
+        self.munge_configini(mods=[ ("format = ", "%%(asctime)s %%(levelname) %%(message)s") ], section="[logging]")
+
+        # load config
+        with self.assertRaises(configuration.OptionValueError) as cm:
+            config.load(self.dirname)
+            
+        self.assertIn('Unrecognized use of %(...) in:  %(levelname)',
+                      cm.exception.args[2])
+
+        # break config by not dubling % sign to quote it from configparser
+        self.munge_configini(mods=[ ("format = ", "%(asctime)s %%(levelname) %%(message)s") ], section="[logging]")
+
+        with self.assertRaises(
+                configuration.ParsingOptionError) as cm:
+            config.load(self.dirname)
+
+        self.assertEqual(cm.exception.args[0],
+                         "Error in _test_instance/config.ini with section "
+                         "[logging] at option format: Bad value substitution: "
+                         "option 'format' in section 'logging' contains an "
+                         "interpolation key 'asctime' which is not a valid "
+                         "option name. Raw value: '%(asctime)s %%(levelname) "
+                         "%%(message)s'")
+
     def testDictLoggerConfigViaJson(self):
 
         # good base test case

From cf70a3778c7b12caebeb367f9e490c90ba60c597 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 8 Sep 2025 09:07:12 -0400
Subject: [PATCH 297/398] chore: dependabot upgrade setup-python to 6.0.0

---
 .github/workflows/build-xapian.yml | 2 +-
 .github/workflows/ci-test.yml      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build-xapian.yml b/.github/workflows/build-xapian.yml
index 00e6fe099..01384615e 100644
--- a/.github/workflows/build-xapian.yml
+++ b/.github/workflows/build-xapian.yml
@@ -46,7 +46,7 @@ jobs:
 
         # Setup version of Python to use
       - name: Set Up Python 3.13
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
         with:
           python-version: 3.13
           allow-prereleases: true
diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index 35a5a948b..c9dac0cec 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -120,7 +120,7 @@ jobs:
 
       # Setup version of Python to use
       - name: Set Up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
         with:
           python-version: ${{ matrix.python-version }}
           allow-prereleases: true

From b9b8478fc2e37b77790b6c099e091b344c5ebe72 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 8 Sep 2025 09:08:14 -0400
Subject: [PATCH 298/398] chore: dependabot upgrade codecov to 5.5.1

---
 .github/workflows/ci-test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index c9dac0cec..a5498a88c 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -323,7 +323,7 @@ jobs:
         
       - name: Upload coverage to Codecov
         # see: https://github.com/codecov/codecov-action#usage
-        uses: codecov/codecov-action@fdcc8476540edceab3de004e990f80d881c6cc00 # v5.5.0
+        uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1
         with:
           verbose: true
           token: ${{ secrets.CODECOV_TOKEN }}

From 4e4b409650289e011515fa4b71bdb431d1db9e3e Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Tue, 16 Sep 2025 22:53:00 -0400
Subject: [PATCH 299/398] feature: add thread local trace_id and trace_reason
 to logging.

Added trace_id to default logging so that all logs for a given request
share the same trace_id.

This allows correlation of logs across a request.

admin_guide.txt, upgrading.txt:
  add docs
  update sample configs to include trace_id.
  rewrite logging docs in admin_guide. Hopefully they are clearer now.
  clean up some stuff in the logging config file docs.

admin.py:

  add decorators to run_command to enable trace_id.
  change calls to db.commit() to use run_command to get trace_id.

configuration.py:

  clean up imports.
  update docstrings, comments and inline docs.
  add trace_id to default log format.
  add function for testing decorated with trace_id.
  add support for dumping stack trace in logging.
  add check for pytest in sys.modules to enable log propagation when
    pytest is running. Otherwise tests fail as the caplog logger doesn't
    see the roundup logs.

logcontext.py:

  new file to handle thread local contextvar mangement.

mailgw.py:

  add decorators for trace_id etc.

scripts/roundup_xlmrpc_server.py:

  add decorators for trace_id etc.
  fix encoding bug turning bytes into a string.
  fix command line issue where we can't set encoding. (not sure if
    changing encoding via command line even works)

cgi/client.py

  decorate two entry points for trace_id etc.

cgi/wsgi_handler.py:

  decorate entry point for trace_id etc.

test/test_config.py:

  add test for trace_id in new log format.
  test various cases for sinfo and errors in formating msg.
---
 CHANGES.txt                              |   5 +
 doc/admin_guide.txt                      | 349 ++++++++++++++++++-----
 doc/upgrading.txt                        |  29 ++
 roundup/admin.py                         |   7 +-
 roundup/cgi/client.py                    |   8 +-
 roundup/cgi/wsgi_handler.py              |   3 +
 roundup/configuration.py                 | 226 ++++++++++++++-
 roundup/logcontext.py                    | 208 ++++++++++++++
 roundup/mailgw.py                        |   3 +
 roundup/scripts/roundup_xmlrpc_server.py |  25 +-
 test/test_config.py                      | 133 +++++++++
 11 files changed, 889 insertions(+), 107 deletions(-)
 create mode 100644 roundup/logcontext.py

diff --git a/CHANGES.txt b/CHANGES.txt
index 4ec37e17a..26cbae60c 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -44,6 +44,11 @@ Features:
   or put them in the input buffer for editing. (John Rouillard)
 - add format to logging section in config.ini. Used to set default
   logging format. (John Rouillard)
+- the default logging format template includes an identifier unique
+  for a request. This identifier (trace_id) can be use to identify
+  logs for a specific transaction. Logging also supports a
+  trace_reason log token with the url for a web request. The logging
+  format can be changed in config.ini. (John Rouillard)
 
 2025-07-13 2.5.0
 
diff --git a/doc/admin_guide.txt b/doc/admin_guide.txt
index ad92a94a7..50ee90b6b 100644
--- a/doc/admin_guide.txt
+++ b/doc/admin_guide.txt
@@ -46,98 +46,284 @@ There's two "installations" that we talk about when using Roundup:
    both choosing your "tracker home" and the ``main`` -> ``database`` variable
    in the tracker's config.ini.
 
+.. _rounduplogging:
 
 Configuring Roundup Message Logging
 ===================================
 
 You can control how Roundup logs messages using your tracker's
-config.ini file. Roundup uses the standard Python (2.3+) logging
-implementation.  The config file and ``roundup-server`` provide very
-basic control over logging.
-
-Configuration for "BasicLogging" implementation:
- - tracker configuration file specifies the location of a log file
-   ``logging`` -> ``filename``
- - tracker configuration file specifies the level to log to as
-   ``logging`` -> ``level``
- - tracker configuration file lets you disable other loggers
-   (e.g. when running under a wsgi framework) with
-   ``logging`` -> ``disable_loggers``.
- - tracker configuration file can set the log format using
-   ``logging`` -> ``format``. See :ref:`logFormat` for more info.
- - ``roundup-server`` specifies the location of a log file on the command
-   line
- - ``roundup-server`` enable  using the standard python logger with
-    the tag/channel ``roundup.http`` on the command line
-
-By supplying a standard log config file in ini or json (dictionary)
-format, you get more control over the logs. You can set different
-levels for logs (e.g. roundup.hyperdb can be set to WARNING while
-other Roundup log channels are set to INFO and roundup.mailgw logs at
-DEBUG level). You can also send the logs for roundup.mailgw to syslog,
-and other roundup logs go to an automatically rotating log file, or
-are submitted to your log aggregator over https.
-
-Configuration for standard "logging" module:
- - tracker configuration file specifies the location of a logging
-   configuration file as ``logging`` -> ``config``.
-
-In both cases, if no logfile is specified then logging will simply be sent
-to sys.stderr with only logging of ERROR messages.
+config.ini file. Roundup uses the standard Python logging
+implementation.  The config file and ``roundup-server`` provide
+very basic control over logging.
+
+``roundup-server``'s logging is controlled from the command
+line. You can:
+
+- specify the location of a log file or
+- enable logging using the standard Python logging library under
+  the tag/channel ``roundup.http``
+
+Configuration for "BasicLogging" implementation for your tracker
+is done using the settings in the tracker's ``config.ini`` under
+the ``logging`` section:
+
+- ``filename`` setting: specifies the location of a log file
+- ``level`` setting: specifies the minimum level to log
+- ``disable_loggers`` setting: disable other loggers (e.g. when
+  running under a wsgi framework)
+- ``format`` setting: set the log format template. See
+  :ref:`logFormat` for more info.
+
+In either case, if logfile is not specified, logging is sent to
+sys.stderr. If level is not set, only ERROR or higher priority
+log messages will be reported.
+
+You can get more control over logging by using the ``config``
+setting in the tracker's ``config.ini``. Using a logging config
+file overrides all the rest of the other logging settings in
+``config.ini``.  You get more control over the logs by supplying
+a log config file in ini or json (dictionary) format.
+
+Using this, you can set different levels by channel.  For example
+roundup.hyperdb can be set to WARNING while other Roundup log
+channels are set to INFO and the roundup.mailgw channel logs at
+the DEBUG level. You can also control the distribution of
+logs. For example roundup.mailgw logs to syslog, other channels
+log to an automatically rotating log file, or are submitted to
+your log aggregator over https.
 
 .. _logFormat:
 
 Defining the Log Format
 -----------------------
 
-Starting with Roundup 2.6 you can specify the logging format. In the
-``logging`` -> ``format`` setting of config.ini you can use any of the
-`standard logging LogRecord attributes
-<https://docs.python.org/3/library/logging.html#logrecord-attributes>`_.
-However you must double any ``%`` format markers. The default value
-is::
+Starting with Roundup 2.6 you can specify the logging format in
+config.ini. The ``logging`` -> ``format`` setting of config.ini
+supports all of the `standard logging LogRecord attributes
+<https://docs.python.org/3/library/logging.html#logrecord-attributes>`_
+or Roundup logging attributes.  However you must double any ``%``
+format markers. The default value is::
 
-  %%(asctime)s %%(levelname)s %%(message)s
+  %%(asctime)s %%(trace_id)s %%(levelname)s %%(message)s
 
-Standard Logging Setup
+Roundup Logging Attributes
+--------------------------
+
+The `logging package has a number of attributes
+<https://docs.python.org/3/library/logging.html#logrecord-attributes>`_
+that can be expanded in the format template. In addition to the
+ones supplied by Python's logging module, Roundup defines
+additional attributes:
+
+  trace_id
+     a unique string that is generated for each request. It is
+     unique per thread.
+
+  trace_reason
+     a string describing the reason for the trace/request.
+     
+     * the URL for a web triggered (http, rest, xmlrpc) request
+     * the email message id for an email triggered request
+     * the roundup-admin os user and start of command. Only first
+       two words in command are printed so seting a password will
+       not be leaked to the logs.
+
+  sinfo
+     the stack traceback information at the time the log call id
+     made.
+
+     This must be intentionally activated by using the extras
+     parameter. For example calling::
+
+        logging.get_logger('roundup.something').warning(
+		"I am here\n%(sinfo)s", extra={"sinfo": 2})
+
+     in the function confirmid() of the file detectors/reauth.py
+     in your demo tracker will print 2 items on the stack
+     including the log call. It results in the following (5 lines
+     total in the log file)::
+
+       2025-09-14 23:07:58,668 Cm0ZPlBaklLZ3Mm6hAAgoC WARNING I am here
+         File "[...]/roundup/hyperdb.py", line 1924, in fireAuditors
+           audit(self.db, self, nodeid, newvalues)
+         File "demo/detectors/reauth.py", line 7, in confirmid
+           logging.getLogger('roundup.something').warning(
+
+     Note that the output does not include the arguments to
+     ``warning`` because they are on the following line.  If you
+     want arguments to the log call included, they have to be on
+     the same line.
+
+     Setting ``sinfo`` to an integer value N includes N lines up
+     the stack ending with the logging call. Setting it to 0
+     includes all the lines in the stack ending with the logging
+     call.
+
+     If the value is less than 0, the stack dump doesn't end at
+     the logging call but continues to the function that
+     generates the stack report. So it includes functions inside
+     the logging module.
+
+     Setting it to a number larger than the stack trace will
+     print the trace down to the log call. So using ``-1000``
+     will print up to 1000 stack frames and start at the function
+     that generates the stack report.
+     
+     Setting ``sinfo`` to a non-integer value ``{"sinfo": None}``
+     will produce 5 lines of the stack trace ending at the
+     logging call.
+
+  pct_char
+     produces a single ``%`` sign in the log. The usual way of
+     embedding a percent sign in a formatted string is to double
+     it like: ``%%``. However when the format string is specified
+     in the config.ini file percent signs are manipulated. So
+     ``%%(pct_char)s`` can be used in config.ini to print a
+     percent sign.
+
+The default logging template is defined in config.ini in the
+``logging`` -> ``format`` setting. It includes the ``trace_id``.
+When searching logs, you can use the trace_id to see all the log
+messages associated with a request.
+
+If you want to log from a detector, extension or other code, you
+can use these tokens in your messages when calling the logging
+functions. (Note that doubling ``%`` signs is only required when
+defining the log format in a config file, not when defining a
+msg.)  For example::
+
+    logging.getLogger('roundup.myextension').error('problem with '
+                      '%(trace_reason)s')
+
+will include the url in the message when triggered from the
+web. This also works with other log methods: ``warning()``,
+``debug()``, ....
+
+Note you must **not** use positional arguments in your
+message. Using::
+
+    logging.getLogger('roundup.myextension').error(
+	'%s problem with %(trace_reason)s', "a")
+
+will not properly substitute the argument. You must use mapping
+key based arguments and define the local values as part of the
+extra dictionary. For example::
+
+    logging.getLogger('roundup.myextension').error('%(article)s '
+                      'problem with %(trace_reason)',
+		      extra={"article": some_local_variable})
+
+Also if you are logging any data supplied by a user, you must not
+log it directly. If the variable ``url`` contains the url typed in
+by the user, never use:
+
+    logger.info(url)
+
+or
+
+    logger.info("Url is %s" % url)
+
+Use:
+
+    logger.info("Url is %s", url)
+
+or
+
+    logger.info("Url is %(url)s", extra={"url": url)
+
+This prevents printf style tokens in ``url`` from being processed
+where it can raise an exception. This could be used to prevent
+the log message from being generated.
+
+More on trace_id
+~~~~~~~~~~~~~~~~
+
+The trace_id provides a unique token (a UUID4 encoded to make it
+shorter) for each transaction in the database. It is unique to
+each thread or transaction. A transaction:
+
+  for the web interface is
+      each web, rest or xmlrpc request
+
+  for the email interface is
+      each email request. Using pipe mode will generate one
+      transaction. Using pop/imap etc can generate multiple
+      transactions, one for each email. Logging that occurs prior
+      to processing an email transaction has the default
+      ``not_set`` value for trace_id
+
+  for the roundup-admin interface is
+      each command in the interactive interface or on the command
+      line.  Plus one transaction when/if a commit happens on
+      roundup-admin exit.
+
+When creating scripts written using the roundup package the entry
+point should use the ``@gen_trace_id`` decorator. For example to
+decorate the entry point that performs one transaction::
+
+    from roundup.logcontext import gen_trace_id
+
+    # stuff ...
+
+    @gen_trace_id()
+    def main(...):
+       ...
+	   
+If your script does multiple processing operations, decorate the entry
+point for the processing operation::
+
+    from roundup.logcontext import gen_trace_id
+
+    @gen_trace_id()
+    def process_one(thing):
+       ...
+
+    def main():
+       for thing in things:
+	   process_one(thing)
+      
+
+Advanced Logging Setup
 ----------------------
 
 If the settings in config.ini are not sufficient for your logging
-requirements, you can specify a full logging configuration in one of
-two formats:
+requirements, you can specify a full logging configuration in one
+of two formats:
 
-  * `fileConfig format
-    <https://docs.python.org/3/library/logging.config.html#logging.config.fileConfig>`_
-    in ini style
   * `dictConfig format
     <https://docs.python.org/3/library/logging.config.html#logging.config.dictConfig>`_
     using json with comment support
+  * `fileConfig format
+    <https://docs.python.org/3/library/logging.config.html#logging.config.fileConfig>`_
+    in ini style
 
-The dictConfig allows more control over configuration including
-loading your own log handlers and disabling existing handlers. If you
-use the fileConfig format, the ``logging`` -> ``disable_loggers`` flag
-in the tracker's config is used to enable/disable pre-existing loggers
-as there is no way to do this in the logging config file.
+The dictConfig format allows more control over configuration
+including loading your own log handlers and disabling existing
+handlers. If you use the fileConfig format, the ``logging`` ->
+``disable_loggers`` flag in the tracker's config is used to
+enable/disable pre-existing loggers as there is no way to do this
+in the logging config file.
 
 .. _`dictLogConfig`:
 
 dictConfig Based Logging Config
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-dictConfigs are specified in JSON format with support for comments.
-The file name in the tracker's config for the ``logging`` -> ``config``
-setting must end with ``.json`` to choose the correct processing.
+dictConfigs are specified in JSON format with support for
+comments.  The file name in the tracker's config for the
+``logging`` -> ``config`` setting must end with ``.json`` to
+choose the correct processing.
 
 Comments have to be in one of two forms based on javascript line
 comments:
 
-1. A ``//`` possibly indented with whitespace on a line is considereda
-   a comment and is stripped from the file before being passed to the
-   json parser. This is a "line comment".
+1. A ``//`` possibly indented with whitespace on a line is
+   considereda a comment and is stripped from the file before
+   being passed to the json parser. This is a "line comment".
 
-2. A ``//`` with at least three white space characters before it is
-   stripped from the end of the line before begin passed to the json
-   parser. This is an "inline comment".
+2. A ``//`` with at least three white space characters before it
+   is stripped from the end of the line before being passed to
+   the json parser. This is an "inline comment".
 
 Block style comments are not supported.
 
@@ -151,20 +337,23 @@ Example dictConfig Logging Config
 .................................
 
 Note that this file is not actually JSON format as it include
-comments.  However by using javascript style comments, some tools that
-expect JSON (editors, linters, formatters) might work with it.  A
-command like ``sed -e 's#^\s*//.*##' -e 's#\s*\s\s\s//.*##'
-logging.json`` can be used to strip comments for programs that need
-it.
+comments.  However by using javascript style comments, some tools
+that treat JSON like javascript (editors, linters, formatters)
+might work with it.  A command like::
+
+  sed -e 's#^\s*//.*##' -e 's#\s*\s\s\s//.*##' logging.json
+
+can be used to strip comments for programs that need it.
 
 The config below works with the `Waitress wsgi server
 <https://github.com/Pylons/waitress>`_ configured to use the
-roundup.wsgi channel. It also controls the `TransLogger middleware
-<https://github.com/pasteorg/paste>`_ configured to use
-roundup.wsgi.translogger, to produce httpd style combined logs. The
-log file is specified relative to the current working directory not
-the tracker home. The tracker home is the subdirectory demo under the
-current working directory. The commented config is::
+roundup.wsgi channel. It also controls the `TransLogger
+middleware <https://github.com/pasteorg/paste>`_ configured to
+use roundup.wsgi.translogger, to produce httpd style combined
+logs. The log file is specified relative to the current working
+directory not the tracker home. The tracker home is the
+subdirectory demo under the current working directory. The
+commented config is::
 
   {
     "version": 1,   // only supported version
@@ -173,11 +362,12 @@ current working directory. The commented config is::
     "formatters": {
       // standard format for Roundup messages
       "standard": {
-        "format": "%(asctime)s %(ctx_id)s %(levelname)s %(name)s:%(module)s %(msg)s"
+        "format": "%(asctime)s %(trace_id)s %(levelname)s %(name)s:%(module)s %(msg)s"
       },
       // used for waitress wsgi server to produce httpd style logs
       "http": {
-	"format": "%(message)s"
+	"format": "%(message)s %(trace_id)"
+
       }
     },
     "handlers": {
@@ -254,12 +444,13 @@ current working directory. The commented config is::
 fileConfig Based Logging Config
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-The file config is an older and more limited method of configuring
-logging. It is described by the `Configuration file format
+The file config is an older and more limited method of
+configuring logging. It is described by the `Configuration file
+format
 <https://docs.python.org/3/library/logging.config.html#configuration-file-format>`_
-in the Python documentation. The file name in the tracker's config for
-the ``logging`` -> ``config`` setting must end with ``.ini`` to choose
-the correct processing.
+in the Python documentation. The file name in the tracker's
+config for the ``logging`` -> ``config`` setting must end with
+``.ini`` to choose the correct processing.
 
 Example fileConfig LoggingConfig
 ................................
@@ -343,7 +534,7 @@ extension output::
   keys=basic,plain
 
   [formatter_basic]
-  format=%(asctime)s %(process)d %(name)s:%(module)s.%(funcName)s,%(levelname)s: %(message)s
+  format=%(asctime)s %(trace_id)s %(process)d %(name)s:%(module)s.%(funcName)s,%(levelname)s: %(message)s
   datefmt=%Y-%m-%d %H:%M:%S
 
   [formatter_plain]
diff --git a/doc/upgrading.txt b/doc/upgrading.txt
index e814a6352..73d91a3f7 100644
--- a/doc/upgrading.txt
+++ b/doc/upgrading.txt
@@ -108,6 +108,35 @@ your database.
 Migrating from 2.5.0 to 2.6.0
 =============================
 
+Default Logs Include Unique Request Identifier (info)
+-----------------------------------------------------
+
+The default logging format has been changed from::
+
+  %(asctime)s %(levelname)s %(message)s
+
+to::
+
+  %(asctime)s %(trace_id)s %(levelname)s %(message)s
+
+So logs now look like::
+
+    2025-08-20 03:25:00,308 f6RPbT2s70vvJ2jFb9BQNF DEBUG get user1 cached
+
+which in the previous format would look like::
+
+    2025-08-20 03:25:00,308 DEBUG get user1 cached
+
+The new format includes ``trace_id`` which is a thread and process
+unique identifier for a single request. So you can link together all
+of the log lines and determine where a slow down or other
+problem occurred.
+
+The logging format is now a ``config.ini`` parameter in the
+``logging`` section with the name ``format``. You can change it if you
+would like the old logging format without having to create a logging
+configuration file. See :ref:`rounduplogging` for details.
+
 Support authorized changes in your tracker (optional)
 -----------------------------------------------------
 
diff --git a/roundup/admin.py b/roundup/admin.py
index eb717b736..737afcbe5 100644
--- a/roundup/admin.py
+++ b/roundup/admin.py
@@ -49,6 +49,7 @@
 )
 from roundup.exceptions import UsageError
 from roundup.i18n import _, get_translation
+from roundup.logcontext import gen_trace_id, store_trace_reason
 
 try:
     from UserDict import UserDict
@@ -2354,6 +2355,8 @@ def usageError_feedback(self, message, function):
         print(function.__doc__)
         return 1
 
+    @gen_trace_id()
+    @store_trace_reason('admin')
     def run_command(self, args):
         """Run a single command
         """
@@ -2599,7 +2602,7 @@ def hook():
         if self.db and self.db_uncommitted:
             commit = self.my_input(_('There are unsaved changes. Commit them (y/N)? '))
             if commit and commit[0].lower() == 'y':
-                self.db.commit()
+                self.run_command(["commit"])
 
         # looks like histfile is saved with mode 600
         if self.readline and self.history_features('save_history'):
@@ -2674,7 +2677,7 @@ def main(self):  # noqa: PLR0912, PLR0911
                 self.interactive()
             else:
                 ret = self.run_command(args)
-                if self.db: self.db.commit()  # noqa: E701
+                if self.db: self.run_command(["commit"])  # noqa: E701
             return ret
         finally:
             if self.db:
diff --git a/roundup/cgi/client.py b/roundup/cgi/client.py
index ed091c507..32290f24c 100644
--- a/roundup/cgi/client.py
+++ b/roundup/cgi/client.py
@@ -56,9 +56,9 @@ class SysCallError(Exception):
     UsageError,
 )
 
-from roundup.mlink_expr import ExpressionError
-
+from roundup.logcontext import gen_trace_id, store_trace_reason
 from roundup.mailer import Mailer, MessageSendError
+from roundup.mlink_expr import ExpressionError
 
 logger = logging.getLogger('roundup')
 
@@ -434,6 +434,8 @@ class Client:
     # content-type.
     precompressed_mime_types = ["image/png", "image/jpeg"]
 
+    @gen_trace_id()
+    @store_trace_reason('client')
     def __init__(self, instance, request, env, form=None, translator=None):
         # re-seed the random number generator. Is this is an instance of
         # random.SystemRandom it has no effect.
@@ -581,6 +583,8 @@ def setTranslator(self, translator=None):
         self._ = self.gettext = translator.gettext
         self.ngettext = translator.ngettext
 
+    @gen_trace_id()
+    @store_trace_reason('client_main')
     def main(self):
         """ Wrap the real main in a try/finally so we always close off the db.
         """
diff --git a/roundup/cgi/wsgi_handler.py b/roundup/cgi/wsgi_handler.py
index f730503dc..f1b27a36c 100644
--- a/roundup/cgi/wsgi_handler.py
+++ b/roundup/cgi/wsgi_handler.py
@@ -13,6 +13,7 @@
 from roundup.anypy.strings import s2b
 from roundup.cgi import TranslationService
 from roundup.cgi.client import BinaryFieldStorage
+from roundup.logcontext import gen_trace_id, store_trace_reason
 
 BaseHTTPRequestHandler = http_.server.BaseHTTPRequestHandler
 DEFAULT_ERROR_MESSAGE = http_.server.DEFAULT_ERROR_MESSAGE
@@ -102,6 +103,8 @@ def __init__(self, home, debug=False, timing=False, lang=None,
         else:
             self.preload()
 
+    @gen_trace_id()
+    @store_trace_reason("wsgi")
     def __call__(self, environ, start_response):
         """Initialize with `apache.Request` object"""
         request = RequestHandler(environ, start_response)
diff --git a/roundup/configuration.py b/roundup/configuration.py
index 6da56200f..906f95317 100644
--- a/roundup/configuration.py
+++ b/roundup/configuration.py
@@ -11,18 +11,19 @@
 import errno
 import getopt
 import logging
-import logging.config
 import os
 import re
 import smtplib
 import sys
 import time
+import traceback
 
 import roundup.date
 from roundup.anypy import random_
 from roundup.anypy.strings import b2s
 from roundup.backends import list_backends
 from roundup.i18n import _
+from roundup.logcontext import gen_trace_id, get_context_info
 
 if sys.version_info[0] > 2:
     import configparser  # Python 3
@@ -577,33 +578,36 @@ def get(self):
 
 
 class LoggingFormatOption(Option):
-    """Replace escaped % (as %%) with single %.
+    """Escape/unescape logging format string '%(' <-> '%%('
 
        Config file parsing allows variable interpolation using
        %(keyname)s.  However this is exactly the format that we need
        for creating a logging format string. So we tell the user to
        quote the string using %%(...). Then we turn %%( -> %( when
-       retrieved.
+       retrieved and turn %( into %%( when saving the file.
     """
 
-    class_description = ("Allowed value: Python logging module named "
-                         "attributes with % sign doubled.")
+    class_description = ("Allowed value: Python LogRecord attribute named "
+                         "formats with % *sign doubled*.\n"
+                         "Also you can include the following attributes:\n"
+                         "  %%(trace_id)s %%(trace_reason)s and %%(pct_char)s"
+                         )
 
     def str2value(self, value):
-        """Check format of unquoted string looking for missing specifiers.
+        """Validate and convert value of logging format string.
 
            This does a dirty check to see if a token is missing a
-           specifier. So "%(ascdate)s %(level) " would fail because of
-           the 's' missing after 'level)'. But "%(ascdate)s %(level)s"
+           specifier. So "%%(ascdate)s %%(level) " would fail because of
+           the 's' missing after 'level)'. But "%%(ascdate)s %%(level)s"
            would pass.
 
-           Note that %(foo)s generates a error from the ini parser
-           with a less than wonderful message.
+           Note that '%(foo)s' (i.e. unescaped substitution) generates
+           a error from the ini parser with a less than wonderful message.
         """
         unquoted_val = value.replace("%%(", "%(")
 
         # regexp matches all current logging record object attribute names.
-        scanned_result = re.sub(r'%\([A-Za-z_]+\)\S','', unquoted_val )
+        scanned_result = re.sub(r'%\([A-Za-z_]+\)\S', '', unquoted_val)
         if scanned_result.find('%(') != -1:
             raise OptionValueError(
                 self, unquoted_val,
@@ -618,6 +622,7 @@ def _value2str(self, value):
         """
         return value.replace("%(", "%%(")
 
+
 class OriginHeadersListOption(Option):
 
     """List of space seperated origin header values.
@@ -1658,7 +1663,7 @@ def str2value(self, value):
             "If above 'config' option is set, this option has no effect.\n"
             "Allowed values: DEBUG, INFO, WARNING, ERROR"),
         (LoggingFormatOption, "format",
-         "%(asctime)s %(levelname)s %(message)s",
+            "%(asctime)s %(trace_id)s %(levelname)s %(message)s",
             "Format of the logging messages with all '%' signs\n"
             "doubled so they are not interpreted by the config file."),
         (BooleanOption, "disable_loggers", "no",
@@ -2379,6 +2384,18 @@ def _get_unset_options(self):
     def _get_name(self):
         return self["TRACKER_NAME"]
 
+    @gen_trace_id()
+    def _logging_test(self, sinfo, msg="test %(a)s\n%(sinfo)s", args=None):
+        """Test method for logging formatting.
+
+           Not used in production.
+        """
+        logger = logging.getLogger('roundup')
+        if args:
+            logger.info(msg, *args)
+        else:
+            logger.info(msg, extra={"a": "a_var", "sinfo": sinfo})
+
     def reset(self):
         Config.reset(self)
         if self.ext:
@@ -2387,6 +2404,177 @@ def reset(self):
             self.detectors.reset()
         self.init_logging()
 
+    def gather_callstack(self, keep_full_stack=False):
+        # Locate logging call in stack
+        stack = traceback.extract_stack()
+        if keep_full_stack:
+            last_frame_index = len(stack)
+        else:
+            for last_frame_index, frame in enumerate(stack):
+                # Walk from the top of stack looking for
+                # "logging" in filename (really
+                # filepath). Can't use /logging/ as
+                # windows uses \logging\.
+                #
+                # Filtering by looking for "logging" in
+                # the filename isn't great.
+                if "logging" in frame.filename:
+                    break
+        if not keep_full_stack:
+            stack = stack[0:last_frame_index]
+        return (stack, last_frame_index)
+
+    def context_filter(self, record):
+        """Add context to record, expand context references in record.msg
+           Define pct_char as '%'
+        """
+
+        # This method can be called multiple times on different handlers.
+        # However it modifies the record on the first call and the changes
+        # persist in the record. So we only want to be called once per
+        # record.
+        if hasattr(record, "ROUNDUP_CONTEXT_FILTER_CALLED"):
+            return True
+
+        for name, value in get_context_info():
+            if not hasattr(record, name):
+                setattr(record, name, value)
+        record.pct_char = "%"
+        record.ROUNDUP_CONTEXT_FILTER_CALLED = True
+
+        if hasattr(record, "sinfo"):
+            # sinfo has to be set via extras argument to logging commands
+            #   to activate this.
+            #
+            # sinfo value can be:
+            #  non-integer: "", None etc. Print 5 elements of
+            #      stack before logging call
+            #  integer N > 0: print N elements of stack before
+            #      logging call
+            #  0: print whole stack before logging call
+            #  integer N < 0: undocumented print stack starting at
+            #      extract_stack() below. I.E. do not set bottom of
+            #      stack to the logging call.
+            # if |N| is greater than stack height, print whole stack.
+            stack_height = record.sinfo
+            keep_full_stack = False
+
+            if isinstance(stack_height, int):
+                if stack_height < 0:
+                    keep_full_stack = True
+                    stack_height = abs(stack_height)
+                if stack_height == 0:
+                    # None will set value to actual stack height.
+                    stack_height = None
+            else:
+                stack_height = 5
+
+            stack, last_frame_index = self.gather_callstack(keep_full_stack)
+
+            if stack_height is None:
+                stack_height = last_frame_index
+            elif stack_height > last_frame_index:
+                stack_height = last_frame_index  # start at frame 0
+
+            # report the stack info
+            record.sinfo = "".join(
+                traceback.format_list(
+                    stack[last_frame_index - stack_height:last_frame_index]
+                )
+            )
+
+        # if args are present, just return. Logging will
+        # expand the arguments.
+        if record.args:
+            return True
+
+        # Since args not present, try formatting msg using
+        # named arguments.
+        try:
+            record.msg = record.msg % record.__dict__
+        except (ValueError, TypeError):
+            # ValueError: means there is a % sign in the msg
+            # somewhere that is not meant to be a format token. So
+            # just leave msg unexpanded.
+            #
+            # TypeError - a positional format string is being
+            # handled without setting record.args. E.G.
+            #     .info("result is %f")
+            # Leave message unexpanded.
+            pass
+        return True
+
+    def add_logging_context_filter(self):
+        """Update log record with contextvar values and expand msg
+
+           The contextvar values are stored as attributes on the log
+           record object in record.__dict__. They should not exist
+           when this is called. Do not overwrite them if they do exist
+           as they can be set in a logger call using::
+
+               logging.warning("a message", extra = {"trace_id": foo})
+
+           the extra argument/parameter.
+
+           Attempt to expand msg using the variables in
+           record.__dict__. This makes::
+
+               logging.warning("the URL was: %(trace_reason)s")
+
+           work and replaces the ``%(trace_reason)s`` token with the value.
+           Note that you can't use positional params and named params
+           together.  For example::
+
+               logging.warning("user = %s and URL was: %(trace_reason)s", user)
+
+           will result in an exception in logging when it formats the
+           message.
+
+           Also ``%(pct_char)`` is defined to allow the addition of %
+           characters in the format string as bare % chars can't make
+           it past the configparser and %% encoded ones run into issue
+           with the format verifier.
+
+           Calling a logger (.warning() etc.) with the argument::
+
+                extra={"sinfo": an_int}
+
+           will result in a stack trace starting at the logger call
+           and going up the stack for `an_int` frames. Using "True"
+           in place of `an_int` will print only the call to the logger.
+
+           Note that logging untrusted strings in the msg set by user
+           (untrusted) may be an issue. So don't do something like:
+
+               .info("%s" % web_url)
+
+           as web_url could include '%(trace_id)s'. Instead use:
+
+               .info("%(url)s", extra=("url": web_url))
+
+          Even in the problem case, I think the damage is contained since:
+
+           * data doesn't leak as the log string is not exposed to the
+             user.
+
+           * the log string isn't executed or used internally.
+
+           * log formating can raise an exception. But this won't
+             affect the application as the exception is swallowed in
+             the logging package. The raw message would be printed by
+             the fallback logging handler.
+
+           but if it is a concern, make sure user data is added using
+           the extra dict when calling one of the logging functions.
+        """
+        loggers = [logging.getLogger(name) for name in
+                   logging.root.manager.loggerDict]
+        # append the root logger as it is not listed in loggerDict
+        loggers.append(logging.getLogger())
+        for logger in loggers:
+            for hdlr in logger.handlers:
+                hdlr.addFilter(self.context_filter)
+
     def load_config_dict_from_json_file(self, filename):
         import json
         comment_re = re.compile(
@@ -2481,14 +2669,15 @@ def init_logging(self):
                     "Unable to load logging config file. "
                     "File extension must be '.ini' or '.json'.\n"
                     )
-                
+
+            self.add_logging_context_filter()
             return
 
         if _file:
             raise OptionValueError(self.options['LOGGING_CONFIG'],
                                    _file,
                                    "Unable to find logging config file.")
-        
+
         _file = self["LOGGING_FILENAME"]
         # set file & level on the roundup logger
         logger = logging.getLogger('roundup')
@@ -2503,6 +2692,15 @@ def init_logging(self):
             logger.removeHandler(hdlr)
         logger.handlers = [hdlr]
         logger.setLevel(self["LOGGING_LEVEL"] or "ERROR")
+        if 'pytest' not in sys.modules:
+            # logger.propatgate is True by default. This is
+            # needed so that pytest caplog code will work. In
+            # production leaving it set to True relogs everything
+            # using the root logger with logging BASIC_FORMAT:
+            #    "%(level)s:%(name)s:%(message)s
+            logger.propagate = False
+
+        self.add_logging_context_filter()
 
     def validator(self, options):
         """ Validate options once all options are loaded.
diff --git a/roundup/logcontext.py b/roundup/logcontext.py
new file mode 100644
index 000000000..e88e3a220
--- /dev/null
+++ b/roundup/logcontext.py
@@ -0,0 +1,208 @@
+import contextvars
+import functools
+import logging
+import os
+import uuid
+
+logger = logging.getLogger("roundup.logcontext")
+
+
+class SimpleSentinel:
+    """A hack to get a sentinel value where I can define __str__().
+
+       I was using sentinel = object(). However some code paths
+       resulted in the sentinel object showing up as an argument
+       to print or logging.warning|error|debug(...). In this case
+       seeing "<class 'object'>" in the output isn't useful.
+
+       So I created this class (with slots) as a fast method where
+       I could control the __str__ representation.
+
+    """
+    __slots__ = ("name", "str")
+
+    def __init__(self, name=None, str_value=""):
+        self.name = name
+        self.str = str_value
+
+    def __str__(self):
+        # Generate a string without whitespace.
+        # Used in logging where whitespace could be
+        # a field delimiter
+        return ("%s%s" % (
+            self.name + "-" if self.name else "",
+            self.str)).replace(" ", "_")
+
+    def __repr__(self):
+        return 'SimpleSentinel(name=%s, str_value="%s")' % (
+            self.name, self.str)
+
+
+# store the context variable names in a dict. Because
+# contactvars.copy_context().items() returns nothing if set has
+# not been called on a context var. I need the contextvar names
+# even if they have not been set.
+ctx_vars = {}
+
+# set up sentinel values that will print a suitable error value
+# and the context vars they are associated with.
+_SENTINEL_ID = SimpleSentinel("trace_id", "not set")
+ctx_vars['trace_id'] = contextvars.ContextVar("trace_id", default=_SENTINEL_ID)
+
+
+_SENTINEL_REASON = SimpleSentinel("trace_reason", "missing")
+ctx_vars['trace_reason'] = contextvars.ContextVar("trace_reason",
+                                                  default=_SENTINEL_REASON)
+
+
+def shorten_int_uuid(uuid):
+    """Encode a UUID integer in a shorter form for display.
+
+       A uuid is long. Make a shorter version that takes less room
+       in a log line.
+    """
+
+    alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz1234567890"
+    result = ""
+    while uuid:
+        uuid, t = divmod(uuid, len(alphabet))
+        result += alphabet[t]
+    return result or "0"
+
+
+def gen_trace_id():
+    """Decorator to generate a trace id (encoded uuid4) and add to contextvar
+
+       The logging routine uses this to label every log line. All
+       logs with the same trace_id should be generated from a
+       single request.
+
+       This decorator is applied to an entry point for a request.
+       Different methods of invoking Roundup have different entry
+       points. As a result, this decorator can be called multiple
+       times as some entry points can traverse another entry point
+       used by a different invocation method. It will not set a
+       trace_id if one is already assigned.
+
+       A uuid4() is used as the uuid, but to shorten the log line,
+       the uuid4 integer is encoded into a 62 character ascii
+       alphabet (A-Za-z0-9).
+
+       This decorator may produce duplicate (colliding) trace_id's
+       when used with multiple processes on some platforms where
+       uuid.uuid4().is_safe is unknown. Probability of a collision
+       is unknown.
+
+    """
+    def decorator(func):
+        @functools.wraps(func)
+        def wrapper(*args, **kwargs):
+            prev = None
+            trace_id = ctx_vars['trace_id']
+            if trace_id.get() is _SENTINEL_ID:
+                prev = trace_id.set(shorten_int_uuid(uuid.uuid4().int))
+            try:
+                r = func(*args, **kwargs)
+            finally:
+                if prev:
+                    trace_id.reset(prev)
+            return r
+        return wrapper
+    return decorator
+
+
+def store_trace_reason(location=None):
+    """Decorator finds and stores a reason trace was started in contextvar.
+
+       Record the url for a regular web triggered request.
+       Record the message id for an email triggered request.
+       Record a roundup-admin command/action for roundup-admin request.
+
+       Because the reason can be stored in different locations
+       depending on where this is called, it is called with a
+       location hint to activate the right extraction method.
+
+       If the reason has already been stored (and it's not "missing",
+       it tries to extract it again and verifies it's the same as the
+       stored reason. If it's not the same it logs an error. This
+       safety check may be removed in a future version of Roundup.
+    """
+    def decorator(func):
+        @functools.wraps(func)
+        def wrapper(*args, **kwargs):
+            nonlocal location
+
+            reason = None
+            prev_trace_reason = None
+            trace_reason = ctx_vars['trace_reason']
+            stored_reason = trace_reason.get()
+
+            # Fast return path. Not enabled to make sure SANITY
+            # CHECK below runs. If the CHECK fails, we have a a
+            # bad internal issue: contextvars shared between
+            # threads, roundup modifying reason within a request, ...
+            #
+            # if stored_reason is not _SENTINEL_REASON:
+            #     return func(*args, **kwargs)
+
+            # use location to determine how to extract the reason
+            if location == "wsgi" and 'REQUEST_URI' in args[1]:
+                reason = args[1]['REQUEST_URI']
+            elif location == "client" and 'REQUEST_URI' in args[3]:
+                reason = args[3]['REQUEST_URI']
+            elif location == "mailgw":
+                reason = args[1].get_header('message-id', "no_message_id")
+            elif location == "admin":
+                reason = "roundup-admin(%s): %s" % (os.getlogin(), args[1][:2])
+            elif location.startswith("file://"):
+                reason = location
+            elif location == "client_main" and 'REQUEST_URI' in args[0].env:
+                reason = args[0].env['REQUEST_URI']
+            elif location == "xmlrpc-server":
+                reason = args[0].path
+
+            if reason is None:
+                pass
+            elif stored_reason is _SENTINEL_REASON:
+                # no value stored and reason is not none, update
+                prev_trace_reason = trace_reason.set(reason)
+            elif reason != stored_reason:   # SANITY CHECK
+                # Throw an error we have mismatched REASON's which
+                # should never happen.
+                logger.error("Mismatched REASON's: stored: %s, new: %s at %s",
+                             stored_reason, reason, location)
+
+            try:
+                r = func(*args, **kwargs)
+            finally:
+                # reset context var in case thread is reused for
+                # another request.
+                if prev_trace_reason:
+                    trace_reason.reset(prev_trace_reason)
+            return r
+        return wrapper
+    return decorator
+
+
+def get_context_info():
+    """Return list of context var tuples [(var_name, var_value), ...]"""
+
+    return [(name, ctx.get()) for name, ctx in ctx_vars.items()]
+
+
+#Is returning a dict for this info more pythonic?
+def get_context_dict():
+    """Return dict of context var tuples ["var_name": "var_value", ...}"""
+    return {name: ctx.get() for name, ctx in ctx_vars.items()}
+
+# Dummy no=op implementation of this module:
+#
+#def noop_decorator(*args, **kwargs):
+#    def decorator(func):
+#        return func
+#    return decorator
+#
+#def get_context_info():
+#    return [ ("trace_id", "noop_trace_id"),
+#             ("trace_reason", "noop_trace_reason") ]
+#gen_trace_id = store_trace_reason = noop_decorator
diff --git a/roundup/mailgw.py b/roundup/mailgw.py
index c12d43137..b221d7be3 100644
--- a/roundup/mailgw.py
+++ b/roundup/mailgw.py
@@ -128,6 +128,7 @@ class node. Any parts of other types are each stored in separate files
 from roundup.anypy.strings import StringIO, b2s, u2s
 from roundup.hyperdb import iter_roles
 from roundup.i18n import _
+from roundup.logcontext import gen_trace_id, store_trace_reason
 from roundup.mailer import Mailer
 from roundup.dehtml import dehtml
 
@@ -1646,6 +1647,8 @@ def main(self, fp):
         return self.handle_Message(message_from_binary_file(fp,
                                                             RoundupMessage))
 
+    @gen_trace_id()
+    @store_trace_reason("mailgw")
     def handle_Message(self, message):
         """Handle an RFC822 Message
 
diff --git a/roundup/scripts/roundup_xmlrpc_server.py b/roundup/scripts/roundup_xmlrpc_server.py
index e4c3645a8..f9847aa5d 100644
--- a/roundup/scripts/roundup_xmlrpc_server.py
+++ b/roundup/scripts/roundup_xmlrpc_server.py
@@ -8,8 +8,12 @@
 
 # --- patch sys.path to make sure 'import roundup' finds correct version
 from __future__ import print_function
-import sys
+
+import base64
+import getopt
 import os.path as osp
+import socket
+import sys
 
 thisdir = osp.dirname(osp.abspath(__file__))
 rootdir = osp.dirname(osp.dirname(thisdir))
@@ -19,15 +23,14 @@
     sys.path.insert(0, rootdir)
 # --/
 
-
-import base64, getopt, os, sys, socket
-from roundup.anypy import urllib_
-from roundup.xmlrpc import translate
-from roundup.xmlrpc import RoundupInstance
 import roundup.instance
-from roundup.instance import TrackerError
+from roundup.anypy import urllib_, xmlrpc_
+from roundup.anypy.strings import b2s
 from roundup.cgi.exceptions import Unauthorised
-from roundup.anypy import xmlrpc_
+from roundup.instance import TrackerError
+from roundup.logcontext import gen_trace_id, store_trace_url
+from roundup.xmlrpc import RoundupInstance, translate
+
 SimpleXMLRPCServer = xmlrpc_.server.SimpleXMLRPCServer
 SimpleXMLRPCRequestHandler = xmlrpc_.server.SimpleXMLRPCRequestHandler
 
@@ -64,7 +67,7 @@ def authenticate(self, tracker):
         scheme, challenge = authorization.split(' ', 1)
 
         if scheme.lower() == 'basic':
-            decoded = base64.b64decode(challenge)
+            decoded = b2s(base64.b64decode(challenge))
             if ':' in decoded:
                 username, password = decoded.split(':')
             else:
@@ -85,6 +88,8 @@ def authenticate(self, tracker):
         db.setCurrentUser(username)
         return db
 
+    @gen_trace_id()
+    @store_trace_url("xmlrpc-server")
     def do_POST(self):
         """Extract username and password from authorization header."""
 
