Merge remote-tracking branch 'origin/release/0.6.4' into wdtk

Conflicts:
  app/views/request/show.rhtml
  spec/models/info_request_spec.rb

41 files changed, 951 insertions, 444 deletions

diff --git a/.rvmrc b/.rvmrc
new file mode 100644
index 000000000..7a2fff690
--- /dev/null
+++ b/.rvmrc
@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+
+# This is an RVM Project .rvmrc file, used to automatically load the ruby
+# development environment upon cd'ing into the directory
+
+# First we specify our desired <ruby>[@<gemset>], the @gemset name is optional,
+# Only full ruby name is supported here, for short names use:
+#     echo "rvm use 1.8.7" > .rvmrc
+environment_id="ruby-1.8.7-p370"
+
+# Uncomment the following lines if you want to verify rvm version per project
+# rvmrc_rvm_version="1.14.10 (stable)" # 1.10.1 seams as a safe start
+# eval "$(echo ${rvm_version}.${rvmrc_rvm_version} | awk -F. '{print "[[ "$1*65536+$2*256+$3" -ge "$4*65536+$5*256+$6" ]]"}' )" || {
+#   echo "This .rvmrc file requires at least RVM ${rvmrc_rvm_version}, aborting loading."
+#   return 1
+# }
+
+# First we attempt to load the desired environment directly from the environment
+# file. This is very fast and efficient compared to running through the entire
+# CLI and selector. If you want feedback on which environment was used then
+# insert the word 'use' after --create as this triggers verbose mode.
+if [[ -d "${rvm_path:-$HOME/.rvm}/environments"
+  && -s "${rvm_path:-$HOME/.rvm}/environments/$environment_id" ]]
+then
+  \. "${rvm_path:-$HOME/.rvm}/environments/$environment_id"
+  [[ -s "${rvm_path:-$HOME/.rvm}/hooks/after_use" ]] &&
+    \. "${rvm_path:-$HOME/.rvm}/hooks/after_use" || true
+  if [[ $- == *i* ]] # check for interactive shells
+  then echo "Using: $(tput setaf 2)$GEM_HOME$(tput sgr0)" # show the user the ruby and gemset they are using in green
+  else echo "Using: $GEM_HOME" # don't use colors in non-interactive shells
+  fi
+else
+  # If the environment file has not yet been created, use the RVM CLI to select.
+  rvm --create use  "$environment_id" || {
+    echo "Failed to create RVM environment '${environment_id}'."
+    return 1
+  }
+fi
+
+# If you use bundler, this might be useful to you:
+# if [[ -s Gemfile ]] && {
+#   ! builtin command -v bundle >/dev/null ||
+#   builtin command -v bundle | GREP_OPTIONS= \grep $rvm_path/bin/bundle >/dev/null
+# }
+# then
+#   printf "%b" "The rubygem 'bundler' is not installed. Installing it now.\n"
+#   gem install bundler
+# fi
+# if [[ -s Gemfile ]] && builtin command -v bundle >/dev/null
+# then
+#   bundle install | GREP_OPTIONS= \grep -vE '^Using|Your bundle is complete'
+# fi
diff --git a/Gemfile b/Gemfile
index f4d467fc1..4ab068d64 100644
--- a/Gemfile
+++ b/Gemfile
@@ -1,5 +1,5 @@
 # Work around bug in Debian Squeeze - see https://github.com/sebbacon/alaveteli/pull/297#issuecomment-4101012
-if File.exist? "/etc/debian_version" and File.open("/etc/debian_version").read.strip =~ /^6\.0\.[45]$/
+if File.exist? "/etc/debian_version" and File.open("/etc/debian_version").read.strip =~ /^(squeeze|6\.0\.[45])$/
     if File.exist? "/lib/libuuid.so.1"
         require 'dl'
         DL::dlopen('/lib/libuuid.so.1')
diff --git a/README.md b/README.md
index 7563e4063..4bba49af7 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
 # Welcome to Alaveteli!
 
-[![Build Status](https://secure.travis-ci.org/sebbacon/alaveteli.png)](http://travis-ci.org/sebbacon/alaveteli)
+[![Build Status](https://secure.travis-ci.org/sebbacon/alaveteli.png)](http://travis-ci.org/sebbacon/alaveteli) [![Dependency Status](https://gemnasium.com/sebbacon/alaveteli.png)](https://gemnasium.com/sebbacon/alaveteli)
 
 This is an open source project to create a standard, internationalised
 platform for making Freedom of Information (FOI) requests in different
@@ -22,3 +22,6 @@ There's background information and a more documentation on
 [our wiki](https://github.com/sebbacon/alaveteli/wiki/Home/), and lots
 of useful information (including a blog) on
 [the project website](http://alaveteli.org)
+
+Looking for the latest stable release? It's on the 
+[master branch](https://github.com/sebbacon/alaveteli/tree/master).
diff --git a/app/controllers/admin_public_body_controller.rb b/app/controllers/admin_public_body_controller.rb
index 7bd794d23..30a43bb81 100644
--- a/app/controllers/admin_public_body_controller.rb
+++ b/app/controllers/admin_public_body_controller.rb
@@ -142,13 +142,7 @@ class AdminPublicBodyController < AdminController
         @notes = ""
         @errors = ""
         if request.post?
-            if params['commit'] == 'Dry run'
-                dry_run_only = true
-            elsif params['commit'] == 'Upload'
-                dry_run_only = false
-            else
-                raise "internal error, unknown button label"
-            end
+            dry_run_only = (params['commit'] == 'Upload' ? false : true)
             # Read file from params
             if params[:csv_file]
                 csv_contents = params[:csv_file].read
diff --git a/app/controllers/admin_request_controller.rb b/app/controllers/admin_request_controller.rb
index 0b58a95e5..c5abf8769 100644
--- a/app/controllers/admin_request_controller.rb
+++ b/app/controllers/admin_request_controller.rb
@@ -185,7 +185,7 @@ class AdminRequestController < AdminController
                 if m.match(/^[0-9]+$/)
                     destination_request = InfoRequest.find_by_id(m.to_i)
                 else
-                    destination_request = InfoRequest.find_by_url_title(m)
+                    destination_request = InfoRequest.find_by_url_title!(m)
                 end
                 if destination_request.nil?
                     flash[:error] = "Failed to find destination request '" + m + "'"
@@ -362,14 +362,18 @@ class AdminRequestController < AdminController
             info_request.set_described_state(params[:reason])
             info_request.save!
 
