Several changes:

 - Fix issue #7028: make sure to update the offset for subsequent query fields + test cases
 - wt_config.xml.in: extBaseURL has no use in Wt 4 anymore
 - Restore accidental conversions to StandardColor back (in docs)
 - WFileDropWidget: remove UpdateLock taking in JWt
 - explicit bool operators for safe bool conversion in:
   - observing_ptr
   - WApplication::UpdateLock

Author: RockinRoel

src/Wt/Auth/AuthModel.C

@@ -236,14 +236,17 @@ User AuthModel::processAuthToken()
       AuthTokenResult result = baseAuth()->processAuthToken(*token, users());
 
       switch(result.state()) {
-      case AuthTokenState::Valid:
-	/*
-	 * Only extend the validity from what we had currently.
-	 */
-	app->setCookie(baseAuth()->authTokenCookieName(), result.newToken(),
-		       result.newTokenValidity(), "", "", app->environment().urlScheme() == "https");
+      case AuthTokenState::Valid: {
+        if (!result.newToken().empty()) {
+          /*
+           * Only extend the validity from what we had currently.
+           */
+          app->setCookie(baseAuth()->authTokenCookieName(), result.newToken(),
+                         result.newTokenValidity(), "", "", app->environment().urlScheme() == "https");
+        }
 
 	return result.user();
+      }
       case AuthTokenState::Invalid:
         app->setCookie(baseAuth()->authTokenCookieName(),std::string(), 0, "", "", app->environment().urlScheme() == "https");
 

src/Wt/Auth/AuthService.C

@@ -128,6 +128,7 @@ AuthService::AuthService()
     emailVerification_(false),
     emailTokenValidity_(3 * 24 * 60),  // three days
     authTokens_(false),
+    authTokenUpdateEnabled_(true),
     authTokenValidity_(14 * 24 * 60)   // two weeks
 {
   redirectInternalPath_ = "/auth/mail/";
@@ -254,26 +255,31 @@ AuthTokenResult AuthService::processAuthToken(const std::string& token,
   User user = users.findWithAuthToken(hash);
 
   if (user.isValid()) {
-    std::string newToken = WRandom::generateId(tokenLength_);
-    std::string newHash = tokenHashFunction()->compute(newToken, std::string());
-    int validity = user.updateAuthToken(hash, newHash);
-
-    if (validity < 0) {
-      /*
-       * Old API, this is bad since we always extend the lifetime of the
-       * token.
-       */
-      user.removeAuthToken(hash);
-      newToken = createAuthToken(user);
-      validity = authTokenValidity_ * 60;
-    }
+    if (authTokenUpdateEnabled_) {
+      std::string newToken = WRandom::generateId(tokenLength_);
+      std::string newHash = tokenHashFunction()->compute(newToken, std::string());
+      int validity = user.updateAuthToken(hash, newHash);
+
+      if (validity < 0) {
+        /*
+         * Old API, this is bad since we always extend the lifetime of the
+         * token.
+         */
+        user.removeAuthToken(hash);
+        newToken = createAuthToken(user);
+        validity = authTokenValidity_ * 60;
+      }
 
-    if (t.get()) t->commit();
+      if (t.get())
+        t->commit();
 
-    return AuthTokenResult(AuthTokenState::Valid, 
-			   user, newToken, validity);
+      return AuthTokenResult(AuthTokenState::Valid, user, newToken, validity);
+    } else {
+      return AuthTokenResult(AuthTokenState::Valid, user);
+    }
   } else {
-    if (t.get()) t->commit();
+    if (t.get())
+      t->commit();
 
     return AuthTokenResult(AuthTokenState::Invalid);
   }

src/Wt/Auth/AuthService.h

@@ -192,8 +192,8 @@ class WT_API AuthTokenResult
 
   /*! \brief Returns a new token for this user.
    *
-   * An authentication token can be used only once, and needs to be
-   * replaced by a new token.
+   * Returns the empty string if there is no new token. See
+   * AuthService::authTokenUpdateEnabled().
    *
    * The returned token is valid only if the state() == AuthTokenState::Valid.
    */
@@ -203,6 +203,8 @@ class WT_API AuthTokenResult
    *
    * This returns the token validity in seconds.
    *
+   * Returns -1 if there is no new token, or result() != Valid.
+   *
    * \sa newToken()
    */
   int newTokenValidity() const;
@@ -331,6 +333,32 @@ class WT_API AuthService
    */
   bool authTokensEnabled() const { return authTokens_; }
 