@@ -149,7 +154,7 @@ def run():
         elif opt in ['-p', '--port']:
             port = int(arg)
         elif opt in ['-e', '--encoding']:
-            encoding = encoding
+            encoding = arg
 
     tracker_homes = {}
     for arg in args:
diff --git a/test/test_config.py b/test/test_config.py
index b3547cdf2..f42298134 100644
--- a/test/test_config.py
+++ b/test/test_config.py
@@ -418,6 +418,10 @@ def testOctalNumberOption(self):
 @pytest.mark.usefixtures("save_restore_logging")
 class TrackerConfig(unittest.TestCase):
 
+    @pytest.fixture(autouse=True)
+    def inject_fixtures(self, caplog):
+        self._caplog = caplog
+
     @pytest.fixture(scope="class")
     def save_restore_logging(self):
         """Save logger state and try to restore it after all tests in
@@ -1009,7 +1013,136 @@ def testLoadConfigNoConfig(self):
         print(cm.exception)
         self.assertEqual(cm.exception.args[0], self.dirname)
 
+    def testFormattedLogging(self):
+        """Depends on using default logging format with %(trace_id)"""
+
+        def find_file_occurances(string):
+            return len(re.findall(r'\bFile\b', string))
+
+        config = configuration.CoreConfig()
+
+        config.LOGGING_LEVEL = "DEBUG"
+        config.init_logging()
+        
 
+        # format the record and verify the logformat/trace_id.
+        config._logging_test(None, msg="message")
+        tuple = self._caplog.record_tuples[0]
+        self.assertEqual(tuple[1], 20)
+        self.assertEqual("message", tuple[2])
+        logger = logging.getLogger('roundup')
+        hdlr = logger.handlers[0]
+        log = hdlr.format(self._caplog.records[0])
+        # verify that %(trace_id) was set and substituted
+        # Note: trace_id is not initialized in this test case
+        log_parts = log.split()
+        self.assertRegex(log_parts[2], r'^[A-Za-z0-9]{22}')
+        self._caplog.clear()
+
+        # the rest check various values of sinfo and msg formating.
+        
+        # sinfo = 1 - one line of stack starting with log call
+        config._logging_test(1)
+        tuple = self._caplog.record_tuples[0]
+        self.assertEqual(tuple[1], 20)
+        self.assertIn("test a_var\n  File", tuple[2])
+        self.assertIn("in _logging_test", tuple[2])
+        self.assertIn("logger.info(msg, extra=", tuple[2])
+        self.assertEqual(find_file_occurances(tuple[2]), 1)
+        self._caplog.clear()
+        
+        # sinfo = None - 5 lines of stack starting with log call
+        config._logging_test(None)
+        tuple = self._caplog.record_tuples[0]
+        self.assertEqual(tuple[1], 20)
+        self.assertIn("test a_var\n  File", tuple[2])
+        self.assertIn("in _logging_test", tuple[2])
+        self.assertIn("logger.info(msg, extra=", tuple[2])
+        self.assertEqual(find_file_occurances(tuple[2]), 5)
+        self._caplog.clear()
+
+        # sinfo = 0 - whole stack starting with log call
+        config._logging_test(0)
+        tuple = self._caplog.record_tuples[0]
+        self.assertEqual(tuple[1], 20)
+        self.assertIn("test a_var\n  File", tuple[2])
+        self.assertIn("in _logging_test", tuple[2])
+        self.assertIn("logger.info(msg, extra=", tuple[2])
+        # A file in 'pytest' directory should be at the top of stack.
+        self.assertIn("pytest", tuple[2])
+        # no idea how deep the actual stack is, could change with python
+        # versions, but 3.12 is 33 so ....
+        self.assertTrue(find_file_occurances(tuple[2]) > 10)
+        self._caplog.clear()
+
+        # sinfo = -1 - one line of stack starting with extract_stack()
+        config._logging_test(-1)
+        tuple = self._caplog.record_tuples[0]
+        self.assertEqual(tuple[1], 20)
+        self.assertIn("test a_var\n  File", tuple[2])
+        # The call to extract_stack should be included as the frame
+        # at bottom of stack.
+        self.assertIn("extract_stack()", tuple[2])
+        # only one frame included
+        self.assertEqual(find_file_occurances(tuple[2]), 1)
+        self._caplog.clear()
+
+        # sinfo = 1000 - whole stack starting with log call 1000>stack size
+        config._logging_test(1000)
+        tuple = self._caplog.record_tuples[0]
+        self.assertEqual(tuple[1], 20)
+        self.assertIn("test a_var\n  File", tuple[2])
+        self.assertIn("in _logging_test", tuple[2])
+        self.assertIn("logger.info(msg, extra=", tuple[2])
+        # A file in 'pytest' directory should be at the top of stack.
+        self.assertIn("pytest", tuple[2])
+        # no idea how deep the actual stack is, could change with python
+        # versions, but 3.12 is 33 so ....
+        self.assertTrue(find_file_occurances(tuple[2]) > 10)
+        self._caplog.clear()
+
+        # sinfo = -1000 - whole stack starting with extract_stack
+        config._logging_test(-1000)
+        tuple = self._caplog.record_tuples[0]
+        self.assertEqual(tuple[1], 20)
+        self.assertIn("test a_var\n  File", tuple[2])
+        self.assertIn("in _logging_test", tuple[2])
+        self.assertIn("logger.info(msg, extra=", tuple[2])
+        # The call to extract_stack should be included as the frame
+        # at bottom of stack.
+        self.assertIn("extract_stack()", tuple[2])
+        # A file in 'pytest' directory should be at the top of stack.
+        # no idea how deep the actual stack is, could change with python
+        # versions, but 3.12 is 33 so ....
+        self.assertTrue(find_file_occurances(tuple[2]) > 10)
+        self.assertIn("pytest", tuple[2])
+        self._caplog.clear()
+
+        # pass args and compatible message
+        config._logging_test(None, args=(1,2,3),
+                             msg="one: %s, two: %s, three: %s"
+                             )
+        tuple = self._caplog.record_tuples[0]
+        self.assertEqual(tuple[1], 20)
+        self.assertEqual('one: 1, two: 2, three: 3', tuple[2])
+        self._caplog.clear()
+
+        # error case for incorrect placeholder
+        config._logging_test(None, msg="%(a)")
+        tuple = self._caplog.record_tuples[0]
+        self.assertEqual(tuple[1], 20)
+        self.assertEqual("%(a)", tuple[2])
+        self._caplog.clear()
+
+        # error case for incompatible format record is the first argument
+        # and it can't be turned into floating point.
+        config._logging_test(None, msg="%f")
+        tuple = self._caplog.record_tuples[0]
+        self.assertEqual(tuple[1], 20)
+        self.assertEqual("%f", tuple[2])
+        self._caplog.clear()
+        
+        
     def testXhtmlRaisesOptionError(self):
         self.munge_configini(mods=[ ("html_version = ", "xhtml") ])
 

From 97446ad58a3e79d34e98f619b82a9a8d45c27bc1 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 17 Sep 2025 00:45:04 -0400
Subject: [PATCH 300/398] bug, test: fix tests for trace_id; readd import
 logging.config

Made save_restore_logging a test level fixture. It was a class level
which worked fine until I started using caplog for tests in the same
class. Due to loading config from dict, the roundup channel was set to
not propagate which broke the new formatting test used for trace_id.

Forgot to update some tests due to change in default format adding
%(trace_id).

Also re-added logging.config import which broke loading logging config
files in configuration.py.
---
 roundup/configuration.py |  1 +
 test/test_config.py      | 30 ++++++++++++++----------------
 2 files changed, 15 insertions(+), 16 deletions(-)

diff --git a/roundup/configuration.py b/roundup/configuration.py
index 906f95317..1c9ba55d6 100644
--- a/roundup/configuration.py
+++ b/roundup/configuration.py
@@ -11,6 +11,7 @@
 import errno
 import getopt
 import logging
+import logging.config
 import os
 import re
 import smtplib
diff --git a/test/test_config.py b/test/test_config.py
index f42298134..baae75226 100644
--- a/test/test_config.py
+++ b/test/test_config.py
@@ -422,7 +422,7 @@ class TrackerConfig(unittest.TestCase):
     def inject_fixtures(self, caplog):
         self._caplog = caplog
 
-    @pytest.fixture(scope="class")
+    @pytest.fixture(autouse=True)
     def save_restore_logging(self):
         """Save logger state and try to restore it after all tests in
            this class have finished.
@@ -461,7 +461,7 @@ def save_restore_logging(self):
         # cribbed from configuration.py:init_loggers
         hdlr = logging.StreamHandler(sys.stdout)
         formatter = logging.Formatter(
-            '%(asctime)s %(levelname)s %(message)s')
+            '%(asctime)s %(trace_id)s %(levelname)s %(message)s')
         hdlr.setFormatter(formatter)
 
         for logger in roundup_loggers:
@@ -1019,11 +1019,7 @@ def testFormattedLogging(self):
         def find_file_occurances(string):
             return len(re.findall(r'\bFile\b', string))
 
-        config = configuration.CoreConfig()
-
-        config.LOGGING_LEVEL = "DEBUG"
-        config.init_logging()
-        
+        config = configuration.CoreConfig(settings={"LOGGING_LEVEL": "DEBUG"})
 
         # format the record and verify the logformat/trace_id.
         config._logging_test(None, msg="message")
@@ -1036,7 +1032,9 @@ def find_file_occurances(string):
         # verify that %(trace_id) was set and substituted
         # Note: trace_id is not initialized in this test case
         log_parts = log.split()
-        self.assertRegex(log_parts[2], r'^[A-Za-z0-9]{22}')
+        # testing len(shorten_int_uuid(uuid.uuid4().int))
+        # for 20000 tests gives range [19,22]
+        self.assertRegex(log_parts[2], r'^[A-Za-z0-9]{19,22}')
         self._caplog.clear()
 
         # the rest check various values of sinfo and msg formating.
@@ -1250,25 +1248,25 @@ def testLoggerFormat(self):
 
         # verify config is initalized to defaults
         self.assertEqual(config['LOGGING_FORMAT'],
-                         '%(asctime)s %(levelname)s %(message)s')
+                         '%(asctime)s %(trace_id)s %(levelname)s %(message)s')
 
         # load config
         config.load(self.dirname)
         self.assertEqual(config['LOGGING_FORMAT'],
-                         '%(asctime)s %(levelname)s %(message)s')
+                         '%(asctime)s %(trace_id)s %(levelname)s %(message)s')
 
         # break config using an incomplete format specifier (no trailing 's')
-        self.munge_configini(mods=[ ("format = ", "%%(asctime)s %%(levelname) %%(message)s") ], section="[logging]")
+        self.munge_configini(mods=[ ("format = ", "%%(asctime)s %%(trace_id)s %%(levelname) %%(message)s") ], section="[logging]")
 
         # load config
         with self.assertRaises(configuration.OptionValueError) as cm:
             config.load(self.dirname)
             
-        self.assertIn('Unrecognized use of %(...) in:  %(levelname)',
+        self.assertIn('Unrecognized use of %(...) in:   %(levelname)',
                       cm.exception.args[2])
 
-        # break config by not dubling % sign to quote it from configparser
-        self.munge_configini(mods=[ ("format = ", "%(asctime)s %%(levelname) %%(message)s") ], section="[logging]")
+        # break config by not doubling % sign to quote it from configparser
+        self.munge_configini(mods=[ ("format = ", "%(asctime)s %%(trace_id)s %%(levelname) %%(message)s") ], section="[logging]")
 
         with self.assertRaises(
                 configuration.ParsingOptionError) as cm:
@@ -1279,8 +1277,8 @@ def testLoggerFormat(self):
                          "[logging] at option format: Bad value substitution: "
                          "option 'format' in section 'logging' contains an "
                          "interpolation key 'asctime' which is not a valid "
-                         "option name. Raw value: '%(asctime)s %%(levelname) "
-                         "%%(message)s'")
+                         "option name. Raw value: '%(asctime)s %%(trace_id)s "
+                         "%%(levelname) %%(message)s'")
 
     def testDictLoggerConfigViaJson(self):
 

From 41fa7cc503b8b736c568234889465b3d3787bc98 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 17 Sep 2025 01:05:35 -0400
Subject: [PATCH 301/398] fix: remove nolocal on unset param in logcontext.py

flake8 was failing in ci on it.
---
 roundup/logcontext.py | 1 -
 1 file changed, 1 deletion(-)

diff --git a/roundup/logcontext.py b/roundup/logcontext.py
index e88e3a220..8b2c72f40 100644
--- a/roundup/logcontext.py
+++ b/roundup/logcontext.py
@@ -130,7 +130,6 @@ def store_trace_reason(location=None):
     def decorator(func):
         @functools.wraps(func)
         def wrapper(*args, **kwargs):
-            nonlocal location
 
             reason = None
             prev_trace_reason = None

From 0bd284b85d0bf5c2d151f075f9c9f73482fa5a74 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 17 Sep 2025 01:31:12 -0400
Subject: [PATCH 302/398] fix: os.getlogin fails with OSError in CI.

---
 roundup/logcontext.py | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/roundup/logcontext.py b/roundup/logcontext.py
index 8b2c72f40..032266398 100644
--- a/roundup/logcontext.py
+++ b/roundup/logcontext.py
@@ -152,7 +152,11 @@ def wrapper(*args, **kwargs):
             elif location == "mailgw":
                 reason = args[1].get_header('message-id', "no_message_id")
             elif location == "admin":
-                reason = "roundup-admin(%s): %s" % (os.getlogin(), args[1][:2])
+                try:
+                    login = os.getlogin()
+                except OSError:
+                    login = "unknown"
+                reason = "roundup-admin(%s): %s" % (login, args[1][:2])
             elif location.startswith("file://"):
                 reason = location
             elif location == "client_main" and 'REQUEST_URI' in args[0].env:

From 949af33cd5a324ef7e6a7a24ea91991835ddc22f Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 17 Sep 2025 01:33:09 -0400
Subject: [PATCH 303/398] fix: use getloing value --unknown-- on error.

In case there is a real user with name unknown, Unlikely for account to
to have dashes in name.
---
 roundup/logcontext.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roundup/logcontext.py b/roundup/logcontext.py
index 032266398..0371e28da 100644
--- a/roundup/logcontext.py
+++ b/roundup/logcontext.py
@@ -155,7 +155,7 @@ def wrapper(*args, **kwargs):
                 try:
                     login = os.getlogin()
                 except OSError:
-                    login = "unknown"
+                    login = "--unknown--"
                 reason = "roundup-admin(%s): %s" % (login, args[1][:2])
             elif location.startswith("file://"):
                 reason = location

From 43eb594d8ff2fecf21d9fdd3963ced98f2512703 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 17 Sep 2025 19:58:08 -0400
Subject: [PATCH 304/398] bug: fix json logging config file syntax
 exception/fix test for windows

If the json logging config file has mimatched {} or [], it raises
an IndexError. Handle that case and test it.

Also handle embedded filenames in tests when testsare run on
windows:(/ vs \ directory sep).
---
 roundup/configuration.py |  6 +++-
 test/test_config.py      | 64 +++++++++++++++++++++++++---------------
 2 files changed, 46 insertions(+), 24 deletions(-)

diff --git a/roundup/configuration.py b/roundup/configuration.py
index 1c9ba55d6..736521a17 100644
--- a/roundup/configuration.py
+++ b/roundup/configuration.py
@@ -2604,7 +2604,11 @@ def load_config_dict_from_json_file(self, filename):
             error_at_doc_line = e.lineno
             # subtract 1 - zero index on config_list
             # remove '\n' for display
-            line = config_list[error_at_doc_line - 1][:-1]
+            try:
+                line = config_list[error_at_doc_line - 1][:-1]
+            except IndexError:
+                line = _("Error found at end of file. Maybe missing a "
+                         "block closing '}'.")
 
             hint = ""
             if line.find('//') != -1:
diff --git a/test/test_config.py b/test/test_config.py
index baae75226..c32cd91eb 100644
--- a/test/test_config.py
+++ b/test/test_config.py
@@ -1169,14 +1169,15 @@ def testCopyConfig(self):
         self.assertEqual(config['STATIC_FILES'], None)
 
         # load config
+        STATIC_FILES = os.path.join(self.dirname, "html2")
         config.load(self.dirname)
-        self.assertEqual(config['STATIC_FILES'], ['_test_instance/html2'])
+        self.assertEqual(config['STATIC_FILES'], [ STATIC_FILES ])
 
         # copy config
         config_copy = config.copy()
 
         # this should work
-        self.assertEqual(config_copy['STATIC_FILES'], ['_test_instance/html2'])
+        self.assertEqual(config_copy['STATIC_FILES'], [STATIC_FILES])
 
     @skip_py2
     def testConfigValueInterpolateError(self):
@@ -1272,13 +1273,14 @@ def testLoggerFormat(self):
                 configuration.ParsingOptionError) as cm:
             config.load(self.dirname)
 
-        self.assertEqual(cm.exception.args[0],
-                         "Error in _test_instance/config.ini with section "
+        ini_path = os.path.join(self.dirname, "config.ini")
+        self.assertEqual(cm.exception.args[0],(
+                         f"Error in {ini_path} with section "
                          "[logging] at option format: Bad value substitution: "
                          "option 'format' in section 'logging' contains an "
                          "interpolation key 'asctime' which is not a valid "
                          "option name. Raw value: '%(asctime)s %%(trace_id)s "
-                         "%%(levelname) %%(message)s'")
+                         "%%(levelname) %%(message)s'"))
 
     def testDictLoggerConfigViaJson(self):
 
@@ -1538,26 +1540,41 @@ def testDictLoggerConfigViaJson(self):
                   "%s'\n" % (log_config_filename, access_filename))
         self.assertEqual(output, target)
 
-    def test_missing_logging_config_file(self):
-        saved_config = self.db.config['LOGGING_CONFIG']
-        
-        self.db.config['LOGGING_CONFIG'] = 'logging.json'
-        
-        with self.assertRaises(configuration.OptionValueError) as cm:
-            self.db.config.init_logging()
+        # mess up '}' so json file block isn't properly closed.
+        test_config = config1.replace(
+            ' }',
+            ' ')
 
-        self.assertEqual(cm.exception.args[1], "_test_instance/logging.json")
-        self.assertEqual(cm.exception.args[2],
-                         "Unable to find logging config file.")
+        with open(log_config_filename, "w") as log_config_file:
+            log_config_file.write(test_config)
 
-        self.db.config['LOGGING_CONFIG'] = 'logging.ini'
+        # file is made relative to tracker dir.
+        self.db.config["LOGGING_CONFIG"] = '_test_log_config.json'
+        with self.assertRaises(configuration.LoggingConfigError) as cm:
+            config = self.db.config.init_logging()
 
-        with self.assertRaises(configuration.OptionValueError) as cm:
-            self.db.config.init_logging()
+        output = cm.exception.args[0].replace(r'\\','\\')
+        target = ("Error parsing json logging dict "
+                  "(%s) near \n\n"
+                  "  Error found at end of file. Maybe missing a "
+                  "block closing '}'.\n\n"
+                  "Expecting ',' delimiter: line 86 column 1." %
+                  (log_config_filename,))
+        self.assertEqual(output, target)
 
-        self.assertEqual(cm.exception.args[1], "_test_instance/logging.ini")
-        self.assertEqual(cm.exception.args[2],
-                         "Unable to find logging config file.")
+    def test_missing_logging_config_file(self):
+        saved_config = self.db.config['LOGGING_CONFIG']
+
+        for logging_file in ["logging.json", "logging.ini", "logging.foobar"]:
+            self.db.config['LOGGING_CONFIG'] = logging_file
+        
+            with self.assertRaises(configuration.OptionValueError) as cm:
+                self.db.config.init_logging()
+
+                logging_configfile = os.path.join(self.dirname, logging_file)
+                self.assertEqual(cm.exception.args[1], logging_configfile)
+                self.assertEqual(cm.exception.args[2],
+                                 "Unable to find logging config file.")
 
         self.db.config['LOGGING_CONFIG'] = saved_config
         
@@ -1566,11 +1583,12 @@ def test_unknown_logging_config_file_type(self):
 
         self.db.config['LOGGING_CONFIG'] = 'schema.py'
 
-        
+
         with self.assertRaises(configuration.OptionValueError) as cm:
             self.db.config.init_logging()
 
-        self.assertEqual(cm.exception.args[1], "_test_instance/schema.py")
+        logging_configfile = os.path.join(self.dirname, "schema.py")
+        self.assertEqual(cm.exception.args[1], logging_configfile)
         self.assertEqual(cm.exception.args[2],
                          "Unable to load logging config file. "
                          "File extension must be '.ini' or '.json'.\n")

From 29adc16b5beb6e978f071bd52fe0386c6d055ee3 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sat, 20 Sep 2025 16:49:38 -0400
Subject: [PATCH 305/398] bug: improve error reporting for errors for logging
 fileConfig.

---
 CHANGES.txt              |   2 +
 roundup/configuration.py |  33 +++++-
 test/test_config.py      | 236 ++++++++++++++++++++++++++++++++++++++-
 3 files changed, 266 insertions(+), 5 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index 26cbae60c..7e89ce711 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -29,6 +29,8 @@ Fixed:
 - in roundup-admin, using 'pragma history_length interactively now
   sets readline history length. Using -P history_length=10 on the
   command line always worked. (John Rouillard)
+- enhanced error reporting for errors in ini style logging
+  configuration. (John Rouillard)
 
 Features:
 
diff --git a/roundup/configuration.py b/roundup/configuration.py
index 736521a17..07fbc38ae 100644
--- a/roundup/configuration.py
+++ b/roundup/configuration.py
@@ -2634,9 +2634,36 @@ def init_logging(self):
         _file = self["LOGGING_CONFIG"]
         if _file and os.path.isfile(_file):
             if _file.endswith(".ini"):
-                logging.config.fileConfig(
-                    _file,
-                    disable_existing_loggers=self["LOGGING_DISABLE_LOGGERS"])
+                try:
+                    logging.config.fileConfig(
+                        _file,
+                        disable_existing_loggers=self[
+                            "LOGGING_DISABLE_LOGGERS"])
+                except (ValueError, RuntimeError,
+                        KeyError, NameError, ModuleNotFoundError) as e:
+                    # configparser.DuplicateOptionError includes
+                    # filename, line number and a useful error.
+                    # so we don't have to augment it.
+                    context = []
+                    if hasattr(e, '__context__') and e.__context__:
+                        # get additional error info.
+                        context.append(str(e.__context__))
+                    if hasattr(e, '__doc__') and e.__doc__:
+                        context.append(e.__doc__)
+
+                    if isinstance(e, KeyError):
+                        context.append("No section found with this name.")
+                    if not context:
+                        context = ["No additional information available."]
+
+                    raise LoggingConfigError(
+                        "Error loading logging config from %(file)s.\n\n"
+                        "   %(msg)s\n\n%(context)s\n" % {
+                            "file": _file,
+                            "msg": e.args[0],
+                            "context": " ".join(context),
+                        }
+                        )
             elif _file.endswith(".json"):
                 config_dict = self.load_config_dict_from_json_file(_file)
                 try:
diff --git a/test/test_config.py b/test/test_config.py
index c32cd91eb..9db9a9477 100644
--- a/test/test_config.py
+++ b/test/test_config.py
@@ -15,6 +15,7 @@
 # BASIS, AND THERE IS NO OBLIGATION WHATSOEVER TO PROVIDE MAINTENANCE,
 # SUPPORT, UPDATES, ENHANCEMENTS, OR MODIFICATIONS.
 
+import configparser
 import errno
 import fileinput
 import logging
@@ -424,8 +425,8 @@ def inject_fixtures(self, caplog):
 
     @pytest.fixture(autouse=True)
     def save_restore_logging(self):
-        """Save logger state and try to restore it after all tests in
-           this class have finished.
+        """Save logger state and try to restore it after each test
+           has finished.
 
            The primary test is testDictLoggerConfigViaJson which
            can change the loggers and break tests that depend on caplog
@@ -484,6 +485,18 @@ def save_restore_logging(self):
         logging.shutdown()
         reload(logging)
 
+    def reset_logging(self):
+        """https://til.tafkas.net/posts/-resetting-python-logging-before-running-tests/"""
+        loggers = [logging.getLogger(name) for name in logging.root.manager.loggerDict]
+        loggers.append(logging.getLogger())
+        for logger in loggers:
+            handlers = logger.handlers[:]
+            for handler in handlers:
+                logger.removeHandler(handler)
+                handler.close()
+            logger.setLevel(logging.NOTSET)
+            logger.propagate = True
+        
     backend = 'anydbm'
 
     def setUp(self):
@@ -1562,6 +1575,225 @@ def testDictLoggerConfigViaJson(self):
                   (log_config_filename,))
         self.assertEqual(output, target)
 
+    def testIniFileLoggerConfig(self):
+
+        # good base test case
+        config1 = dedent("""
+        [loggers]
+        keys=root,roundup,roundup.http,roundup.hyperdb,actions,schema,extension,detector
+
+        [logger_root]
+        #DEBUG, INFO, WARNING, ERROR, CRITICAL
+        #also for root only NOTSET (all)
+        level=DEBUG
+        handlers=basic
+
+        [logger_roundup]
+        #DEBUG, INFO, WARNING, ERROR, CRITICAL
+        #also for root only NOTSET (all)
+        level=DEBUG
+        handlers=rotate
+        qualname=roundup
+        propagate=0
+
+        [logger_roundup.http]
+        level=INFO
+        handlers=rotate_weblog
+        qualname=roundup.http
+        propagate=0
+
+        [logger_roundup.hyperdb]
+        level=WARNING
+        handlers=rotate
+        qualname=roundup.hyperdb
+        propagate=0
+
+        [logger_actions]
+        #DEBUG, INFO, WARNING, ERROR, CRITICAL
+        #also for root only NOTSET (all)
+        level=DEBUG
+        handlers=rotate
+        qualname=actions
+        propagate=0
+
+        [logger_detector]
+        #DEBUG, INFO, WARNING, ERROR, CRITICAL
+        #also for root only NOTSET (all)
+        level=DEBUG
+        handlers=rotate
+        qualname=detector
+        propagate=0
+
+        [logger_schema]
+        level=DEBUG
+        handlers=rotate
+        qualname=schema
+        propagate=0
+
+        [logger_extension]
+        level=DEBUG
+        handlers=rotate
+        qualname=extension
+        propagate=0
+
+        [handlers]
+        keys=basic,rotate,rotate_weblog
+
+        [handler_basic]
+        class=StreamHandler
+        args=(sys.stderr,)
+        formatter=basic
+
+        [handler_rotate]
+        class=logging.handlers.RotatingFileHandler
+        args=('roundup.log','a', 512000, 2)
+        formatter=basic
+
+        [handler_rotate_weblog]
+        class=logging.handlers.RotatingFileHandler
+        args=('httpd.log','a', 512000, 2)
+        formatter=plain
+
+        [formatters]
+        keys=basic,plain
+
+        [formatter_basic]
+        format=%(asctime)s %(name)s:%(module)s.%(funcName)s,%(levelname)s: %(message)s
+        datefmt=%Y-%m-%d %H:%M:%S
+
+        [formatter_plain]
+        format=%(message)s
+        """)
+
+        log_config_filename = os.path.join(self.instance.tracker_home,
+                                           "_test_log_config.ini")
+
+        # happy path
+        with open(log_config_filename, "w") as log_config_file:
+            log_config_file.write(config1)
+
+        self.db.config.LOGGING_CONFIG = "_test_log_config.ini"
+
+        # verify we have a clean environment
+        self.assertEqual(len(logging.getLogger('roundup.http').handlers), 0)
+        
+        # always returns None
+        self.db.config.init_logging()
+
+        # verify that logging loaded and handler is set
+        # default log config doesn't define handlers for roundup.http
+        self.assertEqual(len(logging.getLogger('roundup.http').handlers), 1)
+        self.reset_logging()
+
+        # use undefined enumeration
+        test_config = config1.replace("=DEBUG\n", "=DEBUF\n")
+        with open(log_config_filename, "w") as log_config_file:
+            log_config_file.write(test_config)
+
+        with self.assertRaises(configuration.LoggingConfigError) as cm:
+            config = self.db.config.init_logging()
+ 
+        # verify that logging was reset
+        # default log config doesn't define handlers for roundup.http
+        self.assertEqual(len(logging.getLogger('roundup.http').handlers), 0)
+        
+        self.assertEqual(
+            cm.exception.args[0].replace(r'\\','\\'),
+            ('Error loading logging config from %s.\n\n'
+             "   Unknown level: 'DEBUF'\n\n"
+             'Inappropriate argument value (of correct type).\n' %
+             log_config_filename)
+        )
+        self.reset_logging()
+
+
+        # add a syntax error "= foo"
+        test_config = config1.replace("=DEBUG\n", "=DEBUG\n=foo\n", 1)
+        with open(log_config_filename, "w") as log_config_file:
+            log_config_file.write(test_config)
+
+        with self.assertRaises(configuration.LoggingConfigError) as cm:
+            config = self.db.config.init_logging()
+ 
+        # verify that logging was reset
+        # default log config doesn't define handlers for roundup.http
+        self.assertEqual(len(logging.getLogger('roundup.http').handlers), 0)
+        
+        self.assertEqual(
+            cm.exception.args[0].replace(r'\\','\\'),
+            ("Error loading logging config from %(filename)s.\n\n"
+             "   %(filename)s is invalid: Source contains parsing errors: "
+             "'%(filename)s'\n\t[line  9]: '=foo\\n'\n\n"
+             "Source contains parsing errors: '%(filename)s'\n"
+             "\t[line  9]: '=foo\\n' Unspecified run-time error.\n" %
+             {"filename": log_config_filename})
+        )
+        self.reset_logging()
+        
+        # handler = basic to handler = basi
+        test_config = config1.replace("handlers=basic\n", "handlers=basi\n", 1)
+        with open(log_config_filename, "w") as log_config_file:
+            log_config_file.write(test_config)
+
+        with self.assertRaises(configuration.LoggingConfigError) as cm:
+            config = self.db.config.init_logging()
+ 
+        # verify that logging was reset
+        # default log config doesn't define handlers for roundup.http
+        self.assertEqual(len(logging.getLogger('roundup.http').handlers), 0)
+        
+        self.assertEqual(
+            cm.exception.args[0].replace(r'\\','\\'),
+            ("Error loading logging config from %(filename)s.\n\n"
+             "   basi\n\n"
+             "Mapping key not found. No section found with this name.\n" %
+             {"filename": log_config_filename})
+        )
+        self.reset_logging()
+
+        # Change class to missing class
+        test_config = config1.replace("class=StreamHandler\n",
+                                      "class=SHAndler\n", 1)
+        with open(log_config_filename, "w") as log_config_file:
+            log_config_file.write(test_config)
+
+        with self.assertRaises(configuration.LoggingConfigError) as cm:
+            config = self.db.config.init_logging()
+ 
+        # verify that logging was reset
+        # default log config doesn't define handlers for roundup.http
+        self.assertEqual(len(logging.getLogger('roundup.http').handlers), 0)
+        
+        self.assertEqual(
+            cm.exception.args[0].replace(r'\\','\\'),
+            ("Error loading logging config from %(filename)s.\n\n"
+             "   No module named 'SHAndler'\n\n"
+             "name 'SHAndler' is not defined Module not found.\n" %
+             {"filename": log_config_filename})
+        )
+        self.reset_logging()
+
+        # remove section to cause duplicate option definition
+        test_config = config1.replace("[logger_roundup.http]\n",
+                                      "\n", 1)
+        with open(log_config_filename, "w") as log_config_file:
+            log_config_file.write(test_config)
+
+        with self.assertRaises(configparser.DuplicateOptionError) as cm:
+            config = self.db.config.init_logging()
+ 
+        # verify that logging was reset
+        # default log config doesn't define handlers for roundup.http
+        self.assertEqual(len(logging.getLogger('roundup.http').handlers), 0)
+        
+        self.assertEqual(
+            str(cm.exception).replace(r'\\','\\'),
+            ("While reading from '%(filename)s' [line 20]: "
+             "option 'level' in section 'logger_roundup' already exists" %
+             {"filename": log_config_filename})
+        )
+        self.reset_logging()
+                
     def test_missing_logging_config_file(self):
         saved_config = self.db.config['LOGGING_CONFIG']
 

From 044c744a0e1918e7eef3fa2f59317215ad705cb4 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 22 Sep 2025 12:37:21 -0400
Subject: [PATCH 306/398] chore(build): update anchore to 7.0.0 via dependabot

---
 .github/workflows/anchore.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/anchore.yml b/.github/workflows/anchore.yml
index 3ab5b7cf5..6e1c21351 100644
--- a/.github/workflows/anchore.yml
+++ b/.github/workflows/anchore.yml
@@ -43,7 +43,7 @@ jobs:
     - name: List the Docker image
       run: docker image ls
     - name: Run the Anchore scan action itself with GitHub Advanced Security code scanning integration enabled
-      uses: anchore/scan-action@1638637db639e0ade3258b51db49a9a137574c3e # 6.5.1
+      uses: anchore/scan-action@f6601287cdb1efc985d6b765bbf99cb4c0ac29d8 # 7.0.0
       id: scan
       with:
         image: "localbuild/testimage:latest"

From 6c46419082fe2eb5e61357fa633bd6bc2cb8d350 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 22 Sep 2025 13:09:49 -0400
Subject: [PATCH 307/398] fix: python 3.{7,8,10} raise configfile.ParsingError
 not RuntimeError

when adding broken syntax:

  =foo

to logging config file.

These version failing in CI. 3.9 and 3.11 are also
affected. RuntimeError was added in 3.12.
---
 roundup/configuration.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roundup/configuration.py b/roundup/configuration.py
index 07fbc38ae..f62a7e1b7 100644
--- a/roundup/configuration.py
+++ b/roundup/configuration.py
@@ -2639,7 +2639,7 @@ def init_logging(self):
                         _file,
                         disable_existing_loggers=self[
                             "LOGGING_DISABLE_LOGGERS"])
-                except (ValueError, RuntimeError,
+                except (ValueError, RuntimeError, configparser.ParsingError,
                         KeyError, NameError, ModuleNotFoundError) as e:
                     # configparser.DuplicateOptionError includes
                     # filename, line number and a useful error.

From 1ee6116b772a85d9858d0d3df80090b1f900d904 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 22 Sep 2025 13:57:52 -0400
Subject: [PATCH 308/398] fix: python < 3.12 returns ParsingError not
 RuntimeError; print exception

RuntimeError added in 3.12. Support older configparser.ParsingError.

Supporting older version also requires different test string for the
two versions.