-            ContactMailer.deliver_from_admin_message(
-                    info_request.user,
-                    subject,
-                    params[:explanation]
-                )
+            if ! info_request.is_external?
+                ContactMailer.deliver_from_admin_message(
+                        info_request.user,
+                        subject,
+                        params[:explanation]
+                    )
+                flash[:notice] = _("Your message to {{recipient_user_name}} has been sent",:recipient_user_name=>CGI.escapeHTML(info_request.user.name))
+            else
+                flash[:notice] = _("This external request has been hidden")
+            end
             # expire cached files
             expire_for_request(info_request)
-            flash[:notice] = _("Your message to {{recipient_user_name}} has been sent",:recipient_user_name=>CGI.escapeHTML(info_request.user.name))
             redirect_to request_admin_url(info_request)
         end
     end
diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index 40fa018aa..ce18e6ef5 100644
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -134,6 +134,10 @@ class ApplicationController < ActionController::Base
         # Make sure expiry time for session is set (before_filters are
         # otherwise missed by this override)
         session_remember_me
+
+        # Make sure the locale is set correctly too
+        set_gettext_locale
+
         case exception
         when ActiveRecord::RecordNotFound, ActionController::UnknownAction, ActionController::RoutingError
             @status = 404
@@ -157,6 +161,9 @@ class ApplicationController < ActionController::Base
         # otherwise missed by this override)
         session_remember_me
 
+        # Make sure the locale is set correctly too
+        set_gettext_locale
+
         # Display default, detailed error for developers
         original_rescue_action_locally(exception)
     end
@@ -385,8 +392,11 @@ class ApplicationController < ActionController::Base
                        # might fail later if the database has subsequently been reopened.
         return result
     end
+
     def get_search_page_from_params
-        return (params[:page] || "1").to_i
+        page = (params[:page] || "1").to_i
+        page = 1 if page < 1
+        return page
     end
 
     def perform_search_typeahead(query, model)
diff --git a/app/controllers/comment_controller.rb b/app/controllers/comment_controller.rb
index d9cd002dd..1552017c2 100644
--- a/app/controllers/comment_controller.rb
+++ b/app/controllers/comment_controller.rb
@@ -12,7 +12,7 @@ class CommentController < ApplicationController
 
     def new
         if params[:type] == 'request'
-            @info_request = InfoRequest.find_by_url_title(params[:url_title])
+            @info_request = InfoRequest.find_by_url_title!(params[:url_title])
             @track_thing = TrackThing.create_track_for_request(@info_request)
             if params[:comment]
                 @comment = Comment.new(params[:comment].merge({
diff --git a/app/controllers/help_controller.rb b/app/controllers/help_controller.rb
index e3b77271e..c7affd57c 100644
--- a/app/controllers/help_controller.rb
+++ b/app/controllers/help_controller.rb
@@ -15,7 +15,7 @@ class HelpController < ApplicationController
     def unhappy
         @info_request = nil
         if params[:url_title]
-            @info_request = InfoRequest.find_by_url_title(params[:url_title])
+            @info_request = InfoRequest.find_by_url_title!(params[:url_title])
         end
     end
 
diff --git a/app/controllers/request_controller.rb b/app/controllers/request_controller.rb
index b28252ce4..6e983a014 100644
--- a/app/controllers/request_controller.rb
+++ b/app/controllers/request_controller.rb
@@ -64,10 +64,7 @@ class RequestController < ApplicationController
             end
 
             # Look up by new style text names
-            @info_request = InfoRequest.find_by_url_title(params[:url_title])
-            if @info_request.nil?
-                raise ActiveRecord::RecordNotFound.new("Request not found")
-            end
+            @info_request = InfoRequest.find_by_url_title!(params[:url_title])
             set_last_request(@info_request)
 
             # Test for whole request being hidden
@@ -80,7 +77,13 @@ class RequestController < ApplicationController
             @info_request_events = @info_request.info_request_events
             @status = @info_request.calculate_status
             @collapse_quotes = params[:unfold] ? false : true
-            @update_status = params[:update_status] ? true : false
+
+            # Don't allow status update on external requests, otherwise accept param
+            if @info_request.is_external?
+                @update_status = false
+            else
+                @update_status = params[:update_status] ? true : false
+            end
             @old_unclassified = @info_request.is_old_unclassified? && !authenticated_user.nil?
             @is_owning_user = @info_request.is_owning_user?(authenticated_user)
 
@@ -125,14 +128,10 @@ class RequestController < ApplicationController
     # Extra info about a request, such as event history
     def details
         long_cache
-        @info_request = InfoRequest.find_by_url_title(params[:url_title])
-        if @info_request.nil?
-            raise ActiveRecord::RecordNotFound.new("Request not found")
-        else
-            if !@info_request.user_can_view?(authenticated_user)
-                render :template => 'request/hidden', :status => 410 # gone
-                return
-            end
+        @info_request = InfoRequest.find_by_url_title!(params[:url_title])
+        if !@info_request.user_can_view?(authenticated_user)
+            render :template => 'request/hidden', :status => 410 # gone
+            return
         end
         @columns = ['id', 'event_type', 'created_at', 'described_state', 'last_described_at', 'calculated_state' ]
     end
@@ -142,7 +141,7 @@ class RequestController < ApplicationController
         short_cache
         @per_page = 25
         @page = (params[:page] || "1").to_i
-        @info_request = InfoRequest.find_by_url_title(params[:url_title])
+        @info_request = InfoRequest.find_by_url_title!(params[:url_title])
         raise ActiveRecord::RecordNotFound.new("Request not found") if @info_request.nil?
 
         if !@info_request.user_can_view?(authenticated_user)
@@ -385,6 +384,13 @@ class RequestController < ApplicationController
             return
         end
 
