Make review changes atomic

This follows from investigations in
https://rt.lca2018.org/Ticket/Display.html?id=283&results=eac0bd3c49f782d054f87d6b160ca36b;
in short, it seems that because this very long and complex method
creates several different objects at differnt times, the DB has been
getting out of sync; there are more votes recorded then there are
reviews, becuase the table that stores the vote count is updated
before the table that stores the vote and review information

This change is intended to make this operation (and the other
operations that the revew_detail handler performs) atomic, to prevent
things getting further out of step. It does *not* fix the existing
incosistency.

review_delete has been atomicified as well as it likely needs the same
treatment, but this has not been examined in detail.

Return an integer for the slice index.

Resolves:

File "/app/symposion_app/vendor/symposion/reviews/views.py", line 230, in review_random_proposal
proposals = proposals[:(len(proposals) + 1) / 2]
TypeError: slice indices must be integers or None or have an __index__ method

Fix container name reference for deploy command

In the pod, the container is not called frontend

Correct some spelling in README

README had some typos, correct them.

Switch score calculation to pure Python

Rip out the score expression madness, and calculate the score in Python,
since I hear that Python is better at math than SQL is.

Fix score calculation hack

I have no idea why we do this in the database as some magic after we
call save(). I also have no idea why MySQL is seeming to think we want
type BIGINT UNSIGNED at the end of the
((2 * '+2' + '+1') - ( '-1' + 2 * '-2')) but it does.

Setting it to 2.0 or float(2) doesn't get the ORM to get this right, but
we are going to Decimal and making the 2 multiplier be of type Decimal
manages to make the ORM pull it's shit together and use something that
seems like we're okay with.

+1, -2 = 1 / 2 = -0.5 Score == True
Looks like it works.

UPDATE `symposion_reviews_proposalresult` SET `score` = CASE WHEN `symposion_reviews_proposalresult`.`vote_count` = 0 THEN '0' ELSE ((((2 * `symposion_reviews_proposalresult`.`plus_two`) + `symposion_reviews_proposalresult`.`plus_one`) - (`symposion_reviews_proposalresult`.`minus_one` + (2 * `symposion_reviews_proposalresult`.`minus_two`))) / (`symposion_reviews_proposalresult`.`vote_count` * 1)) END WHERE `symposion_reviews_proposalresult`.`id` = 1

Cleanup more user exploitable input with bleach

My eyes hurt. More user exploitable XSS on inputs.

Build an ephemeral dev container for rego testing

Create a ephemeral dev container to facilitate testing of
populate_inventory. It can be created, tweeked in the admin interface,
files updated in admin's populate_inventory, then redeployed to deal
with those changes.

A branch based one will need to be created to so we can do this work
without polluting the master branch.

Improve image update workflow

This improves the administrative workflow of deploying updated images to
the k8s cluster. Still tag latest however, as that's important to
old-workflow.

Would be good to block this and have it fail on a db migration so it
doesn't happen accidently, and make the deployer deal with it.

Fix miniconf editing - No attribute issue

Editing a miniconf, on save, the code looks in settings for
ADMIN_USERNAMES, and as it does not exist, we stack-trace and 502 to the
user.

Add the attribute to settings.py

Travel assistance to sydney please

* Tweaks help_text to indicate that travel assistance is to Sydney
* Includes the required migration

This migration doesn't change the DB so it's safe to apply with the system live.

Revert "Removes speaker assistance options from the profile form."

This reverts commit 2aa0074bdce1674696c9c28d23a3ff0a449a0454.

Order by ID rather than at last update time

The current ordering is based on what appears to be a random ordering
that happens to correlate to the last time the paper was submitted or
updated. Oldest to most recent.

This changes it to submission order so ordering doesn't change and ID is
a static, making it easier to move through a list of papers. "I last
looked at 24, so 25 is assured to be the next one I want to look at.

There's the thought of updated papers being looked at and voted on, but
it does not seem to me that this is supported or possible. In general
one would look at their un-reviewed list, and go off it, which puts
updates out the window.

We can certainly order on other fields if desired, but this one makes
the most since to me.

Add a note to get the permission required for papers review

So not obvious...

Remove default name from create_review_permssions

This was removed somewhere in 1.8, which means this results in a
failure. If I understand correctly, this "name" is now derived from the
model name's __str__ or something like that.

Change favicon to an LCA-appropriate favicon.

This isn't the same one we're using for the static site - but honestly I think this one is probably better.

Don't tab stop on Hack links in proposal creation

It's really annoying when you are adding a proposal and you hit tab and
end up on the link to the Hack website. There's no need for this and at
least on newer browsers we can pretty easily skip the links for tab.

Unfortunately because this is model text it generates migrations. As we
know these migrations don't actually do anything, so they are annoying
but not actually harmful.

Other suggested django migrations

So django keeps strict synchronization between its code and migrations
so that it can help generating new migrations. These are the additional
suggested migrations. A lot of these are a null effect, some are things
like transforming an unsigned integer to a signed integer. So not super
urgent on a small scale, but worth doing to keep django happy.

Add release materials check boxes to miniconf proposal

We need to have people who are submitting a miniconf proposal agree to
releasing the material. The easiest way to do this is to just make it a
proposal like the other two types. We don't have audience type for
miniconf, instead of deleting it just have a default - it's easier.

WARNING: This requires a real migration to be performed before use.