Also use str(exception) rather than exception.args[0] for producing
message to user. Include exception name in output.
---
 roundup/configuration.py |  4 ++--
 test/test_config.py      | 41 +++++++++++++++++++++++++++-------------
 2 files changed, 30 insertions(+), 15 deletions(-)

diff --git a/roundup/configuration.py b/roundup/configuration.py
index 07fbc38ae..6984aafcd 100644
--- a/roundup/configuration.py
+++ b/roundup/configuration.py
@@ -2639,7 +2639,7 @@ def init_logging(self):
                         _file,
                         disable_existing_loggers=self[
                             "LOGGING_DISABLE_LOGGERS"])
-                except (ValueError, RuntimeError,
+                except (ValueError, RuntimeError, configparser.ParsingError,
                         KeyError, NameError, ModuleNotFoundError) as e:
                     # configparser.DuplicateOptionError includes
                     # filename, line number and a useful error.
@@ -2660,7 +2660,7 @@ def init_logging(self):
                         "Error loading logging config from %(file)s.\n\n"
                         "   %(msg)s\n\n%(context)s\n" % {
                             "file": _file,
-                            "msg": e.args[0],
+                            "msg":  type(e).__name__ + ": " + str(e),
                             "context": " ".join(context),
                         }
                         )
diff --git a/test/test_config.py b/test/test_config.py
index 9db9a9477..e85b14f79 100644
--- a/test/test_config.py
+++ b/test/test_config.py
@@ -1700,7 +1700,7 @@ def testIniFileLoggerConfig(self):
         self.assertEqual(
             cm.exception.args[0].replace(r'\\','\\'),
             ('Error loading logging config from %s.\n\n'
-             "   Unknown level: 'DEBUF'\n\n"
+             "   ValueError: Unknown level: 'DEBUF'\n\n"
              'Inappropriate argument value (of correct type).\n' %
              log_config_filename)
         )
@@ -1718,16 +1718,31 @@ def testIniFileLoggerConfig(self):
         # verify that logging was reset
         # default log config doesn't define handlers for roundup.http
         self.assertEqual(len(logging.getLogger('roundup.http').handlers), 0)
-        
-        self.assertEqual(
-            cm.exception.args[0].replace(r'\\','\\'),
-            ("Error loading logging config from %(filename)s.\n\n"
-             "   %(filename)s is invalid: Source contains parsing errors: "
-             "'%(filename)s'\n\t[line  9]: '=foo\\n'\n\n"
-             "Source contains parsing errors: '%(filename)s'\n"
-             "\t[line  9]: '=foo\\n' Unspecified run-time error.\n" %
-             {"filename": log_config_filename})
-        )
+
+        output = cm.exception.args[0].replace(r'\\','\\')
+
+        if sys.version_info >= (3, 12, 0):
+            expected = (
+                "Error loading logging config from %(filename)s.\n\n"
+                "   RuntimeError: %(filename)s is invalid: Source contains parsing errors: "
+                "'%(filename)s'\n\t[line  9]: '=foo\\n'\n\n"
+                "Source contains parsing errors: '%(filename)s'\n"
+                "\t[line  9]: '=foo\\n' Unspecified run-time error.\n" %
+                {"filename": log_config_filename})
+
+        else: # 3.7 <= x < 3.12.0
+
+            expected = (
+                "Error loading logging config from %(filename)s.\n\n"
+
+                "   ParsingError: Source contains parsing errors: "
+                "'%(filename)s'\n"
+                "\t[line  9]: '=foo\\n'\n\n"
+
+                "Raised when a configuration file does not follow legal "
+                "syntax.\n" % {"filename": log_config_filename})
+
+        self.assertEqual(output, expected)
         self.reset_logging()
         
         # handler = basic to handler = basi
@@ -1745,7 +1760,7 @@ def testIniFileLoggerConfig(self):
         self.assertEqual(
             cm.exception.args[0].replace(r'\\','\\'),
             ("Error loading logging config from %(filename)s.\n\n"
-             "   basi\n\n"
+             "   KeyError: 'basi'\n\n"
              "Mapping key not found. No section found with this name.\n" %
              {"filename": log_config_filename})
         )
@@ -1767,7 +1782,7 @@ def testIniFileLoggerConfig(self):
         self.assertEqual(
             cm.exception.args[0].replace(r'\\','\\'),
             ("Error loading logging config from %(filename)s.\n\n"
-             "   No module named 'SHAndler'\n\n"
+             "   ModuleNotFoundError: No module named 'SHAndler'\n\n"
              "name 'SHAndler' is not defined Module not found.\n" %
              {"filename": log_config_filename})
         )

From cd75cc6d834da22df1156c621fd7a67eae41cbe7 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 22 Sep 2025 14:08:36 -0400
Subject: [PATCH 309/398] merge multiple fix: python < 3.12 returns
 ParsingError not RuntimeError; print exception

---
 roundup/configuration.py |  2 +-
 test/test_config.py      | 39 +++++++++++++++++++++++++++------------
 2 files changed, 28 insertions(+), 13 deletions(-)

diff --git a/roundup/configuration.py b/roundup/configuration.py
index f62a7e1b7..6984aafcd 100644
--- a/roundup/configuration.py
+++ b/roundup/configuration.py
@@ -2660,7 +2660,7 @@ def init_logging(self):
                         "Error loading logging config from %(file)s.\n\n"
                         "   %(msg)s\n\n%(context)s\n" % {
                             "file": _file,
-                            "msg": e.args[0],
+                            "msg":  type(e).__name__ + ": " + str(e),
                             "context": " ".join(context),
                         }
                         )
diff --git a/test/test_config.py b/test/test_config.py
index 9db9a9477..931d3f325 100644
--- a/test/test_config.py
+++ b/test/test_config.py
@@ -1700,7 +1700,7 @@ def testIniFileLoggerConfig(self):
         self.assertEqual(
             cm.exception.args[0].replace(r'\\','\\'),
             ('Error loading logging config from %s.\n\n'
-             "   Unknown level: 'DEBUF'\n\n"
+             "   ValueError: Unknown level: 'DEBUF'\n\n"
              'Inappropriate argument value (of correct type).\n' %
              log_config_filename)
         )
@@ -1718,16 +1718,31 @@ def testIniFileLoggerConfig(self):
         # verify that logging was reset
         # default log config doesn't define handlers for roundup.http
         self.assertEqual(len(logging.getLogger('roundup.http').handlers), 0)
+
+        output = cm.exception.args[0].replace(r'\\','\\')
+
+        if sys.version_info >= (3, 12, 0):
+            expected = (
+                "Error loading logging config from %(filename)s.\n\n"
+                "   %(filename)s is invalid: Source contains parsing errors: "
+                "'%(filename)s'\n\t[line  9]: '=foo\\n'\n\n"
+                "Source contains parsing errors: '%(filename)s'\n"
+                "\t[line  9]: '=foo\\n' Unspecified run-time error.\n" %
+                {"filename": log_config_filename})
+
+        else: # 3.7 <= x < 3.12.0
+
+            expected = (
+                "Error loading logging config from %(filename)s.\n\n"
+                "   ParsingError: Source contains parsing errors: "
+                "'%(filename)s'\n"
+                "\t[line  9]: '=foo\\n'\n\n"
+                "Raised when a configuration file does not follow legal "
+                "syntax.\n" % {"filename": log_config_filename})
+
+        print(output)
         
-        self.assertEqual(
-            cm.exception.args[0].replace(r'\\','\\'),
-            ("Error loading logging config from %(filename)s.\n\n"
-             "   %(filename)s is invalid: Source contains parsing errors: "
-             "'%(filename)s'\n\t[line  9]: '=foo\\n'\n\n"
-             "Source contains parsing errors: '%(filename)s'\n"
-             "\t[line  9]: '=foo\\n' Unspecified run-time error.\n" %
-             {"filename": log_config_filename})
-        )
+        self.assertEqual(output, expected)
         self.reset_logging()
         
         # handler = basic to handler = basi
@@ -1745,7 +1760,7 @@ def testIniFileLoggerConfig(self):
         self.assertEqual(
             cm.exception.args[0].replace(r'\\','\\'),
             ("Error loading logging config from %(filename)s.\n\n"
-             "   basi\n\n"
+             "   KeyError: 'basi'\n\n"
              "Mapping key not found. No section found with this name.\n" %
              {"filename": log_config_filename})
         )
@@ -1767,7 +1782,7 @@ def testIniFileLoggerConfig(self):
         self.assertEqual(
             cm.exception.args[0].replace(r'\\','\\'),
             ("Error loading logging config from %(filename)s.\n\n"
-             "   No module named 'SHAndler'\n\n"
+             "   ModuleNotFoundError: No module named 'SHAndler'\n\n"
              "name 'SHAndler' is not defined Module not found.\n" %
              {"filename": log_config_filename})
         )

From 1fa42d5083cf294bc988f18f03dc0857a459abb9 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 25 Sep 2025 23:30:07 -0400
Subject: [PATCH 310/398] fix: make user_src_input generate valid javascript

user_src_input used to generate False if edit_ok == False in this
statement:

   tal:attributes="onblur python:edit_ok and 'split_name(this)';

but False isn't a boolean in javascript, so it throws an error in the
console. Changed to use:

   tal:attributes="onblur python:'split_name(this)' if edit_ok else '';

which generates an empty onblur if the field is not editable.
---
 share/roundup/templates/classic/html/page.html    | 2 +-
 share/roundup/templates/devel/html/page.html      | 2 +-
 share/roundup/templates/minimal/html/page.html    | 2 +-
 share/roundup/templates/responsive/html/page.html | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/share/roundup/templates/classic/html/page.html b/share/roundup/templates/classic/html/page.html
index cbd531c72..1ad239644 100644
--- a/share/roundup/templates/classic/html/page.html
+++ b/share/roundup/templates/classic/html/page.html
@@ -369,7 +369,7 @@ <h2><span metal:define-slot="body_title">body title</span></h2>
 
 <!-- src: value will be re-used for other input fields -->
 <input metal:define-macro="user_src_input"
-    type="text" tal:attributes="onblur python:edit_ok and 'split_name(this)';
+    type="text" tal:attributes="onblur python:'split_name(this)' if edit_ok else '';
     id name; name name; value value; readonly not:edit_ok"
     value="heinz.kunz">
 <!-- normal: no re-using -->
diff --git a/share/roundup/templates/devel/html/page.html b/share/roundup/templates/devel/html/page.html
index 7a43b32b4..c21375f41 100644
--- a/share/roundup/templates/devel/html/page.html
+++ b/share/roundup/templates/devel/html/page.html
@@ -424,7 +424,7 @@ <h1 id="breadcrumb"><span metal:define-slot="body_title">body title</span></h1>
 
 <!-- src: value will be re-used for other input fields -->
 <input metal:define-macro="user_src_input"
-    type="text" tal:attributes="onblur python:edit_ok and 'split_name(this)';
+    type="text" tal:attributes="onblur python:'split_name(this)' if edit_ok else '';
     id name; name name; value value; readonly not:edit_ok"
     value="heinz.kunz"/>
 <!-- normal: no re-using -->
diff --git a/share/roundup/templates/minimal/html/page.html b/share/roundup/templates/minimal/html/page.html
index 106cafc00..0dbde6d85 100644
--- a/share/roundup/templates/minimal/html/page.html
+++ b/share/roundup/templates/minimal/html/page.html
@@ -331,7 +331,7 @@ <h2><span metal:define-slot="body_title">body title</span></h2>
 
 <!-- src: value will be re-used for other input fields -->
 <input metal:define-macro="user_src_input"
-    type="text" tal:attributes="onblur python:edit_ok and 'split_name(this)';
+    type="text" tal:attributes="onblur python:'split_name(this)' if edit_ok else '';
     id name; name name; value value; readonly not:edit_ok"
     value="heinz.kunz">
 <!-- normal: no re-using -->
diff --git a/share/roundup/templates/responsive/html/page.html b/share/roundup/templates/responsive/html/page.html
index 7651c2af1..b7689ef5f 100644
--- a/share/roundup/templates/responsive/html/page.html
+++ b/share/roundup/templates/responsive/html/page.html
@@ -439,7 +439,7 @@ <h1><span metal:define-slot="body_title">body title</span></h1>
 
 <!-- src: value will be re-used for other input fields -->
 <input metal:define-macro="user_src_input"
-    type="text" tal:attributes="onblur python:edit_ok and 'split_name(this)';
+    type="text" tal:attributes="onblur python:'split_name(this)' if edit_ok else '';
     id name; name name; value value; readonly not:edit_ok"
     value="heinz.kunz"/>
 <!-- normal: no re-using -->

From fa26b6d106b40f72720700c1aaa6efb682bae480 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Fri, 26 Sep 2025 16:08:30 -0400
Subject: [PATCH 311/398] fix: update updating.txt doc for user_src_input bug

I originally thought it was not worth documenting because the error
case had no impact. But deployed copies of the trackers can be updated
to reduce differences between deployed and distributed files.
---
 CHANGES.txt       |  4 +++-
 doc/upgrading.txt | 20 ++++++++++++++++++++
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index 7e89ce711..07a800f50 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -31,7 +31,9 @@ Fixed:
   command line always worked. (John Rouillard)
 - enhanced error reporting for errors in ini style logging
   configuration. (John Rouillard)
-
+- fix bogus javascript emitted by user_src_input macro. (John
+  Rouillard)
+  
 Features:
 
 - add support for authorized changes. User can be prompted to enter
diff --git a/doc/upgrading.txt b/doc/upgrading.txt
index 73d91a3f7..9b3fcd7be 100644
--- a/doc/upgrading.txt
+++ b/doc/upgrading.txt
@@ -177,6 +177,26 @@ stripped before being processed by the logging system.
 
 You can read about the details in the :ref:`admin manual <dictLogConfig>`.
 
+Fix user.item.html template producing invalid Javascript (optional)
+-------------------------------------------------------------------
+
+The html template ``page.html`` in the classic, devel, minimal, and
+responsive tracker templates define a ``user_src_input`` macro. This
+macro produces invalid javascript for the ``onblur`` event when used
+by ``user.item.html``. The only effect from this bug is a javascript
+error reported in the user's browser when the user does not have edit
+permissions on the page. It doesn't have any user visible impact. 
+
+If you want to fix this, replace::
+
+  tal:attributes="onblur python:edit_ok and 'split_name(this)';
+
+with::
+
+  tal:attributes="onblur python:'split_name(this)' if edit_ok else '';
+  
+in the ``html/page.html`` file in your tracker.
+
 .. index:: Upgrading; 2.4.0 to 2.5.0
 
 Migrating from 2.4.0 to 2.5.0

From eedc6dec1dd7e8f76e6dfbd634519b6491e2dc41 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sat, 27 Sep 2025 17:26:32 -0400
Subject: [PATCH 312/398] fix: make version_check enforce version is 3.7+

---
 roundup/version_check.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/roundup/version_check.py b/roundup/version_check.py
index d20840a26..35d6fe24f 100644
--- a/roundup/version_check.py
+++ b/roundup/version_check.py
@@ -1,10 +1,10 @@
 #!/usr/bin/env python
 
-# Roundup requires Python 2.7+ as mentioned in doc\installation.txt
+# Roundup requires Python 3.7+ as mentioned in doc\installation.txt
 from __future__ import print_function
 import sys
 
-VERSION_NEEDED = (2, 7)
+VERSION_NEEDED = (3, 7)
 
 if sys.version_info < VERSION_NEEDED:
     print("Content-Type: text/plain\n")

From 678652a166875a35fc27f80877d3a37d6d919109 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Tue, 30 Sep 2025 18:08:14 -0400
Subject: [PATCH 313/398] doc: remove uWSGI references as it is in maint mode
 and not being updated

Replaced with Waitress where appropriate.
---
 doc/admin_guide.txt  |  8 ++++----
 doc/installation.txt | 19 +------------------
 2 files changed, 5 insertions(+), 22 deletions(-)

diff --git a/doc/admin_guide.txt b/doc/admin_guide.txt
index 50ee90b6b..a6730bbfd 100644
--- a/doc/admin_guide.txt
+++ b/doc/admin_guide.txt
@@ -738,7 +738,7 @@ on the fly, compression is enabled by default, to disable it set::
     dynamic_compression = No
 
 in the tracker's ``config.ini``. You should disable compression if
-your proxy (e.g. nginx or apache) or wsgi server (uwsgi) is configured
+your proxy (e.g. nginx or apache) is configured
 to compress responses on the fly. The python standard library includes
 gzip support. For brotli or zstd you will need to install packages. See
 the `installation documentation`_ for details.
@@ -900,9 +900,9 @@ There are two ways to add a CSP:
 Fixed CSP
 ---------
 
-If you are using a web server (Apache, Nginx) to run Roundup, you can
-add a ``Content-Security-Policy`` header using that server. WSGI
-servers like uWSGI can also be configured to add headers.  An example
+If you are using a web server (Apache, Nginx) to run Roundup, you
+can add a ``Content-Security-Policy`` header using that
+server. WSGI middleware can be written to add headers.  An example
 header would look like::
 
   Content-Security-Policy: default-src 'self' 'unsafe-inline' 'strict-dynamic';
diff --git a/doc/installation.txt b/doc/installation.txt
index 14d5b0087..24a97367f 100644
--- a/doc/installation.txt
+++ b/doc/installation.txt
@@ -1283,7 +1283,7 @@ FastCGI (Cherokee, Hiawatha, lighttpd)
 
 The Hiawatha and lighttpd web servers can run Roundup using FastCGI.
 Cherokee can run FastCGI but it also supports wsgi directly using a
-wsgi server like uWSGI, Gnuicorn etc.
+wsgi server like Waitress, Gnuicorn etc.
 
 To run Roundup using FastCGI, the flup_ package can be used under
 Python 2 and Python 3. We don't have a detailed config for this, but
@@ -1499,23 +1499,6 @@ including putting it behind a proxy, IPV6 support etc.
 .. _`See the Waitress docs`:
    https://docs.pylonsproject.org/projects/waitress/en/stable/
 
-.. index:: pair: web interface; uWSGI
-   single: wsgi; uWSGI
-
-uWSGI Installation
-~~~~~~~~~~~~~~~~~~
-
-For a basic roundup install using uWSGI behind a front end server,
-install uwsgi and the python3 (or python) plugin. Then run::
-
-   uwsgi --http-socket 127.0.0.1:8917 \
-       --plugin python3 --mount=/tracker=wsgi.py \
-       --manage-script-name --callable app
-
-using the same wsgi.py as was used for Gunicorn. If you get path not
-found errors, check the mount option. The /tracker entry must match
-the path used for the [tracker] web value in the tracker's config.ini.
-
 Configure an Email Interface
 ============================
 

From f677b91ed1bee9c69e754ccbe704ff6d17e8f353 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 6 Oct 2025 12:29:16 -0400
Subject: [PATCH 314/398] build: upgrade
 https://github.com/roundup-tracker/roundup/pull/65.patch

---
 .github/workflows/ossf-scorecard.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ossf-scorecard.yml b/.github/workflows/ossf-scorecard.yml
index 28075031e..acfba0063 100644
--- a/.github/workflows/ossf-scorecard.yml
+++ b/.github/workflows/ossf-scorecard.yml
@@ -40,7 +40,7 @@ jobs:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@05b42c624433fc40578a4040d5cf5e36ddca8cde # v5.2.1
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v5.2.1
         with:
           results_file: results.sarif
           results_format: sarif

From 0fe1d65f6db22de26902e2f1af98fa8c96d667b7 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 6 Oct 2025 23:59:23 -0400
Subject: [PATCH 315/398] test: fix version test

---
 test/test_misc.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/test/test_misc.py b/test/test_misc.py
index 931dab43b..0aee93fa9 100644
--- a/test/test_misc.py
+++ b/test/test_misc.py
@@ -106,7 +106,7 @@ def test_Version_Check(self):
 
         # test for valid versions
         from roundup.version_check import VERSION_NEEDED
-        self.assertEqual((2, 7), VERSION_NEEDED)
+        self.assertEqual((3, 7), VERSION_NEEDED)
         del(sys.modules['roundup.version_check'])
 
 
@@ -124,7 +124,7 @@ def test_Version_Check(self):
         sys.stdout = capturedOutput
         from roundup.version_check import VERSION_NEEDED
         sys.stdout = sys.__stdout__
-        self.assertIn("Roundup requires Python 2.7", capturedOutput.getvalue())
+        self.assertIn("Roundup requires Python 3.7", capturedOutput.getvalue())
 
         # reset to valid values for future tests
         sys.exit = real_exit

From c634b7997142c9c00a24e5a348adc0528e797c51 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 9 Oct 2025 13:49:07 -0400
Subject: [PATCH 316/398] doc: update url for irker to point to github.

---
 detectors/irker.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detectors/irker.py b/detectors/irker.py
index 57ce2bfb1..ff330cbbc 100644
--- a/detectors/irker.py
+++ b/detectors/irker.py
@@ -1,6 +1,6 @@
 # This detector sends notification on IRC through an irker daemon
-# (http://www.catb.org/esr/irker/) when issues are created or messages
-#  are added.
+# (https://gitlab.com/esr/irker formerly http://www.catb.org/esr/irker/)
+# when issues are created or messages are added.
 #
 # Written by Ezio Melotti
 #

From bc90fff8526272424f0f6cd01a013b63540d06fd Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sat, 11 Oct 2025 18:18:54 -0400
Subject: [PATCH 317/398] refactor: replace boolean expr with named function
 call

Replace a confusing boolean expression with a the use_cached_tracker()
method call.
---
 roundup/cgi/wsgi_handler.py | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/roundup/cgi/wsgi_handler.py b/roundup/cgi/wsgi_handler.py
index f1b27a36c..bfea660f7 100644
--- a/roundup/cgi/wsgi_handler.py
+++ b/roundup/cgi/wsgi_handler.py
@@ -97,12 +97,16 @@ def __init__(self, home, debug=False, timing=False, lang=None,
         else:
             self.translator = None
 
-        if "cache_tracker" not in self.feature_flags or \
-           self.feature_flags["cache_tracker"] is not False:
+        if self.use_cached_tracker():
             self.tracker = roundup.instance.open(self.home, not self.debug)
         else:
             self.preload()
 
+    def use_cached_tracker(self):
+        return (
+            "cache_tracker" not in self.feature_flags or
+            self.feature_flags["cache_tracker"] is not False)
+
     @gen_trace_id()
     @store_trace_reason("wsgi")
     def __call__(self, environ, start_response):
@@ -135,8 +139,7 @@ def __call__(self, environ, start_response):
         else:
             form = BinaryFieldStorage(fp=environ['wsgi.input'], environ=environ)
 
-        if "cache_tracker" not in self.feature_flags or \
-           self.feature_flags["cache_tracker"] is not False:
+        if self.use_cached_tracker():
             client = self.tracker.Client(self.tracker, request, environ, form,
                                          self.translator)
             try:

From 27281f8df35bf5edb3f8eb2f8a46b186d9744568 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 20 Oct 2025 09:56:47 -0400
Subject: [PATCH 318/398] chore: dependabot update anchore 7.0.0 -> 7.0.2

---
 .github/workflows/anchore.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/anchore.yml b/.github/workflows/anchore.yml
index 6e1c21351..8dcbf3f8d 100644
--- a/.github/workflows/anchore.yml
+++ b/.github/workflows/anchore.yml
@@ -43,7 +43,7 @@ jobs:
     - name: List the Docker image
       run: docker image ls
     - name: Run the Anchore scan action itself with GitHub Advanced Security code scanning integration enabled
-      uses: anchore/scan-action@f6601287cdb1efc985d6b765bbf99cb4c0ac29d8 # 7.0.0
+      uses: anchore/scan-action@a5605eb0943e46279cb4fbd9d44297355d3520ab # 7.0.2
       id: scan
       with:
         image: "localbuild/testimage:latest"

From 3671c2f54de7f307b6df72c24448595bdca8b9bc Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Fri, 31 Oct 2025 20:55:01 -0400
Subject: [PATCH 319/398] fix: replace localhost with ip address in case
 localhost is ipv6 addr??

Norbert had an issue with his docker container where the healthcheck
was timing out/failing. He diagnosed it as a ipv6 address bound to
localhost.

Not sure if this is the right fix. Might be better to determine where
localhost is bound (V4 or V6 address) but I don't have an environment
I can test with.
---
 CHANGES.txt                        | 4 +++-
 scripts/Docker/roundup_healthcheck | 5 ++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index 07a800f50..2422c6277 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -33,7 +33,9 @@ Fixed:
   configuration. (John Rouillard)
 - fix bogus javascript emitted by user_src_input macro. (John
   Rouillard)
-  
+- replaced hostname localhost with 127.0.0.1 in docker healthcheck
+  script. Found/patch by Norbert Schlemmer. (John Rouillard)
+
 Features:
 
 - add support for authorized changes. User can be prompted to enter
diff --git a/scripts/Docker/roundup_healthcheck b/scripts/Docker/roundup_healthcheck
index dfa9dc255..426d66497 100755
--- a/scripts/Docker/roundup_healthcheck
+++ b/scripts/Docker/roundup_healthcheck
@@ -1,7 +1,10 @@
 #! /bin/sh
 
+# change this if you are not using 
+localhost=127.0.0.1
+
 # if there are multiple trackers, d=demo t=tracker ...
 # returns last one for testing that server is up. Does not test
 # each tracker.
 tracker=$(ps -ef | sed -ne '/roundup-server/s/^.*\s\(\w*\)=.*$/\1/p')
-wget -q -O /dev/null --proxy off --no-verbose http://localhost:8080/"${tracker:-demo}"/
+wget -q -O /dev/null --proxy off --no-verbose http://$localhost:8080/"${tracker:-demo}"/

From dffd8f455b4c5cc57356eb27db093729bd8ee811 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Fri, 31 Oct 2025 20:57:26 -0400
Subject: [PATCH 320/398] chore: dependabot upgrade anchore scan from 7.0.2 to
 7.1.0

---
 .github/workflows/anchore.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/anchore.yml b/.github/workflows/anchore.yml
index 8dcbf3f8d..45e4b05db 100644
--- a/.github/workflows/anchore.yml
+++ b/.github/workflows/anchore.yml
@@ -43,7 +43,7 @@ jobs:
     - name: List the Docker image
       run: docker image ls
     - name: Run the Anchore scan action itself with GitHub Advanced Security code scanning integration enabled
-      uses: anchore/scan-action@a5605eb0943e46279cb4fbd9d44297355d3520ab # 7.0.2
+      uses: anchore/scan-action@568b89d27fc18c60e56937bff480c91c772cd993 # 7.1.0
       id: scan
       with:
         image: "localbuild/testimage:latest"

From ba54d0f95f428bce8368de0b3604ad32c1bab293 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Fri, 31 Oct 2025 20:58:31 -0400
Subject: [PATCH 321/398] chore: dependabot upgrade upload-artifact from 4.6.2
 to 5.0.0 pull #68

---
 .github/workflows/ossf-scorecard.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ossf-scorecard.yml b/.github/workflows/ossf-scorecard.yml
index acfba0063..a1fc81dcc 100644
--- a/.github/workflows/ossf-scorecard.yml
+++ b/.github/workflows/ossf-scorecard.yml
@@ -62,7 +62,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: SARIF file
           path: results.sarif

From 998cc4c5837674d0ac120aeab84ec546cfadd8c4 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 2 Nov 2025 20:38:12 -0500
Subject: [PATCH 322/398] chore: update ci test to include 3.14/3.14t drop 3.12

Drop 3.12 to reduce number of runs/usage.
Keep 3.10 IIRC there were some major changes in that version so it's
a good canary.

Swap out 3.13t for 3.14t.
---
 .github/workflows/ci-test.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index a5498a88c..bb9890354 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -52,14 +52,14 @@ jobs:
         # Run in all these versions of Python
         python-version:
           # - "2.7"
+          - "3.14"
           - "3.13"
-          # - 3.6 run via include on ubuntu 20.04
-          # - "3.7"
+          # - "3.7" run via include for ubuntu-22.04
           # - "3.8" run via include for ubuntu-22.04
           # - "3.9"
           - "3.10"
           # - "3.11"
-          - "3.12"
+          # - "3.12"
 
         # use for multiple os or ubuntu versions
         #os: [ubuntu-latest, macos-latest, windows-latest]
@@ -74,7 +74,7 @@ jobs:
             # example: if this version fails the jobs still succeeds
             # allow-prereleases in setup-python allows alpha/beta
             # releases to run. Also allow free threaded python testing
-            - python-version: 3.13t
+            - python-version: 3.14t
               os: ubuntu-24.04
               experimental: true
             

From 410691d6540eafb4cb084ffa01fa19270ea8fcad Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 2 Nov 2025 21:10:28 -0500
Subject: [PATCH 323/398] chore: update base image to python 3.14 alpine
 release.

3-alpine has changed to python 3.14.
---
 scripts/Docker/Dockerfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/scripts/Docker/Dockerfile b/scripts/Docker/Dockerfile
index b3424cd1b..0567793ed 100644
--- a/scripts/Docker/Dockerfile
+++ b/scripts/Docker/Dockerfile
@@ -26,7 +26,7 @@ ARG source=local
 # Note this is the index digest for the image, not the manifest digest.
 # The index digest is shared across archetectures (amd64, arm64 etc.)
 # while the manifest digest is unique per platform/arch.
-ARG SHA256=9ba6d8cbebf0fb6546ae71f2a1c14f6ffd2fdab83af7fa5669734ef30ad48844
+ARG SHA256=8373231e1e906ddfb457748bfc032c4c06ada8c759b7b62d9c73ec2a3c56e710
 
 # Set to any non-empty value to enable shell debugging for troubleshooting
 ARG VERBOSE=
@@ -37,7 +37,7 @@ ARG appdir=/usr/src/app
 # Python version as a.b Used as path component for 
 # installation directory and COPY from install dir
 # in second build stage.
-ARG pythonversion=3.13
+ARG pythonversion=3.14
 
 #FROM python:3-alpine via SHA256 sum
 FROM python@sha256:$SHA256 AS build 

From 6e43272e4e09c331c234c99431a1027b054ce21d Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 3 Nov 2025 00:13:04 -0500
Subject: [PATCH 324/398] refactor: change some classes to use __slots__

Speed up access to and reduce size of some low level classes. A few
classes in security.py, rest.py are heavily used. But for all, it
prevents adding random properties to lower level classes that people
shouldn't be mucking with. While doing this I found some test cases
accessing an invalid property name and this change caused the cases to
crash.

admin.py:

  Use new method Role.props_dict() and Permission.props_dict() where
  original code just referenced __dict__ when printing Role/Permission.

mlink_expr.py:

  Add slots to multiple classes.

  Classes Binary and Unary set real properties/attributes. Classes that
  inherit from them (Equals, Empty, Not, Or, And) define empty slots
  tuple to eliminate need for __dict__.

  Class Expression also gets a slot.

rate_limit.py:

  RateLimit and Gcra classes get slots.

  A couple of pep8 fixes: sort imports, remove trailing spaces on a
  line, remove unused noqa comment.

rest.py:

  Add slots to class SimulateFieldStorageFromJson and FsValue
  classes. The memory savings from this could be useful as well as
  speedier access to the attributes.

security.py:

  Add slots to Permission class. To prevent conflict between slot
  limit_perm_to_props_only and the class variable of the same name,
  rename the class variable to limit_perm_to_props_only_default.
  Also define method props_dict() to allow other code to get a dict to
  iterate over when checking permissions.

  Add slots to class Role along with props_dict() method.

  Add slots to class Security. Also have to add explicit __dict__ slot
  to support test override of the hasPermission() method. Add
  props_dict() method, currently unused, but added for symmetry.

support.py:

  TruthDict and PrioList gets slots.

test/test_cgi.py:

  Fix incorrect setting of permission property. Was setting
  permissions. So testing may not have been doing what we thought it
  was. Multiple places found with this typo.

  Remove setting of permissions in some places where it should
  have no effect on the test and looks like it was just copypasta.

test/test_xmlrpc.py

  Remove setting of permissions in some places where it should
  have no effect on the test and looks like it was just copypasta.
---
 CHANGES.txt           |  4 +++-
 roundup/admin.py      |  6 +++---
 roundup/mlink_expr.py | 16 ++++++++++++++++
 roundup/rate_limit.py | 12 +++++++++---
 roundup/rest.py       |  9 +++++++++
 roundup/security.py   | 38 ++++++++++++++++++++++++++++++++++----
 roundup/support.py    |  6 ++++++
 test/test_cgi.py      |  5 ++---
 test/test_xmlrpc.py   |  1 -
 9 files changed, 82 insertions(+), 15 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index 2422c6277..fe133a2e7 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -35,7 +35,9 @@ Fixed:
   Rouillard)
 - replaced hostname localhost with 127.0.0.1 in docker healthcheck
   script. Found/patch by Norbert Schlemmer. (John Rouillard)
-
+- change some internal classes to use __slots__ for hopefully a small
+  performance improvement. (John Rouillard)
+  
 Features:
 
 - add support for authorized changes. User can be prompted to enter
diff --git a/roundup/admin.py b/roundup/admin.py
index 737afcbe5..142506943 100644
--- a/roundup/admin.py
+++ b/roundup/admin.py
@@ -250,7 +250,7 @@ def help_commands(self):
                 if seq in h:
                     commands.append(' ' + h.split(seq, 1)[1].lstrip())
                     break
-                    
+
         commands.sort()
         commands.append(_(
 """Commands may be abbreviated as long as the abbreviation
@@ -2084,9 +2084,9 @@ def do_security(self, args):
                 sys.stdout.write(_('New Email users get the Role "%(role)s"\n') % locals())
         roles.sort()
         for _rolename, role in roles:
-            sys.stdout.write(_('Role "%(name)s":\n') % role.__dict__)
+            sys.stdout.write(_('Role "%(name)s":\n') % role.props_dict())
             for permission in role.permission_list():
-                d = permission.__dict__
+                d = permission.props_dict()
                 if permission.klass:
                     if permission.properties:
                         sys.stdout.write(_(
diff --git a/roundup/mlink_expr.py b/roundup/mlink_expr.py
index 197921791..0686e2da1 100644
--- a/roundup/mlink_expr.py
+++ b/roundup/mlink_expr.py
@@ -60,6 +60,8 @@ def __repr__(self):
 
 class Binary:
 
+    __slots__ = ("x", "y")
+
     def __init__(self, x, y):
         self.x = x
         self.y = y
@@ -71,6 +73,8 @@ def visit(self, visitor):
 
 class Unary:
 
+    __slots__ = ("x",)
+
     def __init__(self, x):
         self.x = x
 
@@ -83,6 +87,8 @@ def visit(self, visitor):
 
 class Equals(Unary):
 
+    __slots__ = ()
+
     def evaluate(self, v):
         return self.x in v
 
@@ -95,6 +101,8 @@ def __repr__(self):
 
 class Empty(Unary):
 
+    __slots__ = ()
+
     def evaluate(self, v):
         return not v
 
@@ -107,6 +115,8 @@ def __repr__(self):
 
 class Not(Unary):
 
+    __slots__ = ()
+
     def evaluate(self, v):
         return not self.x.evaluate(v)
 
@@ -119,6 +129,8 @@ def __repr__(self):
 
 class Or(Binary):
 
+    __slots__ = ()
+
     def evaluate(self, v):
         return self.x.evaluate(v) or self.y.evaluate(v)
 
@@ -133,6 +145,8 @@ def __repr__(self):
 
 class And(Binary):
 
+    __slots__ = ()
+
     def evaluate(self, v):
         return self.x.evaluate(v) and self.y.evaluate(v)
 
@@ -185,6 +199,8 @@ def compile_expression(opcodes):
 
 class Expression:
 
+    __slots__ = ("evaluate",)
+
     def __init__(self, v, is_link=False):
         try:
             opcodes = [int(x) for x in v]
diff --git a/roundup/rate_limit.py b/roundup/rate_limit.py
index facf1fc23..fec232180 100644
--- a/roundup/rate_limit.py
+++ b/roundup/rate_limit.py
@@ -4,7 +4,7 @@
 # set/get_tat and marshaling as string, support for testonly
 # and status method.
 
-from datetime import timedelta, datetime
+from datetime import datetime, timedelta
 
 try:
     # used by python 3.11 and newer use tz aware dates
@@ -19,12 +19,15 @@
     dt_epoch = datetime(1970, 1, 1)
     def fromisoformat(date):
         # only for naive dates
-        return datetime.strptime(date, "%Y-%m-%dT%H:%M:%S.%f")        
+        return datetime.strptime(date, "%Y-%m-%dT%H:%M:%S.%f")
 
 from roundup.anypy.datetime_ import utcnow
 
 
 class RateLimit:  # pylint: disable=too-few-public-methods
+
+    __slots__ = ("count", "period")
+
     def __init__(self, count, period):
         self.count = count
         self.period = period
@@ -35,6 +38,9 @@ def inverse(self):
 
 
 class Gcra:
+
+    __slots__ = ("memory",)
+
     def __init__(self):
         self.memory = {}
 
@@ -124,7 +130,7 @@ def status(self, key, limit):
             # One item is dequeued every limit.inverse seconds.
             ret['Retry-After'] = str(int(limit.inverse))
             ret['Retry-After-Timestamp'] = "%s" % \
-                    (now + timedelta(seconds=limit.inverse))  # noqa: E127
+                    (now + timedelta(seconds=limit.inverse))
         else:
             # if we are not rejected, the user can post another
             # attempt immediately.
diff --git a/roundup/rest.py b/roundup/rest.py
index 80078dcc2..9de60b1ae 100644
--- a/roundup/rest.py
+++ b/roundup/rest.py
@@ -426,6 +426,9 @@ def execute(cls, instance, path, method, input_payload):
                 func = func_obj['func']
 
                 # zip the varlist into a dictionary, and pass it to the caller
+                # FIXME: 3.10 is min version- add strict=True to zip
+                # also wrap with try/except ValueError if different number of
+                # items (which should never happen).
                 args = dict(zip(list_vars, match_obj.groups()))
                 args['input_payload'] = input_payload
                 return func(instance, **args)
@@ -2741,6 +2744,9 @@ class SimulateFieldStorageFromJson():
     string.
 
     '''
+
+    __slots__ = ("json_dict", "value")
+
     def __init__(self, json_string):
         '''Parse the json string into an internal dict.
 
@@ -2764,6 +2770,9 @@ def raise_error_on_constant(x):
             raise ValueError(e.args[0] + ". JSON is: " + json_string)
 
     class FsValue:
+
+        __slots__ = ("name", "value")
+
         '''Class that does nothing but response to a .value property '''
         def __init__(self, name, val):
             self.name = u2s(name)
diff --git a/roundup/security.py b/roundup/security.py
index 09555ae2b..3e5afb597 100644
--- a/roundup/security.py
+++ b/roundup/security.py
@@ -18,6 +18,7 @@ class Permission:
         - properties (optional)
         - check function (optional)
         - props_only (optional, internal field is limit_perm_to_props_only)
+          default value taken from Permission.limit_perm_to_props_only_default.
         - filter function (optional) returns filter arguments for
           determining which records are visible by the user. The filter
           function comes into play when determining if a set of nodes
@@ -58,7 +59,18 @@ class Permission:
         with a True or False value.
     '''
 
-    limit_perm_to_props_only = False
+    __slots__ = (
+        "_properties_dict",
+        "check",
+        "check_version",
+        "description",
+        "filter",
+        "klass",
+        "limit_perm_to_props_only",
+        "name",
+        "properties")
+
+    limit_perm_to_props_only_default = False
 
     def __init__(self, name='', description='', klass=None,
                  properties=None, check=None, props_only=None, filter=None):
@@ -80,7 +92,7 @@ def __init__(self, name='', description='', klass=None,
             # a == b will be true.
             if props_only is None:
                 self.limit_perm_to_props_only = \
-                                Permission.limit_perm_to_props_only
+                                Permission.limit_perm_to_props_only_default
             else:
                 # see note on use of bool() in set_props_only_default()
                 self.limit_perm_to_props_only = bool(props_only)
@@ -123,6 +135,9 @@ def check(db, userid, itemid):
 
         return check
 
+    def props_dict(self):
+        return {name: getattr(self, name) for name in self.__slots__}
+
     def test(self, db, permission, classname, property, userid, itemid):
         ''' Test permissions 5 args:
             permission - string like Edit, Register etc. Required, no wildcard.
@@ -222,6 +237,9 @@ class Role:
         - description
         - permissions
     '''
+
+    __slots__ = ("_permissions", "description", "name")
+
     def __init__(self, name='', description='', permissions=None):
         self.name = name.lower()
         self.description = description
@@ -301,6 +319,9 @@ def permission_list(self):
         perm_list.sort(key=lambda x: (x.klass or '', x.name))
         return perm_list
 
+    def props_dict(self):
+        return {name: getattr(self, name) for name in self.__slots__}
+
     def searchable(self, classname, propname):
         for perm_name in 'View', 'Search':
             # Only permissions without a check method
@@ -321,6 +342,12 @@ def searchable(self, classname, propname):
 
 
 class Security:
+
+    # __dict__ is needed to allow mocking of db.security.hasPermission
+    # in test/test_templating.py. Define slots for properties used in
+    # production to increase speed.
+    __slots__ = ("__dict__", "db", "permission", "role")
+
     def __init__(self, db):
         ''' Initialise the permission and role classes, and add in the
             base roles (for admin user).
@@ -452,6 +479,9 @@ def is_filterable(self, permission, userid, classname):
                 return False
         return True
 
+    def props_dict(self):
+        return {name: getattr(self, name) for name in self.__slots__}
+
     def roleHasSearchPermission(self, classname, property, *rolenames):
         """ For each of the given roles, check the permissions.
             Property can be a transitive property.
@@ -544,11 +574,11 @@ def set_props_only_default(self, props_only=None):
             # will be compared as part of tuple == tuple and
             # (3,) == (True,) is False even though 3 is a True value
             # in a boolean context. So use bool() to coerce value.
-            Permission.limit_perm_to_props_only = \
+            Permission.limit_perm_to_props_only_default = \
                                     bool(props_only)
 
     def get_props_only_default(self):
-        return Permission.limit_perm_to_props_only
+        return Permission.limit_perm_to_props_only_default
 
     def addPermissionToRole(self, rolename, permission, classname=None,
                             properties=None, check=None, props_only=None):
diff --git a/roundup/support.py b/roundup/support.py
index f52d7bca5..80e999981 100644
--- a/roundup/support.py
+++ b/roundup/support.py
@@ -11,6 +11,9 @@
 class TruthDict:
     '''Returns True for valid keys, False for others.
     '''
+
+    __slots__ = ('keys',)
+
     def __init__(self, keys):
         if keys:
             self.keys = {}
@@ -49,6 +52,9 @@ class PrioList:
     7
 
     '''
+
+    __slots__ = ('key', 'list', 'sorted')
+
     def __init__(self, key=None):
         self.list = []
         self.key = key
diff --git a/test/test_cgi.py b/test/test_cgi.py
index 73f6ca71d..b954b63b8 100644
--- a/test/test_cgi.py
+++ b/test/test_cgi.py
@@ -1973,7 +1973,7 @@ def testClassPermission(self):
             actions.EditItemAction(cl).handle)
 
     def testCheckAndPropertyPermission(self):
-        self.db.security.permissions = {}
+        self.db.security.permission = {}
         def own_record(db, userid, itemid):
             return userid == itemid
         p = self.db.security.addPermission(name='Edit', klass='user',
@@ -2004,7 +2004,7 @@ def own_record(db, userid, itemid):
     def testCreatePermission(self):
         # this checks if we properly differentiate between create and
         # edit permissions
-        self.db.security.permissions = {}
+        self.db.security.permission = {}
         self.db.security.addRole(name='UserAdd')
         # Don't allow roles
         p = self.db.security.addPermission(name='Create', klass='user',
@@ -2061,7 +2061,6 @@ def testCreatePermission(self):
 
     def testSearchPermission(self):
         # this checks if we properly check for search permissions
-        self.db.security.permissions = {}
         self.db.security.addRole(name='User')
         self.db.security.addRole(name='Project')
         self.db.security.addPermissionToRole('User', 'Web Access')
diff --git a/test/test_xmlrpc.py b/test/test_xmlrpc.py
index 48464f8f8..ae8a16926 100644
--- a/test/test_xmlrpc.py
+++ b/test/test_xmlrpc.py
@@ -228,7 +228,6 @@ def testAuthAllowedCreate(self):
 
     def testAuthFilter(self):
         # this checks if we properly check for search permissions
-        self.db.security.permissions = {}
         # self.db.security.set_props_only_default(props_only=False)
         self.db.security.addRole(name='User')
         self.db.security.addRole(name='Project')

From a492c975be6e2cfa176f8731110e2ca0f83d21f7 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 3 Nov 2025 12:42:48 -0500
Subject: [PATCH 325/398] refactor: mke Date class use __slots__

This should be the last slotting for a while.

Instrumenting roundup-admin and the Client class (running under the
waitress wsgi server) shows object count output similar to:

[(('IssueClass', 'roundup.backends.back_anydbm'), 128),
 (('Session', 'roundup.cgi.client'), 128),
 (('Mailer', 'roundup.mailer'), 128),
 (('Password', 'roundup.password'), 220),
 (('LiberalCookie', 'roundup.cgi.client'), 241),
 (('Database', 'roundup.backends.back_anydbm'), 256),
 (('FileClass', 'roundup.backends.back_anydbm'), 256),
 (('Number', 'roundup.hyperdb'), 256),
 (('PythonExpr', 'roundup.cgi.PageTemplates.PythonExpr'), 274),
 (('Proptree', 'roundup.hyperdb'), 276),
 (('Role', 'roundup.security'), 384),
 (('PathExpr', 'roundup.cgi.PageTemplates.Expressions'), 630),
 (('Class', 'roundup.backends.back_anydbm'), 640),
 (('SubPathExpr', 'roundup.cgi.PageTemplates.Expressions'), 645),
 (('Date', 'roundup.hyperdb'), 678),
 (('Link', 'roundup.hyperdb'), 934),
 (('Multilink', 'roundup.hyperdb'), 1024),
 (('Permission', 'roundup.security'), 6784),
 (('TruthDict', 'roundup.support'), 6795),
 (('PrioList', 'roundup.support'), 8192),
 (('Date', 'roundup.date'), 8610)]

where each row is a tuple of (class, module) and the count of
the number of object of that class sorted by number of objects.

I think the major classes that meet the criteria below are all
__slotted__ at this point:

  Is a native roundup class and not a subclass (e.g. LiberalCookie is
     subclass of http.cookies.SimpleCookie)
  Does not touch the database (not hyperdb or backend)
  Is not part of templating
  Is not a top level class that may need runtime attributes/methods
     overwritten e.g Session/Mailer/Password

Some of the excluded classes can be slotted, but they are not low
hanging fruit and requires more class heirarchy changes or more
extensive testing.
---
 roundup/date.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/roundup/date.py b/roundup/date.py
index 6515ee320..4bcd90ab9 100644
--- a/roundup/date.py
+++ b/roundup/date.py
@@ -324,6 +324,9 @@ class Date:
         >>> test_fin(u)
     '''
 
+    __slots__ = ("year", "month", "day", "hour", "minute", "second",
+                 "_", "ngettext", "translator")
+    
     def __init__(self, spec='.', offset=0, add_granularity=False,
                  translator=i18n):
         """Construct a date given a specification and a time zone offset.