+  /*! \brief Set whether processAuthToken() updates the auth token
+   *
+   * If this option is enabled, processAuthToken() will replace the auth token
+   * with a new token. This is a bit more secure, because an auth token can
+   * only be used once. This is enabled by default.
+   *
+   * However, this means that if a user concurrently opens multiple sessions within
+   * the same browsers (e.g. multiple tabs being restored at the same time)
+   * or refreshes before they receive the new cookie, the user will be logged out,
+   * unless the AbstractUserDatabase implementation takes this into account
+   * (e.g. keeps the old token valid for a little bit longer)
+   *
+   * The default Dbo UserDatabase does not handle concurrent token updates well,
+   * so disable this option if you want to prevent that issue.
+   *
+   * \sa processAuthToken()
+   * \sa authTokenUpdateEnabled()
+   */
+  void setAuthTokenUpdateEnabled(bool enabled) { authTokenUpdateEnabled_ = enabled; }
+
+  /*! \brief Returns whether the auth token is updated
+   *
+   * \sa setAuthTokenUpdateEnabled()
+   */
+  bool authTokenUpdateEnabled() const { return authTokenUpdateEnabled_; }
+
   /*! \brief Returns the authentication token cookie name.
    *
    * This is the default cookie name used for storing the authentication
@@ -380,8 +408,11 @@ class WT_API AuthService
   /*! \brief Processes an authentication token.
    *
    * This verifies an authentication token, and considers whether it matches
-   * with a token hash value stored in database. If it matches, the token
-   * is removed and a new token is created for the identified user.
+   * with a token hash value stored in database. If it matches and auth token
+   * update is enabled, the token is updated with a new hash.
+   *
+   * \sa setAuthTokenUpdateEnabled()
+   * \sa AbstractUserDatabase::updateAuthToken()
    */
   virtual AuthTokenResult processAuthToken(const std::string& token,
 					   AbstractUserDatabase& users) const;
@@ -585,6 +616,7 @@ class WT_API AuthService
   std::string redirectInternalPath_;
 
   bool authTokens_;
+  bool authTokenUpdateEnabled_;
   int authTokenValidity_;  // minutes
   std::string authTokenCookieName_;
   std::string authTokenCookieDomain_;

src/Wt/Chart/WAbstractGridData.C

@@ -1731,7 +1731,7 @@ void WAbstractGridData::paintGLIndex(unsigned index, double marginX, double marg
 
     // Encoding the index as a color value.
     //
-    // Since StandardColor::White is the clear color of the index texture,
+    // Since white is the clear color of the index texture,
     // this allows for 16777215 meshes. That should be enough,
     // or is even a tad excessive.
     float r = ((index >> 16) & 0xff) / 255.0f;

src/Wt/Chart/WAbstractGridData.h

@@ -120,7 +120,7 @@ class WT_API WAbstractGridData : public WAbstractDataSeries3D {
   /*! \brief Sets the WPen that is used for drawing the mesh.
    *
    * Used when drawing the mesh on a surface or the lines around bars. The
-   * default is a default constructed WPen (StandardColor::Black and one pixel wide).
+   * default is a default constructed WPen (black and one pixel wide).
    *
    * Note: only the width and color of this WPen are used.
    *

src/Wt/Core/observing_ptr.hpp

@@ -116,7 +116,7 @@ class observing_ptr
    * Returns if the pointer does not point to \c null and the pointed
    * object isn't deleted.
    */
-  operator bool() const noexcept;
+  explicit operator bool() const noexcept;
 
   /*! \brief Returns whether the observed object has been deleted.
    *

src/Wt/Dbo/Query.C

@@ -194,7 +194,7 @@ std::string createQueryCountSql(const std::string& query,
 void substituteFields(const SelectFieldList& list,
 		      const std::vector<FieldInfo>& fs,
 		      std::string& sql,
-		      int offset)
+                      int& offset)
 {
   for (unsigned i = 0, j = 0; j < list.size(); ++j) {
     if (fs[i].isFirstDboField()) {

src/Wt/Dbo/Query_impl.h

@@ -52,7 +52,7 @@ extern void WTDBO_API
 substituteFields(const SelectFieldList& list,
 		 const std::vector<FieldInfo>& fs,
 		 std::string& sql,
-		 int offset);
+                 int& offset);
 
 extern void WTDBO_API 
 parseSql(const std::string& sql, SelectFieldLists& fieldLists);

src/Wt/Render/LayoutBox.h

@@ -27,7 +27,7 @@ struct InlineBox : public LayoutBox
 
   int utf8Pos, utf8Count;
 
-  // minimum width of StandardColor::White space contained in this linebox.
+  // minimum width of whitespace contained in this linebox.
   double whitespaceWidth;
   int whitespaceCount;
 

src/Wt/Render/Line.C

@@ -166,7 +166,7 @@ void Line::finish(AlignmentFlag textAlign,
   Range rangeX(minX, maxX);
   Block::adjustAvailableWidth(y_, page_, floats, rangeX);
 
-  /* Compute total width and total StandardColor::White space width */
+  /* Compute total width and total whitespace width */
   double whitespace = 0;
   double content = 0;