Several changes, merges from master:

 - Maybe not recommend SHA1 for password hashes anymore
 - Always set cursor to pointer when we have .nav > li > a
   Solves issue #5867. Should be harmless?
 - Don't scroll to top in Wt 3 when path changes, minified scroll history
 - WFileUpload.C: we don't need id() in that variable
   fixes issue where change of object name caused syntax error
 - fix for when WTextEdit is bound as child of another widget in WTemplate
 - New scrolling behaviour on back/forward button presses
  - avoids flicker by updating scroll position only when server response arrives
  - for new hash updates (anchor click), the page will scroll to the top

Author: RockinRoel

resources/themes/bootstrap/2/wt.css

@@ -125,8 +125,7 @@
 /*
  * Show pointer even if anchor has no href
  */
-.navbar .nav > li > a,
-.tabwidget .nav-tabs > li > a {
+.nav > li > a {
   cursor: pointer;
 }
 /*

resources/themes/bootstrap/2/wt.less

@@ -118,8 +118,7 @@
 /*
  * Show pointer even if anchor has no href
  */
-.navbar .nav > li > a,
-.tabwidget .nav-tabs > li > a {
+.nav > li > a {
    cursor: pointer;
 }
 

resources/themes/bootstrap/3/wt.css

@@ -119,8 +119,7 @@
  * Show pointer even if anchor has no href
  */
 
-.navbar .nav > li > a,
-.tabwidget .nav-tabs > li > a {
+.nav > li > a {
   cursor: pointer;
 }
 

resources/themes/bootstrap/3/wt.less

@@ -107,8 +107,7 @@
 /*
  * Show pointer even if anchor has no href
  */
-.navbar .nav > li > a,
-.tabwidget .nav-tabs > li > a {
+.nav > li > a {
    cursor: pointer;
 }
 

src/Wt/Auth/HashFunction

@@ -98,8 +98,8 @@ public:
  * This hash function is only available if %Wt was compiled with
  * OpenSSL support.
  *
- * This hashing function is useful for creating token hashes, and is
- * also considered adequate for password hashes.
+ * This hash function is useful for creating token hashes, but
+ * should not be used for password hashes.
  *
  * \ingroup auth
  */

src/Wt/WFileUpload.C

@@ -460,9 +460,9 @@ DomElement *WFileUpload::createDomElement(WApplication *app)
 
     form->addChild(input);
 
-    doJavaScript("var a" + id() + "=" + jsRef() + ".action;"
+    doJavaScript("var a =" + jsRef() + ".action;"
 		 "var f = function(event) {"
-		 """if (a" + id() + ".indexOf(event.origin) === 0) {"
+		 """if (a.indexOf(event.origin) === 0) {"
 		 ""  "var data = JSON.parse(event.data);"
      ""  "if (data.type === 'upload') {"
      ""    "if (data.fu == '" + id() + "')"

src/Wt/WWebWidget.C

@@ -2229,7 +2229,11 @@ DomElement *WWebWidget::createDomElement(WApplication *app)
 
 bool WWebWidget::domCanBeSaved() const
 {
-  return true;
+  bool canBeSaved = true;
+  iterateChildren([&canBeSaved](WWidget *child){
+    canBeSaved = canBeSaved && child->webWidget()->domCanBeSaved();
+  });
+  return canBeSaved;
 }
 
 bool WWebWidget::isRendered() const

src/web/WebSession.C

@@ -2939,8 +2939,7 @@ void WebSession::notifySignal(const WEvent& e)
 	const std::string *hashE = request.getParameter(se + "_");
 	if (hashE) {
 	  changeInternalPath(*hashE, handler.response());
-	  app_->doJavaScript(WT_CLASS ".scrollIntoView("
-			     + WWebWidget::jsStringLiteral(*hashE) + ");");
+	  app_->doJavaScript(WT_CLASS ".scrollHistory();");
 	} else
 	  changeInternalPath("", handler.response());
       } else {

src/web/skeleton/Wt.js

@@ -914,28 +914,50 @@ this.wheelDelta = function(e) {
   return delta;
 };
 
-this.scrollIntoView = function(id) {
-  setTimeout(function() {
-      var hashI = id.indexOf('#');
-      if (hashI != -1)
-	id = id.substr(hashI + 1);
-
-      var obj = document.getElementById(id);
-      if (obj) {
-	/* Locate a suitable ancestor to scroll */
-	var p;
-	for (p = obj.parentNode; p != document.body; p = p.parentNode) {
-	  if (p.scrollHeight > p.clientHeight &&
-	      WT.css(p, 'overflow-y') == 'auto') {
-	    var xy = WT.widgetPageCoordinates(obj, p);
-	    p.scrollTop += xy.y;
-	    return;
-	  }
-	}
+this.scrollHistory = function() {
+  // after any hash change event (forward/backward, or user clicks
+  // on an achor with internal path), the server calls this function
+  // to update the scroll position of the main window
+  try {
+    if (window.history.state) {
+      if (typeof window.history.state.pageXOffset !== UNDEFINED) {
+        // scroll to a historic position where we have been before
+        //console.log("scrollHistory: " + JSON.stringify(window.history.state));
+        window.scrollTo(window.history.state.pageXOffset, window.history.state.pageYOffset);
+      } else {
+        // we went to a new hash (following an anchor, we assume some equivalence
+        // with 'new page') that hasn't been scrolled yet.
+        // Scroll to the top, which may be overriden by scrollIntoView (if the hash
+        // exists somewhere as an object ID)
+        //console.log("scrollHistory: new page scroll strategy");
+        // window.scrollTo(0, 0);
+        WT.scrollIntoView(window.history.state.state);
+      }
+    }
+  } catch (error) {
+    console.log(error);
+  }
+}
 