From fe5f88f9821f6cc107964ff123a22d86a12a33ed Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Fri, 7 Nov 2025 22:14:01 -0500
Subject: [PATCH 326/398] doc: spelling correction.

---
 doc/reference.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/reference.txt b/doc/reference.txt
index 5d26493fa..eb0759b7b 100644
--- a/doc/reference.txt
+++ b/doc/reference.txt
@@ -1307,7 +1307,7 @@ is added to the db object. As a result, the ``hasattr`` call shown
 above will return True and the Reauth exception is not raised. (Note
 that the value of the ``reauth_done`` attribute is True, so
 ``getattr(db, "reauth_done", False)`` will return True when reauth is
-done and the defaul value of False if the attribute is missing. If the
+done and the defile value of False if the attribute is missing. If the
 default is not set, `getattr` raises an ``AttributeError`` which might
 be useful for flow control.)
 

From 65b50f32ebb3923793a322ab73ee014752ef8e71 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sat, 8 Nov 2025 00:40:39 -0500
Subject: [PATCH 327/398] doc: removed line referencing API change in 1.6

Removed sentence:

  This may be fixed in Roundup 1.6 by introducing
  ``init_web(client)`` callback or a more flexible extension point
  mechanism.

as I think RegisterAction can be used for both cgi/html
interface (action inherits from roundup.cgi.actions.Action) and
rest/xmlrpc interface (action inherits from roundup.actions.Action).
---
 doc/reference.txt | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/doc/reference.txt b/doc/reference.txt
index eb0759b7b..8fe8acb0e 100644
--- a/doc/reference.txt
+++ b/doc/reference.txt
@@ -1368,10 +1368,8 @@ from this directory, at which point it calls ``init(instance)`` from
 each file supplying itself as a first argument.
 
 Note that at this point web interface is not loaded, but
-extensions still can register actions for it in the tracker
-instance. This may be fixed in Roundup 1.6 by introducing
-``init_web(client)`` callback or a more flexible extension point
-mechanism.
+extensions can register actions for it in the tracker
+instance.
 
 * ``instance.registerUtil`` is used for adding `templating utilities`_
   (see `adding a time log to your issues
@@ -1384,8 +1382,9 @@ mechanism.
 
 * ``instance.registerAction`` is used to add more actions to the
   instance and to web interface. See `Defining new web actions`_
-  for details.  Generic action can be added by inheriting from
-  ``action.Action`` instead of ``cgi.action.Action``.
+  for details.  Generic action (used by xmlrpc or rest interfaces) can
+  be added by inheriting from ``action.Action`` instead of
+  ``cgi.action.Action``.
 
 .. _interfaces.py:
 .. _modifying the core of Roundup:

From f67cf64157930438094cc0e4f88f0df2f1cb72e8 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sat, 8 Nov 2025 14:03:42 -0500
Subject: [PATCH 328/398] doc: update styles to WCAG AAA; add accessibility
 statement; reword

Update to AA WCAG 2.2 contrast:
  in note admonitions, link contrast was too low
  in python code examples, comments were too low contrast

Added accessability statement. It is only in the tree and not linked
to the website currently.

Updated install directions for future 2.6 release. Updated paragraph
to make it clearer.
---
 doc/_static/style.css                         | 10 +++
 .../accessibility-statement_2025-10-08.html   | 75 +++++++++++++++++++
 website/www/_static/style.css                 | 10 +++
 website/www/index.txt                         |  9 ++-
 4 files changed, 100 insertions(+), 4 deletions(-)
 create mode 100644 doc/html_extra/accessibility-statement_2025-10-08.html

diff --git a/doc/_static/style.css b/doc/_static/style.css
index ef5215caf..60f673a2c 100644
--- a/doc/_static/style.css
+++ b/doc/_static/style.css
@@ -186,6 +186,8 @@ div[class^=highlight-], div[class^=highlight-] * { width:
 /* style */
 
 :link { color: rgb(220,0,0); text-decoration: none;}
+/* improve contrast to AA */
+.admonition.note :link { color: rgb(170,1,1); text-decoration: none;}
 :link:hover {
     text-decoration: underline solid clamp(1px, .3ex, 4px);
     text-underline-position: under;
@@ -438,6 +440,14 @@ dd > ul:first-child {
     white-space: break-spaces;
 }*/
 
+/* improve color contrast to AA against yellowish highlight bg */
+div.highlight .c1 {
+    color: rgb(3,114,3);
+}
+div.highlight .na {
+    color: rgb(220,2,2);
+}
+
 /* Forcing wrap in a pre leads to some confusing line breaks.
    Use a horizontal scroll. Indicate the scroll by using
    rounded scroll shadows.
diff --git a/doc/html_extra/accessibility-statement_2025-10-08.html b/doc/html_extra/accessibility-statement_2025-10-08.html
new file mode 100644
index 000000000..f4e67e004
--- /dev/null
+++ b/doc/html_extra/accessibility-statement_2025-10-08.html
@@ -0,0 +1,75 @@
+<!DOCTYPE html>
+<h2>Accessibility Statement for <span class="basic-information website-name">Roundup Issue Tracker Main Website</span></h2>
+<p>
+	This is an accessibility statement from <span class="basic-information organization-name">Roundup Issue Tracker</span>.
+</p>
+<h3>Conformance status</h3>
+<p>
+	The <a href="https://www.w3.org/WAI/standards-guidelines/wcag/">Web Content Accessibility Guidelines (WCAG)</a> defines requirements for designers and developers to improve accessibility for people with disabilities. It defines three levels of conformance: Level A, Level AA, and Level AAA.
+	<span class="basic-information website-name">Roundup Issue Tracker Main Website</span>
+	is
+	<span class="basic-information conformance-status" data-printfilter="lowercase">partially conformant</span>
+	with
+	<span class="basic-information conformance-standard"><span data-negate="">WCAG 2.2 level AA</span>.</span>
+	<span>
+	<span class="basic-information conformance-status">Partially conformant</span>
+	means that
+	<span class="basic-information conformance-meaning">some parts of the content do not fully conform to the accessibility standard</span>.
+</span>
+</p>
+<h3>Feedback</h3>
+<p>
+	We welcome your feedback on the accessibility of
+	<span class="basic-information website-name">Roundup Issue Tracker Main Website</span>.
+	Please let us know if you encounter accessibility barriers on
+	<span class="basic-information website-name">Roundup Issue Tracker Main Website</span>:
+</p>
+<ul class="basic-information feedback h-card">
+	<li>
+	E-mail:
+	<a class="email u-email" href="mailto:roundup-users@lists.sourceforge.net">roundup-users@lists.sourceforge.net</a>
+</li>
+	<li class="contact-other p-note">See https://www.roundup-tracker.org/contact.html for more.</li>
+</ul>
+<h3>Technical specifications</h3>
+<p>
+	Accessibility of
+	<span class="basic-information website-name">Roundup Issue Tracker Main Website</span>
+	relies on the following technologies to work with the particular combination of web browser and any assistive technologies or plugins installed on your computer:
+</p>
+<ul class="technical-information technologies-used">
+	<li>HTML</li>
+	<li>WAI-ARIA</li>
+	<li>CSS</li>
+</ul>
+<p>These technologies are relied upon for conformance with the accessibility standards used.</p>
+<h3>Limitations and alternatives</h3>
+<p>
+	Despite our best efforts to ensure accessibility of
+	<span class="basic-information website-name">Roundup Issue Tracker Main Website</span> , there may be some limitations. Below is a description of known limitations, and potential solutions. Please contact us if you observe an issue not listed below.
+</p>
+<p>
+	Known limitations for
+	<span class="basic-information website-name">Roundup Issue Tracker Main Website</span>:
+</p>
+<ol class="technical-information accessibility-limitations">
+	<li><strong>Search input does not have a visible label</strong>: The visible label is in the [Search] button next to the input but it not tied to the input directly. because The button acts as a visible label from proximity. The input has an aria-label describing the input.</li>
+	<li><strong>Multi-language tab panel examples do not scroll</strong>: Multi-language example panels require two tabs to get to the element that will scroll. The Sphinx tab extension is used to show different language examples for the same item. It adds a focusable container around the example container. So the outer container must be tabbed/focused through to scroll the example when using the keyboard.</li>
+</ol>
+<h3>Assessment approach</h3>
+<p>
+	<span class="basic-information organization-name">Roundup Issue Tracker</span>
+	assessed the accessibility of
+	<span class="basic-information website-name">Roundup Issue Tracker Main Website</span>
+	by the following approaches:
+</p>
+<ul class="technical-information assessment-approaches">
+	<li>Self-evaluation</li>
+</ul>
+<hr noshade="noshade">
+<h3>Date</h3>
+<p>
+	This statement was created on
+	<span class="basic-information statement-created-date">8 November 2025</span>
+	using the <a href="https://www.w3.org/WAI/planning/statements/">W3C Accessibility Statement Generator Tool</a>.
+</p>
diff --git a/website/www/_static/style.css b/website/www/_static/style.css
index aa319c4b2..bcf510116 100644
--- a/website/www/_static/style.css
+++ b/website/www/_static/style.css
@@ -186,6 +186,8 @@ div[class^=highlight-], div[class^=highlight-] * { width:
 /* style */
 
 :link { color: rgb(220,0,0); text-decoration: none;}
+/* improve contrast to AA */
+.admonition.note :link { color: rgb(170,1,1); text-decoration: none;}
 :link:hover {
     text-decoration: underline solid clamp(1px, .3ex, 4px);
     text-underline-position: under;
@@ -438,6 +440,14 @@ dd > ul:first-child {
     white-space: break-spaces;
 }*/
 
+/* improve color contrast to AA against yellowish highlight bg */
+div.highlight .c1 {
+    color: rgb(3,114,3);
+}
+div.highlight .na {
+    color: rgb(220,2,2);
+}
+
 /* Forcing wrap in a pre leads to some confusing line breaks.
    Use a horizontal scroll. Indicate the scroll by using
    rounded scroll shadows.
diff --git a/website/www/index.txt b/website/www/index.txt
index 6173f1312..9906bcb80 100644
--- a/website/www/index.txt
+++ b/website/www/index.txt
@@ -197,17 +197,18 @@ install Roundup. After you've unpacked the source, just run "``python
 demo.py``" and load up the URL it prints out!
 
 Follow the source gratification mode with these steps (change the
-``-2.4.0`` version identifier to match your downloaded file).
+``-2.6.0`` version identifier to match the version of Roundup you want
+to use).
 
 1. ``python3 -m pip download roundup``
-2. ``tar -xzvf roundup-2.4.0.tar.gz``
+2. ``tar -xzvf roundup-2.6.0.tar.gz``
 
    * if you don't have a tar command (e.g windows), use::
 
-       python -c "import tarfile, sys; tarfile.open(sys.argv[1]).extractall();" roundup-2.4.0.tar.gz
+       python -c "import tarfile, sys; tarfile.open(sys.argv[1]).extractall();" roundup-2.6.0.tar.gz
 
 
-3. ``cd roundup-2.4.0``
+3. ``cd roundup-2.6.0``
 4. ``python3 demo.py``
 
 (The source download can also be used to `create a custom Docker

From 7ef5b13ddcffb07d916ed2cb3ad3a2989bd41829 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 12 Nov 2025 22:28:16 -0500
Subject: [PATCH 329/398] doc: add docs for producing jsonl formatted output

---
 doc/admin_guide.txt | 50 ++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 45 insertions(+), 5 deletions(-)

diff --git a/doc/admin_guide.txt b/doc/admin_guide.txt
index a6730bbfd..69c77f47c 100644
--- a/doc/admin_guide.txt
+++ b/doc/admin_guide.txt
@@ -350,10 +350,19 @@ The config below works with the `Waitress wsgi server
 roundup.wsgi channel. It also controls the `TransLogger
 middleware <https://github.com/pasteorg/paste>`_ configured to
 use roundup.wsgi.translogger, to produce httpd style combined
-logs. The log file is specified relative to the current working
+logs.
+
+The log file is specified relative to the current working
 directory not the tracker home. The tracker home is the
-subdirectory demo under the current working directory. The
-commented config is::
+subdirectory demo under the current working directory.
+
+The config also expects the ``python-json-logger`` package to be
+installed so that it can produce a jsonl (json line) formatted
+output log file. This format is useful for sending to log
+management/observability platforms like elasticsearch, splunk,
+logly, or honeycomb.
+
+The commented config is::
 
   {
     "version": 1,   // only supported version
@@ -364,6 +373,28 @@ commented config is::
       "standard": {
         "format": "%(asctime)s %(trace_id)s %(levelname)s %(name)s:%(module)s %(msg)s"
       },
+      // Used to dump all log requests in jsonl format.
+      // Each json object is on one line. Can be pretty printed
+      // using:
+      //    python -m json.tool --json-lines --sort-keys < roundup.json.log
+      //    jq --slurp --sort-keys . < roundup.json.log
+      // requires that you pip install python-json-logger
+      // * does not report the fields in reserved_attrs
+      // * example to remap a field in the log to traceID in
+      //   the output json. (note trace_id_eg is not defined by
+      //   logging
+      // * also adds the env atribute to json with the value of demo
+      "json": {
+	"()": "pythonjsonlogger.json.JsonFormatter",
+	"reserved_attrs": ["ROUNDUP_CONTEXT_FILTER_CALLED",
+			   "msg", "pct_char", "relativeCreated"],
+	"rename_fields": {
+	  "trace_id_eg": "traceID"
+	},
+	"static_fields": {
+	  "env": "demo"
+	}
+      },
       // used for waitress wsgi server to produce httpd style logs
       "http": {
 	"format": "%(message)s %(trace_id)"
@@ -385,6 +416,13 @@ commented config is::
 	"class": "logging.FileHandler",
 	"filename": "demo/roundup.log"
       },
+      // handler for json output log file
+      "roundup_json": {
+	"level": "DEBUG",        // "DEBUG",
+	"formatter": "json",
+	"class": "logging.FileHandler",
+	"filename": "demo/roundup.json.log"
+      },
       // print to stdout - fall through for other logging
       "default": {
 	"level": "DEBUG",
@@ -396,7 +434,8 @@ commented config is::
     "loggers": {
       "": {
 	"handlers": [
-	  "default"
+	  "default",
+	  "roundup_json"    // add json formatted logging
 	],
 	"level": "DEBUG",
 	"propagate": false
@@ -404,7 +443,8 @@ commented config is::
       // used by roundup.* loggers
       "roundup": {
 	"handlers": [
-	  "roundup"
+	  "roundup",
+	  "roundup_json"
 	],
 	"level": "DEBUG",
 	"propagate": false   // note pytest testing with caplog requires

From 5c79282f52b53a9f7cf6e8bf4d1f8413befd3156 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sat, 15 Nov 2025 16:59:24 -0500
Subject: [PATCH 330/398] doc: initial attempt to document setup of pgp support
 for email.

Used an AI assistant to help write this. Basic gpg commands seem to
work, but I have not tested this totally. Docs basically follow the
setup used for pgp testing in the test suite.

It looks like roundup accepts signed emails as well as encrypted
and signed emails. But it does not generate signed emails.

Also it looks like there is no PGP support for alternate email
addresses. Only primary addresses can do PGP emails.
---
 doc/admin_guide.txt | 81 +++++++++++++++++++++++++++++++++++++++++++++
 doc/upgrading.txt   |  2 ++
 2 files changed, 83 insertions(+)

diff --git a/doc/admin_guide.txt b/doc/admin_guide.txt
index 69c77f47c..4b1d0ed59 100644
--- a/doc/admin_guide.txt
+++ b/doc/admin_guide.txt
@@ -1870,6 +1870,87 @@ Because environment variables can be inadvertently exposed in
 logs or process listings, Roundup does not currently support
 loading secrets from environment variables.
 
+.. _pgpconfig:
+
+Configuring PGP Email Support
+=============================
+
+.. note::
+   This section was written with the help of the Devin/DeepWiki AI.
+
+You have to install the gpg module using pip. See :ref:`directions for
+installing gpg <gpginstall>`
+in the upgrading document for more information.
+
+In your tracker's config.ini configure the following settings in the
+``[pgp]`` section::
+
+  enable = yes
+  homedir = /path/to/pgp/configdir
+  roles = admin
+
+This will allow any user with the admin role to send signed pgp
+email. If ``roles`` is not set, all users will need to use signed
+emails. If it is not signed it will be rejected. Note that ``homedir``
+must be an absolute path. Unlike other path settings, a relative path
+is not interpreted relative to the tracker home. See the documentation
+in config.ini for more information and other settings (e.g. to send
+encrypted emails from the tracker).
+
+When PGP is enabled and a message is signed with a valid signature,
+the database transaction source (db.tx_Source) is set to
+``email-sig-openpgp`` instead of ``email``. This allows you to
+restrict certain operations (e.g. changing a private flag) to
+authenticated/signed emails.
+
+Creating GPG Keys for the Tracker
+---------------------------------
+
+To generate a keypair use::
+
+  gpg --homedir /path/to/pgp/configdir --gen-key
+
+where the homedir directory matches the one you set in
+config.ini. Note the gpg homedir must be created before you run the
+command.  You will be prompted for the full name of your tracker and
+the email address for your tracker. You also need to do with as the
+user who runs roundup (aka the roundup user) and the roundup email
+gateway. Do not encrypt the key.
+
+Roundup has no mechanism for reading the private key if it is
+encrypted. So make sure the permissions on the homedir only allow the
+roundup user to read the files.
+
+You can export the public key for use by clients using::
+
+  gpg --homedir /path/to/pgp/configdir --export -a tracker@example.com > tracker-public.key
+
+with homedir and email matching the values used to generate the
+key. This will allow users to import the public key and encrypt emails
+to the tracker.
+
+The public gpg key for each user's email address must be imported. To
+do this, obtain the user's public key for their primary email address
+and import it using::
+
+  gpg --homedir /path/to/tracker/gpg --import user-public-key.asc
+
+While Roundup supports multiple addresses for each user, only the
+primary address supports PGP signed or encrypted messages.
+
+.. comment:
+   Questions:
+
+   Can roundup send signed emails? (looks like no, why??)
+
+   Why are alternate addresses not supported for receiving PGP emails?
+   
+   Does Roundup ever send an email to an alternate email address?
+
+   Should there be some way for a user to upload their own public key?
+   If so what ui (paste armored asci cert in textbox, upload ascii
+   file from user page and process)?
+   
 Tasks
 =====
 
diff --git a/doc/upgrading.txt b/doc/upgrading.txt
index 9b3fcd7be..8f84c0931 100644
--- a/doc/upgrading.txt
+++ b/doc/upgrading.txt
@@ -785,6 +785,8 @@ request (tu.client.request), the translator for the current language
 
 You can find an example in :ref:`dynamic_csp`.
 
+.. _gpginstall:
+
 Directions for installing gpg (optional)
 ----------------------------------------
 

From c85105cfbbe18697115e9328195fd68bbaa68011 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 24 Nov 2025 11:50:19 -0500
Subject: [PATCH 331/398] chore: github actions/checkout upgrade 5.0.0 to 6.0.0

---
 .github/workflows/anchore.yml         | 2 +-
 .github/workflows/build-xapian.yml    | 2 +-
 .github/workflows/ci-test.yml         | 2 +-
 .github/workflows/codeql-analysis.yml | 2 +-
 .github/workflows/ossf-scorecard.yml  | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/anchore.yml b/.github/workflows/anchore.yml
index 45e4b05db..dafe7a96e 100644
--- a/.github/workflows/anchore.yml
+++ b/.github/workflows/anchore.yml
@@ -37,7 +37,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout the code
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
     - name: Build the Docker image
       run: docker pull python:3-alpine; docker build . --file scripts/Docker/Dockerfile --tag localbuild/testimage:latest
     - name: List the Docker image
diff --git a/.github/workflows/build-xapian.yml b/.github/workflows/build-xapian.yml
index 01384615e..a4e40ae6a 100644
--- a/.github/workflows/build-xapian.yml
+++ b/.github/workflows/build-xapian.yml
@@ -42,7 +42,7 @@ jobs:
         # if: {{ false }}
           # continue running if step fails
         # continue-on-error: true
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
 
         # Setup version of Python to use
       - name: Set Up Python 3.13
diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index bb9890354..a41e5085d 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -116,7 +116,7 @@ jobs:
         # if: {{ false }}
           # continue running if step fails
         # continue-on-error: true
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
 
       # Setup version of Python to use
       - name: Set Up Python ${{ matrix.python-version }}
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index d5a708504..da1361354 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -49,7 +49,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
diff --git a/.github/workflows/ossf-scorecard.yml b/.github/workflows/ossf-scorecard.yml
index a1fc81dcc..7e280c875 100644
--- a/.github/workflows/ossf-scorecard.yml
+++ b/.github/workflows/ossf-scorecard.yml
@@ -35,7 +35,7 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
           persist-credentials: false
 

From 51fa3d68c1be4b541669dc2e8041aa6d73ebf816 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 24 Nov 2025 11:51:40 -0500
Subject: [PATCH 332/398] chore: anchore anchore/scan-action upgrade 7.1.0 to
 7.2.0

---
 .github/workflows/anchore.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/anchore.yml b/.github/workflows/anchore.yml
index dafe7a96e..ebce562c3 100644
--- a/.github/workflows/anchore.yml
+++ b/.github/workflows/anchore.yml
@@ -43,7 +43,7 @@ jobs:
     - name: List the Docker image
       run: docker image ls
     - name: Run the Anchore scan action itself with GitHub Advanced Security code scanning integration enabled
-      uses: anchore/scan-action@568b89d27fc18c60e56937bff480c91c772cd993 # 7.1.0
+      uses: anchore/scan-action@3aaf50d765cfcceafa51d322ccb790e40f6cd8c5 # 7.2.0
       id: scan
       with:
         image: "localbuild/testimage:latest"

From 235eb28234fce093661939e58e369265441b3237 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 24 Nov 2025 11:52:32 -0500
Subject: [PATCH 333/398] chore: coveralls coverallsapp/github-action upgrade
 2.3.6 to 2.3.7

---
 .github/workflows/ci-test.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index a41e5085d..e29abb294 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -331,7 +331,7 @@ jobs:
       - name: Upload coverage to Coveralls
         # python 2.7 and 3.6 versions of coverage can't produce lcov files.
         if: matrix.python-version != '2.7' && matrix.python-version != '3.6'
-        uses: coverallsapp/github-action@648a8eb78e6d50909eff900e4ec85cab4524a45b # v2.3.6
+        uses: coverallsapp/github-action@5cbfd81b66ca5d10c19b062c04de0199c215fb6e # v2.3.7
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           path-to-lcov: coverage.lcov
@@ -367,7 +367,7 @@ jobs:
     
     steps:
       - name: Coveralls Finished
-        uses: coverallsapp/github-action@648a8eb78e6d50909eff900e4ec85cab4524a45b # v2.3.6
+        uses: coverallsapp/github-action@5cbfd81b66ca5d10c19b062c04de0199c215fb6e # v2.3.7
         with:
           github-token: ${{ secrets.github_token }}
           parallel-finished: true

From 3bf7faaf214d6f9aee17ad610e4c9dde73363b65 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Fri, 28 Nov 2025 11:51:03 -0500
Subject: [PATCH 334/398] chore: anchore anchore/scan-action upgrade 7.1.0 to
 7.2.0

---
 .github/workflows/anchore.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/anchore.yml b/.github/workflows/anchore.yml
index ebce562c3..8401e6914 100644
--- a/.github/workflows/anchore.yml
+++ b/.github/workflows/anchore.yml
@@ -43,7 +43,7 @@ jobs:
     - name: List the Docker image
       run: docker image ls
     - name: Run the Anchore scan action itself with GitHub Advanced Security code scanning integration enabled
-      uses: anchore/scan-action@3aaf50d765cfcceafa51d322ccb790e40f6cd8c5 # 7.2.0
+      uses: anchore/scan-action@40a61b52209e9d50e87917c5b901783d546b12d0 # 7.2.1
       id: scan
       with:
         image: "localbuild/testimage:latest"

From 0b9722347806baceb44aeeeec087f70d3e0c29cc Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Tue, 2 Dec 2025 12:30:20 -0500
Subject: [PATCH 335/398] chore: bump actions/setup-python from 6.0.0 to 6.1.0

---
 .github/workflows/build-xapian.yml | 2 +-
 .github/workflows/ci-test.yml      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build-xapian.yml b/.github/workflows/build-xapian.yml
index a4e40ae6a..36d837b7f 100644
--- a/.github/workflows/build-xapian.yml
+++ b/.github/workflows/build-xapian.yml
@@ -46,7 +46,7 @@ jobs:
 
         # Setup version of Python to use
       - name: Set Up Python 3.13
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
         with:
           python-version: 3.13
           allow-prereleases: true
diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index e29abb294..5e465aa23 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -120,7 +120,7 @@ jobs:
 
       # Setup version of Python to use
       - name: Set Up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
         with:
           python-version: ${{ matrix.python-version }}
           allow-prereleases: true

From 3356e989ccf2cc71b1824b945da929e74ed67bc3 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 7 Dec 2025 16:28:08 -0500
Subject: [PATCH 336/398] chore: update base image to python 3.14.1-alpine3.23
 release.

New release is 3.14.1-alpine3.23.
---
 scripts/Docker/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/Docker/Dockerfile b/scripts/Docker/Dockerfile
index 0567793ed..1d7b1b57a 100644
--- a/scripts/Docker/Dockerfile
+++ b/scripts/Docker/Dockerfile
@@ -26,7 +26,7 @@ ARG source=local
 # Note this is the index digest for the image, not the manifest digest.
 # The index digest is shared across archetectures (amd64, arm64 etc.)
 # while the manifest digest is unique per platform/arch.
-ARG SHA256=8373231e1e906ddfb457748bfc032c4c06ada8c759b7b62d9c73ec2a3c56e710
+ARG SHA256=b80c82b1a282283bd3e3cd3c6a4c895d56d1385879c8c82fa673e9eb4d6d4aa5
 
 # Set to any non-empty value to enable shell debugging for troubleshooting
 ARG VERBOSE=

From 1b6bb479e7027489abd031447dc561eb6e51137b Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 7 Dec 2025 17:30:41 -0500
Subject: [PATCH 337/398] docs: key from keyserver, check key before import to
 production

---
 doc/admin_guide.txt | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/doc/admin_guide.txt b/doc/admin_guide.txt
index 4b1d0ed59..d4742f46e 100644
--- a/doc/admin_guide.txt
+++ b/doc/admin_guide.txt
@@ -1935,9 +1935,28 @@ and import it using::
 
   gpg --homedir /path/to/tracker/gpg --import user-public-key.asc
 
+You may also be able to get it from a public keyserver using::
+
+  gpg --recv-keys KEYID
+
+where the ``KEYID`` is supplied by the roundup user.
+
 While Roundup supports multiple addresses for each user, only the
 primary address supports PGP signed or encrypted messages.
 
+You should verify that the public key is sane and has few signatures
+attached. You can import a key into a throw away keystore::
+
+  mkdir throwaway
+  gpg --homedir throwaway -- import user-public-key.asc
+  gpg --homedir throwaway --list-sigs
+
+and verify that the number of sig lines is small (under 10 or so). If
+it takes a long time to import you can kill the import without
+affecting your production keystore. Large numbers of sig lines can
+take a long time to import/access when compressed. See:
+https://nvd.nist.gov/vuln/detail/CVE-2022-3219.
+
 .. comment:
    Questions:
 

From df79d29a571099c699f98e4131526e393b95fe52 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 7 Dec 2025 17:33:25 -0500
Subject: [PATCH 338/398] docs: update changelog with pgp doc addition.

---
 CHANGES.txt | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGES.txt b/CHANGES.txt
index fe133a2e7..c277eb5ee 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -57,6 +57,8 @@ Features:
   logs for a specific transaction. Logging also supports a
   trace_reason log token with the url for a web request. The logging
   format can be changed in config.ini. (John Rouillard)
+- issue2551152 - added basic PGP setup/use info to admin_guide. (John
+  Rouillard)
 
 2025-07-13 2.5.0
 

From 49137882b8a49cda6d8239e6012fdd41ac590b76 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 8 Dec 2025 00:23:14 -0500
Subject: [PATCH 339/398] feat: add nanoid pkg trace_id gen and decorator for
 setting processName

nanoid is a shorter unique id generator and faster than uuid.
I truncate nanoid id's to 12 chars to make it more readable.

Also added decorator to allow setting the default processName
definition in the logging module. admin.py and wsgi_handler now set
processName. configuration.py knows how to overide the processName if
set to the default MainProcess.

Updated install docs to add nanoid as optional, how to switch to
different trace_id output. pydoc generated docs include logcontext
module and are referenced from admin.py.
---
 CHANGES.txt                 |   7 ++-
 doc/admin_guide.txt         |   8 ++-
 doc/installation.txt        |   7 ++-
 doc/pydoc.txt               |  18 +++++-
 roundup/admin.py            |   3 +-
 roundup/cgi/wsgi_handler.py |   3 +-
 roundup/configuration.py    |   6 ++
 roundup/logcontext.py       | 120 +++++++++++++++++++++++++++++-------
 8 files changed, 140 insertions(+), 32 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index fe133a2e7..bb675bfb0 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -54,9 +54,10 @@ Features:
   logging format. (John Rouillard)
 - the default logging format template includes an identifier unique
   for a request. This identifier (trace_id) can be use to identify
-  logs for a specific transaction. Logging also supports a
-  trace_reason log token with the url for a web request. The logging
-  format can be changed in config.ini. (John Rouillard)
+  logs for a specific transaction. Will use nanoid if installed, uses
+  uuid.uuid4 otherwise. Logging also supports a trace_reason log token
+  with the url for a web request. The logging format can be changed in
+  config.ini. (John Rouillard)
 
