I encountered this because I've set my web browser (Iceweasel/Firefox 21) to store my MediaGoblin password and automatically fill it in when it deems appropriate.

Steps to reproduce

1. Go to "Change account settings".

2. Web browser automatically fills in "Old password" field, but leaves "New password" field empty (user that only wishes to change license setting will not notice this as it happens automatically).

3. Change license setting if you want (this seems to be optional).

4. Press "Save changes."

5. Log out and try to log in again: your old password doesn't work, the new password is the empty string. (Can be confirmed e.g. by trying to login with the piwigo plugin which allows empty password to be entered.)

The change account settings dialog should either warn of empty password, or simply assume the user does not wish to touch the password if it is left empty. (As was my case.)

At the moment, running tests that don't use a full mediagoblin app are fast, ones that do are slow. Probably the reason for this is that we use 3 sqlite databases (one for celery, one for Kombu, one for mediagoblin itself).

I'm not sure whether the celery of kombu (which isn't used during tests anyway) databases would be affected by unit tests if we just switched them over to an in-memory database. It might be easy enough to just do those and they'd be just fine. I don't know.

MediaGoblin's db is a bit different because it needs to run the migration machinery to init the db. This means that things will be a bit tricky: Somehow we need to create a reference to the database *before* the MediaGoblin application spins up and connects it to the ORM. Then we need to pass that database connection (without the ORM initialized) to the migrations, then pass it into the MediaGoblin application, which must then connect the ORM to the database based on init.

Problem: we set up MediaGoblin's application wrapped in paste, so we don't have much control over this.

Here's an alternate solution, also evil, maybe even more so: MediaGoblin the application itself could contain a config option where it will, on init, run dbupdate from *within itself* if needed. (Note: that *could* be used in production environments also but I think it would more likely than not, especially if a person is both running MediaGoblin *and* celery, shoot us in the foot.)

I'm running MediaGoblin under the "mediagoblin" user and serve the files via Nginx/FCGI.

After converting uploaded videos, they have the wrong permissions (600 instead of 644). Images are fine.

Is there a way to define an umask and/or group for newly uploaded files?