-	obj.scrollIntoView(true);
+this.scrollIntoView = function(id) {
+  var hashI = id.indexOf('#');
+  if (hashI != -1)
+    id = id.substr(hashI + 1);
+
+  var obj = document.getElementById(id);
+  if (obj) {
+    /* Locate a suitable ancestor to scroll */
+    var p;
+    for (p = obj.parentNode; p != document.body; p = p.parentNode) {
+      if (p.scrollHeight > p.clientHeight &&
+          WT.css(p, 'overflow-y') == 'auto') {
+        var xy = WT.widgetPageCoordinates(obj, p);
+        p.scrollTop += xy.y;
+        return;
       }
-    }, 100);
+    }
+    obj.scrollIntoView(true);
+  }
 };
 
 function isHighSurrogate(chr) {
@@ -1905,6 +1927,37 @@ function gentleURIEncode(s) {
 }
 
 if (html5History) {
+  // we need to update the scroll position at the scroll event,
+  // because we don't have the chance to update the html5history
+  // state anymore at the moment that onPopState() is called.
+  // For navigation, when pushState() is called, the scroll
+  // history can be updated before the pushState() call.
+  function updateScrollHistory() {
+    //console.log("updateScrollHistory");
+    try {
+      var newState = window.history.state;
+      if (window.history.state == null) {
+        // freshly initiated session, no state present yet
+        newState = {};
+        newState.state = "";
+        newState.title = window.document.title;
+      }
+      newState.pageXOffset = window.pageXOffset;
+      newState.pageYOffset = window.pageYOffset;
+      window.history.replaceState(newState, newState.title);
+    } catch (error) {
+      // shouldn't happen
+      console.log(error.toString());
+    }
+  }
+  window.addEventListener('scroll', updateScrollHistory);
+
+  // the 'auto' scrollRestoration gives too much flicker, since it
+  // updates the scroll state before the page is updated
+  // Browsers not supporting manual scrollRestoration, the flicker
+  // should not be worse than what it was.
+  window.history.scrollRestoration = 'manual';
+
   this.history = (function()
 {
   var currentState = null, baseUrl = null, ugly = false, cb = null,
@@ -1925,7 +1978,9 @@ if (html5History) {
       saveState(initialState);
 
       function onPopState(event) {
-	var newState = event.state;
+	var newState = null;
+        if (event.state && event.state.state)
+          newState = event.state.state;
 
 	if (newState == null)
 	  newState = stateMap[w.location.pathname + w.location.search];
@@ -1945,6 +2000,7 @@ if (html5History) {
 	  currentState = newState;
 	  onStateChange(currentState != "" ? currentState : "/");
 	}
+        //console.log("onPopState: " + JSON.stringify(window.history.state));
       }
 
       w.addEventListener("popstate", onPopState, false);
@@ -1965,6 +2021,7 @@ _$_$endif_$_();
     },
 
     navigate: function (state, generateEvent) {
+      //console.log("navigate: " + state);
       WT.resolveRelativeAnchors();
 
       currentState = state;
@@ -2004,7 +2061,18 @@ _$_$endif_$_();
       }
 
       try {
-	window.history.pushState(state ? state : "", document.title, url);
+        var historyState = { };
+        historyState.state = state ? state : "";
+        // By not setting historyState.page[XY]Offset, we indicate that
+        // this state change was made by navigation rather than by
+        // the back/forward button
+        // keep title for call to replaceState when page offset is updated
+        historyState.title = document.title;
+        // update scroll position of stack top with the position at the time of leaving the page
+        updateScrollHistory();
+        //console.log("pushState before: " + JSON.stringify(window.history.state));
+	window.history.pushState(historyState, document.title, url);
+        //console.log("pushState after: " + JSON.stringify(window.history.state));
       } catch (error) {
 	/*
 	 * In case we are wrong about our baseUrl or base href
@@ -2013,7 +2081,12 @@ _$_$endif_$_();
 	console.log(error.toString());
       }
 
-      WT.scrollIntoView(state);
+      // We used to call scrollIntoView here. We modified this to have
+      // scrollIntoView called after the server round-trip, so that the
+      // new content is certainly visible before we scroll. This avoids
+      // flicker. If the rendering result was pre-learned client-side,
+      // the page will scroll to the right position only after a server
+      // round-trip, which is not ideal.
 
       if (generateEvent)
 	cb(state);
@@ -2056,8 +2129,6 @@ _$_$endif_$_();
 
       w.location.hash = state;
 
-      WT.scrollIntoView(state);
-
       if (generateEvent)
 	cb(state);
     },