 2025-07-13 2.5.0
 
diff --git a/doc/admin_guide.txt b/doc/admin_guide.txt
index 4b1d0ed59..261eb4f77 100644
--- a/doc/admin_guide.txt
+++ b/doc/admin_guide.txt
@@ -239,8 +239,8 @@ More on trace_id
 ~~~~~~~~~~~~~~~~
 
 The trace_id provides a unique token (a UUID4 encoded to make it
-shorter) for each transaction in the database. It is unique to
-each thread or transaction. A transaction:
+shorter or a nanoid) for each transaction in the database. It is
+unique to each thread or transaction. A transaction:
 
   for the web interface is
       each web, rest or xmlrpc request
@@ -282,7 +282,11 @@ point for the processing operation::
        for thing in things:
 	   process_one(thing)
       
+You can change the format of the trace_id if required using the
+tracker's interfaces.py file. See the :ref:`module docs for the
+logcontext module <logcontext_pydoc>` for details.
 
+	   
 Advanced Logging Setup
 ----------------------
 
diff --git a/doc/installation.txt b/doc/installation.txt
index 24a97367f..055ba66c1 100644
--- a/doc/installation.txt
+++ b/doc/installation.txt
@@ -253,7 +253,11 @@ gpg
   version 2.0 of gpg from test.pypi.org. See the `gpg install
   directions in the upgrading document`_.
 
-
+nanoid
+  If nanoid_ is installed, it is used to generate short unique
+  ids to link all logging to a single request. If not installed,
+  uuid4's from the standard library are used.
+  
 jinja2
   To use the jinja2 template (may still be experimental, check out
   its TEMPLATE-INFO.txt file) you need
@@ -2432,6 +2436,7 @@ the test.
 .. _mod_python: https://github.com/grisha/mod_python
 .. _mod_wsgi: https://pypi.org/project/mod-wsgi/
 .. _MySQLdb: https://pypi.org/project/mysqlclient/
+.. _nanoid: https://pypi.org/project/nanoid/
 .. _Olson tz database: https://www.iana.org/time-zones
 .. _polib: https://polib.readthedocs.io
 .. _Psycopg2: https://www.psycopg.org/
diff --git a/doc/pydoc.txt b/doc/pydoc.txt
index ef7bf849b..36df7250f 100644
--- a/doc/pydoc.txt
+++ b/doc/pydoc.txt
@@ -1,10 +1,14 @@
-================
-Pydocs from code
-================
+================================
+Embedded documentation from code
+================================
 
 .. contents::
    :local:
 
+The following are embedded documentation selected from the Roundup
+code base. You can see the same information using the ``help``
+function after importing the modules.
+
 Client class
 ============
 
@@ -40,3 +44,11 @@ Templating Utils class
 
 .. autoclass:: roundup.cgi.templating::TemplatingUtils
    :members:
+
+Logcontext Module
+=================
+.. _logcontext_pydoc:
+
+.. automodule:: roundup.logcontext
+   :members:
+   :exclude-members: SimpleSentinel
diff --git a/roundup/admin.py b/roundup/admin.py
index 142506943..446b13f2c 100644
--- a/roundup/admin.py
+++ b/roundup/admin.py
@@ -49,7 +49,7 @@
 )
 from roundup.exceptions import UsageError
 from roundup.i18n import _, get_translation
-from roundup.logcontext import gen_trace_id, store_trace_reason
+from roundup.logcontext import gen_trace_id, set_processName, store_trace_reason
 
 try:
     from UserDict import UserDict
@@ -2355,6 +2355,7 @@ def usageError_feedback(self, message, function):
         print(function.__doc__)
         return 1
 
+    @set_processName("roundup-admin")
     @gen_trace_id()
     @store_trace_reason('admin')
     def run_command(self, args):
diff --git a/roundup/cgi/wsgi_handler.py b/roundup/cgi/wsgi_handler.py
index bfea660f7..46458891d 100644
--- a/roundup/cgi/wsgi_handler.py
+++ b/roundup/cgi/wsgi_handler.py
@@ -13,7 +13,7 @@
 from roundup.anypy.strings import s2b
 from roundup.cgi import TranslationService
 from roundup.cgi.client import BinaryFieldStorage
-from roundup.logcontext import gen_trace_id, store_trace_reason
+from roundup.logcontext import gen_trace_id, set_processName, store_trace_reason
 
 BaseHTTPRequestHandler = http_.server.BaseHTTPRequestHandler
 DEFAULT_ERROR_MESSAGE = http_.server.DEFAULT_ERROR_MESSAGE
@@ -107,6 +107,7 @@ def use_cached_tracker(self):
             "cache_tracker" not in self.feature_flags or
             self.feature_flags["cache_tracker"] is not False)
 
+    @set_processName("wsgi_handler")
     @gen_trace_id()
     @store_trace_reason("wsgi")
     def __call__(self, environ, start_response):
diff --git a/roundup/configuration.py b/roundup/configuration.py
index 6984aafcd..da5511ecf 100644
--- a/roundup/configuration.py
+++ b/roundup/configuration.py
@@ -2440,6 +2440,12 @@ def context_filter(self, record):
         for name, value in get_context_info():
             if not hasattr(record, name):
                 setattr(record, name, value)
+                continue
+            if (name == "processName" and
+                isinstance(value, str) and
+                getattr(record, name) == "MainProcess"):
+                setattr(record, name, value)
+                    
         record.pct_char = "%"
         record.ROUNDUP_CONTEXT_FILTER_CALLED = True
 
diff --git a/roundup/logcontext.py b/roundup/logcontext.py
index 0371e28da..51095a4f4 100644
--- a/roundup/logcontext.py
+++ b/roundup/logcontext.py
@@ -1,9 +1,70 @@
+"""Generate and store thread local logging context including unique
+trace id for request, request source etc. to be logged.
+
+Trace id generator can use nanoid or uuid.uuid4 stdlib function.
+Nanoid is preferred if nanoid is installed using pip as nanoid is
+faster and generates a shorter id. If nanoid is installed in the
+tracker's lib subdirectory, it must be enabled using the tracker's
+interfaces.py by adding::
+
+   # if nanoid is installed in tracker's lib directory or
+   # if you want to change the length of the nanoid from 12
+   # to 14 chars use:
+   from functools import partial
+   from nanoid import generate
+   import roundup.logcontext
+   # change 14 to 12 to get the default nanoid size.
+   roundup.logcontext.idgen=partial(generate, size=14)
+
+   # to force use of shortened uuid when nanoid is
+   # loaded by default
+   import roundup.logcontext
+   roundup.logcontext.idgen=roundup.logcontext.short_uuid
+
+"""
 import contextvars
 import functools
 import logging
 import os
 import uuid
 
+
+def short_uuid():
+    """Encode a UUID integer in a shorter form for display.
+
+       A uuid is long. Make a shorter version that takes less room
+       in a log line and is easier to store.
+    """
+    alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz1234567890"
+    result = ""
+    alphabet_len = len(alphabet)
+    uuid_int = uuid.uuid4().int
+    while uuid_int:
+        uuid_int, t = divmod(uuid_int, alphabet_len)
+        result += alphabet[t]
+    return result or "0"
+
+
+try:
+    from nanoid import generate
+    # With size=12 and the normal alphabet, it take ~4 months
+    # with 1000 nanoid's/sec to generate a collision with 1%
+    # probability. That's 100 users sec continously. These id's
+    # are used to link logging messages/traces that are all done
+    # in a few seconds. Collisions ae unlikely to happen in the
+    # same time period leading to confusion.
+    #
+    # nanoid is faster than shortened uuids.
+    # 1,000,000 generate(size=12) timeit.timeit at 25.4 seconds
+    # 1,000,000 generate(size=21) timeit.timeit at 33.7 seconds
+
+    #: Variable used for setting the id generator.
+    idgen = functools.partial(generate, size=12)
+except ImportError:
+    # 1,000,000 of short_uuid() timeit.timeit at 54.1 seconds
+    idgen = short_uuid  #: :meta hide-value:
+
+
 logger = logging.getLogger("roundup.logcontext")
 
 
@@ -46,6 +107,11 @@ def __repr__(self):
 
 # set up sentinel values that will print a suitable error value
 # and the context vars they are associated with.
+_SENTINEL_PROCESSNAME = SimpleSentinel("processName", None)
+ctx_vars['processName'] = contextvars.ContextVar("processName",
+                                                  default=_SENTINEL_PROCESSNAME)
+
+
 _SENTINEL_ID = SimpleSentinel("trace_id", "not set")
 ctx_vars['trace_id'] = contextvars.ContextVar("trace_id", default=_SENTINEL_ID)
 
@@ -55,23 +121,8 @@ def __repr__(self):
                                                   default=_SENTINEL_REASON)
 
 
-def shorten_int_uuid(uuid):
-    """Encode a UUID integer in a shorter form for display.
-
-       A uuid is long. Make a shorter version that takes less room
-       in a log line.
-    """
-
-    alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz1234567890"
-    result = ""
-    while uuid:
-        uuid, t = divmod(uuid, len(alphabet))
-        result += alphabet[t]
-    return result or "0"
-
-
 def gen_trace_id():
-    """Decorator to generate a trace id (encoded uuid4) and add to contextvar
+    """Decorator to generate a trace id (nanoid or encoded uuid4) as contextvar
 
        The logging routine uses this to label every log line. All
        logs with the same trace_id should be generated from a
@@ -84,15 +135,22 @@ def gen_trace_id():
        used by a different invocation method. It will not set a
        trace_id if one is already assigned.
 
-       A uuid4() is used as the uuid, but to shorten the log line,
-       the uuid4 integer is encoded into a 62 character ascii
-       alphabet (A-Za-z0-9).
+       If a uuid4() is used as the id, the uuid4 integer is encoded
+       into a 62 character alphabet (A-Za-z0-9) to shorten
+       the log line.
 
        This decorator may produce duplicate (colliding) trace_id's
        when used with multiple processes on some platforms where
        uuid.uuid4().is_safe is unknown. Probability of a collision
        is unknown.
 
+       If nanoid is used to generate the id, it is 12 chars long and
+       uses a 64 char ascii alphabet, the 62 above with '_' and '-'.
+       The shorter nanoid has < 1% chance of collision in ~4 months
+       when generating 1000 id's per second.
+
+       See the help text for the module to change how the id is
+       generated.
     """
     def decorator(func):
         @functools.wraps(func)
@@ -100,7 +158,7 @@ def wrapper(*args, **kwargs):
             prev = None
             trace_id = ctx_vars['trace_id']
             if trace_id.get() is _SENTINEL_ID:
-                prev = trace_id.set(shorten_int_uuid(uuid.uuid4().int))
+                prev = trace_id.set(idgen())
             try:
                 r = func(*args, **kwargs)
             finally:
@@ -111,6 +169,26 @@ def wrapper(*args, **kwargs):
     return decorator
 
 
+def set_processName(name):
+    """Decorator to set the processName used in the LogRecord
+    """
+    def decorator(func):
+        @functools.wraps(func)
+        def wrapper(*args, **kwargs):
+            prev = None
+            processName = ctx_vars['processName']
+            if processName.get() is _SENTINEL_PROCESSNAME:
+                prev = processName.set(name)
+            try:
+                r = func(*args, **kwargs)
+            finally:
+                if prev:
+                    processName.reset(prev)
+            return r
+        return wrapper
+    return decorator
+
+
 def store_trace_reason(location=None):
     """Decorator finds and stores a reason trace was started in contextvar.
 
@@ -195,7 +273,7 @@ def get_context_info():
 
 #Is returning a dict for this info more pythonic?
 def get_context_dict():
-    """Return dict of context var tuples ["var_name": "var_value", ...}"""
+    """Return dict of context var tuples {"var_name": "var_value", ...}"""
     return {name: ctx.get() for name, ctx in ctx_vars.items()}
 
 # Dummy no=op implementation of this module:

From 0c60ec8bab86c94151db50422d6fe9d30d63cdb4 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 8 Dec 2025 23:07:57 -0500
Subject: [PATCH 340/398] chore: update actions/checkout from 6.0.0 to 6.1.1
 pull74

---
 .github/workflows/anchore.yml         | 2 +-
 .github/workflows/build-xapian.yml    | 2 +-
 .github/workflows/ci-test.yml         | 2 +-
 .github/workflows/codeql-analysis.yml | 2 +-
 .github/workflows/ossf-scorecard.yml  | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/anchore.yml b/.github/workflows/anchore.yml
index 8401e6914..aa510fd51 100644
--- a/.github/workflows/anchore.yml
+++ b/.github/workflows/anchore.yml
@@ -37,7 +37,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout the code
-      uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - name: Build the Docker image
       run: docker pull python:3-alpine; docker build . --file scripts/Docker/Dockerfile --tag localbuild/testimage:latest
     - name: List the Docker image
diff --git a/.github/workflows/build-xapian.yml b/.github/workflows/build-xapian.yml
index 36d837b7f..e71f6d082 100644
--- a/.github/workflows/build-xapian.yml
+++ b/.github/workflows/build-xapian.yml
@@ -42,7 +42,7 @@ jobs:
         # if: {{ false }}
           # continue running if step fails
         # continue-on-error: true
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
         # Setup version of Python to use
       - name: Set Up Python 3.13
diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index 5e465aa23..d04d77083 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -116,7 +116,7 @@ jobs:
         # if: {{ false }}
           # continue running if step fails
         # continue-on-error: true
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       # Setup version of Python to use
       - name: Set Up Python ${{ matrix.python-version }}
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index da1361354..c1702df5d 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -49,7 +49,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
diff --git a/.github/workflows/ossf-scorecard.yml b/.github/workflows/ossf-scorecard.yml
index 7e280c875..a1f84d886 100644
--- a/.github/workflows/ossf-scorecard.yml
+++ b/.github/workflows/ossf-scorecard.yml
@@ -35,7 +35,7 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           persist-credentials: false
 

From b96c66147e4fb3f29341cca5b7a625731fb31e81 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sat, 13 Dec 2025 23:02:53 -0500
Subject: [PATCH 341/398] issue2551413 - Broken MultiLink columns in CSV export

cmeerw found a crash and bug.

While investigating CSV export using names with a multilink field that
doesn't have a label field (name or realname for user class). cmeerw's
patch displays a multilink like messages as "['12', '23']" as when
exporting csv with id. I changes code so this displays as "12;23" to
match the list format output of the other fields in export csv (with
names).
---
 CHANGES.txt            | 4 ++++
 roundup/cgi/actions.py | 5 ++++-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index ac0d40ad3..e09117b30 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -37,6 +37,10 @@ Fixed:
   script. Found/patch by Norbert Schlemmer. (John Rouillard)
 - change some internal classes to use __slots__ for hopefully a small
   performance improvement. (John Rouillard)
+- issue2551413 - Broken MultiLink columns in CSV export. CSV export of
+  a multilink link "messages" that does not have a 'name' property
+  causes a crash. (found/fix by cmeerw; commit and better handling of
+  non-labeled multilink by John Rouillard)
   
 Features:
 
diff --git a/roundup/cgi/actions.py b/roundup/cgi/actions.py
index 7d12af4a6..f6d73a850 100644
--- a/roundup/cgi/actions.py
+++ b/roundup/cgi/actions.py
@@ -1688,7 +1688,6 @@ def fct(arg):
             if isinstance(props[col], hyperdb.Multilink):
                 cname = props[col].classname
                 cclass = self.db.getclass(cname)
-                represent[col] = repr_list(cclass, 'name')
                 if not self.hasPermission(self.permissionType, classname=cname):
                     represent[col] = repr_no_right(cclass, 'name')
                 else:
@@ -1696,6 +1695,10 @@ def fct(arg):
                         represent[col] = repr_list(cclass, 'name')
                     elif cname == 'user':
                         represent[col] = repr_list(cclass, 'realname')
+                    else:
+                        # handle cases like messages which have no
+                        # useful label field issue2551413 
+                        represent[col] = repr_list(cclass, 'id')
             if isinstance(props[col], hyperdb.Link):
                 cname = props[col].classname
                 cclass = self.db.getclass(cname)

From 6a05a1d13d5c776514c7f9b204d2a9dd42476bfc Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 14 Dec 2025 22:40:46 -0500
Subject: [PATCH 342/398] feat: support justhtml parsing library to convert
 email to plain text

justhtml is an pure python, fast, HTML5 compliant parser. It is now an
option for converting html only emails to plain text. Its output
format differs slightly from dehtml or beautifulsoup. Mostly by
removing extra blank lines.

dehtml.py:
  Using the stream parser of justhtml. Unable to get the full
  document parser to successfully strip script and style blocks.

  If I can fix this and use the standard parser, I can in theory
  generate markdown from the DOM tree generated by justhtml.

  Updated test case to include inline elements that should not cause a
  line break when they are encountered. Running dehtml as: `python
  roundup/dehtml.py foo.html` will load foo.html and parse it using
  all available parsers.

configuration.py: justhtml is available as an option.

docs: updated CHANGES.txt, doc/tracker_config.txt added beautifulsoup
and justhtml to the optional software section of doc/installtion.txt.

test_mailgw.py, .github/workflows/ci-test Updated tests and install
justhtml as part of CI.
---
 .github/workflows/ci-test.yml |   2 +-
 CHANGES.txt                   |   4 +
 doc/installation.txt          |  10 +++
 doc/tracker_config.txt        |   8 +-
 roundup/configuration.py      |  20 ++---
 roundup/dehtml.py             | 152 ++++++++++++++++++++++++++++++++--
 test/test_mailgw.py           |  16 ++++
 7 files changed, 191 insertions(+), 21 deletions(-)

diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index d04d77083..344fc7273 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -240,7 +240,7 @@ jobs:
           # pygments for markdown2 to highlight code blocks
           pip install markdown2 pygments
           # docutils for ReStructuredText
-          pip install beautifulsoup4 brotli docutils jinja2 \
+          pip install beautifulsoup4 justhtml brotli docutils jinja2 \
             mistune==0.8.4 pyjwt pytz whoosh
           # gpg on PyPi is currently broken with newer OS platform
           #   ubuntu 24.04
diff --git a/CHANGES.txt b/CHANGES.txt
index e09117b30..a75bc93ea 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -64,6 +64,10 @@ Features:
   config.ini. (John Rouillard)
 - issue2551152 - added basic PGP setup/use info to admin_guide. (John
   Rouillard)
+- add support for the 'justhtml' html 5 parser library. It is written
+  in pure Python. Used to convert html emails into plain text. Faster
+  then beautifulsoup4 and it passes the html 5 standard browser test
+  suite. Beautifulsoup is still supported. (John Rouillard)
 
 2025-07-13 2.5.0
 
diff --git a/doc/installation.txt b/doc/installation.txt
index 2f0227477..78bf4c88c 100644
--- a/doc/installation.txt
+++ b/doc/installation.txt
@@ -311,6 +311,14 @@ polib
   roundup-gettext, you must install polib_. See the `developer's
   guide`_ for details on translating your tracker.
 
+beautifulsoup, justhtml
+  When HTML only email is received, Roundup can convert it into
+  plain text using the native dehtml parser. To convert HTML
+  email into plain text, beautifulsoup4_ or justhtml_ can also be
+  used. You can choose the converter in the tracker's
+  config. Note that justhtml is pure Python, fast and conforms to
+  HTML 5 standards.
+  
 pywin32 - Windows Service
   You can run Roundup as a Windows service if pywin32_ is installed.
   Otherwise it must be started manually.
@@ -2423,6 +2431,7 @@ the test.
 .. _`adding MySQL users`:
     https://dev.mysql.com/doc/refman/8.0/en/creating-accounts.html
 .. _apache: https://httpd.apache.org/
+.. _beautifulsoup4: https://pypi.org/project/beautifulsoup4/
 .. _brotli: https://pypi.org/project/Brotli/
 .. _`developer's guide`: developers.html
 .. _defusedxml: https://pypi.org/project/defusedxml/
@@ -2430,6 +2439,7 @@ the test.
 .. _flup: https://pypi.org/project/flup/
 .. _gpg: https://www.gnupg.org/software/gpgme/index.html
 .. _jinja2: https://palletsprojects.com/projects/jinja/
+.. _justhtml: https://pypi.org/project/justhtml/
 .. _markdown: https://python-markdown.github.io/
 .. _markdown2: https://github.com/trentm/python-markdown2
 .. _mistune: https://pypi.org/project/mistune/
diff --git a/doc/tracker_config.txt b/doc/tracker_config.txt
index 1d132660f..a76220b04 100644
--- a/doc/tracker_config.txt
+++ b/doc/tracker_config.txt
@@ -1112,12 +1112,12 @@
 
   # If an email has only text/html parts, use this module
   # to convert the html to text. Choose from beautifulsoup 4,
-  # dehtml - (internal code), or none to disable conversion.
-  # If 'none' is selected, email without a text/plain part
-  # will be returned to the user with a message. If
+  # justhtml, dehtml - (internal code), or none to disable
+  # conversion. If 'none' is selected, email without a text/plain
+  # part will be returned to the user with a message. If
   # beautifulsoup is selected but not installed dehtml will
   # be used instead.
-  # Allowed values: beautifulsoup, dehtml, none
+  # Allowed values: beautifulsoup, justhtml, dehtml, none
   # Default: none
   convert_htmltotext = none
 
diff --git a/roundup/configuration.py b/roundup/configuration.py
index d07b8bcd7..1c470b4d9 100644
--- a/roundup/configuration.py
+++ b/roundup/configuration.py
@@ -384,17 +384,17 @@ class HtmlToTextOption(Option):
 
     """What module should be used to convert emails with only text/html
     parts into text for display in roundup. Choose from beautifulsoup
-    4, dehtml - the internal code or none to disable html to text
-    conversion. If beautifulsoup chosen but not available, dehtml will
-    be used.
+    4, justhtml, dehtml - the internal code or none to disable html to
+    text conversion. If beautifulsoup or justhtml is chosen but not
+    available, dehtml will be used.
 
     """
 
-    class_description = "Allowed values: beautifulsoup, dehtml, none"
+    class_description = "Allowed values: beautifulsoup, justhtml, dehtml, none"
 
     def str2value(self, value):
         _val = value.lower()
-        if _val in ("beautifulsoup", "dehtml", "none"):
+        if _val in ("beautifulsoup", "justhtml", "dehtml", "none"):
             return _val
         else:
             raise OptionValueError(self, value, self.class_description)
@@ -1811,11 +1811,11 @@ def str2value(self, value):
         (HtmlToTextOption, "convert_htmltotext", "none",
             "If an email has only text/html parts, use this module\n"
             "to convert the html to text. Choose from beautifulsoup 4,\n"
-            "dehtml - (internal code), or none to disable conversion.\n"
-            "If 'none' is selected, email without a text/plain part\n"
-            "will be returned to the user with a message. If\n"
-            "beautifulsoup is selected but not installed dehtml will\n"
-            "be used instead."),
+            "justhtml, dehtml - (internal code), or none to disable\n"
+            "conversion. If 'none' is selected, email without a text/plain\n"
+            "part will be returned to the user with a message. If\n"
+            "beautifulsoup or justhtml is selected but not installed\n"
+            "dehtml will be used instead."),
         (BooleanOption, "keep_real_from", "no",
             "When handling emails ignore the Resent-From:-header\n"
             "and use the original senders From:-header instead.\n"
diff --git a/roundup/dehtml.py b/roundup/dehtml.py
index cd913a0d1..ec73fb406 100644
--- a/roundup/dehtml.py
+++ b/roundup/dehtml.py
@@ -5,6 +5,10 @@
 
 from roundup.anypy.strings import u2s, uchr
 
+# ruff PLC0415 ignore imports not at top of file
+# ruff RET505 ignore else  after return
+# ruff: noqa: PLC0415 RET505
+
 _pyver = sys.version_info[0]
 
 
@@ -28,6 +32,108 @@ def html2text(html):
 
                     return u2s(soup.get_text("\n", strip=True))
 
+                self.html2text = html2text
+            elif converter == "justhtml":
+                from justhtml import stream
+
+                def html2text(html):
+                    # The below does not work.
+                    # Using stream parser since I couldn't seem to strip
+                    # 'script' and 'style' blocks. But stream doesn't
+                    # have error reporting or stripping of text nodes
+                    # and dropping empty nodes. Also I would like to try
+                    # its GFM markdown output too even though it keeps
+                    # tables as html and doesn't completely covert as
+                    # this would work well for those supporting markdown.
+                    #
+                    #  ctx used for for testing since I have a truncated
+                    #  test doc. It eliminates error from missing DOCTYPE
+                    #  and head.
+                    #
+                    #from justhtml import JustHTML
+                    # from justhtml.context import FragmentContext
+                    #
+                    #ctx = FragmentContext('html')
+                    #justhtml = JustHTML(html,collect_errors=True,
+                    #                    fragment_context=ctx)
+                    # I still have the text output inside style/script tags.
+                    # with :not(style, script). I do get text contents
+                    # with query("style, script").
+                    #
+                    #return u2s("\n".join(
+                    #     [elem.to_text(separator="\n", strip=True)
+                    #        for elem in justhtml.query(":not(style, script)")])
+                    #          )
+
+                    # define inline elements so I can accumulate all unbroken
+                    # text in a single line with embedded inline elements.
+                    # 'br' is inline but should be treated it as a line break
+                    # and element before/after should not be accumulated
+                    # together.
+                    inline_elements = (
+                        "a",
+                        "address",
+                        "b",
+                        "cite",
+                        "code",
+                        "em",
+                        "i",
+                        "img",
+                        "mark",
+                        "q",
+                        "s",
+                        "small",
+                        "span",
+                        "strong",
+                        "sub",
+                        "sup",
+                        "time")
+
+                    # each line is appended and joined at the end
+                    text = []
+                    # the accumulator for all text in inline elements
+                    text_accumulator = ""
+                    # if set skip all lines till matching end tag found
+                    # used to skip script/style blocks
+                    skip_till_endtag = None
+                    # used to force text_accumulator into text with added
+                    # newline so we have a blank line between paragraphs.
+                    _need_parabreak = False
+
+                    for event, data in stream(html):
+                        if event == "end" and skip_till_endtag == data:
+                            skip_till_endtag = None
+                            continue
+                        if skip_till_endtag:
+                            continue
+                        if (event == "start" and
+                              data[0] in ('script', 'style')):
+                            skip_till_endtag = data[0]
+                            continue
+                        if (event == "start" and
+                              text_accumulator and
+                              data[0] not in inline_elements):
+                            # add accumulator to "text"
+                            text.append(text_accumulator)
+                            text_accumulator = ""
+                            _need_parabreak = False
+                        elif event == "text":
+                            if not data.isspace():
+                                text_accumulator = text_accumulator + data
+                                _need_parabreak = True
+                        elif (_need_parabreak and
+                              event == "start" and
+                              data[0] == "p"):
+                            text.append(text_accumulator + "\n")
+                            text_accumulator = ""
+                            _need_parabreak = False
+
+                    # save anything left in the accumulator at end of document
+                    if text_accumulator:
+                        # add newline to match dehtml and beautifulsoup
+                        text.append(text_accumulator + "\n")
+                    return u2s("\n".join(text))
+
                 self.html2text = html2text
             else:
                 raise ImportError
@@ -96,6 +202,16 @@ def html2text(html):
 
 
 if __name__ == "__main__":
+    # ruff: noqa: B011 S101
+
+    try:
+        assert False
+    except AssertionError:
+        pass
+    else:
+        print("Error, assertions turned off. Test fails")
+        sys.exit(1)
+
     html = """
 <body>
 <script>
@@ -128,10 +244,10 @@ def html2text(html):
 <li class="toctree-l2"><a class="reference internal" href="admin_guide.html">Administration Guide</a></li>
 </ul>
 <div class="section" id="prerequisites">
-<h2><a class="toc-backref" href="#id5">Prerequisites</a></h2>
+<H2><a class="toc-backref" href="#id5">Prerequisites</a></H2>
 <p>Roundup requires Python 2.5 or newer (but not Python 3) with a functioning
 anydbm module. Download the latest version from <a class="reference external" href="http://www.python.org/">http://www.python.org/</a>.
-It is highly recommended that users install the latest patch version
+It is highly recommended that users install the <span>latest patch version</span>
 of python as these contain many fixes to serious bugs.</p>
 <p>Some variants of Linux will need an additional &#8220;python dev&#8221; package
 installed for Roundup installation to work. Debian and derivatives, are
@@ -147,18 +263,42 @@ def html2text(html):
 </body>
 """
 
-    html2text = dehtml("dehtml").html2text
-    if html2text:
-        print(html2text(html))
+    if len(sys.argv) > 1:
+        with open(sys.argv[1]) as h:
+            html = h.read()
 
+    print("==== beautifulsoup")
     try:
         # trap error seen if N_TOKENS not defined when run.
         html2text = dehtml("beautifulsoup").html2text
         if html2text:
-            print(html2text(html))
+            text = html2text(html)
+            assert ('HELP' not in text)
+            assert ('display:block' not in text)
+            print(text)
     except NameError as e:
         print("captured error %s" % e)
 
+    print("==== justhtml")
+    try:
+        html2text = dehtml("justhtml").html2text
+        if html2text:
+            text = html2text(html)
+            assert ('HELP' not in text)
+            assert ('display:block' not in text)
+            print(text)
+    except NameError as e:
+        print("captured error %s" % e)
+
+    print("==== dehtml")
+    html2text = dehtml("dehtml").html2text
+    if html2text:
+        text = html2text(html)
+        assert ('HELP' not in text)
+        assert ('display:block' not in text)
+        print(text)
+
+    print("==== disabled html -> text conversion")
     html2text = dehtml("none").html2text
     if html2text:
         print("FAIL: Error, dehtml(none) is returning a function")
diff --git a/test/test_mailgw.py b/test/test_mailgw.py
index 33590d247..b6a626c20 100644
--- a/test/test_mailgw.py
+++ b/test/test_mailgw.py
@@ -35,6 +35,13 @@
     skip_beautifulsoup = mark_class(pytest.mark.skip(
         reason="Skipping beautifulsoup tests: 'bs4' not installed"))
 
+try:
+    import justhtml
+    skip_justhtml = lambda func, *args, **kwargs: func
+except ImportError:
+    from .pytest_patcher import mark_class
+    skip_justhtml = mark_class(pytest.mark.skip(
+        reason="Skipping justhtml tests: 'justhtml' not installed"))
 
 from roundup.anypy.email_ import message_from_bytes
 from roundup.anypy.strings import b2s, u2s, s2b
@@ -315,6 +322,10 @@ class MailgwTestCase(MailgwTestAbstractBase, StringFragmentCmpHelper, unittest.T
     def testTextHtmlMessageBeautifulSoup(self):
         self.testTextHtmlMessage(converter='beautifulsoup')
 
+    @skip_justhtml
+    def testTextHtmlMessageJusthtml(self):
+        self.testTextHtmlMessage(converter='justhtml')
+        
     def testTextHtmlMessage(self, converter='dehtml'):
         html_message='''Content-Type: text/html;
   charset="iso-8859-1"
@@ -375,10 +386,15 @@ def testTextHtmlMessage(self, converter='dehtml'):
         text_fragments['dehtml'] = ['Roundup\n        Home\nDownload\nDocs\nRoundup Features\nInstalling Roundup\nUpgrading to newer versions of Roundup\nRoundup FAQ\nUser Guide\nCustomising Roundup\nAdministration Guide\nPrerequisites\n\nRoundup requires Python 2.6 or newer (but not Python 3) with a functioning\nanydbm module. Download the latest version from http://www.python.org/.\nIt is highly recommended that users install the latest patch version\nof python as these contain many fixes to serious bugs.\n\nSome variants of Linux will need an additional ', ('python dev', u2s(u'\u201cpython dev\u201d')), ' package\ninstalled for Roundup installation to work. Debian and derivatives, are\nknown to require this.\n\nIf you', (u2s(u'\u2019'), ''), 're on windows, you will either need to be using the ActiveState python\ndistribution (at http://www.activestate.com/Products/ActivePython/), or you', (u2s(u'\u2019'), ''), 'll\nhave to install the win32all package separately (get it from\nhttp://starship.python.net/crew/mhammond/win32/).']
         text_fragments['beautifulsoup'] = ['Roundup\nHome\nDownload\nDocs\nRoundup Features\nInstalling Roundup\nUpgrading to newer versions of Roundup\nRoundup FAQ\nUser Guide\nCustomising Roundup\nAdministration Guide\nPrerequisites\nRoundup requires Python 2.6 or newer (but not Python 3) with a functioning\nanydbm module. Download the latest version from\nhttp://www.python.org/\n.\nIt is highly recommended that users install the latest patch version\nof python as these contain many fixes to serious bugs.\nSome variants of Linux will need an additional ', ('python dev', u2s(u'\u201cpython dev\u201d')), ' package\ninstalled for Roundup installation to work. Debian and derivatives, are\nknown to require this.\nIf you', (u2s(u'\u2019'), "'"), 're on windows, you will either need to be using the ActiveState python\ndistribution (at\nhttp://www.activestate.com/Products/ActivePython/\n), or youâ€™ll\nhave to install the win32all package separately (get it from\nhttp://starship.python.net/crew/mhammond/win32/\n).']
 
+        text_fragments['justhtml'] = ['Roundup\nHome\nDownload\nDocs\nRoundup Features\nInstalling Roundup\nUpgrading to newer versions of Roundup\nRoundup FAQ\nUser Guide\nCustomising Roundup\nAdministration Guide\nPrerequisites\nRoundup requires Python 2.6 or newer (but not Python 3) with a functioning\nanydbm module. Download the latest version from http://www.python.org/.\nIt is highly recommended that users install the latest patch version\nof python as these contain many fixes to serious bugs.\nSome variants of Linux will need an additional ', ('python dev', u2s(u'\u201cpython dev\u201d')), ' package\ninstalled for Roundup installation to work. Debian and derivatives, are\nknown to require this.\nIf you', (u2s(u'\u2019'), "'"), 're on windows, you will either need to be using the ActiveState python\ndistribution (at http://www.activestate.com/Products/ActivePython/), or youâ€™ll\nhave to install the win32all package separately (get it from\nhttp://starship.python.net/crew/mhammond/win32/).']
+        self.maxDiff = 100000
         self.db.config.MAILGW_CONVERT_HTMLTOTEXT = converter
         nodeid = self._handle_mail(html_message)
         assert not os.path.exists(SENDMAILDEBUG)
         msgid = self.db.issue.get(nodeid, 'messages')[0]
+        print(self.db.msg.get(msgid, 'content'))
+        print("\n==== fragment\n")
+        print(text_fragments[converter])
         self.compareStringFragments(self.db.msg.get(msgid, 'content'),
                                     text_fragments[converter])
 

From 4bfd32d534d94ea888ace9e4dc5a9d850411671e Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 15 Dec 2025 00:04:16 -0500
Subject: [PATCH 343/398] issue2551413 - Broken MultiLink columns in CSV export
 (take 2)

Changed how I solved this. Restored the original line that cmeerw took
out, but use the 'id' field rather than the 'name' field.  The if
statements folowing the line change it to the 'name' field
(realname if it's a user object): if there is one.

Updated the tests to test for this error and exercise the code.  I had
to change the test to create/add messages to an issue. This required
that I suppress the sending of nosy messages using SENDMAILDEBUG env
var.
---
 roundup/cgi/actions.py |  7 +++----
 test/test_cgi.py       | 38 +++++++++++++++++++++++++++-----------
 2 files changed, 30 insertions(+), 15 deletions(-)

diff --git a/roundup/cgi/actions.py b/roundup/cgi/actions.py
index f6d73a850..236cb7211 100644
--- a/roundup/cgi/actions.py
+++ b/roundup/cgi/actions.py
@@ -1688,6 +1688,9 @@ def fct(arg):
             if isinstance(props[col], hyperdb.Multilink):
                 cname = props[col].classname
                 cclass = self.db.getclass(cname)
+                # Use id by default to handle cases like messages
+                # which have no useful label field issue2551413
+                represent[col] = repr_list(cclass, 'id')
                 if not self.hasPermission(self.permissionType, classname=cname):
                     represent[col] = repr_no_right(cclass, 'name')
                 else:
@@ -1695,10 +1698,6 @@ def fct(arg):
                         represent[col] = repr_list(cclass, 'name')
                     elif cname == 'user':
                         represent[col] = repr_list(cclass, 'realname')
-                    else:
-                        # handle cases like messages which have no
-                        # useful label field issue2551413 
-                        represent[col] = repr_list(cclass, 'id')
             if isinstance(props[col], hyperdb.Link):
                 cname = props[col].classname
                 cclass = self.db.getclass(cname)
diff --git a/test/test_cgi.py b/test/test_cgi.py
index b954b63b8..1bf32a9a6 100644
--- a/test/test_cgi.py
+++ b/test/test_cgi.py
@@ -108,8 +108,12 @@ def testAddMessageNoEscape(self):
 class testCsvExport(object):
 
     def testCSVExportBase(self):
+        if 'SENDMAILDEBUG' not in os.environ:
+            os.environ['SENDMAILDEBUG'] = 'mail-test1.log'
+        SENDMAILDEBUG = os.environ['SENDMAILDEBUG']
+
         cl = self._make_client(
-            {'@columns': 'id,title,status,keyword,assignedto,nosy,creation'},
+            {'@columns': 'id,title,status,keyword,assignedto,nosy,creation,messages'},
             nodeid=None, userid='1')
         cl.classname = 'issue'
 
@@ -127,19 +131,26 @@ def dummyClosure(adate=None, translator=None):
             return dummyClosure
         date.Date = dummyDate()
 
+        a_msg = self.db.msg.create(content="23a", author="4",
+                                   messageid="xyzzy@there",
+                                   recipients=['3'])
+        b_msg = self.db.msg.create(content="23b", author="3",
+                                   messageid="xyzzy@here",
+                                   recipients=['4'])
+        
         self.db.issue.create(title='foo1', status='2', assignedto='4', nosy=['3',demo_id])
         self.db.issue.create(title='bar2', status='1', assignedto='3', keyword=[key_id1,key_id2])
-        self.db.issue.create(title='baz32', status='4')
+        self.db.issue.create(title='baz32', status='4', messages=[a_msg, b_msg])
+        
         output = io.BytesIO()
         cl.request = MockNull()
         cl.request.wfile = output
         # call export version that outputs names
         actions.ExportCSVAction(cl).handle()
-        should_be=(s2b('"id","title","status","keyword","assignedto","nosy","creation"\r\n'
-                       '"1","foo1","deferred","","Contrary, Mary","Bork, Chef;Contrary, Mary;demo","2000-06-26 00:34"\r\n'
-                       '"2","bar2","unread","keyword1;keyword2","Bork, Chef","Bork, Chef","2000-06-26 00:34"\r\n'
-                       '"3","baz32","need-eg","","","","2000-06-26 00:34"\r\n'))
-
+        should_be=(s2b('"id","title","status","keyword","assignedto","nosy","creation","messages"\r\n'
+                       '"1","foo1","deferred","","Contrary, Mary","Bork, Chef;Contrary, Mary;demo","2000-06-26 00:34",""\r\n'
+                       '"2","bar2","unread","keyword1;keyword2","Bork, Chef","Bork, Chef","2000-06-26 00:34",""\r\n'
+                       '"3","baz32","need-eg","","","Bork, Chef;Contrary, Mary","2000-06-26 00:34","1;2"\r\n'))
 
         #print(should_be)
         #print(output.getvalue())
@@ -149,10 +160,10 @@ def dummyClosure(adate=None, translator=None):
         cl.request.wfile = output
         # call export version that outputs id numbers
         actions.ExportCSVWithIdAction(cl).handle()
-        should_be = s2b('"id","title","status","keyword","assignedto","nosy","creation"\r\n'
-                        '''"1","foo1","2","[]","4","['3', '4', '5']","2000-06-26.00:34:02"\r\n'''
-                        '''"2","bar2","1","['1', '2']","3","['3']","2000-06-26.00:34:02"\r\n'''
-                        '''"3","baz32","4","[]","None","[]","2000-06-26.00:34:02"\r\n''')
+        should_be = s2b('"id","title","status","keyword","assignedto","nosy","creation","messages"\r\n'
+                        '''"1","foo1","2","[]","4","['3', '4', '5']","2000-06-26.00:34:02","[]"\r\n'''
+                        '''"2","bar2","1","['1', '2']","3","['3']","2000-06-26.00:34:02","[]"\r\n'''
+                        '''"3","baz32","4","[]","None","['3', '4']","2000-06-26.00:34:02","['1', '2']"\r\n''')
         #print(should_be)
         #print(output.getvalue())
         self.assertEqual(output.getvalue(), should_be)
@@ -184,6 +195,11 @@ def dummyClosure(adate=None, translator=None):
                         "\"2\",\"bar2\",\"1\",\"['1', '2']\",\"3\",\"['3']\"\r\n")
         self.assertEqual(output.getvalue(), should_be)
 
+        # clean up from email log
+        if os.path.exists(SENDMAILDEBUG):
+            os.remove(SENDMAILDEBUG)
+
+
 class FormTestCase(FormTestParent, StringFragmentCmpHelper, testCsvExport, unittest.TestCase):
 
     def setUp(self):

From 1fd22d16b9685b66281d6018f71702f8d058bd3a Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 15 Dec 2025 00:10:24 -0500
Subject: [PATCH 344/398] doc: update tracker_config.txt. add format logging
 option and update docs on convert_htmltotext

---
 doc/tracker_config.txt | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/doc/tracker_config.txt b/doc/tracker_config.txt
index a76220b04..01292b547 100644
--- a/doc/tracker_config.txt
+++ b/doc/tracker_config.txt
@@ -867,6 +867,14 @@
   # Default: ERROR
   level = ERROR
 
+  # Format of the logging messages with all '%' signs
+  # doubled so they are not interpreted by the config file.
+  # Allowed value: Python LogRecord attribute named formats with % *sign doubled*.
+  # Also you can include the following attributes:
+  #   %%(trace_id)s %%(trace_reason)s and %%(pct_char)s
+  # Default: %%(asctime)s %%(trace_id)s %%(levelname)s %%(message)s
+  format = %%(asctime)s %%(trace_id)s %%(levelname)s %%(message)s
+
   # If set to yes, only the loggers configured in this section will
   # be used. Yes will disable gunicorn's --access-logfile.
   # 
@@ -1115,8 +1123,8 @@
   # justhtml, dehtml - (internal code), or none to disable
   # conversion. If 'none' is selected, email without a text/plain
   # part will be returned to the user with a message. If
-  # beautifulsoup is selected but not installed dehtml will
-  # be used instead.
+  # beautifulsoup or justhtml is selected but not installed
+  # dehtml will be used instead.
   # Allowed values: beautifulsoup, justhtml, dehtml, none
   # Default: none
   convert_htmltotext = none

From 62661edc5ef95f96daa955a0dbeafb5af4f8732d Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 15 Dec 2025 00:52:41 -0500
Subject: [PATCH 345/398] build: justhtml fails on python < 3.10

change method of pip install so it doesn't break the ci.
---
 .github/workflows/ci-test.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index 344fc7273..b3f24e2c0 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -240,7 +240,7 @@ jobs:
           # pygments for markdown2 to highlight code blocks
           pip install markdown2 pygments
           # docutils for ReStructuredText
-          pip install beautifulsoup4 justhtml brotli docutils jinja2 \
+          pip install beautifulsoup4 brotli docutils jinja2 \
             mistune==0.8.4 pyjwt pytz whoosh
           # gpg on PyPi is currently broken with newer OS platform
           #   ubuntu 24.04
@@ -257,6 +257,8 @@ jobs:
         run: |
           set -xv
           pip install zstd || true
+          # justhtml supports python 3.10 or newer.
+          pip install justhtml || true
           if [[ "$PYTHON_VERSION" != "2."* ]]; then 
               pip install Markdown; fi
 

From 58cc1b64957b09a90957c277c169c989591e8a92 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 15 Dec 2025 09:42:41 -0500
Subject: [PATCH 346/398] build: prevent justhtml install < 3.10 python

The package says 3.10 or newer but does install on 3.8 (and maybe 3.9)
but the formatting is different (it's actually more like beautifulsoup
and dehtml output).

So rather than trying to fix the test when it shouldn't be installed
anyway just stop install if < 3.10.
---
 .github/workflows/ci-test.yml | 7 +++++--
 CHANGES.txt                   | 9 +++++----
 doc/installation.txt          | 2 +-
 3 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index b3f24e2c0..98f505f12 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -257,8 +257,11 @@ jobs:
         run: |
           set -xv
           pip install zstd || true
-          # justhtml supports python 3.10 or newer.
-          pip install justhtml || true
+          # justhtml supports python 3.10 or newer according to pypi
+          # page, but will install on 3.8 (and maybe 3.9) but formats
+          # differently. So skip install if before 3.10.
+          if echo $PYTHON_VERSION | grep '^3\...'; then
+              pip install justhtml || true; fi
           if [[ "$PYTHON_VERSION" != "2."* ]]; then 
               pip install Markdown; fi
 
diff --git a/CHANGES.txt b/CHANGES.txt
index a75bc93ea..183433f3a 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -64,10 +64,11 @@ Features:
   config.ini. (John Rouillard)
 - issue2551152 - added basic PGP setup/use info to admin_guide. (John
   Rouillard)
-- add support for the 'justhtml' html 5 parser library. It is written
-  in pure Python. Used to convert html emails into plain text. Faster
-  then beautifulsoup4 and it passes the html 5 standard browser test
-  suite. Beautifulsoup is still supported. (John Rouillard)
+- add support for the 'justhtml' html 5 parser library for python >=
+  3.10. It is written in pure Python. Used to convert html emails into
+  plain text. Faster then beautifulsoup4 and it passes the html 5
+  standard browser test suite. Beautifulsoup is still supported. (John
+  Rouillard)
 
 2025-07-13 2.5.0
 
diff --git a/doc/installation.txt b/doc/installation.txt
index 78bf4c88c..b50c1f00c 100644
--- a/doc/installation.txt
+++ b/doc/installation.txt
@@ -317,7 +317,7 @@ beautifulsoup, justhtml
   email into plain text, beautifulsoup4_ or justhtml_ can also be
   used. You can choose the converter in the tracker's
   config. Note that justhtml is pure Python, fast and conforms to
-  HTML 5 standards.
