Plug a number of security holes: - EditCSV and ExportCSV altered to include permission checks - HTTP POST required on actions which alter data - HTML file uploads served as application/octet-stream - New item action reject creation of new users - Item retirement was not being controlled Additionally include documentation of the changes and modify affected tests.

#!/usr/bin/env python
import zlib, base64, sys
print base64.encodestring(zlib.compress(sys.stdin.read()))