+        # If this is an external request, go to the request page - we don't allow
+        # state change from the front end interface.
+        if @info_request.is_external?
+            redirect_to request_url(@info_request)
+            return
+        end
+
         @is_owning_user = @info_request.is_owning_user?(authenticated_user)
         @last_info_request_event_id = @info_request.last_event_id_needing_description
         @old_unclassified = @info_request.is_old_unclassified? && !authenticated_user.nil?
@@ -431,7 +437,7 @@ class RequestController < ApplicationController
                 })
 
             # Don't give advice on what to do next, as it isn't their request
-            RequestMailer.deliver_old_unclassified_updated(@info_request)
+            RequestMailer.deliver_old_unclassified_updated(@info_request) if !@info_request.is_external?
             if session[:request_game]
                 flash[:notice] = _('Thank you for updating the status of the request \'<a href="{{url}}">{{info_request_title}}</a>\'. There are some more requests below for you to classify.',:info_request_title=>CGI.escapeHTML(@info_request.title), :url=>CGI.escapeHTML(request_url(@info_request)))
                 redirect_to play_url
@@ -592,6 +598,13 @@ class RequestController < ApplicationController
             return
         end
 
+        # Test for external request
+        if @info_request.is_external?
+            @reason = 'external'
+            render :action => 'followup_bad'
+            return
+        end
+
         # Force login early - this is really the "send followup" form. We want
         # to make sure they're the right user first, before they start writing a
         # message and wasting their time if they are not the requester.
@@ -667,7 +680,7 @@ class RequestController < ApplicationController
     end
 
     def report_request
-        info_request = InfoRequest.find_by_url_title(params[:url_title])
+        info_request = InfoRequest.find_by_url_title!(params[:url_title])
         return if !authenticated?(
                 :web => _("To report this FOI request"),
                 :email => _("Then you can report the request '{{title}}'", :title => info_request.title),
@@ -793,7 +806,7 @@ class RequestController < ApplicationController
     def upload_response
         @locale = self.locale_from_params()
         PublicBody.with_locale(@locale) do
-            @info_request = InfoRequest.find_by_url_title(params[:url_title])
+            @info_request = InfoRequest.find_by_url_title!(params[:url_title])
 
             @reason_params = {
                     :web => _("To upload a response, you must be logged in using an email address from ") +  CGI.escapeHTML(@info_request.public_body.name),
@@ -850,10 +863,7 @@ class RequestController < ApplicationController
     def download_entire_request
         @locale = self.locale_from_params()
         PublicBody.with_locale(@locale) do
-            info_request = InfoRequest.find_by_url_title(params[:url_title])
-            if info_request.nil?
-                raise ActiveRecord::RecordNotFound.new("Request not found")
-            end
+            info_request = InfoRequest.find_by_url_title!(params[:url_title])
             if authenticated?(
                               :web => _("To download the zip file"),
                               :email => _("Then you can download a zip file of {{info_request_title}}.",:info_request_title=>info_request.title),
diff --git a/app/controllers/services_controller.rb b/app/controllers/services_controller.rb
index 00c0e61bd..40e0faaf7 100644
--- a/app/controllers/services_controller.rb
+++ b/app/controllers/services_controller.rb
@@ -3,36 +3,43 @@
 require 'open-uri'
 
 class ServicesController < ApplicationController
+
     def other_country_message
         text = ""
         iso_country_code = MySociety::Config.get('ISO_COUNTRY_CODE').downcase
         if country_from_ip.downcase != iso_country_code
             found_country = WorldFOIWebsites.by_code(country_from_ip)
             found_country_name = !found_country.nil? && found_country[:country_name]
-            old_locale = FastGettext.locale
-            FastGettext.locale = FastGettext.best_locale_in(request.env['HTTP_ACCEPT_LANGUAGE'])
-            if found_country_name
-                text = _("Hello! You can make Freedom of Information requests within {{country_name}} at {{link_to_website}}", :country_name => found_country_name, :link_to_website => "<a href=\"#{found_country[:url]}\">#{found_country[:name]}</a>")
-            else
-                current_country = WorldFOIWebsites.by_code(iso_country_code)[:country_name]
-                text = _("Hello! We have an  <a href=\"/help/alaveteli?country_name=#{CGI.escape(current_country)}\">important message</a> for visitors outside {{country_name}}", :country_name => current_country)
+
+            old_fgt_locale = FastGettext.locale
+            begin
+              FastGettext.locale = FastGettext.best_locale_in(request.env['HTTP_ACCEPT_LANGUAGE'])
+              if found_country_name
+                  text = _("Hello! You can make Freedom of Information requests within {{country_name}} at {{link_to_website}}", :country_name => found_country_name, :link_to_website => "<a href=\"#{found_country[:url]}\">#{found_country[:name]}</a>")
+              else
+                  current_country = WorldFOIWebsites.by_code(iso_country_code)[:country_name]
+                  text = _("Hello! We have an  <a href=\"/help/alaveteli?country_name=#{CGI.escape(current_country)}\">important message</a> for visitors outside {{country_name}}", :country_name => current_country)
+              end
+            ensure
+              FastGettext.locale = old_fgt_locale
             end
-            FastGettext.locale = old_locale            
         end
         if !text.empty?
             text += ' <span class="close-button">X</span>'
         end
         render :text => text, :content_type => "text/plain"  # XXX workaround the HTML validation in test suite
     end
+
     def hidden_user_explanation
         info_request = InfoRequest.find(params[:info_request_id])
-        render :template => "admin_request/hidden_user_explanation", 
+        render :template => "admin_request/hidden_user_explanation",
                :content_type => "text/plain",
                :layout => false,
-               :locals => {:name_to => info_request.user.name, 
-                          :name_from => MySociety::Config.get("CONTACT_NAME", 'Alaveteli'), 
+               :locals => {:name_to => info_request.user_name,
+                          :name_from => MySociety::Config.get("CONTACT_NAME", 'Alaveteli'),
                           :info_request => info_request, :reason => params[:reason],
                           :info_request_url => 'http://' + MySociety::Config.get('DOMAIN') + request_url(info_request),
                           :site_name => site_name}
     end
+
 end
diff --git a/app/controllers/track_controller.rb b/app/controllers/track_controller.rb
index 07e807451..1a21491b1 100644
--- a/app/controllers/track_controller.rb
+++ b/app/controllers/track_controller.rb
@@ -15,7 +15,7 @@ class TrackController < ApplicationController
 