+  HTML 5 standards but works only for Python 3.10 or newer.
   
 pywin32 - Windows Service
   You can run Roundup as a Windows service if pywin32_ is installed.

From 4394ff9741a0f6b7bdc87d32f97b3b31981474cb Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 15 Dec 2025 09:44:44 -0500
Subject: [PATCH 347/398] build: bump anchore/scan-action from 7.2.1 to 7.2.2
 (PR #75)

---
 .github/workflows/anchore.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/anchore.yml b/.github/workflows/anchore.yml
index aa510fd51..4e03f1e94 100644
--- a/.github/workflows/anchore.yml
+++ b/.github/workflows/anchore.yml
@@ -43,7 +43,7 @@ jobs:
     - name: List the Docker image
       run: docker image ls
     - name: Run the Anchore scan action itself with GitHub Advanced Security code scanning integration enabled
-      uses: anchore/scan-action@40a61b52209e9d50e87917c5b901783d546b12d0 # 7.2.1
+      uses: anchore/scan-action@3c9a191a0fbab285ca6b8530b5de5a642cba332f # 7.2.2
       id: scan
       with:
         image: "localbuild/testimage:latest"

From 880a685a402e2feba9645f23e01c12e2f56678a9 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 15 Dec 2025 09:45:32 -0500
Subject: [PATCH 348/398] build: bump codecov/codecov-action from 5.5.1 to
 5.5.2 (PR #76)

---
 .github/workflows/ci-test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index 98f505f12..3e8d9ed48 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -328,7 +328,7 @@ jobs:
         
       - name: Upload coverage to Codecov
         # see: https://github.com/codecov/codecov-action#usage
-        uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1
+        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
         with:
           verbose: true
           token: ${{ secrets.CODECOV_TOKEN }}

From 78409c3ceaa7af532064dcf26bcf8525c03491c4 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 15 Dec 2025 09:46:01 -0500
Subject: [PATCH 349/398] build: bump actions/upload-artifact from 5.0.0 to
 6.0.0 (PR #77)

---
 .github/workflows/ossf-scorecard.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ossf-scorecard.yml b/.github/workflows/ossf-scorecard.yml
index a1f84d886..283e488a3 100644
--- a/.github/workflows/ossf-scorecard.yml
+++ b/.github/workflows/ossf-scorecard.yml
@@ -62,7 +62,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: SARIF file
           path: results.sarif

From 40200f2716b9e84355abde308d108393d711e12a Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 15 Dec 2025 17:31:37 -0500
Subject: [PATCH 350/398] bug: supress deprecation warning when importing cgi
 module

cgi was removed in 3.13, but it is vendored in Roundup.
So we don't need to see the warning.
---
 roundup/anypy/cgi_.py | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/roundup/anypy/cgi_.py b/roundup/anypy/cgi_.py
index 6df75c7fd..72df69762 100644
--- a/roundup/anypy/cgi_.py
+++ b/roundup/anypy/cgi_.py
@@ -1,7 +1,10 @@
 # ruff: noqa: F401  - unused imports
+import warnings
 try:
     # used for python2 and python 3 < 3.13
-    import cgi
+    with warnings.catch_warnings():
+        warnings.filterwarnings('ignore', category=DeprecationWarning)
+        import cgi
     from cgi import FieldStorage, MiniFieldStorage
 except ImportError:
     # use for python3 >= 3.13

From 1b247ccb08827d059124db21870ac11f18b9fed3 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 21 Dec 2025 23:59:08 -0500
Subject: [PATCH 351/398] bug: don't reference vendored outside of anypy
 modules

client.py was referencing the vendored.cgi module. This is wrong.
It should pull the vendored.cgi module only via anypy.cgi_.
---
 roundup/cgi/client.py | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/roundup/cgi/client.py b/roundup/cgi/client.py
index 32290f24c..186fa2156 100644
--- a/roundup/cgi/client.py
+++ b/roundup/cgi/client.py
@@ -59,6 +59,7 @@ class SysCallError(Exception):
 from roundup.logcontext import gen_trace_id, store_trace_reason
 from roundup.mailer import Mailer, MessageSendError
 from roundup.mlink_expr import ExpressionError
+from roundup.performance import report_object_use
 
 logger = logging.getLogger('roundup')
 
@@ -585,6 +586,7 @@ def setTranslator(self, translator=None):
 
     @gen_trace_id()
     @store_trace_reason('client_main')
+    @report_object_use(highest=20, pre_collect=False)
     def main(self):
         """ Wrap the real main in a try/finally so we always close off the db.
         """
@@ -1187,9 +1189,15 @@ def determine_language(self):
         # self.language to the desired language !
         self.language = language
 
-        self.setTranslator(TranslationService.get_translation(
+        try:
+            self.setTranslator(TranslationService.get_translation(
                 language,
                 tracker_home=self.instance.config["TRACKER_HOME"]))
+        except IOError as e:
+            logger.error(str(e), extra={"requested_language": language})
+            # failed to set the requested/TRACKER_LANGUAGE language.
+            # Set to en.
+            self.language = ""
 
     def authenticate_bearer_token(self, challenge):
         ''' authenticate the bearer token. Refactored from determine_user()
@@ -1931,7 +1939,7 @@ def reauth(self, exception):
            Can be overridden by code in tracker's interfaces.py.
         """
         
-        from roundup.anypy.vendored.cgi import MiniFieldStorage
+        from roundup.anypy.cgi_ import MiniFieldStorage
 
         original_action = self.form['@action'].value if '@action' \
             in self.form else ""

From 2ff50102d7dceb366983202484c48ee3083ddee0 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 22 Dec 2025 00:08:26 -0500
Subject: [PATCH 352/398] doc: fix typo.

---
 doc/reference.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/reference.txt b/doc/reference.txt
index 8fe8acb0e..d92b23c5c 100644
--- a/doc/reference.txt
+++ b/doc/reference.txt
@@ -1307,7 +1307,7 @@ is added to the db object. As a result, the ``hasattr`` call shown
 above will return True and the Reauth exception is not raised. (Note
 that the value of the ``reauth_done`` attribute is True, so
 ``getattr(db, "reauth_done", False)`` will return True when reauth is
-done and the defile value of False if the attribute is missing. If the
+done and the default value of False if the attribute is missing. If the
 default is not set, `getattr` raises an ``AttributeError`` which might
 be useful for flow control.)
 

From 51db26f303b3d1fa48906a2f8d8d63e465fb0c66 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 22 Dec 2025 01:14:14 -0500
Subject: [PATCH 353/398] chore: ruff whitespace fixes.

---
 roundup/cgi/client.py | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/roundup/cgi/client.py b/roundup/cgi/client.py
index 186fa2156..5a17029ed 100644
--- a/roundup/cgi/client.py
+++ b/roundup/cgi/client.py
@@ -106,6 +106,7 @@ def add_message(msg_list, msg, escape=True):
     msg_list.append(msg)
     return msg_list  # for unittests
 
+
 # if set to False via interfaces.py do not log a warning when
 # xmlrpc is used and defusedxml is not installed.
 WARN_FOR_MISSING_DEFUSEDXML = True
@@ -1938,7 +1939,7 @@ def reauth(self, exception):
 
            Can be overridden by code in tracker's interfaces.py.
         """
-        
+
         from roundup.anypy.cgi_ import MiniFieldStorage
 
         original_action = self.form['@action'].value if '@action' \
@@ -1946,11 +1947,11 @@ def reauth(self, exception):
         original_template = self.template
 
         self.template = 'reauth'
-        self.form.list = [ x for x in self.form.list
-                           if x.name not in ('@action',
-                                             '@csrf',
-                                             '@template'
-                                             )]
+        self.form.list = [x for x in self.form.list
+                          if x.name not in ('@action',
+                                            '@csrf',
+                                            '@template'
+                                            )]
 
         # save the action and template used when the Reauth as
         # triggered. Will be used to resolve the change by the reauth

From 6f5bd00d60cb975efee248837eca90211f0353d1 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 22 Dec 2025 12:21:33 -0500
Subject: [PATCH 354/398] doc: fix bad formatting arg in json logging config
 file.

---
 doc/admin_guide.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/admin_guide.txt b/doc/admin_guide.txt
index bade36d24..4ee64d636 100644
--- a/doc/admin_guide.txt
+++ b/doc/admin_guide.txt
@@ -374,7 +374,7 @@ The commented config is::
     "formatters": {
       // standard format for Roundup messages
       "standard": {
-        "format": "%(asctime)s %(trace_id)s %(levelname)s %(name)s:%(module)s %(msg)s"
+        "format": "%(asctime)s %(trace_id)s %(levelname)s %(name)s:%(module)s %(message)s"
       },
       // Used to dump all log requests in jsonl format.
       // Each json object is on one line. Can be pretty printed

From 22f84a8f54e3f9b720d266a5bdfc74e4561f8ba1 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 22 Dec 2025 12:26:03 -0500
Subject: [PATCH 355/398] doc: add note that we can't incrementally clean old
 records from db

The clean operation can take a while. I considered setting a time
limit so it would clean as many records as it can within a time limit
(e.g. 2 seconds) and then return from clean.

However the callers expect that all old record are removed so that
looking for a matching session key, csrf key etc. will match ONLY
unexpired records. They don't check the __timestamp returned.

So clean MUST destroy all expired records before returning.
---
 roundup/backends/sessions_dbm.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/roundup/backends/sessions_dbm.py b/roundup/backends/sessions_dbm.py
index 5eca055a4..996084846 100644
--- a/roundup/backends/sessions_dbm.py
+++ b/roundup/backends/sessions_dbm.py
@@ -201,6 +201,10 @@ def updateTimestamp(self, sessid):
 
     def clean(self):
         ''' Remove session records that haven't been used for a week. '''
+        ''' Note: deletion of old keys must be completed when this method
+            returns. Calling code must not have any expired keys present
+            after this returns or expired keys could be used to validate
+            a user. This can mean a long delay when expiring but ....'''
         now = time.time()
         week = 60*60*24*7
         a_week_ago = now - week

From f47350a9bbfa46a15e5a29625dda5c88f6ee9322 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Tue, 23 Dec 2025 22:11:23 -0500
Subject: [PATCH 356/398] bug: rearrange test condition to optimize test w/
 most likely to fail first and expensive permission check last

---
 roundup/cgi/client.py | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/roundup/cgi/client.py b/roundup/cgi/client.py
index 5a17029ed..0c1f78bbe 100644
--- a/roundup/cgi/client.py
+++ b/roundup/cgi/client.py
@@ -1404,8 +1404,9 @@ def check_anonymous_access(self):
 
         # allow Anonymous to view the "user" "register" template if they're
         # allowed to register
-        if (self.db.security.hasPermission('Register', self.userid, 'user')
-                and self.classname == 'user' and self.template == 'register'):
+        if (self.template == 'register' and self.classname == 'user'
+            and self.db.security.hasPermission('Register',
+                                               self.userid, 'user')):
             return
 
         # otherwise for everything else

From 22a3d42a69ba15cbbe79ff282900f1289b8cec7b Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 25 Dec 2025 12:14:53 -0500
Subject: [PATCH 357/398] bug: fix mis-commit of perf tests and crash fix for
 setTranslation

The commit  included more than it should have.

It included some memory dump code that is not part of production.

Also removed WIP for fixing crash bug when translation unable to
create .mo file - issue2551405
---
 roundup/cgi/client.py | 10 +---------
 1 file changed, 1 insertion(+), 9 deletions(-)

diff --git a/roundup/cgi/client.py b/roundup/cgi/client.py
index 0c1f78bbe..57cd131e5 100644
--- a/roundup/cgi/client.py
+++ b/roundup/cgi/client.py
@@ -59,7 +59,6 @@ class SysCallError(Exception):
 from roundup.logcontext import gen_trace_id, store_trace_reason
 from roundup.mailer import Mailer, MessageSendError
 from roundup.mlink_expr import ExpressionError
-from roundup.performance import report_object_use
 
 logger = logging.getLogger('roundup')
 
@@ -587,7 +586,6 @@ def setTranslator(self, translator=None):
 
     @gen_trace_id()
     @store_trace_reason('client_main')
-    @report_object_use(highest=20, pre_collect=False)
     def main(self):
         """ Wrap the real main in a try/finally so we always close off the db.
         """
@@ -1190,15 +1188,9 @@ def determine_language(self):
         # self.language to the desired language !
         self.language = language
 
-        try:
-            self.setTranslator(TranslationService.get_translation(
+        self.setTranslator(TranslationService.get_translation(
                 language,
                 tracker_home=self.instance.config["TRACKER_HOME"]))
-        except IOError as e:
-            logger.error(str(e), extra={"requested_language": language})
-            # failed to set the requested/TRACKER_LANGUAGE language.
-            # Set to en.
-            self.language = ""
 
     def authenticate_bearer_token(self, challenge):
         ''' authenticate the bearer token. Refactored from determine_user()

From 3f7c5961a1c8135c46bfbb723e50332e6ce5e805 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 25 Dec 2025 14:04:09 -0500
Subject: [PATCH 358/398] set self.language attribute when translator passed
 into Client()

---
 CHANGES.txt           | 4 +++-
 roundup/cgi/client.py | 9 ++++++---
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index 183433f3a..2365ece24 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -41,7 +41,9 @@ Fixed:
   a multilink link "messages" that does not have a 'name' property
   causes a crash. (found/fix by cmeerw; commit and better handling of
   non-labeled multilink by John Rouillard)
-  
+- in cgi/client.py, set self.language attribute when translator passed
+  into Client(). (John Rouillard)
+
 Features:
 
 - add support for authorized changes. User can be prompted to enter
diff --git a/roundup/cgi/client.py b/roundup/cgi/client.py
index 57cd131e5..faa59bd9e 100644
--- a/roundup/cgi/client.py
+++ b/roundup/cgi/client.py
@@ -452,9 +452,12 @@ def __init__(self, instance, request, env, form=None, translator=None):
         self.env = env
         if translator is not None:
             self.setTranslator(translator)
-            # XXX we should set self.language to "translator"'s language,
-            # but how to get it ?
-            self.language = ""
+            # set self.language to "translator"'s language
+            try:
+                self.language = translator.info()["language"]
+            except (AttributeError, KeyError):
+                # info() missing or no language key
+                self.language = ""
         else:
             self.setTranslator(TranslationService.NullTranslationService())
             self.language = ""  # as is the default from determine_language

From d4752cf82074d7950ed38f1eec3a80c4cca8777d Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Tue, 13 Jan 2026 16:26:33 -0500
Subject: [PATCH 359/398] bump anchore/scan-action from 7.2.2 to 7.2.3 (PR #78)

---
 .github/workflows/anchore.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/anchore.yml b/.github/workflows/anchore.yml
index 4e03f1e94..2e410d197 100644
--- a/.github/workflows/anchore.yml
+++ b/.github/workflows/anchore.yml
@@ -43,7 +43,7 @@ jobs:
     - name: List the Docker image
       run: docker image ls
     - name: Run the Anchore scan action itself with GitHub Advanced Security code scanning integration enabled
-      uses: anchore/scan-action@3c9a191a0fbab285ca6b8530b5de5a642cba332f # 7.2.2
+      uses: anchore/scan-action@62b74fb7bb810d2c45b1865f47a77655621862a5 # 7.2.3
       id: scan
       with:
         image: "localbuild/testimage:latest"

From 0847b68c29757f9d5d30df6c65e5226b4811ec03 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Tue, 27 Jan 2026 21:07:02 -0500
Subject: [PATCH 360/398] bug:  Issue2551393 - keep search name when paginating

Title:  Named searches lose their name in title when next page is selected.

Include dispname in next/prev(ious) URL pagination links in index
pages if dispname is defined.
---
 CHANGES.txt                                   |  2 +
 doc/upgrading.txt                             | 40 +++++++++++++++++++
 .../templates/classic/html/issue.index.html   | 10 ++++-
 .../templates/devel/html/bug.index.html       | 10 ++++-
 .../templates/devel/html/task.index.html      | 10 ++++-
 .../jinja2/html/layout/pagination.html        | 10 ++++-
 .../templates/responsive/html/bug.index.html  | 12 ++++--
 .../templates/responsive/html/task.index.html | 12 ++++--
 8 files changed, 92 insertions(+), 14 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index 2365ece24..77d59d070 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -43,6 +43,8 @@ Fixed:
   non-labeled multilink by John Rouillard)
 - in cgi/client.py, set self.language attribute when translator passed
   into Client(). (John Rouillard)
+- issue2551393 -  Named searches lose their name in title when next
+  page is selected. (John Rouillard)
 
 Features:
 
diff --git a/doc/upgrading.txt b/doc/upgrading.txt
index 8f84c0931..c610b22da 100644
--- a/doc/upgrading.txt
+++ b/doc/upgrading.txt
@@ -137,6 +137,46 @@ The logging format is now a ``config.ini`` parameter in the
 would like the old logging format without having to create a logging
 configuration file. See :ref:`rounduplogging` for details.
 
+Make Pagination Links Keep Search Name (optional)
+-------------------------------------------------
+
+When displaying a named search, index templates don't preserve
+the name when using the pagination (Next/Prev) links. This is
+fixed in the 2.6.0 templates for issues/bugs/tasks. To make the
+change to your templates, look for the pagination links (look for
+prev or previous case insensitive) in your tracker's html
+subdirectory and change::
+
+   request.indexargs_url(request.classname,
+         {'@startwith':prev.first, '@pagesize':prev.size})"
+
+to read::
+
+   request.indexargs_url(request.classname,
+                     dict({'@dispname': request.dispname}
+                     if request.dispname
+                     else {},
+                     **{'@startwith':prev.first, '@pagesize':prev.size}))"
+
+This code will be embedded in templating markup that is not shown
+above. The change above is for your previous/prev link. The
+change for the next pagination link is similar with::
+
+   {'@startwith':next.first, '@pagesize':next.size}
+
+replacing::
+
+    {'@startwith':prev.first, '@pagesize':prev.size}
+
+in the example.
+
+This moves the existing dictionary used to override the URL
+arguments to the second argument inside a ``dict()`` call. It
+also adds ``**`` before it. This change creates a new override
+dictionary that includes an ``@dispname`` parameter if it is set
+in the request. If ``@dispname`` is not set, the existing
+dictionary contents are used.
+
 Support authorized changes in your tracker (optional)
 -----------------------------------------------------
 
diff --git a/share/roundup/templates/classic/html/issue.index.html b/share/roundup/templates/classic/html/issue.index.html
index 5a42f6c96..1df0e4317 100644
--- a/share/roundup/templates/classic/html/issue.index.html
+++ b/share/roundup/templates/classic/html/issue.index.html
@@ -79,7 +79,10 @@
      <th>
       <a tal:define="prev batch/previous" tal:condition="prev"
          tal:attributes="href python:request.indexargs_url(request.classname,
-         {'@startwith':prev.first, '@pagesize':prev.size})"
+                     dict({'@dispname': request.dispname}
+                     if request.dispname
+                     else {},
+                     **{'@startwith':prev.first, '@pagesize':prev.size}))"
          i18n:translate="">&lt;&lt; previous</a>
       &nbsp;
      </th>
@@ -90,7 +93,10 @@
      <th>
       <a tal:define="next batch/next" tal:condition="next"
          tal:attributes="href python:request.indexargs_url(request.classname,
-         {'@startwith':next.first, '@pagesize':next.size})"
+                     dict({'@dispname': request.dispname}
+                     if request.dispname
+                     else {},
+                     **{'@startwith':next.first, '@pagesize':next.size}))"
          i18n:translate="">next &gt;&gt;</a>
       &nbsp;
      </th>
diff --git a/share/roundup/templates/devel/html/bug.index.html b/share/roundup/templates/devel/html/bug.index.html
index 6dec98cb8..468357864 100644
--- a/share/roundup/templates/devel/html/bug.index.html
+++ b/share/roundup/templates/devel/html/bug.index.html
@@ -93,7 +93,10 @@
      <th>
       <a tal:define="prev batch/previous" tal:condition="prev"
          tal:attributes="href python:request.indexargs_url(request.classname,
-         {'@startwith':prev.first, '@pagesize':prev.size})"
+                     dict({'@dispname': request.dispname}
+                     if request.dispname
+                     else {},
+                     **{'@startwith':prev.first, '@pagesize':prev.size}))"
          i18n:translate="">&lt;&lt; previous</a>
       &nbsp;
      </th>
@@ -104,7 +107,10 @@
      <th>
       <a tal:define="next batch/next" tal:condition="next"
          tal:attributes="href python:request.indexargs_url(request.classname,
-         {'@startwith':next.first, '@pagesize':next.size})"
+                     dict({'@dispname': request.dispname}
+                     if request.dispname
+                     else {},
+                     **{'@startwith':next.first, '@pagesize':next.size}))"
          i18n:translate="">next &gt;&gt;</a>
       &nbsp;
      </th>
diff --git a/share/roundup/templates/devel/html/task.index.html b/share/roundup/templates/devel/html/task.index.html
index 7f35f010e..ee8ca7782 100644
--- a/share/roundup/templates/devel/html/task.index.html
+++ b/share/roundup/templates/devel/html/task.index.html
@@ -84,7 +84,10 @@
      <th>
       <a tal:define="prev batch/previous" tal:condition="prev"
          tal:attributes="href python:request.indexargs_url(request.classname,
-         {'@startwith':prev.first, '@pagesize':prev.size})"
+                     dict({'@dispname': request.dispname}
+                     if request.dispname
+                     else {},
+                     **{'@startwith':prev.first, '@pagesize':prev.size}))"
          i18n:translate="">&lt;&lt; previous</a>
       &nbsp;
      </th>
@@ -95,7 +98,10 @@
      <th>
       <a tal:define="next batch/next" tal:condition="next"
          tal:attributes="href python:request.indexargs_url(request.classname,
-         {'@startwith':next.first, '@pagesize':next.size})"
+                     dict({'@dispname': request.dispname}
+                     if request.dispname
+                     else {},
+                     **{'@startwith':next.first, '@pagesize':next.size}))"
          i18n:translate="">next &gt;&gt;</a>
       &nbsp;
      </th>
diff --git a/share/roundup/templates/jinja2/html/layout/pagination.html b/share/roundup/templates/jinja2/html/layout/pagination.html
index 095137493..4281ba42e 100644
--- a/share/roundup/templates/jinja2/html/layout/pagination.html
+++ b/share/roundup/templates/jinja2/html/layout/pagination.html
@@ -4,7 +4,10 @@
     {% if batch and batch.previous %}
       <li class="page-item">
         <a class="page-link" href="{{ request.indexargs_url(request.classname,
-                                   {'@startwith':batch.previous().first, '@pagesize':batch.previous().size}) }}">{% trans %}Previous{% endtrans %}</a>
+                                   dict({'@dispname': request.dispname}
+                                   if request.dispname
+                                   else {},
+                                   **{'@startwith':batch.previous().first, '@pagesize':batch.previous().size})) }}">{% trans %}Previous{% endtrans %}</a>
       </li>
     {% else %}
       <li class='page-item disabled'>
@@ -21,7 +24,10 @@
     {% if batch and batch.next() %}
       <li class="page-item">
         <a class="page-link" href="{{ request.indexargs_url(request.classname,
-                                   {'@startwith':batch.next().first, '@pagesize':batch.next().size}) }}">{% trans %}Next{% endtrans %}</a>
+                                   dict({'@dispname': request.dispname}
+                                   if request.dispname
+                                   else {},
+                                   **{'@startwith':batch.next().first, '@pagesize':batch.next().size})) }}">{% trans %}Next{% endtrans %}</a>
       </li>
     {% else %}
       <li class='page-item disabled'>
diff --git a/share/roundup/templates/responsive/html/bug.index.html b/share/roundup/templates/responsive/html/bug.index.html
index 9a6770a46..bce64136e 100644
--- a/share/roundup/templates/responsive/html/bug.index.html
+++ b/share/roundup/templates/responsive/html/bug.index.html
@@ -82,8 +82,11 @@
     <ul>
       <li tal:define="prev batch/previous" tal:condition="prev" class='disabled'>
         <a tal:define="prev batch/previous" tal:condition="prev"
-         tal:attributes="href python:request.indexargs_url(request.classname,
-         {'@startwith':prev.first, '@pagesize':prev.size})"
+           tal:attributes="href python:request.indexargs_url(request.classname,
+                       dict({'@dispname': request.dispname}
+                       if request.dispname
+                       else {},
+                       **{'@startwith':prev.first, '@pagesize':prev.size}))"
          i18n:translate="">Previous</a>
       </li>
       <li tal:define="prev batch/previous" tal:condition="not:prev" class='disabled'><a href='#' i18n:translate="">Previous</a></li>
@@ -95,7 +98,10 @@
       <li tal:define="next batch/next" tal:condition="next" class='disabled'>
       <a tal:define="next batch/next" tal:condition="next"
          tal:attributes="href python:request.indexargs_url(request.classname,
-         {'@startwith':next.first, '@pagesize':next.size})"
+                     dict({'@dispname': request.dispname}
+                     if request.dispname
+                     else {},
+                     **{'@startwith':next.first, '@pagesize':next.size}))"
          i18n:translate="">Next</a>
       </li>
       <li tal:define="next batch/next" tal:condition="not:next" class='disabled'><a href='#' i18n:translate="">Next</a></li>
diff --git a/share/roundup/templates/responsive/html/task.index.html b/share/roundup/templates/responsive/html/task.index.html
index d015b8ca0..26df3f87f 100644
--- a/share/roundup/templates/responsive/html/task.index.html
+++ b/share/roundup/templates/responsive/html/task.index.html
@@ -76,8 +76,11 @@
     <ul>
       <li tal:define="prev batch/previous" tal:condition="prev" class='disabled'>
         <a tal:define="prev batch/previous" tal:condition="prev"
-         tal:attributes="href python:request.indexargs_url(request.classname,
-         {'@startwith':prev.first, '@pagesize':prev.size})"
+           tal:attributes="href python:request.indexargs_url(request.classname,
+                       dict({'@dispname': request.dispname}
+                       if request.dispname
+                       else {},
+                       **{'@startwith':prev.first, '@pagesize':prev.size}))"
          i18n:translate="">Previous</a>
       </li>
       <li tal:define="prev batch/previous" tal:condition="not:prev" class='disabled'><a href='#' i18n:translate="">Previous</a></li>
@@ -89,7 +92,10 @@
       <li tal:define="next batch/next" tal:condition="next" class='disabled'>
       <a tal:define="next batch/next" tal:condition="next"
          tal:attributes="href python:request.indexargs_url(request.classname,
-         {'@startwith':next.first, '@pagesize':next.size})"
+                     dict({'@dispname': request.dispname}
+                     if request.dispname
+                     else {},
+                     **{'@startwith':next.first, '@pagesize':next.size}))"
          i18n:translate="">Next</a>
       </li>
       <li tal:define="next batch/next" tal:condition="not:next" class='disabled'><a href='#' i18n:translate="">Next</a></li>

From b9d57cbed89078adb9357f114f69498690c4e982 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Tue, 27 Jan 2026 21:40:43 -0500
Subject: [PATCH 361/398] chore(build): bump actions/checkout from 6.0.1 to
 6.0.2 pull #79

---
 .github/workflows/anchore.yml         | 2 +-
 .github/workflows/build-xapian.yml    | 2 +-
 .github/workflows/ci-test.yml         | 2 +-
 .github/workflows/codeql-analysis.yml | 2 +-
 .github/workflows/ossf-scorecard.yml  | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/anchore.yml b/.github/workflows/anchore.yml
index 2e410d197..b271ec806 100644
--- a/.github/workflows/anchore.yml
+++ b/.github/workflows/anchore.yml
@@ -37,7 +37,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout the code
-      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
     - name: Build the Docker image
       run: docker pull python:3-alpine; docker build . --file scripts/Docker/Dockerfile --tag localbuild/testimage:latest
     - name: List the Docker image
diff --git a/.github/workflows/build-xapian.yml b/.github/workflows/build-xapian.yml
index e71f6d082..9b49b5785 100644
--- a/.github/workflows/build-xapian.yml
+++ b/.github/workflows/build-xapian.yml
@@ -42,7 +42,7 @@ jobs:
         # if: {{ false }}
           # continue running if step fails
         # continue-on-error: true
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
         # Setup version of Python to use
       - name: Set Up Python 3.13
diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index 3e8d9ed48..cb7ff8a03 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -116,7 +116,7 @@ jobs:
         # if: {{ false }}
           # continue running if step fails
         # continue-on-error: true
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       # Setup version of Python to use
       - name: Set Up Python ${{ matrix.python-version }}
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index c1702df5d..8d4599924 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -49,7 +49,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
diff --git a/.github/workflows/ossf-scorecard.yml b/.github/workflows/ossf-scorecard.yml
index 283e488a3..85622e1ec 100644
--- a/.github/workflows/ossf-scorecard.yml
+++ b/.github/workflows/ossf-scorecard.yml
@@ -35,7 +35,7 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 

From 7a79324770c2daf90ca7bfc64ed5f46e52e8a746 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Tue, 27 Jan 2026 21:41:37 -0500
Subject: [PATCH 362/398] chore(build): bump anchore/scan-action from 7.2.3 to
 7.3.0 pull #80

---
 .github/workflows/anchore.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/anchore.yml b/.github/workflows/anchore.yml
index b271ec806..76a9e5de4 100644
--- a/.github/workflows/anchore.yml
+++ b/.github/workflows/anchore.yml
@@ -43,7 +43,7 @@ jobs:
     - name: List the Docker image
       run: docker image ls
     - name: Run the Anchore scan action itself with GitHub Advanced Security code scanning integration enabled
-      uses: anchore/scan-action@62b74fb7bb810d2c45b1865f47a77655621862a5 # 7.2.3
+      uses: anchore/scan-action@0d444ed77d83ee2ba7f5ced0d90d640a1281d762 # 7.3.0
       id: scan
       with:
         image: "localbuild/testimage:latest"

From d1a1b9e069a7f6cbd3352f05afa25afc57a6c10b Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Tue, 27 Jan 2026 21:42:34 -0500
Subject: [PATCH 363/398] chore(build): bump actions/setup-python from 6.1.0 to
 6.2.0 pull #81

---
 .github/workflows/build-xapian.yml | 2 +-
 .github/workflows/ci-test.yml      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build-xapian.yml b/.github/workflows/build-xapian.yml
index 9b49b5785..262a542da 100644
--- a/.github/workflows/build-xapian.yml
+++ b/.github/workflows/build-xapian.yml
@@ -46,7 +46,7 @@ jobs:
 
         # Setup version of Python to use
       - name: Set Up Python 3.13
-        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: 3.13
           allow-prereleases: true
diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index cb7ff8a03..d382541d5 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -120,7 +120,7 @@ jobs:
 
       # Setup version of Python to use
       - name: Set Up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: ${{ matrix.python-version }}
           allow-prereleases: true

From b20bf97cc69f69cc29ba332248cb65965bb2e5e2 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Tue, 27 Jan 2026 21:55:27 -0500
Subject: [PATCH 364/398] chore(build) - update python3-alpine version.

alpine 3.23.2 python 3.14.2
---
 scripts/Docker/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/Docker/Dockerfile b/scripts/Docker/Dockerfile
index 1d7b1b57a..2c563987f 100644
--- a/scripts/Docker/Dockerfile
+++ b/scripts/Docker/Dockerfile
@@ -26,7 +26,7 @@ ARG source=local
 # Note this is the index digest for the image, not the manifest digest.
 # The index digest is shared across archetectures (amd64, arm64 etc.)
 # while the manifest digest is unique per platform/arch.
-ARG SHA256=b80c82b1a282283bd3e3cd3c6a4c895d56d1385879c8c82fa673e9eb4d6d4aa5
+ARG SHA256=7af51ebeb83610fb69d633d5c61a2efb87efa4caf66b59862d624bb6ef788345
 
 # Set to any non-empty value to enable shell debugging for troubleshooting
 ARG VERBOSE=

From 34e750061d36d196118b35f7f9bde3ed2a84c539 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Tue, 27 Jan 2026 22:17:17 -0500
Subject: [PATCH 365/398] chore(build): bump anchore/scan-action from 7.2.3 to
 7.3.0 pull #80

---
 .github/workflows/anchore.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/anchore.yml b/.github/workflows/anchore.yml
index 76a9e5de4..69a65ead0 100644
--- a/.github/workflows/anchore.yml
+++ b/.github/workflows/anchore.yml
@@ -43,7 +43,7 @@ jobs:
     - name: List the Docker image
       run: docker image ls
     - name: Run the Anchore scan action itself with GitHub Advanced Security code scanning integration enabled
-      uses: anchore/scan-action@0d444ed77d83ee2ba7f5ced0d90d640a1281d762 # 7.3.0
+      uses: anchore/scan-action@8d2fce09422cd6037e577f4130e9b925e9a37175 # 7.3.1
       id: scan
       with:
         image: "localbuild/testimage:latest"

From 4ac217f7343e204b4b4a4d7da09872229a235b22 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 28 Jan 2026 15:21:02 -0500
Subject: [PATCH 366/398] doc: fix typo and error in check command

change or -> for

In check command replace:

   if user.organisation == issue.organisation:
      return True

with

   return user.organisation == issue.organisation

which returns a real False (not just a falsy None) and is more
pythonic than if X: return True, just return X if False is a valid
value.
---
 doc/reference.txt | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/doc/reference.txt b/doc/reference.txt
index d92b23c5c..48a8151cf 100644
--- a/doc/reference.txt
+++ b/doc/reference.txt
@@ -1820,15 +1820,15 @@ The ``addPermission`` method takes a four optional parameters:
   ``issue`` class and the ``user`` class include a reference to an
   ``organization`` class. Users are permitted to view only those
   issues that are associated with their respective organizations. A
-  check function or this could look like::
+  check function for this could look like::
 
     def view_issue(db, userid, itemid):
         user  = db.user.getnode(userid)
         if not user.organisation:
             return False
         issue = db.issue.getnode(itemid)
-        if user.organisation == issue.organisation:
-            return True
+        return user.organisation == issue.organisation
+
 
   The corresponding ``filter`` function::
 

From 79f56e68424445b01d5ceae85ec12be1dffd5ed5 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 28 Jan 2026 15:22:53 -0500
Subject: [PATCH 367/398] doc: change layout to work with sphinx 9.x api
 change.

Replace removed construct with new one so sphinx 9.x doesn't throw an
error.  Works back to sphinx 6.x.
---
 website/www/_templates/layout.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/website/www/_templates/layout.html b/website/www/_templates/layout.html
index e40290fb6..ea1206b70 100644
--- a/website/www/_templates/layout.html
+++ b/website/www/_templates/layout.html
@@ -151,7 +151,7 @@
     <link rel="stylesheet" href="{{ pathto('_static/pygments.css', 1) }}" type="text/css" />
     {%- for cssfile in css_files %}
     <!-- loading css_files -->
-    <link rel="stylesheet" href="{{ pathto(cssfile, 1) }}" type="text/css" />
+    <link rel="stylesheet" href="{{ cssfile.filename }}" type="text/css" />
     {%- endfor %}
     <script>
       /* locally hosted goatcounter https://www.goatcounter.com/ */

From 97e5ddffc8248cf1637c6290b6100cbd4bf7eb0e Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 2 Feb 2026 23:41:36 -0500
Subject: [PATCH 368/398] bug: move import findargspec out of Permission
 __init__ method

We have a few places where imports are done inside a method/function.
For methods that are called once it's not an issue but the Permissions
__init__ method is called often and accounts for > 10% of the time in
the __init__ function when looking at wsgi-lineprof output.

So move it to the module level.
---
 roundup/security.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roundup/security.py b/roundup/security.py
index 3e5afb597..016e3455a 100644
--- a/roundup/security.py
+++ b/roundup/security.py
@@ -6,6 +6,7 @@
 import weakref
 
 from roundup import hyperdb, support
+from roundup.anypy import findargspec
 
 logger = logging.getLogger('roundup.security')
 
@@ -74,7 +75,6 @@ class Permission:
 
     def __init__(self, name='', description='', klass=None,
                  properties=None, check=None, props_only=None, filter=None):
-        from roundup.anypy import findargspec
         self.name = name
         self.description = description
         self.klass = klass

From d79e28e43c9a0bb596d64e75dd844677e42ddbdc Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 19 Feb 2026 21:48:55 -0500
Subject: [PATCH 369/398] chore: ruff spacing fixups, flow control and import
 reordering/removal

---
 roundup/scripts/roundup_mailgw.py | 42 +++++++++++++++++--------------
 1 file changed, 23 insertions(+), 19 deletions(-)

diff --git a/roundup/scripts/roundup_mailgw.py b/roundup/scripts/roundup_mailgw.py
index 01c6e1d2a..88a788be0 100644
--- a/roundup/scripts/roundup_mailgw.py
+++ b/roundup/scripts/roundup_mailgw.py
@@ -17,14 +17,19 @@
 """Command-line script stub that calls the roundup.mailgw.
 """
 from __future__ import print_function
+
 __docformat__ = 'restructuredtext'
 
 
-# --- patch sys.path to make sure 'import roundup' finds correct version
-import sys
+import netrc
+import os
 import os.path as osp
+import re
+import socket
+import sys
 from argparse import ArgumentParser, RawDescriptionHelpFormatter
 
+# --- patch sys.path to make sure 'import roundup' finds correct version
 thisdir = osp.dirname(osp.abspath(__file__))
 rootdir = osp.dirname(osp.dirname(thisdir))
 if (osp.exists(thisdir + '/__init__.py') and
@@ -33,16 +38,13 @@
     sys.path.insert(0, rootdir)
 # --/
 
+# Python version check run for side effect.
+# Aborts program if Python version too old.
+from roundup import version_check  # noqa: E402 F401 I001
 
-# python version check
-from roundup import version_check
-from roundup import __version__ as roundup_version
-
-import sys, os, re, getopt, socket, netrc
-
-from roundup import mailgw
-from roundup.i18n import _
-
+from roundup import __version__ as roundup_version  # noqa: E402
+from roundup import mailgw   # noqa: E402
+from roundup.i18n import _   # noqa: E402
 
 usage_epilog = """
 The roundup mail gateway may be called in one of the following ways:
@@ -140,6 +142,7 @@
 
 """
 
+
 def parse_arguments(argv):
     '''Handle the arguments to the program
     '''
@@ -164,13 +167,14 @@ def parse_arguments(argv):
             'organizations/oauth2/v2.0/token')
     return cmd, cmd.parse_args(argv)
 
+
 def main(argv):
     '''Handle the arguments to the program and initialise environment.
     '''
     cmd, args = parse_arguments(argv)
     if args.version:
         print('%s (python %s)' % (roundup_version, sys.version.split()[0]))
-        return
+        return None
 
     # figure the instance home
     if len(args.args) > 0:
@@ -234,17 +238,17 @@ def main(argv):
     if source.startswith('pop'):
         ssl = source.endswith('s')
         return handler.do_pop(server, username, password, ssl)
-    elif source == 'apop':
+    if source == 'apop':
         return handler.do_apop(server, username, password)
-    elif source.startswith('imap'):
+    if source.startswith('imap'):
         d = {}
         if source.endswith('s'):
-            d.update(ssl = 1)
+            d.update(ssl=1)
         elif source.endswith('s_cram'):
-            d.update(ssl = 1, cram = 1)
+            d.update(ssl=1, cram=1)
         elif source == 'imaps_oauth':
-            d.update(ssl = 1, oauth = 1, oauth_path = args.oauth_directory)
-            d.update(token_endpoint = args.oauth_token_endpoint)
+            d.update(ssl=1, oauth=1, oauth_path=args.oauth_directory)
+            d.update(token_endpoint=args.oauth_token_endpoint)
         mailbox = ''
         if len(args.args) > 3:
             mailbox = args.args[3]
@@ -257,7 +261,7 @@ def main(argv):
 
 
 def run():
-    sys.exit(main(sys.argv [1:]))
+    sys.exit(main(sys.argv[1:]))
 
 
 # call main

From 2d502dbf4d5d95b3a242762cbd9152253134cbf9 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 19 Feb 2026 22:15:12 -0500
Subject: [PATCH 370/398] refactor/bug: handle case where netrc returns None.

pyrefly flagged this. Python 3.14 (and 2.7) says authenticators()
returns None if there is no matching host.  Also the original
exceptions IOError and TypeError appear to not be valid in this
context.

Rewrite to scope FileNotFoundError if .netrc is missing to just the
one method call. Handle rest of flow with if/else not exception
jump.
---
 roundup/scripts/roundup_mailgw.py | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/roundup/scripts/roundup_mailgw.py b/roundup/scripts/roundup_mailgw.py
index 88a788be0..e899b1421 100644
--- a/roundup/scripts/roundup_mailgw.py
+++ b/roundup/scripts/roundup_mailgw.py
@@ -215,15 +215,20 @@ def main(argv):
 
     # the source will be a network server, so obtain the credentials to
     # use in connecting to the server
+    authenticator = None
     try:
         # attempt to obtain credentials from a ~/.netrc file
+        # returns None if host not found
         authenticator = netrc.netrc().authenticators(specification)
+    except FileNotFoundError:
+        # FileNotFoundError if no ~/.netrc file
+        pass
+
+    if authenticator:
         username = authenticator[0]
         password = authenticator[2]
         server = specification
-        # IOError if no ~/.netrc file, TypeError if the hostname
-        # not found in the ~/.netrc file:
-    except (IOError, TypeError):
+    else:
         match = re.match(r'((?P<user>[^:]+)(:(?P<pass>.+))?@)?(?P<server>.+)',
                          specification)
         if match:

From 4a479f1d95ab227ced9e5ea2a7f59bd8f89384af Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 19 Feb 2026 22:24:17 -0500
Subject: [PATCH 371/398] chore: ruff cleanup.

---
 roundup/scripts/roundup_gettext.py | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/roundup/scripts/roundup_gettext.py b/roundup/scripts/roundup_gettext.py
index 0ce115882..e5f448e89 100644
--- a/roundup/scripts/roundup_gettext.py
+++ b/roundup/scripts/roundup_gettext.py
@@ -7,12 +7,11 @@
 from __future__ import print_function
 
 import os
-
-# --- patch sys.path to make sure 'import roundup' finds correct version
 import os.path as osp
 import sys
 import tempfile
 
+# --- patch sys.path to make sure 'import roundup' finds correct version
 thisdir = osp.dirname(osp.abspath(__file__))
 rootdir = osp.dirname(osp.dirname(thisdir))
 if (osp.exists(thisdir + '/__init__.py') and
@@ -21,11 +20,10 @@
     sys.path.insert(0, rootdir)
 # --/
 
-from roundup.anypy import scandir_
-from roundup import configuration
-from roundup.cgi.TAL import talgettext
-from roundup.i18n import _
-from roundup.pygettext import TokenEater, make_escapes, tokenize
+from roundup import configuration  # noqa: E402
+from roundup.cgi.TAL import talgettext  # noqa: E402
+from roundup.i18n import _  # noqa: E402
+from roundup.pygettext import TokenEater, make_escapes, tokenize  # noqa: E402
 
 try:
     import polib

From e89d13fa4c8517db739d0206e9b2b929deef316b Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 19 Feb 2026 22:30:24 -0500
Subject: [PATCH 372/398] bug: remove socket setdefaulttimeout call.

I have no idea why that is here. Admin AFAIK doesn't use socket.
Copypasta maybe?
---
 roundup/scripts/roundup_admin.py | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/roundup/scripts/roundup_admin.py b/roundup/scripts/roundup_admin.py
index 234f5dc4b..4a6843dd6 100644
--- a/roundup/scripts/roundup_admin.py
+++ b/roundup/scripts/roundup_admin.py
@@ -40,10 +40,6 @@
 
 
 def run():
-    # time out after a minute if we can
-    import socket
-    if hasattr(socket, 'setdefaulttimeout'):
-        socket.setdefaulttimeout(60)
     tool = AdminTool()
     sys.exit(tool.main())
 

From 9d5ec1bbf1e62a8ce300a2338dc8e8b34002a69c Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Fri, 20 Feb 2026 16:27:21 -0500
Subject: [PATCH 373/398] refactor: remove unused import

i18n's _ function is not used in the wrapper. Don't import it.
---
 roundup/scripts/roundup_admin.py | 1 -
 1 file changed, 1 deletion(-)

diff --git a/roundup/scripts/roundup_admin.py b/roundup/scripts/roundup_admin.py
index 4a6843dd6..9fb34e6cf 100644
--- a/roundup/scripts/roundup_admin.py
+++ b/roundup/scripts/roundup_admin.py
@@ -36,7 +36,6 @@
 
 # import the admin tool guts and make it go
 from roundup.admin import AdminTool
-from roundup.i18n import _
 
 
 def run():

From f1ed2ea26be9d5b7e12b9c8102b92a7a570e6590 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Fri, 20 Feb 2026 16:30:50 -0500
Subject: [PATCH 374/398] ruff: exclusions on imports

ignore import locations and import used for side effect
---
 roundup/scripts/roundup_admin.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/roundup/scripts/roundup_admin.py b/roundup/scripts/roundup_admin.py
index 9fb34e6cf..86f1fdbae 100644
--- a/roundup/scripts/roundup_admin.py
+++ b/roundup/scripts/roundup_admin.py
@@ -32,10 +32,10 @@
 
 
 # python version check - import exits if version invalid
-from roundup import version_check  # noqa: F401
+from roundup import version_check  # noqa: E402 F401
 
 # import the admin tool guts and make it go
-from roundup.admin import AdminTool
+from roundup.admin import AdminTool  # noqa: E402
 
 
 def run():

From 86d7de706f83dd9df5486deeeb6acc2005ee02fb Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 23 Feb 2026 20:13:40 -0500
Subject: [PATCH 375/398] chore(build): build(deps): bump anchore/scan-action
 from 7.3.1 to 7.3.2 pull #82

---
 .github/workflows/anchore.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/anchore.yml b/.github/workflows/anchore.yml
index 69a65ead0..18aca61a6 100644
--- a/.github/workflows/anchore.yml
+++ b/.github/workflows/anchore.yml
@@ -43,7 +43,7 @@ jobs:
     - name: List the Docker image
       run: docker image ls
     - name: Run the Anchore scan action itself with GitHub Advanced Security code scanning integration enabled
-      uses: anchore/scan-action@8d2fce09422cd6037e577f4130e9b925e9a37175 # 7.3.1
+      uses: anchore/scan-action@7037fa011853d5a11690026fb85feee79f4c946c # 7.3.2
       id: scan
       with:
         image: "localbuild/testimage:latest"

From a1a1e95c4a4c4723e9345cf4ea0fc2d5f8be0580 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 26 Feb 2026 09:46:02 -0500
Subject: [PATCH 376/398] fix: replace except: with except Exception: (by