Use Linux Australia for release and not pycon

Update the recording and materials release to say Linux Australia, not
Pycon Australia. This generates a migration because the model text has
change - but also because in the 0001_initial migration it appears that
this help text is stored as a byte string.

This is a bit weird, but realistically running this migration is not
going to cause us any problems so just add it so we don't end up
fighting django along the way.

Add the T&C and COC to the accept box

Link to the T&C and Code of conducts so people know what they are
accepting. Create this as a static link because i don't know how django
would accept this being something dynamic on the model.

This annoyingly creates a migration, but it's not a real change and
easier to accept it now than fight django forever.

Specify python3 when creating a virtualenv in README

This app is now python3 only so we must specify python3 when creating a
virtualenv. Yes this assumes that most people are using python2 as
default, most distros still ship this way.

Collect Static so admin works

Thanks tchaypo and jammielennox

Closes #11

Fix static content serving

What? Why did this stop working?

Specify how to create a superuser account in dev

To do development you will need a local super user account. This is
a standard Django practice but should be documented here as well.

Add fixture data to the README

The site requires you to have some basic data installed in your database
before running. This is located in the fixtures file and so the README
should tell people to install this data.

Remove sponsor fixtures

The sponsor fixtures don't work with our current site. Remove them to
make loading easier.

Add a dev-env.sh script you can source in dev

In dev we need some environment variables set to allow us to at least
test the site. Add a file we can source to get past this step.

Display failure messages when environment variables missing

Running migrate initially as specified from README leads to a cryptic
"CONFIG ERROR" failure message. Print out what variables are actually
missing.

Add our vendor path to our path

I guess this is as good a method as any to get or vendored packages in.

Taking one out of PyCon's (US) book

We're lock-step with symposion, and upstream is dead.
Vendor it.

Use a standard login handler

Is there any reason to not use the standard login decorator?

Link to GCP storage for files

WARNING: We need to reflect in the webpage that these won't be behind a
login.

GitLab Issue #2

require django-bootstrap-forms

While pinax-theme-bootstrap pulls this in, we use this directly too, so
we need to put this into our top level reqs too.

Support monospace TextFields instead of Markdown

Drop markdown for monospace

With markdown, we're only allowing about 1/10 of what is possible.
This creates a false reality and expectation. Lets not suggest this.
Nor do we have in-editor preview. So the user has to save, look at it,
then go back and edit. And seeing a bunch of sanitized HTML or just
missing sections isn't firendly.

Monospace, what you type, is what you're going to get. It gives the
presenter enough power to build a readable abstract, but not so much
that they can break the page and it's CSS, nor the ability to confuse
onselve through not getting what you expect.

We keep bleach sanitation and we should probably run linkify on this in
the long term. (Turn links into clickable links)

Use monospace font, hack, and not markdown.

Font should be made local and not remote loaded.

Use app.css not inlined css

Simpler for us.

Remove unused "hooks"

This isn't used, drop it.

settings - DEBUG hardening

DEBUG is something that should never be turned in on prod. As such,
lets be extremely specific on what we expect to process.

As we'll be taking this in from the environment, it's ensured we will
get a string. So we'll always get and only handle this in string
form. If it's anything else, it's an operational error and we bail.

(Note: bool('0') is truthy, so we make sure we leverge our string -> int
-> bool every time, so corectness can be noticed if it is not)

settings saml2_contact type is wrong.

We had List[Dict[str, str]], but this was passed without question from
djangosaml2 to pysaml2 no questions asked, which expects Dict[str, str].

Lets try to automate this build a bit

This doesn't rebuild on subproject changes... this is something that
will need fixed.

Add initial Dockerfile

This builds a working docker image for the application.
This is only an initial revision. It needs testing. MySQL, PIL, etc.

Was going to use Alpine, however, python3.6 segfaulted on docker
starting up, and I couldn't find the core files...

Add a CSS class on required fields labels

This makes it possible to add a ' *' required notifier to labels without
needing a bunch of custom form code in templates.

Py2 compatability has been broke elsewhere drop it

This is all noop in Py3, and Py2 is broke now in various places.
Dropping Py2 code as it will not be a thing going forward.

Django 2 is the next release, Py2 support will be dropped, as such,
dropping this is forward looking.

Sanitize user input on markdown fields

This is an XSS vulnribilitiy.

This also blocks a number of MD attributes that a user might attempt to
use.

The following are the allowed attributes.

['a', 'abbr', 'acronym', 'b', 'blockquote', 'code', 'em', 'i', 'li',
'ol', 'p', 'pre', 'strong', 'ul']

I belive this to be acceptable, as honeslty, a speaker using H1 is going
to stomp all over the page and make it harder for the reviewer to parse.

UX wise, it's less than great. A user can do # title and be left with
<h1> in the sanitized output.

Use full imports not .

And tox to py3.6

Remove excess CSS and fonts

print wont work for us now. Will need to be recreated.

Fonts, I don't even know where they came from, so I can't keep them

_styles.html is not loaded anywhere

Not in use, remove it.

Hym, might be able to remove this CSS now too.

Convert to bootstrap tab configuration

This was broken due to being something not bootstrap for tabs.

Convert to tab layout, just like reviewers page already is.

This script isn't loaded - remove it

This isn't loaded, doesn't seem to be for 2017 or PyCon, so I'll chuck
it.