     # Track all updates to a particular request
     def track_request
-        @info_request = InfoRequest.find_by_url_title(params[:url_title])
+        @info_request = InfoRequest.find_by_url_title!(params[:url_title])
         @track_thing = TrackThing.create_track_for_request(@info_request)
 
         return atom_feed_internal if params[:feed] == 'feed'
diff --git a/app/helpers/link_to_helper.rb b/app/helpers/link_to_helper.rb
index 01332c5ab..16e37277b 100755
--- a/app/helpers/link_to_helper.rb
+++ b/app/helpers/link_to_helper.rb
@@ -45,9 +45,11 @@ module LinkToHelper
     def incoming_message_url(incoming_message)
         return request_url(incoming_message.info_request)+"#incoming-"+incoming_message.id.to_s
     end
+
     def outgoing_message_url(outgoing_message)
         return request_url(outgoing_message.info_request)+"#outgoing-"+outgoing_message.id.to_s
     end
+
     def comment_url(comment)
         return request_url(comment.info_request)+"#comment-"+comment.id.to_s
     end
@@ -67,21 +69,27 @@ module LinkToHelper
     def public_body_url(public_body)
         public_body.url_name.nil? ? '' : show_public_body_url(:url_name => public_body.url_name, :only_path => true)
     end
+
     def public_body_link_short(public_body)
         link_to h(public_body.short_or_long_name), public_body_url(public_body)
     end
+
     def public_body_link(public_body, cls=nil)
         link_to h(public_body.name), public_body_url(public_body), :class => cls
     end
+
     def public_body_link_absolute(public_body) # e.g. for in RSS
         link_to h(public_body.name), main_url(public_body_url(public_body))
     end
+
     def public_body_admin_url(public_body)
         return admin_url('body/show/' + public_body.id.to_s)
     end
+
     def public_body_both_links(public_body)
         link_to(h(public_body.name), main_url(public_body_url(public_body))) + " (" + link_to("admin", public_body_admin_url(public_body)) + ")"
     end
+
     def list_public_bodies_default
         list_public_bodies_url(:tag => 'all')
     end
@@ -90,20 +98,37 @@ module LinkToHelper
     def user_url(user)
         return show_user_url(:url_name => user.url_name, :only_path => true)
     end
+
     def user_link(user, cls=nil)
         link_to h(user.name), user_url(user), :class => cls
     end
+
     def user_link_for_request(request, cls=nil)
         if request.is_external?
-            request.external_user_name || _("Anonymous user")
+            user_name = request.external_user_name || _("Anonymous user")
+            if !request.external_url.nil?
+                link_to h(user_name), request.external_url
+            else
+                user_name
+            end
         else
             link_to h(request.user.name), user_url(request.user), :class => cls
         end
     end
 
+    def user_admin_link_for_request(request, external_text=nil, internal_text=nil)
+        if request.is_external?
+            text = external_text ? external_text : request.user_name + " (external)"
+        else
+            text = internal_text ? internal_text : request.user.name
+            link_to(h(text), user_admin_url(request.user))
+        end
+    end
+
     def user_link_absolute(user)
         link_to h(user.name), main_url(user_url(user))
     end
+
     def request_user_link_absolute(request)
         if request.is_external?
             request.external_user_name || _("Anonymous user")
@@ -111,6 +136,7 @@ module LinkToHelper
             user_link_absolute(request.user)
         end
     end
+
     def user_or_you_link(user)
         if @user && user == @user
             link_to h("you"), user_url(user)
@@ -118,6 +144,7 @@ module LinkToHelper
             link_to h(user.name), user_url(user)
         end
     end
+
     def user_or_you_capital(user)
         if @user && user == @user
             return h("You")
@@ -125,15 +152,19 @@ module LinkToHelper
             return h(user.name)
         end
     end
+
     def user_or_you_capital_link(user)
         link_to user_or_you_capital(user), user_url(user)
     end
+
     def user_admin_url(user)
         return admin_url('user/show/' + user.id.to_s)
     end
+
     def user_admin_link(user, name="admin", cls=nil)
       link_to name, user_admin_url(user), :class => cls
     end
+
     def user_both_links(user)
         link_to(h(user.name), main_url(user_url(user))) + " (" + link_to("admin", user_admin_url(user)) + ")"
     end
@@ -199,6 +230,7 @@ module LinkToHelper
     def about_url
         return help_general_url(:action => 'about')
     end
+
     def unhappy_url(info_request = nil)
         if info_request.nil?
             return help_general_url(:action => 'unhappy')
diff --git a/app/models/exim_log.rb b/app/models/exim_log.rb
index 60faa7f0b..82000efa1 100644
--- a/app/models/exim_log.rb
+++ b/app/models/exim_log.rb
@@ -94,7 +94,7 @@ class EximLog < ActiveRecord::Base
         # Get all requests sent for from 2 to 10 days ago. The 2 day gap is
         # because we load exim log lines via cron at best an hour after they
         # are made)
-        irs = InfoRequest.find(:all, :conditions => [ "created_at < ? and created_at > ?", Time.now() - 2.day, Time.now() - 10.days ] )
+        irs = InfoRequest.find(:all, :conditions => [ "created_at < ? and created_at > ? and user_id is not null", Time.now() - 2.day, Time.now() - 10.days ] )
 