 haosenwang1018@github)

Remove bare 'except:' statements replace with 'except Exception'.

In roundup_xmlrpc_server.py I changed Exception to BaseException so
the database gets closed on signals as well. The rest of the changes
do not look like they affect data integrity and are commited as
supplied.
---
 CHANGES.txt                               | 2 ++
 frontends/ZRoundup/ZRoundup.py            | 2 +-
 roundup/anypy/vendored/cgi.py             | 4 ++--
 roundup/backends/rdbms_common.py          | 4 ++--
 roundup/cgi/PageTemplates/PageTemplate.py | 6 +++---
 roundup/cgi/PageTemplates/PythonExpr.py   | 2 +-
 roundup/cgi/TAL/DummyEngine.py            | 2 +-
 roundup/cgi/TAL/TALInterpreter.py         | 2 +-
 roundup/cgi/ZTUtils/Iterator.py           | 2 +-
 roundup/cgi/templating.py                 | 2 +-
 roundup/dist/command/build.py             | 2 +-
 roundup/scripts/roundup_xmlrpc_server.py  | 2 +-
 scripts/copy-user.py                      | 4 ++--
 scripts/imapServer.py                     | 4 ++--
 scripts/import_sf.py                      | 2 +-
 test/test_locking.py                      | 2 +-
 tools/load_tracker.py                     | 2 +-
 tools/migrate-queries.py                  | 2 +-
 18 files changed, 25 insertions(+), 23 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index 77d59d070..e6a28e53b 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -45,6 +45,8 @@ Fixed:
   into Client(). (John Rouillard)
 - issue2551393 -  Named searches lose their name in title when next
   page is selected. (John Rouillard)
+- code cleanup replace bare except: with except Exception:. (patch by
+  Sense_wang (haosenwang1018) applied by John Rouillard)
 
 Features:
 
diff --git a/frontends/ZRoundup/ZRoundup.py b/frontends/ZRoundup/ZRoundup.py
index b349e2469..27b35b296 100644
--- a/frontends/ZRoundup/ZRoundup.py
+++ b/frontends/ZRoundup/ZRoundup.py
@@ -210,7 +210,7 @@ def index_html(self, REQUEST=None):
         except client.NotFound:
             raise Exception('NotFound ' + REQUEST.URL)
             pass
-        except:
+        except Exception:
             import traceback
             traceback.print_exc()
             # all other exceptions in roundup are valid
diff --git a/roundup/anypy/vendored/cgi.py b/roundup/anypy/vendored/cgi.py
index caebe57e9..8964ff0da 100755
--- a/roundup/anypy/vendored/cgi.py
+++ b/roundup/anypy/vendored/cgi.py
@@ -870,7 +870,7 @@ def g(f=f):
             f()
         print("<H3>What follows is a test, not an actual exception:</H3>")
         g()
-    except:
+    except Exception:
         print_exception()
 
     print("<H1>Second try with a small maxlen...</H1>")
@@ -883,7 +883,7 @@ def g(f=f):
         print_arguments()
         print_form(form)
         print_environ(environ)
-    except:
+    except Exception:
         print_exception()
 
 def print_exception(type=None, value=None, tb=None, limit=None):
diff --git a/roundup/backends/rdbms_common.py b/roundup/backends/rdbms_common.py
index 771afecc7..e50f86ba4 100644
--- a/roundup/backends/rdbms_common.py
+++ b/roundup/backends/rdbms_common.py
@@ -2612,7 +2612,7 @@ def collect_values(n):
             e.context['class'] = pln
             e.context['attr'] = prp
             raise
-        except:
+        except Exception:
             pass
         # Fallback to original code
         args = []
@@ -2693,7 +2693,7 @@ def collect_values(n):
             e.context['class'] = classname
             e.context['attr'] = proptree.name
             raise
-        except:
+        except Exception:
             # fallback behavior when expression parsing above fails
             orclause = ''
             if '-1' in v:
diff --git a/roundup/cgi/PageTemplates/PageTemplate.py b/roundup/cgi/PageTemplates/PageTemplate.py
index 13333dc8e..bbc9895d4 100644
--- a/roundup/cgi/PageTemplates/PageTemplate.py
+++ b/roundup/cgi/PageTemplates/PageTemplate.py
@@ -106,7 +106,7 @@ def pt_errors(self):
         if not self.expand: return
         try:
             self.pt_render(source=1)
-        except:
+        except Exception:
             return ('Macro expansion failed', '%s: %s' % sys.exc_info()[:2])
 
     def pt_warnings(self):
@@ -147,7 +147,7 @@ def read(self):
                 return self._text
             try:
                 return self.pt_render(source=1)
-            except:
+            except Exception:
                 return ('%s\n Macro expansion failed\n %s\n-->\n%s' %
                         (self._error_start, "%s: %s" % sys.exc_info()[:2],
                          self._text) )
@@ -177,7 +177,7 @@ def _cook(self):
         try:
             parser.parseString(self._text)
             self._v_program, self._v_macros = parser.getCode()
-        except:
+        except Exception:
             self._v_errors = ["Compilation failed",
                               "%s: %s" % sys.exc_info()[:2]]
         self._v_warnings = parser.getWarnings()
diff --git a/roundup/cgi/PageTemplates/PythonExpr.py b/roundup/cgi/PageTemplates/PythonExpr.py
index 2243c51f4..b13478270 100644
--- a/roundup/cgi/PageTemplates/PythonExpr.py
+++ b/roundup/cgi/PageTemplates/PythonExpr.py
@@ -36,7 +36,7 @@ def __init__(self, name, expr, engine):
             self.f_code = 'def f():\n return %s\n' % expr.strip()
             exec(self.f_code, d)
             self._f = d['f']
-        except:
+        except Exception:
             raise CompilerError(('Python expression error:\n'
                                  '%s: %s') % exc_info()[:2])
         self._get_used_names()
diff --git a/roundup/cgi/TAL/DummyEngine.py b/roundup/cgi/TAL/DummyEngine.py
index 58a5d9415..94137695b 100644
--- a/roundup/cgi/TAL/DummyEngine.py
+++ b/roundup/cgi/TAL/DummyEngine.py
@@ -118,7 +118,7 @@ def evaluate(self, expression):
         if type == "python":
             try:
                 return eval(expr, self.globals, self.locals)
-            except:
+            except Exception:
                 raise TALESError("evaluation error in %s" % repr(expr))
         if type == "position":
             # Insert the current source file name, line number,
diff --git a/roundup/cgi/TAL/TALInterpreter.py b/roundup/cgi/TAL/TALInterpreter.py
index 27d7e6c77..2bbd12d1c 100644
--- a/roundup/cgi/TAL/TALInterpreter.py
+++ b/roundup/cgi/TAL/TALInterpreter.py
@@ -724,7 +724,7 @@ def do_onError_tal(self, block_handler):
         self._stream_write = stream.write
         try:
             self.interpret(block)
-        except:
+        except Exception:
             exc = sys.exc_info()[1]
             self.restoreState(state)
             engine = self.engine
diff --git a/roundup/cgi/ZTUtils/Iterator.py b/roundup/cgi/ZTUtils/Iterator.py
index ed1e458a2..225330687 100644
--- a/roundup/cgi/ZTUtils/Iterator.py
+++ b/roundup/cgi/ZTUtils/Iterator.py
@@ -189,7 +189,7 @@ def _supports(self, ob):
         try:
             if hasattr(ob, 'next') and (ob is iter(ob)):
                 return 1
-        except:
+        except Exception:
             return 0
 
     def prep_next(self, it):
diff --git a/roundup/cgi/templating.py b/roundup/cgi/templating.py
index b0b53f62b..fb1f2caeb 100644
--- a/roundup/cgi/templating.py
+++ b/roundup/cgi/templating.py
@@ -2717,7 +2717,7 @@ def __init__(self, *args, **kwargs):
             # ignore these errors to preserve user input
             try:
                 display_value.sort(key=keyfun)
-            except:
+            except Exception:
                 pass
             self._value = display_value
 
diff --git a/roundup/dist/command/build.py b/roundup/dist/command/build.py
index 1f2c5f7db..b02163bd2 100644
--- a/roundup/dist/command/build.py
+++ b/roundup/dist/command/build.py
@@ -30,7 +30,7 @@ def check_manifest():
     manifest_file = 'roundup.egg-info/SOURCES.txt'
     try:
         f=open(manifest_file)
-    except:
+    except Exception:
         print('\n*** SOURCE WARNING: The MANIFEST file "%s" is missing!' % manifest_file)
         return
     try:
diff --git a/roundup/scripts/roundup_xmlrpc_server.py b/roundup/scripts/roundup_xmlrpc_server.py
index f9847aa5d..be54155c6 100644
--- a/roundup/scripts/roundup_xmlrpc_server.py
+++ b/roundup/scripts/roundup_xmlrpc_server.py
@@ -105,7 +105,7 @@ def do_POST(self):
             SimpleXMLRPCRequestHandler.do_POST(self)
         except Unauthorised as message:
             self.send_error(403, '%s (%s)' % (self.path, message))
-        except:
+        except BaseException:
             if db:
                 db.close()
             exc, val, tb = sys.exc_info()
diff --git a/scripts/copy-user.py b/scripts/copy-user.py
index 6b49ea552..9189017d8 100755
--- a/scripts/copy-user.py
+++ b/scripts/copy-user.py
@@ -31,14 +31,14 @@ def copy_user(home1, home2, *userids):
     try:
         instance1 = roundup.instance.open(home1)
         print("Opened source instance: %s" % home1)
-    except:
+    except Exception:
         print("Can't open source instance: %s" % home1)
         sys.exit(1)
 
     try:
         instance2 = roundup.instance.open(home2)
         print("Opened target instance: %s" % home2)
-    except:
+    except Exception:
         print("Can't open target instance: %s" % home2)
         sys.exit(1)
 
diff --git a/scripts/imapServer.py b/scripts/imapServer.py
index c19811425..675233e51 100644
--- a/scripts/imapServer.py
+++ b/scripts/imapServer.py
@@ -225,7 +225,7 @@ def checkBoxes(self):
 
                             # We are done with this mailbox
                             serv.close()
-                    except:
+                    except Exception:
                         log.exception('Exception with server %s user %s',
                             server, user)
                         noErrors = False
@@ -233,7 +233,7 @@ def checkBoxes(self):
                     serv.logout()
                     serv.shutdown()
                     del serv
-            except:
+            except Exception:
                 log.exception('Exception while connecting to %s', server)
                 noErrors = False
         return noErrors
diff --git a/scripts/import_sf.py b/scripts/import_sf.py
index bb93f8827..cd743a05a 100644
--- a/scripts/import_sf.py
+++ b/scripts/import_sf.py
@@ -299,7 +299,7 @@ def to_date(ts):
                         f = open(os.path.join(file_dir, fid), 'rb')
                         content = f.read()
                         f.close()
-                    except:
+                    except Exception:
                         content = 'content missing'
                     file_data.append({
                         'id': fid,
diff --git a/test/test_locking.py b/test/test_locking.py
index 5f59bec2c..f0b0fb9ca 100644
--- a/test/test_locking.py
+++ b/test/test_locking.py
@@ -33,7 +33,7 @@ def xtest_basics(self):
         f = acquire_lock(self.path)
         try:
             acquire_lock(self.path, block=0)
-        except:
+        except Exception:
             pass
         else:
             raise AssertionError('no exception')
diff --git a/tools/load_tracker.py b/tools/load_tracker.py
index b3da1394f..755a51fe8 100755
--- a/tools/load_tracker.py
+++ b/tools/load_tracker.py
@@ -55,7 +55,7 @@
 try:
     try:
         db.user.lookup('alpha0')
-    except:
+    except Exception:
         # add some users
         M = N//100
         for i in range(M):
diff --git a/tools/migrate-queries.py b/tools/migrate-queries.py
index 3cfad27a1..221dd284d 100644
--- a/tools/migrate-queries.py
+++ b/tools/migrate-queries.py
@@ -22,7 +22,7 @@
     # Do some basic exception handling to catch bad arguments.
     try:
         instance = roundup.instance.open(home)
-    except:
+    except Exception:
         print('Cannot open instance home directory %s!' % home)
         continue
 

From 4ec909833b619261fed307ebd7c1ba3132a43831 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 1 Mar 2026 21:39:44 -0500
Subject: [PATCH 377/398] chore(build) - update python3-alpine version.

---
 scripts/Docker/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/Docker/Dockerfile b/scripts/Docker/Dockerfile
index 2c563987f..57571fff9 100644
--- a/scripts/Docker/Dockerfile
+++ b/scripts/Docker/Dockerfile
@@ -26,7 +26,7 @@ ARG source=local
 # Note this is the index digest for the image, not the manifest digest.
 # The index digest is shared across archetectures (amd64, arm64 etc.)
 # while the manifest digest is unique per platform/arch.
-ARG SHA256=7af51ebeb83610fb69d633d5c61a2efb87efa4caf66b59862d624bb6ef788345
+ARG SHA256=faee120f7885a06fcc9677922331391fa690d911c020abb9e8025ff3d908e510
 
 # Set to any non-empty value to enable shell debugging for troubleshooting
 ARG VERBOSE=

From 78bfa46a8db68a79084687cf65979ca7e5379ec5 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sat, 7 Mar 2026 19:25:22 -0500
Subject: [PATCH 378/398] bug: fix case where null json value for datetime
 fails

Json like:

{
  "assignedto": "3",
  "duedate": null,
  "files": [],
  "keyword": [],
  "messages": [
    "4",
    "13"
  ],
  "nosy": [],
  "priority": "2",
  "status": "3",
  "superseder": [],
  "title": "issue title"
}

is produced by a GET request using verbose=0. When submitted to the
rest interface results in:

  property duedate: 'None' is an invalid date (Not a date spec: 'None'
  ("yyyy-mm-dd", "mm-dd", "HH:MM", "HH:MM:SS" or "yyyy-mm-dd.HH:MM:SS.SSS"

Fix FsValue to map null to the None object rather than 'None' string.
---
 roundup/rest.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/roundup/rest.py b/roundup/rest.py
index 9de60b1ae..5f89a4222 100644
--- a/roundup/rest.py
+++ b/roundup/rest.py
@@ -2782,6 +2782,8 @@ def __init__(self, name, val):
             elif isinstance(val, type([])):
                 # then lists of strings
                 self.value = [u2s(v) for v in val]
+            elif val is None:
+                self.value = None
             else:
                 # then stringify anything else (int, float)
                 self.value = str(val)

From 8b9ee642e93d3497ea0f3bba836e1aaf74ed3a01 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Tue, 10 Mar 2026 22:52:54 -0400
Subject: [PATCH 379/398] chore(build): bump actions/upload-artifact from 6.0.0
 to 7.0.0. #84

---
 .github/workflows/ossf-scorecard.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ossf-scorecard.yml b/.github/workflows/ossf-scorecard.yml
index 85622e1ec..5bfa6d50a 100644
--- a/.github/workflows/ossf-scorecard.yml
+++ b/.github/workflows/ossf-scorecard.yml
@@ -62,7 +62,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: SARIF file
           path: results.sarif

From 19642314ffa7378f179f9dca11b76a578b8405cc Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 18 Mar 2026 10:55:17 -0400
Subject: [PATCH 380/398] chore: replaced writer_name with writer in call to
 ReStructuredText

Was generating:

roundup/cgi/templating.py:1889: PendingDeprecationWarning: Argument
"writer_name" will be removed in Docutils 2.0.  Specify writer name in
the "writer" argument.  return u2s(ReStructuredText(
---
 roundup/cgi/templating.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roundup/cgi/templating.py b/roundup/cgi/templating.py
index fb1f2caeb..adbf332b6 100644
--- a/roundup/cgi/templating.py
+++ b/roundup/cgi/templating.py
@@ -1887,7 +1887,7 @@ def rst(self, hyperlink=1):
                     raise
 
         return u2s(ReStructuredText(
-            s, writer_name="html",
+            s, writer="html",
             settings_overrides=self.rst_defaults)["html_body"])
 
     def markdown(self, hyperlink=1):

From f254d18e157fd89094bd738ce2664ba6e297b0fe Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 18 Mar 2026 11:11:03 -0400
Subject: [PATCH 381/398] test: handle failing email signature removal test
 differently

The comment for the test is:

    # This fails because the sig isn't removed (we currently remove the
    # sig only if the delimiter is the first line in a section)

Originally the test was decorated so it didn't run at all and reported
PASSED. The decorator also returned the value 0. This caused a
deprecation warning:

  test/test_mailgw.py::MailgwTestCase::testEmailQuotingRemove3
  /usr/lib/python3.12/unittest/case.py:690: DeprecationWarning: It is
  deprecated to return a value that is not None from a test case [...]

Better to handle it using pytest xfail so if we start stripping the
signature we get a failure.

This does mean the tests get an xfail registered, but I am ok with
that.  I added "OK" to the reason to indicate it was expected.
---
 test/test_mailgw.py | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/test/test_mailgw.py b/test/test_mailgw.py
index b6a626c20..e05160826 100644
--- a/test/test_mailgw.py
+++ b/test/test_mailgw.py
@@ -60,12 +60,6 @@
 from roundup.test import memorydb
 from .cmp_helper import StringFragmentCmpHelper
 
-def expectedFailure(method):
-    """ For marking a failing test.
-        This will *not* run the test and return success instead.
-    """
-    return lambda x: 0
-
 
 def get_body(message):
     if not message.is_multipart():
@@ -3706,7 +3700,7 @@ def testEmailQuotingRemove2(self):
 
     # This fails because the sig isn't removed (we currently remove the
     # sig only if the delimiter is the first line in a section)
-    @expectedFailure
+    @pytest.mark.xfail(reason="OK: sig not removed - delim not first section line")
     def testEmailQuotingRemove3(self):
         self.instance.config.EMAIL_KEEP_QUOTED_TEXT = 'yes'
         self.innerTestQuoting(self.thirdquotingtest,

From f3cc213d76a806be67ca94e0bbbeed270ef984d9 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 18 Mar 2026 17:24:14 -0400
Subject: [PATCH 382/398] bug: using 'null' value for attributes causes error.

In rest.py, filter out any attributes that are set to 'None'.

GET on an endpoint can return 'null' values when the attribute is
unset. E.G. for a user:

{
            "address": "baddy@example.com",
            "alternate_addresses": null,
            "last_login": "2026-03-18.05:57:09",
            "organisation": null,
            "password": null,
            "phone": null,
            "queries": [],
            "realname": "Fred Jones",
            "roles": "User",
            "timezone": null,
            "username": "badeggs"
        }

But this json can not be submitted to a PUT or POST endpoint. The
validators for passwords, strings, integers etc. don't expect a None
value.

This change handles attributes with "null" (None) values in json
objects by filtering them from the python object before processing.

The null value can't be used to unset an attribute via PUT or POST.

The 'remove' action using the PATCH verb can unset the value.

Also there appears to be some missing checks in the back_anydbm and
rdbms_common files for the password type. All the other types have a
check:

 value is not None and not isinstance(.....)

but passwords only have the 'not isinstance(....)' part. Not sure why
this was the case.  Looking at commit history didn't make me think it
was intentional.
---
 CHANGES.txt                      | 7 +++++++
 roundup/backends/back_anydbm.py  | 4 ++--
 roundup/backends/rdbms_common.py | 4 ++--
 roundup/rest.py                  | 8 +++++++-
 4 files changed, 18 insertions(+), 5 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index e6a28e53b..df1b3765f 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -47,6 +47,13 @@ Fixed:
   page is selected. (John Rouillard)
 - code cleanup replace bare except: with except Exception:. (patch by
   Sense_wang (haosenwang1018) applied by John Rouillard)
+- handle "null" values in json objects sent to a rest endpoint by
+  filtering them from the object before processing. A "null" value
+  will not unset an attribute. The 'remove' action using the
+  PATCH verb can unset the value. Before this change "null" values
+  retrieved from the REST interface would cause errors when sent
+  using POST or PUT verbs. Also guard against password being set to
+  None. (John Rouillard)
 
 Features:
 
diff --git a/roundup/backends/back_anydbm.py b/roundup/backends/back_anydbm.py
index ca02f1717..0b52403c5 100644
--- a/roundup/backends/back_anydbm.py
+++ b/roundup/backends/back_anydbm.py
@@ -984,7 +984,7 @@ def create_inner(self, **propvalues):
                         (self.classname, newid, key), value)
 
             elif isinstance(prop, hyperdb.Password):
-                if not isinstance(value, password.Password):
+                if value is not None and not isinstance(value, password.Password):
                     raise TypeError('new property "%s" not a Password' % key)
 
             elif isinstance(prop, hyperdb.Date):
@@ -1344,7 +1344,7 @@ def set_inner(self, nodeid, **propvalues):
                         value)
 
             elif isinstance(prop, hyperdb.Password):
-                if not isinstance(value, password.Password):
+                if value is not None and not isinstance(value, password.Password):
                     raise TypeError('new property "%s" not a '
                                     'Password' % propname)
                 propvalues[propname] = value
diff --git a/roundup/backends/rdbms_common.py b/roundup/backends/rdbms_common.py
index e50f86ba4..0f8cfe531 100644
--- a/roundup/backends/rdbms_common.py
+++ b/roundup/backends/rdbms_common.py
@@ -1818,7 +1818,7 @@ def create_inner(self, **propvalues):
                                              value)
 
             elif isinstance(prop, Password):
-                if not isinstance(value, password.Password):
+                if value is not None and not isinstance(value, password.Password):
                     raise TypeError('new property "%s" not a Password' % key)
 
             elif isinstance(prop, Date):
@@ -2132,7 +2132,7 @@ def set_inner(self, nodeid, **propvalues):
                         (self.classname, nodeid, propname), value)
 
             elif isinstance(prop, Password):
-                if not isinstance(value, password.Password):
+                if value is not None and not isinstance(value, password.Password):
                     raise TypeError(
                         'new property "%s" not a Password' % propname)
                 propvalues[propname] = value
diff --git a/roundup/rest.py b/roundup/rest.py
index 5f89a4222..1627eaa12 100644
--- a/roundup/rest.py
+++ b/roundup/rest.py
@@ -34,6 +34,7 @@
 from roundup.exceptions import Reject, UsageError
 from roundup.i18n import _
 from roundup.rate_limit import Gcra, RateLimit
+from roundup.timer import timer
 
 logger = logging.getLogger('roundup.rest')
 
@@ -2432,6 +2433,8 @@ def determine_output_format(self, uri):
                      "acceptable": ", ".join(sorted(
                          self.__accepted_content_type.keys()))}))
 
+    @timer(name="rest_dispatch", tag="args[2]",
+           writer=logging.getLogger('roundup.timer').error)
     def dispatch(self, method, uri, input_payload):
         """format and process the request"""
         output = None
@@ -2747,6 +2750,8 @@ class SimulateFieldStorageFromJson():
 
     __slots__ = ("json_dict", "value")
 
+    @timer(name="simultateFieldStorage", tag="args[1][:10]",
+           writer=logging.getLogger('roundup.timer').error)
     def __init__(self, json_string):
         '''Parse the json string into an internal dict.
 
@@ -2765,7 +2770,8 @@ def raise_error_on_constant(x):
             self.json_dict = json.loads(json_string,
                                     parse_constant=raise_error_on_constant)
             self.value = [self.FsValue(index, self.json_dict[index])
-                          for index in self.json_dict]
+                          for index in self.json_dict if
+                          self.json_dict[index] is not None]
         except (JSONDecodeError, ValueError) as e:
             raise ValueError(e.args[0] + ". JSON is: " + json_string)
 

From abad13d66af7d4cceab8990bbec112a152286051 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 18 Mar 2026 17:49:16 -0400
Subject: [PATCH 383/398] bug: make web page follow login_empty_passwords
 setting.

remove the required attribute from password input in the the html
templates if login_empty_passwords is enabled in config.ini.

Also document in upgrading.txt.
---
 CHANGES.txt                                   |  3 ++
 doc/upgrading.txt                             | 43 +++++++++++++++++++
 .../roundup/templates/classic/html/page.html  |  5 ++-
 share/roundup/templates/devel/html/page.html  |  4 +-
 .../jinja2/html/layout/navigation.html        |  2 +-
 .../roundup/templates/minimal/html/page.html  |  5 ++-
 .../templates/responsive/html/page.html       |  4 +-
 7 files changed, 61 insertions(+), 5 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index df1b3765f..7488c1c27 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -54,6 +54,9 @@ Fixed:
   retrieved from the REST interface would cause errors when sent
   using POST or PUT verbs. Also guard against password being set to
   None. (John Rouillard)
+- change the html templates so that the password is not required if
+  the ``login_empty_passwords`` setting is enabled in ``config.ini``.
+  Directions for your tracker are in upgrading.txt. (John Rouillard)
 
 Features:
 
diff --git a/doc/upgrading.txt b/doc/upgrading.txt
index c610b22da..08e66fc0c 100644
--- a/doc/upgrading.txt
+++ b/doc/upgrading.txt
@@ -237,6 +237,49 @@ with::
   
 in the ``html/page.html`` file in your tracker.
 
+Allow users without a password to log in (optional)
+---------------------------------------------------
+
+You can configure a tracker to allow a login without a password.
+However the default html templates require the password field to
+be filled in. This prevents a login with an empty password.
+
+If you don't want to allow a login without a password, you can
+skip this section.
+
+This change automatically removes the required attribute if the
+``config.ini`` ``login_empty_passwords`` setting is enabled
+(true). The default is disabled with the value ``no``).
+
+This change is the default for the tracker templates in 2.6 and
+newer.
+
+To add this to your tracker, change the ``page.html`` (for TAL
+based trackers) or ``layout/navigation.html (for jinja2 trackers).
+
+For TAL trackers, replace the ``required`` parameter by finding
+the following password input in the tracker's ``html/page.html``
+file::
+
+  <input size="10" spellcheck="false" type="password" required name="__login_password"><br>
+
+and modifying it to look like::
+
+  <input size="10" spellcheck="false" type="password"
+         tal:attributes="required python: 'required'
+               if not db.config.WEB_LOGIN_EMPTY_PASSWORDS else nothing"
+         name="__login_password"><br>
+
+The equivalent change for jinja2's
+``html/layout/navigation.html`` based template starts with::
+
+  <input class="form-control form-control-sm" spellcheck="false" type="password" required name="__login_password" placeholder='password'>
+
+and changes to::
+
+  <input class="form-control form-control-sm" spellcheck="false" type="password" name="__login_password" placeholder='password' {{ "required" if not db.config.WEB_LOGIN_EMPTY_PASSWORDS }}>
+
+
 .. index:: Upgrading; 2.4.0 to 2.5.0
 
 Migrating from 2.4.0 to 2.5.0
diff --git a/share/roundup/templates/classic/html/page.html b/share/roundup/templates/classic/html/page.html
index 1ad239644..4f76cf6fe 100644
--- a/share/roundup/templates/classic/html/page.html
+++ b/share/roundup/templates/classic/html/page.html
@@ -132,7 +132,10 @@ <h2><span metal:define-slot="body_title">body title</span></h2>
    <p class="userblock">
     <b i18n:translate="">Login</b><br>
     <input size="10" required name="__login_name"><br>
-    <input size="10" spellcheck="false" type="password" required name="__login_password"><br>
+    <input size="10" spellcheck="false" type="password"
+	   tal:attributes="required python: 'required'
+		 if not db.config.WEB_LOGIN_EMPTY_PASSWORDS else nothing"
+	   name="__login_password"><br>
     <input type="hidden" name="@action" value="Login">
     <input type="checkbox" name="remember" id="remember">
     <label for="remember" i18n:translate="">Remember me?</label><br>
diff --git a/share/roundup/templates/devel/html/page.html b/share/roundup/templates/devel/html/page.html
index c21375f41..3f00e6c7f 100644
--- a/share/roundup/templates/devel/html/page.html
+++ b/share/roundup/templates/devel/html/page.html
@@ -163,7 +163,9 @@ <h1><a href="/">Roundup Demo Tracker</a></h1>
         <li>
          <tal:span i18n:translate="">Login</tal:span><br/>
          <input size="10" required name="__login_name"/><br/>
-         <input size="10" spellcheck="false" type="password" required name="__login_password"/><br/>
+         <input size="10" spellcheck="false" type="password" required name="__login_password"
+		tal:attributes="required python: 'required'
+		 if not db.config.WEB_LOGIN_EMPTY_PASSWORDS else nothing"/><br/>
 	 <input name="@csrf" type="hidden"
 		tal:attributes="value python:utils.anti_csrf_nonce()">
          <input type="hidden" name="@action" value="Login"/>
diff --git a/share/roundup/templates/jinja2/html/layout/navigation.html b/share/roundup/templates/jinja2/html/layout/navigation.html
index f507a26aa..73d19b560 100644
--- a/share/roundup/templates/jinja2/html/layout/navigation.html
+++ b/share/roundup/templates/jinja2/html/layout/navigation.html
@@ -113,7 +113,7 @@
         <input class="form-control form-control-sm" type='text' required name="__login_name" placeholder='username'>
       </li>
       <li class="nav-item">
-        <input class="form-control form-control-sm" spellcheck="false" type="password" required name="__login_password" placeholder='password'>
+        <input class="form-control form-control-sm" spellcheck="false" type="password" name="__login_password" placeholder='password' {{ "required" if not db.config.WEB_LOGIN_EMPTY_PASSWORDS }}>
       </li>
       <li class="nav-item">
         <label class="form-control form-control-sm" class='checkbox'>
diff --git a/share/roundup/templates/minimal/html/page.html b/share/roundup/templates/minimal/html/page.html
index 0dbde6d85..ffb1264bd 100644
--- a/share/roundup/templates/minimal/html/page.html
+++ b/share/roundup/templates/minimal/html/page.html
@@ -130,7 +130,10 @@ <h2><span metal:define-slot="body_title">body title</span></h2>
    <p class="userblock">
     <b i18n:translate="">Login</b><br>
     <input size="10" required name="__login_name"><br>
-    <input size="10" type="password" spellcheck="false" required name="__login_password"><br>
+    <input size="10" type="password" spellcheck="false"
+	   tal:attributes="required python: 'required'
+		 if not db.config.WEB_LOGIN_EMPTY_PASSWORDS else nothing"
+	   name="__login_password"><br>
     <input name="@csrf" type="hidden"
            tal:attributes="value python:utils.anti_csrf_nonce()">
     <input type="hidden" name="@action" value="Login">
diff --git a/share/roundup/templates/responsive/html/page.html b/share/roundup/templates/responsive/html/page.html
index b7689ef5f..80abd42bf 100644
--- a/share/roundup/templates/responsive/html/page.html
+++ b/share/roundup/templates/responsive/html/page.html
@@ -178,7 +178,9 @@
                 <fieldset>
                   <legend><i class='icon-user'></i>Login form</legend>
                   <input name="__login_name" type='text' placeholder='Username' i18n:attributes="placeholder" required>
-                  <input spellcheck="false" type="password" name="__login_password" placeholder='Password' i18n:attributes="placeholder" required>
+                  <input spellcheck="false" type="password" name="__login_password" placeholder='Password' i18n:attributes="placeholder"
+			 tal:attributes="required python: 'required'
+		 if not db.config.WEB_LOGIN_EMPTY_PASSWORDS else nothing">
 		  <input name="@csrf" type="hidden"
 			 tal:attributes="value python:utils.anti_csrf_nonce()">
                   <input type="hidden" name="@action" value="Login"/>

From 7878f1671551cf1d6be9af1d9780c8964d5df04d Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sat, 21 Mar 2026 21:40:57 -0400
Subject: [PATCH 384/398] bug: remove performance and tracing decorators.

Accidently commited as part of 8534:1f8492d68aca rest.py change.
---
 roundup/rest.py | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/roundup/rest.py b/roundup/rest.py
index 1627eaa12..cb200deab 100644
--- a/roundup/rest.py
+++ b/roundup/rest.py
@@ -34,7 +34,6 @@
 from roundup.exceptions import Reject, UsageError
 from roundup.i18n import _
 from roundup.rate_limit import Gcra, RateLimit
-from roundup.timer import timer
 
 logger = logging.getLogger('roundup.rest')
 
@@ -2433,8 +2432,6 @@ def determine_output_format(self, uri):
                      "acceptable": ", ".join(sorted(
                          self.__accepted_content_type.keys()))}))
 
-    @timer(name="rest_dispatch", tag="args[2]",
-           writer=logging.getLogger('roundup.timer').error)
     def dispatch(self, method, uri, input_payload):
         """format and process the request"""
         output = None
@@ -2750,8 +2747,6 @@ class SimulateFieldStorageFromJson():
 
     __slots__ = ("json_dict", "value")
 
-    @timer(name="simultateFieldStorage", tag="args[1][:10]",
-           writer=logging.getLogger('roundup.timer').error)
     def __init__(self, json_string):
         '''Parse the json string into an internal dict.
 

From d28b32dea2480943e4e8b62e22ced6887801ec3b Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sat, 21 Mar 2026 23:49:14 -0400
Subject: [PATCH 385/398] bug: fix replacement for param writer_name -> writer
 correctly.

Use the html4css1 writer for now. If you use the html5_polyglot you
end up with:

  <main>
  processed rst
  </main>

rather than (html4css1 writer's):

  <div class="document">
  processed rst
  </div>

there can only be one <main> per document.  Each message must not be
inside a <main> tag.

I could string munge the main tag to a div. But that's ugly.  The
correct way is to subclass html5_polyglot and override the
HTMLTrnslator::documenttag_args replacing {'tagname': 'main'} with
{'tagname': 'div', "CLASS": "document"} or something similar.

That's a change for another time.
---
 roundup/cgi/templating.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/roundup/cgi/templating.py b/roundup/cgi/templating.py
index adbf332b6..69487546b 100644
--- a/roundup/cgi/templating.py
+++ b/roundup/cgi/templating.py
@@ -40,6 +40,7 @@
 
 try:
     from docutils.core import publish_parts as ReStructuredText
+    from docutils.writers.html4css1 import Writer as html_writer
 except ImportError:
     ReStructuredText = None
 try:
@@ -1887,7 +1888,7 @@ def rst(self, hyperlink=1):
                     raise
 
         return u2s(ReStructuredText(
-            s, writer="html",
+            s, writer=html_writer(),
             settings_overrides=self.rst_defaults)["html_body"])
 
     def markdown(self, hyperlink=1):

From 0adbfb8e2cd2e836e87388cb5dfa3219775ef3e3 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 22 Mar 2026 22:39:40 -0400
Subject: [PATCH 386/398] build(deps): bump codecov/codecov-action from 5.5.2
 to 5.5.3 #85

---
 .github/workflows/ci-test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index d382541d5..fe73e6082 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -328,7 +328,7 @@ jobs:
         
       - name: Upload coverage to Codecov
         # see: https://github.com/codecov/codecov-action#usage
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad # v5.5.3
         with:
           verbose: true
           token: ${{ secrets.CODECOV_TOKEN }}

From c96f57f6728ada1e313a15d99c5798f3c5f30bbc Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 22 Mar 2026 22:40:11 -0400
Subject: [PATCH 387/398] build(deps): bump anchore/scan-action from 7.3.2 to
 7.4.0  #86

---
 .github/workflows/anchore.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/anchore.yml b/.github/workflows/anchore.yml
index 18aca61a6..e0ba3d102 100644
--- a/.github/workflows/anchore.yml
+++ b/.github/workflows/anchore.yml
@@ -43,7 +43,7 @@ jobs:
     - name: List the Docker image
       run: docker image ls
     - name: Run the Anchore scan action itself with GitHub Advanced Security code scanning integration enabled
-      uses: anchore/scan-action@7037fa011853d5a11690026fb85feee79f4c946c # 7.3.2
+      uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # 7.4.0
       id: scan
       with:
         image: "localbuild/testimage:latest"

From f147bec852959df702563d21a5f0e5b50cee3ff8 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 23 Mar 2026 13:18:41 -0400
Subject: [PATCH 388/398] bug: fix traceback in roundup-admin init with bad
 config values

initialize accepts setting values for config.ini file settings. If
they are not valid, you got a python traceback.


ConfigurationError exceptions are now trapped. The admin.py's
usageError_feedback method is used to inform the user. Also the
feedback message now starts with a newline making it easier to read by
separating it from command that caused the issue.
---
 CHANGES.txt      | 7 ++++++-
 roundup/admin.py | 8 ++++++--
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index 7488c1c27..755a85ab7 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -57,7 +57,12 @@ Fixed:
 - change the html templates so that the password is not required if
   the ``login_empty_passwords`` setting is enabled in ``config.ini``.
   Directions for your tracker are in upgrading.txt. (John Rouillard)
-
+- fix traceback displayed when roundup-admin install was used with
+  invalid settings for config.ini. It now reports the error and
+  provides the usage output. Also usage output starts with a newline
+  to provide a blank line between the command and the output to
+  improve readability. (John Rouillard)
+  
 Features:
 
 - add support for authorized changes. User can be prompted to enter
diff --git a/roundup/admin.py b/roundup/admin.py
index 446b13f2c..0e89d934d 100644
--- a/roundup/admin.py
+++ b/roundup/admin.py
@@ -39,6 +39,7 @@
 from roundup.anypy.my_input import my_input
 from roundup.anypy.strings import repr_export
 from roundup.configuration import (
+    ConfigurationError,
     CoreConfig,
     NoConfigError,
     Option,
@@ -1488,7 +1489,10 @@ def do_install(self, tracker_home, args):
             defns[k] = template_config[k]
 
         # install!
-        init.install(tracker_home, templates[template]['path'], settings=defns)
+        try:
+            init.install(tracker_home, templates[template]['path'], settings=defns)
+        except ConfigurationError as e:
+            raise UsageError(e)
 
         # Remove config_ini.ini file from tracker_home (not template dir).
         # Ignore file not found - not all templates have
@@ -2350,7 +2354,7 @@ def do_updateconfig(self, args):
         self.do_genconfig(args, update=True)
 
     def usageError_feedback(self, message, function):
-        print(_('Error: %s') % message)
+        print(_('\nError: %s') % message)
         print()
         print(function.__doc__)
         return 1

From f63e4edfb375a4b7393899e41a5ecfa664c21f47 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 23 Mar 2026 22:22:24 -0400
Subject: [PATCH 389/398] bug: import/importables fail to set newid correctly.

Looks like I broke import when I was fixing a scandir
issue. Overindented a couple of lines. This prevented the next used id
from being set properly.

It also resulted in wierd output when importing (bunches of newlines).

Also fixed the two export/import tests to verify the new nextid for
all the classes is equal or higher than the old one. Ideally they
should be equal, but there is a bug somewhere where we get a double
increment in the export/import cycle dropping a number or two.
---
 CHANGES.txt          |  3 +++
 roundup/admin.py     |  8 +++++---
 test/db_test_base.py | 27 +++++++++++++++++++++++++++
 3 files changed, 35 insertions(+), 3 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index 755a85ab7..7f72d29c7 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -62,6 +62,9 @@ Fixed:
   provides the usage output. Also usage output starts with a newline
   to provide a blank line between the command and the output to
   improve readability. (John Rouillard)
+- fix bug in 2.5.0 where roundup-admin import (or importtable) fails
+  to properly set the next available id for the class. (John Rouillard
+  broke it and fixed it 8-))
   
 Features:
 
diff --git a/roundup/admin.py b/roundup/admin.py
index 0e89d934d..b88bfa354 100644
--- a/roundup/admin.py
+++ b/roundup/admin.py
@@ -1317,6 +1317,7 @@ def import_class(self, filepath, csv_format_class, hyperdb_class,
             file_props = None
             # loop through the file and create a node for each entry
             for n, r in enumerate(reader):
+                # read the file header
                 if file_props is None:
                     file_props = r
                     continue
@@ -1330,10 +1331,11 @@ def import_class(self, filepath, csv_format_class, hyperdb_class,
                 nodeid = hyperdb_class.import_list(file_props, r)
                 if hasattr(hyperdb_class, 'import_files') and import_files:
                     hyperdb_class.import_files(import_dir, nodeid)
-                    maxid = max(maxid, int(nodeid))
+                
+                maxid = max(maxid, int(nodeid))
 
-                # (print to sys.stdout here to allow tests to squash it .. ugh)
-                print(file=sys.stdout)
+            # (print to sys.stdout here to allow tests to squash it .. ugh)
+            print(file=sys.stdout)
 
         return maxid
 
diff --git a/test/db_test_base.py b/test/db_test_base.py
index 038383db8..958ed6edb 100644
--- a/test/db_test_base.py
+++ b/test/db_test_base.py
@@ -3231,6 +3231,9 @@ def testImportExport(self):
                 for name in klass.getprops().keys():
                     it[name] = klass.get(id, name)
 
+        # record the newid from the original database
+        orig_newid = {cn: self.db.newid(cn) for cn in self.db.classes.keys()}
+        
         os.mkdir('_test_export')
         try:
             # grab the export
@@ -3356,6 +3359,16 @@ def testImportExport(self):
                 rj.sort(key = NoneAndDictComparable)
                 ae(oj, rj)
 
+        # compare the newid's. The new database must always have
+        # newid that is greater or equal to the old newid. Ideally
+        # they should be equal but there is a latent bug where the restored
+        # newid is 1 or 2 higher than the old one.
+        for classname, newid in orig_newid.items():
+            self.assertGreaterEqual(
+                self.db.newid(classname), newid,
+                msg="When comparing newid values for classname:old_val:"
+                " %s:%s" % (classname, newid))
+
         # make sure the retired items are actually imported
         ae(self.db.user.get('4', 'username'), 'blop')
         ae(self.db.issue.get('2', 'title'), 'issue two')
@@ -3376,6 +3389,10 @@ def testAdminImportExport(self):
         self.db.config.CSV_FIELD_SIZE = 400
         self.db.commit()
         output = []
+
+        # record the newid from the original database
+        orig_newid = {cn: self.db.newid(cn) for cn in self.db.classes.keys()}
+
         # ugly hack to get stderr output and disable stdout output
         # during regression test. Depends on roundup.admin not using
         # anything but stdout/stderr from sys (which is currently the
@@ -3426,6 +3443,16 @@ def stderrwrite(s):
 
             # verify the data is loaded.
             self.db.user.getnode("5").values()
+
+            # compare the newid's. The new database must always have
+            # newid that is greater or equal to the old newid. Ideally
+            # they should be equal but there is a latent bug where the restored
+            # newid is 1 or 2 higher than the old one.
+            for classname, newid in orig_newid.items():
+                self.assertGreaterEqual(
+                    self.db.newid(classname), newid,
+                    msg="When comparing newid values for "
+                    "classname:old_val: %s:%s" % (classname, newid))
         finally:
             roundup.admin.sys = sys
             shutil.rmtree('_test_export')

From 264d42d07fee8fda0cf61f34d32cc0233f8add16 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Tue, 24 Mar 2026 16:56:38 -0400
Subject: [PATCH 390/398] perf: dereference methods before using in loop

I have a few comprehensions where I use self.FsValue and
self.json_dict.

Assign self.X to a variable and use the variable in the
comprehension. This may provide a little speedup since the lookup is
done once.
---
 roundup/rest.py | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/roundup/rest.py b/roundup/rest.py
index cb200deab..4b03ab9b3 100644
--- a/roundup/rest.py
+++ b/roundup/rest.py
@@ -2761,12 +2761,14 @@ def raise_error_on_constant(x):
             self.value = None
             return
 
+        fsvalue = self.FsValue
         try:
             self.json_dict = json.loads(json_string,
                                     parse_constant=raise_error_on_constant)
-            self.value = [self.FsValue(index, self.json_dict[index])
-                          for index in self.json_dict if
-                          self.json_dict[index] is not None]
+            json_dict = self.json_dict
+            self.value = [fsvalue(index, json_dict[index])
+                          for index in json_dict if
+                          json_dict[index] is not None]
         except (JSONDecodeError, ValueError) as e:
             raise ValueError(e.args[0] + ". JSON is: " + json_string)
 

From 5a72d8ca2a0ff0bbf028ad5cc231890e7ad8b3b5 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Tue, 24 Mar 2026 21:30:47 -0400
Subject: [PATCH 391/398] refactor: rework mime type comparison and clean code

rest.py:

accept application/* as match for application/json in non
/binary_context rest path.

allow defining default mime type to return when file/message is
missing mime type. Make it a class variable to it can be changed from
text/plain to text/markdown or whatever.

extract code from determine_output_format() to create
create_valid_content_types() method which returns a list of matching
mime types for a given type/subtype.

Eliminate mostly duplicate return statements by introducing a variable
to specify valid mime types in error message.

rest_common.py:

Fix error messages that now return application/* as valid mime type.

CHANGES.txt upgrading.txt rest.txt:

top level notes and corrections.

Also correct rst syntax on earlier change.
---
 CHANGES.txt         |   5 +-
 doc/rest.txt        |  19 ++++--
 doc/upgrading.txt   |  25 ++++++-
 roundup/rest.py     | 157 ++++++++++++++++++++++++++++++--------------
 test/rest_common.py |  24 +++----
 5 files changed, 160 insertions(+), 70 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index 7f72d29c7..e57318bae 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -65,7 +65,10 @@ Fixed:
 - fix bug in 2.5.0 where roundup-admin import (or importtable) fails
   to properly set the next available id for the class. (John Rouillard
   broke it and fixed it 8-))
-  
+- refactor mime detection/handling in the rest interface. Better
+  supports some mime types, ads default mime type for files without a
+  mime type (e.g. message contents). Cleaner code. (John Rouillard)
+
 Features:
 
 - add support for authorized changes. User can be prompted to enter
diff --git a/doc/rest.txt b/doc/rest.txt
index b9163e0a7..3521a386e 100644
--- a/doc/rest.txt
+++ b/doc/rest.txt
@@ -945,12 +945,13 @@ with ``Content-Type: application/json`` and a (4x larger) json encoded
 representation of the binary data.
 
 If you want it returned with a ``Content-Type: image/png`` header,
-you can use ``image/png`` or ``*/*`` in the Accept header.
+you can use ``image/png``, ``image/*``, or ``*/*`` in the Accept header.
 
 For message files, you can use
 ``https://.../demo/rest/data/msg/23/binary_content`` with ``Accept:
 application/octet-stream; q=0.5, application/json; q=0.4, image/png;
-q=0.495, text/*``. It will return the plain text of the message.
+q=0.495, text/*``. It will return the plain text (text/plain mime
+type) of the message.
 
 Most message files are not stored with a mime type. Getting
 ``https://.../demo/rest/data/msg/23/type`` returns::
@@ -972,10 +973,16 @@ Messages are meant to be human readable, so the mime type ``text/*``