         # Go through each request and check it
         ok = true
diff --git a/app/models/info_request.rb b/app/models/info_request.rb
index a7d09401b..6f472c290 100644
--- a/app/models/info_request.rb
+++ b/app/models/info_request.rb
@@ -223,7 +223,7 @@ class InfoRequest < ActiveRecord::Base
             incoming_message.clear_in_database_caches!
         end
     end
-
+    
     # For debugging
     def InfoRequest.profile_search(query)
         t = Time.now.usec
@@ -246,7 +246,9 @@ public
         # For request with same title as others, add on arbitary numeric identifier
         unique_url_title = url_title
         suffix_num = 2 # as there's already one without numeric suffix
-        while not InfoRequest.find_by_url_title(unique_url_title, :conditions => self.id.nil? ? nil : ["id <> ?", self.id] ).nil?
+        while not InfoRequest.find_by_url_title(unique_url_title,
+            :conditions => self.id.nil? ? nil : ["id <> ?", self.id]
+        ).nil?
             unique_url_title = url_title + "_" + suffix_num.to_s
             suffix_num = suffix_num + 1
         end
@@ -456,7 +458,7 @@ public
 
             if !allow
                 if self.handle_rejected_responses == 'bounce'
-                    RequestMailer.deliver_stopped_responses(self, email, raw_email_data)
+                    RequestMailer.deliver_stopped_responses(self, email, raw_email_data) if !is_external?
                 elsif self.handle_rejected_responses == 'holding_pen'
                     InfoRequest.holding_pen_request.receive(email, raw_email_data, false, reason)
                 elsif self.handle_rejected_responses == 'blackhole'
@@ -566,7 +568,10 @@ public
         self.calculate_event_states
 
         if self.requires_admin?
-            RequestMailer.deliver_requires_admin(self, set_by)
+            # Check there is someone to send the message "from"
+            if !set_by.nil? || !self.user.nil?
+                RequestMailer.deliver_requires_admin(self, set_by)
+            end
         end
     end
 
@@ -942,7 +947,7 @@ public
         last_response_created_at = last_event_time_clause('response')
         age = extra_params[:age_in_days] ? extra_params[:age_in_days].days : OLD_AGE_IN_DAYS
         params = {:select => "*, #{last_response_created_at} as last_response_time",
-                  :conditions => ["awaiting_description = ? and #{last_response_created_at} < ? and url_title != 'holding_pen'",
+                  :conditions => ["awaiting_description = ? and #{last_response_created_at} < ? and url_title != 'holding_pen' and user_id is not null",
                                  true, Time.now() - age],
                                  :order => "last_response_time"}
         params[:limit] = extra_params[:limit] if extra_params[:limit]
@@ -960,6 +965,7 @@ public
     end
 
     def is_old_unclassified?
+        return false if is_external?
         return false if !awaiting_description
         return false if url_title == 'holding_pen'
         last_response_event = get_last_response_event
diff --git a/app/models/request_mailer.rb b/app/models/request_mailer.rb
index 03d26f237..ba9285fc6 100644
--- a/app/models/request_mailer.rb
+++ b/app/models/request_mailer.rb
@@ -28,17 +28,17 @@ class RequestMailer < ApplicationMailer
                 :filename => attachment_name
         end
     end
-    
+
     # Used when a response is uploaded using the API
     def external_response(info_request, body, sent_at, attachments)
         @from = blackhole_email
         @recipients = info_request.incoming_name_and_email
         @body = { :body => body }
-        
+
         # ActionMailer only works properly when the time is in the local timezone:
         # see https://rails.lighthouseapp.com/projects/8994/tickets/3113-actionmailer-only-works-correctly-with-sent_on-times-that-are-in-the-local-time-zone
         @sent_on = sent_at.dup.localtime
-        
+
         attachments.each do |attachment_hash|
             attachment attachment_hash
         end
@@ -392,6 +392,7 @@ class RequestMailer < ApplicationMailer
         )
         for info_request in info_requests
 
+            next if info_request.is_external?
             # Count number of new comments to alert on
             earliest_unalerted_comment_event = nil
             last_comment_event = nil
diff --git a/app/views/admin_public_body/import_csv.rhtml b/app/views/admin_public_body/import_csv.rhtml
index 4eb83cc7e..4a03d0665 100644
--- a/app/views/admin_public_body/import_csv.rhtml
+++ b/app/views/admin_public_body/import_csv.rhtml
@@ -44,7 +44,7 @@
 
     <blockquote>
         <p>
-            #id,name,request_email,name.es,tag_string<br/>
+            &#35;id,name,request_email,name.es,tag_string<br/>
             1,An Authority,a@example.com,Un organismo,a_tag another_tag<br/>
             2,Another One,another@example.com,Otro organismo,a_tag<br/>
         <p>
diff --git a/app/views/admin_request/edit.rhtml b/app/views/admin_request/edit.rhtml
index 4026ee712..808028b47 100644
--- a/app/views/admin_request/edit.rhtml
+++ b/app/views/admin_request/edit.rhtml
@@ -7,21 +7,21 @@
    <p><label for="info_request_title"><strong>Title</strong></label> (warning: editing this will break URLs right now)<br/>
    <%= text_field 'info_request', 'title', :size => 50  %></p>
 
-   <p><label for="info_request_prominence"><strong>Prominence</strong></label> 
+   <p><label for="info_request_prominence"><strong>Prominence</strong></label>
    <%= select( 'info_request', "prominence", [ "normal", "backpage", "requester_only", "hidden" ]) %>
    (backpage means hidden from lists/search; hidden means completely hidden; super users can see anything)
    </p>
 
    <p>
-   <label for="info_request_allow_new_responses_from"><strong>Allow new responses</strong> from</label> 
+   <label for="info_request_allow_new_responses_from"><strong>Allow new responses</strong> from</label>
    <%= select( 'info_request', "allow_new_responses_from", [ "anybody", "authority_only", "nobody" ] ) %>;
-   <label for="info_request_handle_rejected_responses"><strong>Handle rejected responses</strong> with</label> 
+   <label for="info_request_handle_rejected_responses"><strong>Handle rejected responses</strong> with</label>
    <%= select( 'info_request', "handle_rejected_responses", [ "bounce", "holding_pen", "blackhole" ] ) %>
    <br>
    ('authority_only' means email From: domain of authority request email or any domain that has previously sent a response; 'nobody' also stops requester making followups; take care when using 'blackhole' which just drops mail)
    </p>
 
-   <p><label for="info_request_described_state"><strong>Described state</strong></label> 
+   <p><label for="info_request_described_state"><strong>Described state</strong></label>
    <%= select( 'info_request', "described_state", InfoRequest.enumerate_states ) %>;
     <label for="info_request_awaiting_description"><strong>Awaiting description</strong></label>
    <%= select('info_request', "awaiting_description", [["Yes - needs state updating",true],["No - state is up to date",false]]) %>
@@ -49,7 +49,7 @@
 