 can be used to access any text style mime type (``text/plain``,
 ``text/x-rst``, ``text/markdown``, ``text/html``, ...) or an empty
 mime type. If the item's type is not empty, it will be used as the
-Content-Type (similar to ``*/*``). Otherwise ``text/*`` will be the
-Content-Type. If your tracker supports markup languages
-(e.g. markdown), you should set the mime type (e.g. ``text/markdown``)
-when storing your message.
+Content-Type (similar to ``*/*``). Otherwise the default mime type
+``text/plain`` will be the Content-Type. The default mime type can be
+changed using ``interfaces.py`` in your tracker. So you can change the
+default ``text/plain`` to ``text/markdown`` using::
+
+   from roundup.rest import RestfulInstance
+   RestfulInstance.default_text_file_mimetype = "text/markdown"
+
+If your tracker supports markup languages (e.g. markdown), you should
+set the mime type (e.g. ``text/markdown``) when storing your message.
 
 Note that the header ``X-Content-Type-Options: nosniff`` is returned
 with a non javascript or xml binary_content response to prevent the
diff --git a/doc/upgrading.txt b/doc/upgrading.txt
index 08e66fc0c..ff8e7627c 100644
--- a/doc/upgrading.txt
+++ b/doc/upgrading.txt
@@ -255,7 +255,7 @@ This change is the default for the tracker templates in 2.6 and
 newer.
 
 To add this to your tracker, change the ``page.html`` (for TAL
-based trackers) or ``layout/navigation.html (for jinja2 trackers).
+based trackers) or ``layout/navigation.html`` (for jinja2 trackers).
 
 For TAL trackers, replace the ``required`` parameter by finding
 the following password input in the tracker's ``html/page.html``
@@ -279,6 +279,29 @@ and changes to::
 
   <input class="form-control form-control-sm" spellcheck="false" type="password" name="__login_password" placeholder='password' {{ "required" if not db.config.WEB_LOGIN_EMPTY_PASSWORDS }}>
 
+REST interface changes (info)
+-----------------------------
+
+The default type of a message file (the msg class) is now
+``text/plain``.  This can be change to a different mime type using
+`the interfaces.py file`_. See `the rest documentation on getting file
+content for details <rest.html#getting-message-and-files-content>`_.
+
+Roundup supports a wildcard mime type. So ``text/*`` would match any
+text resource. The response to this request should have a full mime
+type like ``text/plain`` or ``text/csv`` etc. However Roundup used to
+return ``text/*`` which makes it difficult for the client to interpret
+the data. This release should do a better job of returning a proper
+subtype replacing the ``*``.
+
+The mime type of ``application/*`` resolves to ``application/json`` by
+default. Using it before resulted in an error.
+
+Malformed mime types assigned to files/messages could cause a crash,
+now they are just ignored.
+
+There have been some internal refactorings and improvements in the
+REST code that will make it a bit faster.
 
 .. index:: Upgrading; 2.4.0 to 2.5.0
 
diff --git a/roundup/rest.py b/roundup/rest.py
index 4b03ab9b3..653933a3b 100644
--- a/roundup/rest.py
+++ b/roundup/rest.py
@@ -441,6 +441,7 @@ class RestfulInstance(object):
     __default_patch_op = "replace"  # default operator for PATCH method
     __accepted_content_type = {
         "application/json": "json",
+        "application/*": "json"     # json is preferred over application/xml
     }
     __default_accept_type = "json"
 
@@ -449,6 +450,11 @@ class RestfulInstance(object):
 
     api_version = None
 
+    # to allow override from interfaces.py.
+    # Used for msg class. Could
+    # be useful to set to text/markdown.
+    default_text_file_mimetype = "text/plain"
+
     # allow 10M row response - can change using interfaces.py
     # limit is 1 less than this size.
     max_response_row_size = 10000001
@@ -2227,6 +2233,78 @@ def handle_apiRateLimitExceeded(self, apiRateLimit):
             # human may read it
         ), None)
 
+    def create_valid_content_types(self, mime_type):
+        """Return a list of mime types matching the submitted mime_type.
+
+           For a MIME type of type/subtype return a list that matches:
+
+              type/subtype
+              type/*
+              application/octet-stream
+              */*
+
+           If mime_type for the file is empty return:
+
+               ["text/plain", "text/*", "application/octet-stream", */*]
+
+           Issue messages (msg) often are missing a mime type. So we
+           treat them text/plain. text/plain is the value of
+           RestfulInterface.default_text_file_mimetype. This can be
+           changed.
+
+           The first mime type in the list is usually used as the
+           Content-Type in the http response.
+
+        """
+        valid_binary_content_types = []
+
+        if mime_type:
+            # strip off MIME parameters. We may do param matching
+            # in the future but not now.
+            mime_type, *_more = mime_type.split(';')
+            # remove spaces in case they snuck in.
+            mime_type = mime_type.strip()
+            # Put the mime_type first. If the user is requesting a
+            # specific type/subtype we will match on first item.
+            # Also first item is returned as Content-type/accept_type.
+            valid_binary_content_types.append(mime_type)
+
+            # For mime type main_type/subtype add main_type/*
+            try:
+                (main_type, _subtype) = mime_type.split('/', 2)
+            except ValueError:
+                # malformed mime type, 0, 2+ '/' chars
+                # don't add anything
+                pass
+            else:
+                valid_binary_content_types.append(main_type + "/*")
+
+        if not mime_type:
+            # allow text/* as msg items can have empty type field
+            # also match text/* for text/plain, text/x-rst,
+            # text/markdown, text/html etc.
+            #
+            # Ideally we would know the subtype.
+            #
+            # text/plain works for most messages, but
+            # text/markdown could be valid for a modified tracker.
+            #
+            # Value can be overridden by interfaces.py, but consider
+            # adding config setting for the default file mime type.
+            valid_binary_content_types.append(self.default_text_file_mimetype)
+            valid_binary_content_types.append("text/*")
+
+        # Octet-stream should be allowed for any content.
+        # If mime_type unparsable, the file will get the
+        # Content-Type of application/octet-stream as this will
+        # be the first element of the returned list.
+        valid_binary_content_types.append("application/octet-stream")
+
+        # */* should be allowed for any content.
+        valid_binary_content_types.append("*/*")
+
+        return valid_binary_content_types
+
     def determine_output_format(self, uri):
         """Returns tuple of:
 
@@ -2287,10 +2365,10 @@ def determine_output_format(self, uri):
                         _("Content type '%(requested)s' requested in URL is "
                           "not available.\nAcceptable types: "
                           "%(acceptable)s\n") %
-                        { "requested": ext_type,
-                          "acceptable": ", ".join(sorted(
-                              set(self.__accepted_content_type.values())))}))
-            
+                        {"requested": ext_type,
+                         "acceptable": ", ".join(sorted(
+                             set(self.__accepted_content_type.values())))}))
+
             # strip extension so uri makes sense.
             # E.G. .../issue.json -> .../issue
             uri = uri[:-(len(ext_type) + 1)]
@@ -2317,12 +2395,12 @@ def determine_output_format(self, uri):
             return (self.__default_accept_type, uri, None)
 
         accept_type = ""
-        valid_binary_content_types = []
+        valid_binary_content_types = None
         if uri.endswith("/binary_content"):
             request_path = uri
             request_class, request_id = request_path.split('/')[-3:-1]
             try:
-                designator_type = self.db.getclass(
+                declared_type = self.db.getclass(
                     request_class).get(request_id, "type")
             except (KeyError, IndexError):
                 # class (KeyError) or
@@ -2331,28 +2409,14 @@ def determine_output_format(self, uri):
                 # The 400/404 error will be thrown by other code.
                 return (None, uri, None)
 
-            if designator_type:
-                # put this first as we usually require exact mime
-                # type match and this will be matched most often.
-                # Also for text/* Accept header it will be returned.
-                valid_binary_content_types.append(designator_type)
-
-            if not designator_type or designator_type.startswith('text/'):
-                # allow text/* as msg items can have empty type field
-                # also match text/* for text/plain, text/x-rst,
-                # text/markdown, text/html etc.
-                valid_binary_content_types.append("text/*")
-
-            # Octet-stream should be allowed for any content.
-            # client.py sets 'X-Content-Type-Options: nosniff'
-            # for file downloads (sendfile) via the html interface,
-            # so we should be able to set it in this code as well.
-            valid_binary_content_types.append("application/octet-stream")
+            valid_binary_content_types = self.create_valid_content_types(
+                declared_type)
 
         for part in accept_header:
             if accept_type:
                 # we accepted the best match, stop searching for
-                # lower quality matches.
+                # lower quality matches. A break happens in every clause
+                # that sets accept_type. This is just a safety.
                 break
 
             # check for structured rest return types (json xml)
@@ -2384,25 +2448,24 @@ def determine_output_format(self, uri):
                                part[1]['version'])
                     return (None, uri,
                            self.error_obj(406, msg))
+                break
 
-            if part[0] == "*/*":
-                if valid_binary_content_types:
-                    self.client.setHeader("X-Content-Type-Options", "nosniff")
-                    accept_type = valid_binary_content_types[0]
-                else:
+            # client.py sets 'X-Content-Type-Options: nosniff'
+            # for file downloads (sendfile) via the html interface,
+            # so we should be able to set it in this code as well.
+            if not valid_binary_content_types:
+                if part[0] == "*/*":
                     accept_type = "json"
+                    break
 
             # check type of binary_content
-            if part[0] in valid_binary_content_types:
+            elif part[0] in valid_binary_content_types:
                 self.client.setHeader("X-Content-Type-Options", "nosniff")
-                accept_type = part[0]
-            # handle text wildcard
-            if ((part[0] in 'text/*') and
-                "text/*" in valid_binary_content_types):
-                self.client.setHeader("X-Content-Type-Options", "nosniff")
-                # use best choice of mime type, try not to use
-                # text/* if there is a real text mime type/subtype.
-                accept_type = valid_binary_content_types[0]
+                # try to return most exact MIME type if request
+                # includes wildcard.
+                accept_type = part[0] if part[0].find('*') == -1 \
+                    else valid_binary_content_types[0]
+                break
 
         # accept_type will be empty only if there is an Accept header
         # with invalid values.
@@ -2410,27 +2473,21 @@ def determine_output_format(self, uri):
             return (accept_type, uri, None)
 
         if valid_binary_content_types:
-            return (None, uri,
-                    self.error_obj(
-                        406,
-                        _("Requested content type(s) '%(requested)s' not "
-                          "available.\nAcceptable mime types are: */*, "
-                          "%(acceptable)s") %
-                        {"requested":
-                         self.client.request.headers.get('Accept'),
-                         "acceptable": ", ".join(sorted(
-                             valid_binary_content_types))}))
+            report_acceptable_types = valid_binary_content_types
+        else:
+            report_acceptable_types = list(self.__accepted_content_type.keys())
+            report_acceptable_types.append("*/*")
 
         return (None, uri,
                 self.error_obj(
                     406,
                     _("Requested content type(s) '%(requested)s' not "
-                      "available.\nAcceptable mime types are: */*, "
+                      "available.\nAcceptable mime types are: "
                       "%(acceptable)s") %
                     {"requested":
                      self.client.request.headers.get('Accept'),
                      "acceptable": ", ".join(sorted(
-                         self.__accepted_content_type.keys()))}))
+                         report_acceptable_types))}))
 
     def dispatch(self, method, uri, input_payload):
         """format and process the request"""
diff --git a/test/rest_common.py b/test/rest_common.py
index 58a639cd0..396c2587e 100644
--- a/test/rest_common.py
+++ b/test/rest_common.py
@@ -1909,7 +1909,7 @@ def testdetermine_output_formatBadAccept(self):
         (output_type, uri, error) = dof("/rest/data/issue")
 
         self.assertEqual(self.server.client.response_code, 406)
-        self.assertIn(b"Requested content type(s) 'application/zot; version=1; q=0.5' not available.\nAcceptable mime types are: */*, application/json",
+        self.assertIn(b"Requested content type(s) 'application/zot; version=1; q=0.5' not available.\nAcceptable mime types are: */*, application/*, application/json",
                       s2b(error['error']['msg']))
 
         # simulate: /rest/data/issue works, multiple acceptable output, one
@@ -1985,7 +1985,7 @@ def testdetermine_output_formatBadAccept(self):
         self.assertEqual(self.server.client.response_code, 400)
         self.assertEqual(output_type, None)
         self.assertEqual(uri, "/rest/data/issue")
-        self.assertIn('Unable to parse Accept Header. Invalid media type: Xyzzy I am not a mime. Acceptable types: */*, application/json', error['error']['msg'])
+        self.assertIn('Unable to parse Accept Header. Invalid media type: Xyzzy I am not a mime. Acceptable types: */*, application/*, application/json', error['error']['msg'])
 
         # test 5 accept mimetype is ok, param is not
         headers={"accept": "*/*; foo",
@@ -2007,7 +2007,7 @@ def testdetermine_output_formatBadAccept(self):
         self.assertEqual(self.server.client.response_code, 400)
         self.assertEqual(output_type, None)
         self.assertEqual(uri, "/rest/data/issue")
-        self.assertIn('Unable to parse Accept Header. Invalid param: foo. Acceptable types: */*, application/json', error['error']['msg'])
+        self.assertIn('Unable to parse Accept Header. Invalid param: foo. Acceptable types: */*, application/*, application/json', error['error']['msg'])
 
         # test 6: test paths:
         #
@@ -2144,7 +2144,7 @@ def testdetermine_output_formatBadAccept(self):
                  "output_type": None,
                  "uri": "/rest/data/file/1/binary_content",
                  "error": {'error': 
-                           {'status': 406, 'msg': "Requested content type(s) 'image/svg+html' not available.\nAcceptable mime types are: */*, application/octet-stream, image/png"}},
+                           {'status': 406, 'msg': "Requested content type(s) 'image/svg+html' not available.\nAcceptable mime types are: */*, application/octet-stream, image/*, image/png"}},
                  "has_nosniff": False,
                 }),
             (# use wildcard accept and get back msg's actual mime type
@@ -2199,16 +2199,16 @@ def testdetermine_output_formatBadAccept(self):
                 {"path": "/rest/data/msg/2/binary_content",
                  "accept": "*/*",
                  "response_code": "",
-                 "output_type": "text/*",
+                 "output_type": "text/plain",
                  "uri": "/rest/data/msg/2/binary_content",
                  "error": None,
                  "has_nosniff": True,
                 }),
-            (# use text/* and get back text/*
+            (# use text/* and get back text/plain
                 {"path": "/rest/data/msg/2/binary_content",
                  "accept": "text/*",
                  "response_code": "",
-                 "output_type": "text/*",
+                 "output_type": "text/plain",
                  "uri": "/rest/data/msg/2/binary_content",
                  "error": None,
                  "has_nosniff": True,
@@ -2221,7 +2221,7 @@ def testdetermine_output_formatBadAccept(self):
                  "uri": "/rest/data/msg/2/binary_content",
                  "error": {'error': 
                            {'status': 406, 'msg':
-                            "Requested content type(s) 'text/markdown' not available.\nAcceptable mime types are: */*, application/octet-stream, text/*"}},
+                            "Requested content type(s) 'text/markdown' not available.\nAcceptable mime types are: */*, application/octet-stream, text/*, text/plain"}},
                  "has_nosniff": False,
                 }),
             (# use error accept and get back error
@@ -2232,7 +2232,7 @@ def testdetermine_output_formatBadAccept(self):
                  "uri": "/rest/data/msg/1/binary_content",
                  "error": {'error':
                            {'status': 400, 'msg':
-                            'Unable to parse Accept Header. Invalid media type: q=2. Acceptable types: */*, application/json'}},
+                            'Unable to parse Accept Header. Invalid media type: q=2. Acceptable types: */*, application/*, application/json'}},
                  "has_nosniff": False,
                  }),
             (# use text/* but override with extension of .json get back json
@@ -2358,7 +2358,7 @@ def testDispatchBadAccept(self):
         print(results)
         json_dict = json.loads(b2s(results))
         self.assertEqual(self.server.client.response_code, 406)
-        self.assertIn("Requested content type(s) 'application/zot; version=1; q=0.5' not available.\nAcceptable mime types are: */*, application/json",
+        self.assertIn("Requested content type(s) 'application/zot; version=1; q=0.5' not available.\nAcceptable mime types are: */*, application/*, application/json",
                       json_dict['error']['msg'])
 
         # simulate: /rest/data/issue works, multiple acceptable output, one
@@ -2439,7 +2439,7 @@ def testDispatchBadAccept(self):
         print(results)
         self.assertEqual(self.server.client.response_code, 400)
         json_dict = json.loads(b2s(results))
-        self.assertIn('Unable to parse Accept Header. Invalid media type: Xyzzy I am not a mime. Acceptable types: */*, application/json', json_dict['error']['msg'])
+        self.assertIn('Unable to parse Accept Header. Invalid media type: Xyzzy I am not a mime. Acceptable types: */*, application/*, application/json', json_dict['error']['msg'])
 
         # test 5 accept mimetype is ok, param is not
         headers={"accept": "*/*; foo",
@@ -2463,7 +2463,7 @@ def testDispatchBadAccept(self):
         print(results)
         self.assertEqual(self.server.client.response_code, 400)
         json_dict = json.loads(b2s(results))
-        self.assertIn('Unable to parse Accept Header. Invalid param: foo. Acceptable types: */*, application/json', json_dict['error']['msg'])
+        self.assertIn('Unable to parse Accept Header. Invalid param: foo. Acceptable types: */*, application/*, application/json', json_dict['error']['msg'])
 
     @skip_on_py2
     def testBadJson(self):

From 2099872ebf6e47cd2c92959ccac73c7fc8765840 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Tue, 24 Mar 2026 22:11:27 -0400
Subject: [PATCH 392/398] feature: add detector that prevents file content
 changes by Admin and other users.

New detector and upgrading announcement. Also example of stripping
content editing from the User role.
---
 CHANGES.txt                          | 10 +++++++-
 detectors/README.txt                 |  4 +++
 detectors/immutable_file_contents.py | 22 ++++++++++++++++
 doc/upgrading.txt                    | 38 ++++++++++++++++++++++++++++
 4 files changed, 73 insertions(+), 1 deletion(-)
 create mode 100644 detectors/immutable_file_contents.py

diff --git a/CHANGES.txt b/CHANGES.txt
index e57318bae..6eb879686 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -96,7 +96,15 @@ Features:
   plain text. Faster then beautifulsoup4 and it passes the html 5
   standard browser test suite. Beautifulsoup is still supported. (John
   Rouillard)
-
+- add a new detector: immutable_file_contents.py that prevents changes
+  to file contents. By default, the permissions assigned to FileClass
+  based classes (files, msgs) do not prevent editing of file contents.
+  While the usual HTML templates don't provide a way to modify files,
+  the REST interface allows changing file contents without an audit
+  trail. Manually driving the HTML interface (via curl for example)
+  also allows content changes. The new detector prevents changes to
+  file contents via Roundup even by a user with admin rights.
+  
 2025-07-13 2.5.0
 
 Fixed:
diff --git a/detectors/README.txt b/detectors/README.txt
index fde325dd6..508299ce4 100644
--- a/detectors/README.txt
+++ b/detectors/README.txt
@@ -19,6 +19,10 @@ creator_resolution.py - only allow the creator of the issue to resolve it
 emailauditor.py - Rename .eml files (from email multi-part bodies) to
                   .mht so they can be downloaded/viewed in Internet Explorer.
 
+immutable_file_contents.py - prevent changes to the contents property
+                             of file and msg classes including by
+                             people with the admin role.
+
 irker.py - communicate with irkerd to allow roundtup to send announcements
            to an IRC channel.
 
diff --git a/detectors/immutable_file_contents.py b/detectors/immutable_file_contents.py
new file mode 100644
index 000000000..d5a8dc391
--- /dev/null
+++ b/detectors/immutable_file_contents.py
@@ -0,0 +1,22 @@
+# HTML pages don't provide a way to change the contents of a file.
+# However REST does allow setting content and the HTML interface can
+# be directed to update the content as well. This detector
+# prevents changes to file content.
+
+from roundup.exceptions import UsageError
+
+def immutable_file_contents(db, cl, nodeid, newvalues):
+    ''' Prevent content changes to a file
+    '''
+    if 'content' in newvalues:
+        raise UsageError("File contents are immutable. "
+                         "Rejecting change to contents.")
+
+
+def init(db):
+    """If you have other FileClass based classes add them here."""
+
+    # fire before changes are made
+    db.file.audit('set', immutable_file_contents)
+    db.msg.audit('set', immutable_file_contents)
+
diff --git a/doc/upgrading.txt b/doc/upgrading.txt
index ff8e7627c..1b257231c 100644
--- a/doc/upgrading.txt
+++ b/doc/upgrading.txt
@@ -303,6 +303,44 @@ now they are just ignored.
 There have been some internal refactorings and improvements in the
 REST code that will make it a bit faster.
 
+Make File Contents Immutable for Everybody (optional)
+-----------------------------------------------------
+
+The HTML based interface for files and messages doesn't provide a way
+to change file content. However it is possible for privileged people
+to modify the content via the web. In most cases, this change will not
+be recorded in the audit log. It can be detected by looking at the
+change time of the file. Then compare it to the change time of files
+before and after it. Since files are created in order, the file
+``msg50`` should have a change timestamp after ``msg49`` and before
+``msg51``.
+
+The 2.6.0 release includes an immutable_file_contents.py
+detector.  If you copy the detector into your tracker's detector
+directory nobody, including users with admin rights, can change
+file/msg contents via Roundup. Changes to files would have to be
+done by logging into the Roundup server and editing the files
+locally.
+
+For non-admin user's the following edit permission for FileClass based
+classes will prevent regular users from changing file content via
+Roundup. Remove the existing ``Edit`` permission from your FileClass
+based classes. Then add your classname to the loop. The permission
+strips ``content`` from the list of editable properties and permits
+editing of the other properties::
+
+  for cl in 'file', 'msg':
+    properties = list(x for x in
+                   db.getclass(cl).getprops(protected=False).keys()
+                   if x != 'content')
+
+    file_edit_perm = db.security.addPermission(
+        name='Edit', klass=cl,
+        properties=properties,
+        description="User is allowed to edit all %s props except content" % cl)
+
+    db.security.addPermissionToRole('User', file_edit_perm)
+
 .. index:: Upgrading; 2.4.0 to 2.5.0
 
 Migrating from 2.4.0 to 2.5.0

From e2fb5e9ec0aad51d649100a9929c2c893eb00845 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 25 Mar 2026 11:37:03 -0400
Subject: [PATCH 393/398] doc: provide card look for "sections" on features
 page.

Make each section on the features page look like a raised card.

Note the sections aren't headers 8-(. The markup is:

  .. container:: card

     **pseudo header**

     - list stuff

  .. container:: card

I can't put:

    pseudo header
    =============

in there even though each card is its own section. I would like to
have real headers for them (allow text->speech and othr devices
easiera access). Starting a header in column 1 seems to be a
requirement of the syntax 8-(.
---
 doc/_static/style.css         |   7 ++
 doc/features.txt              | 176 +++++++++++++++++++---------------
 website/www/_static/style.css |   7 ++
 3 files changed, 111 insertions(+), 79 deletions(-)

diff --git a/doc/_static/style.css b/doc/_static/style.css
index 60f673a2c..73f30b110 100644
--- a/doc/_static/style.css
+++ b/doc/_static/style.css
@@ -526,3 +526,10 @@ aside.footnote > span + p { margin-block-start: unset; }
 :target {
   scroll-margin-block-start: 2em;
 }
+
+
+/* Make feature blocks look like raised cards for some variety. */
+div.card {
+    box-shadow: rgba(6, 24, 44, 0.4) 0px 0px 0px 2px, rgba(6, 24, 44, 0.65) 0px 4px 6px -1px, rgba(255, 255, 255, 0.08) 0px 1px 0px inset;
+    padding: 1em;
+}
diff --git a/doc/features.txt b/doc/features.txt
index a55da90ee..2f3c1bb44 100644
--- a/doc/features.txt
+++ b/doc/features.txt
@@ -13,97 +13,115 @@ web, e-mail and command-line interfaces. Based on the winning design
 from Ka-Ping Yee in the :index:`Software Carpentry` "Track" design
 competition. 
 
-**Installation and Setup**
-
-- Start using the software in `instant-gratification (demo) mode`_ with
-  ``python demo.py`` or `a Docker container`_ in under 5 minutes. 
-- Choose from `five included templates`_ for your tracker.
-- `Customize`_ and use the demo as a template for your production tracker.
-- No need for additional support software, just Python (3.7+)
-  to get started.
-- Basic installation (including a web interface) takes about 30 minutes.
-- Supports embedded databases like `SQLite`_ and dbm. Upgradable
-  to databases like `MySQL`_ or `PostgreSQL`_ if needed.
-- Can be run in a container like Docker or kubernetes.
-- Deploy in your network as a standalone web server or `through
-  various methods`_ like WSGI, FastCGI, plain CGI, etc.
-- Essential tracking features depend on the Python standard
-  library. Supplementary packages from PyPI are optional and can be
-  tailored to fit your unique threat model and security needs.
-
-**Issue Tracking and Management**
-
-- Manage your issues your way. Handle bugs, features, milestones, 
-  user feedback, fleet maintenance, office issues etc.
-- Issues become a mini mailing list to keep everyone informed.
-- Searches on specific properties (e.g. open issues with a high
-  priority) can be saved and reused or shared with other users.
-- Full Text Search for quick searches across messages.
-- Keeps a detailed history of issue changes.
-- Email is a first class method for interacting with issues.
-
-**Scalability and Performance**
-
-- Default trackers use simple HTML with low resource requirements.
-- Fast and scalable with sqlite, mysql, and postgresql backends.
-- Indexes are automatically configured.
-- Supports full-text indexing engines (xapian, whoosh, SQLite,
-  PostgreSQL) for large trackers.
-
-**Customization**
-
-- The database schema can be updated to `track additional data`_.
-- The web interface can be redesigned to fit your workflow.
-- Extensible web interface with various features like `wizards`_,
-  bug displays, etc.
-- Add business rules using `auditors and reactors`_ for actions before
-  and after database changes.
-- Comprehensive documentation for customization, installation,
-  maintenance, and user guidance.
-
-**Data Security, Privacy and Authorization**
-
-- Your data remains on your servers.
-- You can choose if AI can access the data.
-- Can use HTTPS for security over the web.
-- Fine-grained authorization (`ABAC`_, `ReBAC`_, `RBAC`_) based on
-  user, resource, and external properties.
+.. container:: card
+
+  **Installation and Setup**
+
+  - Start using the software in `instant-gratification (demo) mode`_ with
+    ``python demo.py`` or `a Docker container`_ in under 5 minutes. 
+  - Choose from `five included templates`_ for your tracker.
+  - `Customize`_ and use the demo as a template for your production tracker.
+  - No need for additional support software, just Python (3.7+)
+    to get started.
+  - Basic installation (including a web interface) takes about 30 minutes.
+  - Supports embedded databases like `SQLite`_ and dbm. Upgradable
+    to databases like `MySQL`_ or `PostgreSQL`_ if needed.
+  - Can be run in a container like Docker or kubernetes.
+  - Deploy in your network as a standalone web server or `through
+    various methods`_ like WSGI, FastCGI, plain CGI, etc.
+  - Essential tracking features depend on the Python standard
+    library. Supplementary packages from PyPI are optional and can be
+    tailored to fit your unique threat model and security needs.
+
+.. container:: card
+
+  **Issue Tracking and Management**
+
+  - Manage your issues your way. Handle bugs, features, milestones, 
+    user feedback, fleet maintenance, office issues etc.
+  - Issues become a mini mailing list to keep everyone informed.
+  - Searches on specific properties (e.g. open issues with a high
+    priority) can be saved and reused or shared with other users.
+  - Full Text Search for quick searches across messages.
+  - Keeps a detailed history of issue changes.
+  - Email is a first class method for interacting with issues.
+
+.. container:: card
+
+  **Scalability and Performance**
+
+  - Default trackers use simple HTML with low resource requirements.
+  - Fast and scalable with sqlite, mysql, and postgresql backends.
+  - Indexes are automatically configured.
+  - Supports full-text indexing engines (xapian, whoosh, SQLite,
+    PostgreSQL) for large trackers.
+
+.. container:: card
+
+  **Customization**
+
+  - The database schema can be updated to `track additional data`_.
+  - The web interface can be redesigned to fit your workflow.
+  - Extensible web interface with various features like `wizards`_,
+    bug displays, etc.
+  - Add business rules using `auditors and reactors`_ for actions before
+    and after database changes.
+  - Comprehensive documentation for customization, installation,
+    maintenance, and user guidance.
+
+.. container:: card
+
+  **Data Security, Privacy and Authorization**
+
+  - Your data remains on your servers.
+  - You can choose if AI can access the data.
+  - Can use HTTPS for security over the web.
+  - Fine-grained authorization (`ABAC`_, `ReBAC`_, `RBAC`_) based on
+    user, resource, and external properties.
 
 .. _`ABAC`: https://en.wikipedia.org/wiki/Attribute-based_access_control 
 .. _`ReBAC`: https://en.wikipedia.org/wiki/Relationship-based_access_control
 .. _`RBAC`: https://en.wikipedia.org/wiki/Role-based_access_control
 
-**Documentation and User Management**
+.. container:: card
 
-- Users can sign up through the web interface or new user creation
-  can be limited to admin users.
-- Can use an `external user database`_ (LDAP, password file)
-- Self-serve password reset for users via email.
+  **Documentation and User Management**
 
-**Email Integration and Automation**
+  - Users can sign up through the web interface or new user creation
+    can be limited to admin users.
+  - Can use an `external user database`_ (LDAP, password file)
+  - Self-serve password reset for users via email.
 
-- Update issues via email with new messages and the ability to
-  change properties of issues (e.g. close an issue).
-- Secure email handling with features like TLS, APOP, IMAPS/OAUTH.
-- Optional auto-registration for email users.
-- Configurable nosy list for each issue controls email notifications.
-- Proper handling of email attachments and content types.
+.. container:: card
 
-**Command-Line and API Access**
+  **Email Integration and Automation**
 
-- Manage database interactively from the command line.
-- Automate modifications using standard shell scripting.
-- Python programs can use the Roundup Python API to manage/automate issues.
-- Sample scripts provided for various tasks.
+  - Update issues via email with new messages and the ability to
+    change properties of issues (e.g. close an issue).
+  - Secure email handling with features like TLS, APOP, IMAPS/OAUTH.
+  - Optional auto-registration for email users.
+  - Configurable nosy list for each issue controls email notifications.
+  - Proper handling of email attachments and content types.
 
-**Remote Access Interfaces**
+.. container:: card
 
-- `RESTful API`_ accessible with basic HTTP authentication or optional JWT.
-- `XMLRPC interface`_ for remote tracker access with basic
-  HTTP authentication.
-- Configurable CORS support for third-party web pages.
-- Ability to `generate and authenticate JSON Web Tokens (JWT)
-  <rest.html#changing-access-roles-with-json-web-tokens>`_.
+  **Command-Line and API Access**
+
+  - Manage database interactively from the command line.
+  - Automate modifications using standard shell scripting.
+  - Python programs can use the Roundup Python API to manage/automate issues.
+  - Sample scripts provided for various tasks.
+
+.. container:: card
+
+  **Remote Access Interfaces**
+
+  - `RESTful API`_ accessible with basic HTTP authentication or optional JWT.
+  - `XMLRPC interface`_ for remote tracker access with basic
+    HTTP authentication.
+  - Configurable CORS support for third-party web pages.
+  - Ability to `generate and authenticate JSON Web Tokens (JWT)
+    <rest.html#changing-access-roles-with-json-web-tokens>`_.
 
 .. _`auditors and reactors`: reference.html#auditor-or-reactor
 .. _`customize`: customizing.html
diff --git a/website/www/_static/style.css b/website/www/_static/style.css
index bcf510116..99d0d7834 100644
--- a/website/www/_static/style.css
+++ b/website/www/_static/style.css
@@ -527,6 +527,12 @@ aside.footnote > span + p { margin-block-start: unset; }
   scroll-margin-block-start: 2em;
 }
 
+/* Make feature blocks look like raised cards for some variety. */
+div.card {
+    box-shadow: rgba(6, 24, 44, 0.4) 0px 0px 0px 2px, rgba(6, 24, 44, 0.65) 0px 4px 6px -1px, rgba(255, 255, 255, 0.08) 0px 1px 0px inset;
+    padding: 1em;
+}
+
 /* website only */
 /* assume desktop reader for local html files, also no contact
    page for local doc files */
@@ -604,3 +610,4 @@ div#contact table td {
   white-space: nowrap;
   padding: 1pt 1em;
 }
+

From 518920ceeb049abf5acbdbe24572eed28406b43b Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 25 Mar 2026 11:39:27 -0400
Subject: [PATCH 394/398] doc: update admonintion to past tense

Also remove some rationale as it's no longer important.
---
 website/www/index.txt | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/website/www/index.txt b/website/www/index.txt
index 9906bcb80..8dec9e6eb 100644
--- a/website/www/index.txt
+++ b/website/www/index.txt
@@ -86,9 +86,7 @@ Roundup is compatible with Python 3.7+.
 
 .. admonition:: Python 2 Support
 
-   Python 2 support ends with release 2.4.0 (July 2024).
-   Several Continuous Integration (CI) services are
-   discontinuing their resources for testing with Python 2.
+   Python 2 support ended with release 2.4.0 (July 2024).
    Use Python 3 for the deployment of new trackers.
    Existing trackers should be `upgraded to use Python 3.
    <docs/upgrading.html#python-3-support-info>`_

From 20e72c1057993abb3c20b47776199799fb8664f9 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Wed, 25 Mar 2026 18:00:19 -0400
Subject: [PATCH 395/398] doc: inplace db migration; replace [database] with
 [rdbms]

Document inplace tracker migration using exporttable and
importtable. I just tested it with anydbm and sqlite.

Also directions included old name for [rdbms] section of config.ini
file. Fixed it and said old version of roundup may have a [database]
section.
---
 CHANGES.txt         |  4 +++-
 doc/admin_guide.txt | 56 ++++++++++++++++++++++++++++++++++++++++++++-
 2 files changed, 58 insertions(+), 2 deletions(-)

diff --git a/CHANGES.txt b/CHANGES.txt
index 6eb879686..558a2fc9d 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -104,7 +104,9 @@ Features:
   trail. Manually driving the HTML interface (via curl for example)
   also allows content changes. The new detector prevents changes to
   file contents via Roundup even by a user with admin rights.
-  
+- Added documentation on doing an in place database migration. This is
+  faster for large databases. (John Rouillard)
+
 2025-07-13 2.5.0
 
 Fixed:
diff --git a/doc/admin_guide.txt b/doc/admin_guide.txt
index 4ee64d636..bafcdcfe2 100644
--- a/doc/admin_guide.txt
+++ b/doc/admin_guide.txt
@@ -2050,6 +2050,9 @@ reinstall the older version of the sofware using the same install command::
 Migrating Backends
 ------------------
 
+Note that the ``[rdbms]`` section label was called ``[database]`` in
+earlier versions of Roundup.
+
 1. Stop the existing tracker web and email frontends (preventing changes).
 2. Use the roundup-admin tool "export" command to export the contents of
    your tracker to disk. (If you are running on windows see
@@ -2058,7 +2061,7 @@ Migrating Backends
    export data.)
 3. Copy the tracker home to a new directory.
 4. Delete the "db" directory from the new directory.
-5. Set the value of the ``backend`` key under the ``[database]``
+5. Set the value of the ``backend`` key under the ``[rdbms]``
    section of the tracker's ``config.ini`` file.
 6. Use the roundup-admin "import" command to import the previous export with
    the new tracker home. If non-interactively::
@@ -2083,6 +2086,57 @@ to set a higher or lower number in roundup-admin. In this example a
 commit will be done every 20,000 objects/rows. The pragma can also be
 set on the roundup-admin command line as described below.
 
+Migrating Only Database Data
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The method above is well tested and works. However because it
+exports/imports file content and works on a copy of the tracker home
+it is slow. An alternate way is to use the ``exporttables`` and
+``importtables`` commands to export/import only the database entries
+and do the migration in place.
+
+The untested steps using this method are:
+
+0. Backup your tracker.
+1. Stop the existing tracker web and email frontends (preventing changes).
+2. Use the roundup-admin tool's "exporttable" command to export the
+   database for your tracker to disk. (If you are running on windows see
+   `issue1441336 <https://issues.roundup-tracker.org/issue1441336>`_
+   on how to use the command line rather than interactive mode to
+   export data.)
+3. Set the value of the ``backend`` key under the ``[rdbms]``
+   section of the tracker's ``config.ini`` file to the new database
+   backend.
+4. Use the roundup-admin "importtable" command to import the
+   exporttable. The non-interactive command is::
+     
+     roundup-admin -i <tracker home> importtable <tracker export dir>
+
+   If running the importtable interactively, enter 'commit' before exiting.
+5. Test each of the admin tool, web interface and mail gateway using the new
+   backend.
+6. Restart web and email frontends.
+7. Clean up the old database once you are confortable that the migration
+   has suceeded.
+
+   If you are moving from an external database
+   (postgres/mysql/mariadb) to an embedded db, drop your external db
+   tables.
+
+   If you are migrating from anydbm to sqlite, you can move/delete
+   files that match:
+
+   - ``nodes.*``
+   - ``_ids``
+   - ``journals.*``
+   - ``lock``
+
+   Keep the ``db/db`` file as that is your new sqlite database.
+
+   Also if you run for a few days and find the ``otks`` and
+   ``sessions`` file change times are the same, you can move/delete
+   these as well.
+
 Moving a Tracker
 ----------------
 

From d3d749db0cb119b16fccd18cd3502b02de7aae43 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Thu, 26 Mar 2026 21:46:19 -0400
Subject: [PATCH 396/398] refactor: remove duplicate code block

Had the same code inside two different if statements. Replaced
with 'if X in [ a, b ] ' and only one copy of the code.
---
 roundup/password.py   | 17 +++------------
 test/test_security.py | 50 +++++++++++++++++++++++++++++++++++++++----
 2 files changed, 49 insertions(+), 18 deletions(-)

diff --git a/roundup/password.py b/roundup/password.py
index 3d77ebd30..ebfc1520c 100644
--- a/roundup/password.py
+++ b/roundup/password.py
@@ -430,21 +430,10 @@ def needs_migration(self, config):
 
         if rounds < 1000:
             return True
-
-        if (self.scheme == "PBKDF2"):
-            new_rounds = config.PASSWORD_PBKDF2_DEFAULT_ROUNDS
-            if ("pytest" in sys.modules and
-                "PYTEST_CURRENT_TEST" in os.environ):
-                if ("PYTEST_USE_CONFIG" in os.environ):
-                    new_rounds = config.PASSWORD_PBKDF2_DEFAULT_ROUNDS
-                else:
-                    # for testing
-                    new_rounds = 1000
-            if rounds < int(new_rounds):
-                return True
-
-        if (self.scheme == "PBKDF2S5"):
+        if self.scheme in ["PBKDF2S5", "PBKDF2"]:
             new_rounds = config.PASSWORD_PBKDF2_DEFAULT_ROUNDS
+            # PYTEST_CURRENT_TEST is set when pytest is running
+            # a test case.
             if ("pytest" in sys.modules and
                 "PYTEST_CURRENT_TEST" in os.environ):
                 if ("PYTEST_USE_CONFIG" in os.environ):
diff --git a/test/test_security.py b/test/test_security.py
index db5dfe69b..1a20399ff 100644
--- a/test/test_security.py
+++ b/test/test_security.py
@@ -473,22 +473,64 @@ def test_empty_passwords(self):
         p.setPassword("sekret", config=self.db.config)
         self.assertEqual(p.scheme, default_scheme)
 
+    def test_migrate_deprecated(self):
+
+        # migrate: deprecated encryption
+
+        # force test to use config file settings
+        # rather than the testing default of 1000
+        os.environ["PYTEST_USE_CONFIG"] = "True"
+        self.db.config.PASSWORD_PBKDF2_DEFAULT_ROUNDS = 2000
+
+        p = roundup.password.Password('sekrit', 'SSHA',
+                                      config=self.db.config)
+        self.assertEqual(p.needs_migration(config=self.db.config), True)
+
+        p = roundup.password.Password('sekrit', 'PBKDF2',
+                                      config=self.db.config)
+
+        self.assertEqual(p.needs_migration(config=self.db.config), True)
+
+        # no need to migrate
+        self.db.config.PASSWORD_PBKDF2_DEFAULT_ROUNDS = 200000
+
+        p = roundup.password.Password('sekrit', 'PBKDF2S5',
+                                      config=self.db.config)
+
+        self.assertEqual(p.needs_migration(config=self.db.config), False)
+
+        self.assertEqual(p.password.find('200000$'), 0)
+        del(os.environ["PYTEST_USE_CONFIG"])
+
     def test_pbkdf2_migrate_rounds(self):
         '''Check that migration happens when number of rounds in
            config is larger than number of rounds in current password.
         '''
-
-        p = roundup.password.Password('sekrit', 'PBKDF2',
+        default_scheme = roundup.password.Password.default_scheme
+        # will only have 1000 rounds since it's running under
+        # pytest but without PYTEST_USE_CONFIG set in environment.
+        p = roundup.password.Password('sekrit', default_scheme,
                                       config=self.db.config)
 
-        self.db.config.PASSWORD_PBKDF2_DEFAULT_ROUNDS = 2000000
+        self.assertEqual(p.password.find('1000$'), 0)
 
+        # reduce it a bit to save runtime
+        self.db.config.PASSWORD_PBKDF2_DEFAULT_ROUNDS = 200000
+
+        # now set PYTEST_USE_CONFIG so we test rounds against
+        # config setting.
         os.environ["PYTEST_USE_CONFIG"] = "True"
         self.assertEqual(p.needs_migration(config=self.db.config), True)
         del(os.environ["PYTEST_USE_CONFIG"])
 
-        # set up p with rounds under 1000. This is usually prevented,
+        
+        # Set up p with rounds under 1000. This is usually prevented,
         # but older software could generate smaller rounds.
+        p = roundup.password.Password('sekrit', default_scheme,
+                                      config=self.db.config)
+
+        # Can't actaully generate a password with fewer than 1000 rounds.
+        # so edit p.password to fake 900 rounds.
         p.password = p.password.replace('1000$', '900$')
         self.assertEqual(p.needs_migration(config=self.db.config), True)
 

From 21fb9594d5be4e3653da5657b50e2b451e08a737 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Sun, 29 Mar 2026 15:42:52 -0400
Subject: [PATCH 397/398] bug: set minimum level for docker requirements.txt
 packages

Choose minimum versions that do not have outstanding CVE's.
---
 scripts/Docker/requirements.txt | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/scripts/Docker/requirements.txt b/scripts/Docker/requirements.txt
index 138f888e1..8b355b9ec 100644
--- a/scripts/Docker/requirements.txt
+++ b/scripts/Docker/requirements.txt
@@ -1,5 +1,9 @@
+# Get newest versions, but specify minimum versions to get versions
+# without known vulnerabilities as reported by:
+# https://tools.simonwillison.net/python-vulnerability-lookup
+
 # setuptools required for installation - missing from newer base images
-setuptools
+setuptools >= 78.1.1
 # human timezones
 pytz
 # indexer
@@ -8,13 +12,13 @@ Whoosh
 # extra database support
 psycopg2
 mysqlclient
-redis
+redis >= 4.5.4
 # encryption
 gpg
 # java web tokens
-PyJWT
+PyJWT >= 2.12.0
 # extra HTTP compression methods
-Brotli
-zstd
+Brotli >= 1.2.0
+zstd >= 1.5.4
 # jinja2 template engine
-Jinja2
+Jinja2 >= 3.1.6

From 2a59d8aa5990386eda1e6bd7357a4caba4b7b196 Mon Sep 17 00:00:00 2001
From: John Rouillard <rouilj@ieee.org>
Date: Mon, 30 Mar 2026 10:55:53 -0400
Subject: [PATCH 398/398] build(deps): bump codecov/codecov-action from 5.5.3
 to 6.0.0 #87

---
 .github/workflows/ci-test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci-test.yml b/.github/workflows/ci-test.yml
index fe73e6082..b15986016 100644
--- a/.github/workflows/ci-test.yml
+++ b/.github/workflows/ci-test.yml
@@ -328,7 +328,7 @@ jobs:
         
       - name: Upload coverage to Codecov
         # see: https://github.com/codecov/codecov-action#usage
-        uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad # v5.5.3
+        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
         with:
           verbose: true
           token: ${{ secrets.CODECOV_TOKEN }}