 <% form_tag '../destroy/' + @info_request.id.to_s do %>
     <p>
-    <strong>This is permanent and irreversible!</strong> <%= submit_tag 'Destory request entirely' %>
+    <strong>This is permanent and irreversible!</strong> <%= submit_tag 'Destroy request entirely' %>
     <br>Use it mainly if someone posts private information, e.g. made a Data Protection request. It
     destroys all responses and tracks as well.
     </p>
diff --git a/app/views/comment/new.rhtml b/app/views/comment/new.rhtml
index 55155c8a2..aa5b6051c 100644
--- a/app/views/comment/new.rhtml
+++ b/app/views/comment/new.rhtml
@@ -33,7 +33,7 @@
 <% if [ 'successful', 'partially_successful' ].include?(@info_request.described_state) %>
     <li><%= _(' <strong>Summarise</strong> the content of any information returned. ')%></li>
     <li><%= _(' Say how you\'ve <strong>used the information</strong>, with links if possible.')%> </li>
-    <li> <%= _('<strong>Thank</strong> the public authority or ')%><%=h @info_request.user.name %>. </li>
+    <li> <%= _('<strong>Thank</strong> the public authority or ')%><%=h (@info_request.user_name ? @info_request.user_name : _('the requester')) %>. </li>
 <% end %>
 <% if [ 'partially_successful' ].include?(@info_request.described_state) %>
     <li> <%= _('Suggest how the requester can find the <strong>rest of the information</strong>.')%></li>
@@ -67,7 +67,7 @@
 </ul>
 
 <p>
-    <big><%= _('Annotations will be posted publicly here, and are 
+    <big><%= _('Annotations will be posted publicly here, and are
         <strong>not</strong> sent to {{public_body_name}}.',:public_body_name=>h(@info_request.public_body.name)) %></big>
     <% if @info_request.is_external? %>
     <big><%= _('Note that the requester will not be notified about your annotation, because the request was published by {{public_body_name}} on their behalf.', :public_body_name => @info_request.public_body.name) %></big>
diff --git a/app/views/request/_after_actions.rhtml b/app/views/request/_after_actions.rhtml
index 02ed7c849..15ca6302e 100644
--- a/app/views/request/_after_actions.rhtml
+++ b/app/views/request/_after_actions.rhtml
@@ -1,51 +1,52 @@
 <div id="after_actions">
-    
+
     <h2><%= _('Things to do with this request') %></h2>
 
     <div id="anyone_actions">
         <strong><%= _('Anyone:') %></strong>
         <ul>
         <li>
-			<%= _('<a href="%s">Add an annotation</a> (to help the requester or others)') % [new_comment_url(:url_title => @info_request.url_title)] %>
+      <%= _('<a href="%s">Add an annotation</a> (to help the requester or others)') % [new_comment_url(:url_title => @info_request.url_title)] %>
         </li>
-        <% if @old_unclassified %> 
+        <% if @old_unclassified %>
             <li>
                 <%= link_to _('Update the status of this request'), '#describe_state_form_1' %>
             </li>
         <% end %>
       <li>
-          <%= link_to _("Download a zip file of all correspondence"), download_entire_request_url(:url_title => @info_request.url_title) %> 
+          <%= link_to _("Download a zip file of all correspondence"), download_entire_request_url(:url_title => @info_request.url_title) %>
       </li>
     </ul>
     </div>
+    <% if ! @info_request.is_external? %>
+      <div id="owner_actions">
+      <strong><%= _('{{info_request_user_name}} only:',:info_request_user_name=>h(@info_request.user_name)) %></strong>
+        <ul>
+
+        <li>
+            <% if @last_response.nil? %>
+                <%= link_to _("Send a followup"), show_response_no_followup_url(:id => @info_request.id, :incoming_message_id => nil) + "#followup" %>
+            <% else %>
+                <%= link_to _("Write a reply"), show_response_url(:id => @info_request.id, :incoming_message_id => @last_response.id) + "#followup" %>
+            <% end %>
+        </li>
+        <% if !@old_unclassified %>
+            <li>
+            <%= link_to _("Update the status of this request"), request_url(@info_request, :update_status => 1) %>
+            </li>
+        <% end %>
+        <li>
+            <%= link_to _("Request an internal review"), show_response_no_followup_url(:id => @info_request.id, :incoming_message_id => nil) + "?internal_review=1#followup" %>
+        </li>
+    </ul>
+      </div>
+    <% end %>
 
-    <div id="owner_actions">
-		<strong><%= _('{{info_request_user_name}} only:',:info_request_user_name=>h(@info_request.user_name)) %></strong>
-      <ul>
-      
-      <li>
-          <% if @last_response.nil? %>
-              <%= link_to _("Send a followup"), show_response_no_followup_url(:id => @info_request.id, :incoming_message_id => nil) + "#followup" %>
-          <% else %>
-              <%= link_to _("Write a reply"), show_response_url(:id => @info_request.id, :incoming_message_id => @last_response.id) + "#followup" %>
-          <% end %>
-      </li>
-      <% if !@old_unclassified %>
-          <li>
-          <%= link_to _("Update the status of this request"), request_url(@info_request, :update_status => 1) %>
-          </li>
-      <% end %>
-      <li>
-          <%= link_to _("Request an internal review"), show_response_no_followup_url(:id => @info_request.id, :incoming_message_id => nil) + "?internal_review=1#followup" %> 
-      </li>
-  </ul>
-    </div>
-  
     <div id="public_body_actions">
-		<strong><%= _('{{public_body_name}} only:',:public_body_name=>h(@info_request.public_body.name) ) %> </strong>
+    <strong><%= _('{{public_body_name}} only:',:public_body_name=>h(@info_request.public_body.name) ) %> </strong>
       <ul>
       <li>
-          <%= link_to _("Respond to request"), upload_response_url(:url_title => @info_request.url_title) %> 
+          <%= link_to _("Respond to request"), upload_response_url(:url_title => @info_request.url_title) %>
       </li>
       </ul>
     </div>
diff --git a/app/views/request/_correspondence.rhtml b/app/views/request/_correspondence.rhtml
index 36257991b..bcfc93657 100644
--- a/app/views/request/_correspondence.rhtml
+++ b/app/views/request/_correspondence.rhtml
@@ -40,7 +40,7 @@ elsif [ 'sent', 'followup_sent' ].include?(info_request_event.event_type)
         <%= render :partial => 'bubble', :locals => { :body => outgoing_message.get_body_for_html_display(), :attachments => nil }  %>
 
         <p class="event_actions"> 
-            <% if outgoing_message.status == 'ready' %>
+            <% if outgoing_message.status == 'ready' && !@info_request.is_external? %>
                  <strong>Warning:</strong> This message has <strong>not yet been sent</strong> for an unknown reason.
             <% end %> 
 
diff --git a/app/views/request/followup_bad.rhtml b/app/views/request/followup_bad.rhtml
index 306eddd10..7efa3f826 100644
--- a/app/views/request/followup_bad.rhtml
+++ b/app/views/request/followup_bad.rhtml
@@ -25,6 +25,9 @@
     one on their website, or by phoning them up and asking. If you manage
     to find one, then please <a href="%s">send it to us</a>.') % [help_contact_path] %>
     </p>
+<% elsif @reason == 'external' %>
+    <p><%= _("Followups cannot be sent for this request, as it was made externally, and published here by {{public_body_name}} on the requester's behalf.", :public_body_name => h(@info_request.public_body.name)) %>
+    </p>
 <% else %>
     <% raise _("unknown reason ") + @reason %>
 <% end %>
diff --git a/app/views/request/show.rhtml b/app/views/request/show.rhtml
index b4795fc21..a9fd95d54 100644
--- a/app/views/request/show.rhtml
+++ b/app/views/request/show.rhtml
@@ -16,7 +16,7 @@
 <% end %>
 
 
-<% if @update_status || @info_request.awaiting_description %>
+<% if ( @update_status || @info_request.awaiting_description ) && ! @info_request.is_external? %>
     <div class="describe_state_form" id="describe_state_form_1">
     <%= render :partial => 'describe_state', :locals => { :id_suffix => "1" } %>
     </div>
@@ -36,25 +36,22 @@
 
     <p class="subtitle">
         <% if !@user.nil? && @user.admin_page_links? %>
-            <%= _('{{user}} (<a href="{{user_admin_url}}">admin</a>) made this {{law_used_full}} request (<a href="{{request_admin_url}}">admin</a>) to {{public_body_link}} (<a href="{{public_body_admin_url}}">admin</a>)',
-                    :user => user_link(@info_request.user),
+            <%= _('{{user}} ({{user_admin_link}}) made this {{law_used_full}} request (<a href="{{request_admin_url}}">admin</a>) to {{public_body_link}} (<a href="{{public_body_admin_url}}">admin</a>)',
+                    :user => @info_request.is_external? ? (@info_request.user_name || _('An anonymous user')) : user_link(@info_request.user),
                     :law_used_full => h(@info_request.law_used_full),
-                    :user_admin_url => user_admin_url(@info_request.user),
+                    :user_admin_link => user_admin_link_for_request(@info_request, _('external'), _('admin')),
                     :request_admin_url => request_admin_url(@info_request),
                     :public_body_link => public_body_link(@info_request.public_body),
                     :public_body_admin_url => public_body_admin_url(@info_request.public_body)) %>
         <% else %>
-
-
-            <%= _('{{user}} made this {{law_used_full}} request',:user=>@info_request.user.nil? ? @info_request.user_name : user_link(@info_request.user), :law_used_full=>h(@info_request.law_used_full)) %>
+            <%= _('{{user}} made this {{law_used_full}} request',:user=>@info_request.is_external? ? (@info_request.user_name || _('An anonymous user')) : user_link(@info_request.user), :law_used_full=>h(@info_request.law_used_full)) %>
             <%= _('to {{public_body}}',:public_body=>public_body_link(@info_request.public_body)) %>
-
         <% end %>
     </p>
 
     <p id="request_status" class="request_icon_line icon_<%= @info_request.calculate_status %>">
     <% if @info_request.awaiting_description %>
-        <% if @is_owning_user %>
+        <% if @is_owning_user && !@info_request.is_external? %>
             <%= _('Please <strong>answer the question above</strong> so we know whether the ')%>
             <%= MySociety::Format.fancy_pluralize(@new_responses_count, 'recent response contains', 'recent responses contain') %> <%= _('useful information.') %>
         <% else %>
@@ -65,10 +62,8 @@
               <%= _('and update the status accordingly. Perhaps <strong>you</strong> might like to help out by doing that?') %>
             <% else %>
             <%=  _('We\'re waiting for') %>
-
               <%= user_link_for_request(@info_request) %> <%= _('to read') %>
               <%= MySociety::Format.fancy_pluralize(@new_responses_count, 'a recent response', 'recent responses') %>
-
               <%= _('and update the status.') %>
             <% end %>
         <% end %>
@@ -93,8 +88,10 @@
         <%= _('Response to this request is <strong>long overdue</strong>.') %>
         <%= _('By law, under all circumstances, {{public_body_link}} should have responded by now',:public_body_link => public_body_link(@info_request.public_body)) %>
         (<%= _('<a href="%s">details</a>') % [help_requesting_path + '#quickly_response'] %>).
-        <%= _('You can <strong>complain</strong> by') %>
-        <%= link_to _("requesting an internal review"), show_response_no_followup_url(:id => @info_request.id, :incoming_message_id => nil) + "?internal_review=1#followup" %>.
+        <% if !@info_request.is_external? %>
+          <%= _('You can <strong>complain</strong> by') %>
+          <%= link_to _("requesting an internal review"), show_response_no_followup_url(:id => @info_request.id, :incoming_message_id => nil) + "?internal_review=1#followup" %>.
+        <% end %>
     <% elsif @status == 'not_held' %>
         <%= public_body_link(@info_request.public_body) %> <%= _('<strong>did not have</strong> the information requested.') %>
     <% elsif @status == 'rejected' %>
@@ -104,14 +101,16 @@
     <% elsif @status == 'partially_successful' %>
         <%= _('The request was <strong>partially successful</strong>.') %>
     <% elsif @status == 'waiting_clarification' %>
-        <% if @is_owning_user %>
+        <% if @is_owning_user && !@info_request.is_external? %>
             <%=h @info_request.public_body.name %> <%= _('is <strong>waiting for your clarification</strong>.') %>
             <%= _('Please') %>
               <%= link_to _("send a follow up message"), respond_to_last_url(@info_request) + '#followup' %>.
         <% else %>
             <%= _('The request is <strong>waiting for clarification</strong>.') %>
-            <%= _('If you are {{user_link}}, please',:user_link=>user_link_for_request(@info_request)) %>
-            <%= link_to _("sign in"), signin_url(:r => request.request_uri) %> <%= _('to send a follow up message.') %>
+            <% if !@info_request.is_external? %>
+              <%= _('If you are {{user_link}}, please',:user_link=>user_link_for_request(@info_request)) %>
+              <%= link_to _("sign in"), signin_url(:r => request.request_uri) %> <%= _('to send a follow up message.') %>
+            <% end %>
         <% end %>
     <% elsif @status == 'gone_postal' %>
         <%= _('The authority would like to / has <strong>responded by post</strong> to this request.') %>
@@ -141,7 +140,7 @@
         <% end %>
     <% end %>
 
-    <% if @info_request.awaiting_description %>
+    <% if @info_request.awaiting_description && ! @info_request.is_external? %>
         <div class="describe_state_form" id="describe_state_form_2">
         <%= render :partial => 'describe_state', :locals => { :id_suffix => "2" } %>
         </div>
diff --git a/app/views/request/simple_correspondence.rhtml b/app/views/request/simple_correspondence.rhtml
index 45b90b84b..bcbc795e7 100644
--- a/app/views/request/simple_correspondence.rhtml
+++ b/app/views/request/simple_correspondence.rhtml
@@ -4,16 +4,16 @@
 <%
     incoming_message = nil
     if info_request_event.visible
-	if !info_request_event.nil? && info_request_event.event_type == 'response'
-	   incoming_message = info_request_event.incoming_message
-	end
+    if !info_request_event.nil? && info_request_event.event_type == 'response'
+       incoming_message = info_request_event.incoming_message
+    end
 
 
     if not incoming_message.nil?
         if !incoming_message.safe_mail_from.nil? && incoming_message.safe_mail_from.strip != @info_request.public_body.name.strip %>
 <%= _('From:') %> <%= incoming_message.safe_mail_from %><% end
         if incoming_message.safe_mail_from.nil? || (incoming_message.mail_from_domain == @info_request.public_body.request_email_domain) %>, <%= @info_request.public_body.name %><% end %>
-<%= _('To:') %> <%= @info_request.user.name %>
+<%= _('To:') %> <% if @info_request.user_name %><%= @info_request.user_name %><% else %><%= "[#{_('An anonymous user')}]"%><% end %>
 <%= _('Date:') %> <%= simple_date(incoming_message.sent_at) %>
 
 <%= incoming_message.get_body_for_quoting %>
@@ -24,7 +24,7 @@
 elsif [ 'sent', 'followup_sent' ].include?(info_request_event.event_type)
     outgoing_message = info_request_event.outgoing_message
     %>
-<%= _('From:') %> <%= @info_request.user.name %>
+<%= _('From:') %> <% if @info_request.user_name %><%= @info_request.user_name %><% else %><%= "[#{_('An anonymous user')}]"%><% end %>
 <%= _('To:') %> <%= @info_request.public_body.name %>
 <%= _('Date:') %> <%= simple_date(info_request_event.created_at) %>
 <%
@@ -36,7 +36,7 @@ elsif [ 'sent', 'followup_sent' ].include?(info_request_event.event_type)
 <%= _('Date:') %> <%= simple_date(info_request_event.created_at) %>
 Sent <% if info_request_event.outgoing_message.message_type == 'initial_request' %> request <% elsif info_request_event.outgoing_message.message_type == 'followup' %> a follow up <% else %> <% raise "unknown message_type" %><% end %> to <%= public_body_link(@info_request.public_body) %> again<% if not info_request_event.same_email_as_previous_send? %>, using a new contact address<% end %>.
 
-<% elsif info_request_event.event_type == 'comment' 
+<% elsif info_request_event.event_type == 'comment'
     comment = info_request_event.comment
 %>
 <%= _("{{username}} left an annotation:", :username =>comment.user.name) %> (<%= simple_date(comment.created_at || Time.now) %>)
diff --git a/app/views/request/upload_response.rhtml b/app/views/request/upload_response.rhtml
index 0de96c5f3..697ff99aa 100644
--- a/app/views/request/upload_response.rhtml
+++ b/app/views/request/upload_response.rhtml
@@ -27,17 +27,17 @@
 
   <h2><%= _('Respond using the web')%></h2>
 
-  <p><%= _('Enter your response below. You may attach one file (use email, or 
+  <p><%= _('Enter your response below. You may attach one file (use email, or
   <a href="%s">contact us</a> if you need more).')% [help_contact_path] %></p>
 
   <% form_tag '', :id => 'upload_response_form', :multipart => true do %>
       <p>
-          <label class="form_label" for="body"><% _('Response:')%></label> 
+          <label class="form_label" for="body"><% _('Response:')%></label>
                   <%= text_area_tag :body, "", :rows => 10, :cols => 55 %>
       </p>
 
       <p>
-  	    <label class="form_label" for="file_1"><% _('Attachment (optional):')%></label> 
+        <label class="form_label" for="file_1"><% _('Attachment (optional):')%></label>
           <%= file_field_tag :file_1, :size => 35 %>
       </p>
 
diff --git a/config/general.yml-example b/config/general.yml-example
index 5653f89bc..33e3ad5bf 100644
--- a/config/general.yml-example
+++ b/config/general.yml-example
@@ -37,7 +37,7 @@ FRONTPAGE_PUBLICBODY_EXAMPLES: 'tgq'
 # URLs of themes to download and use (when running rails-post-deploy
 # script). Earlier in the list means the templates have a higher
 # priority.
-THEME_URLS: 
+THEME_URLS:
  - 'git://github.com/sebbacon/adminbootstraptheme.git'
  - 'git://github.com/sebbacon/alavetelitheme.git'
 
@@ -157,8 +157,3 @@ VARNISH_HOST: localhost
 
 # Adding a value here will enable Google Analytics on all non-admin pages.
 GA_CODE: ''
-
-# We need to add the WDTK survey variables here, or else the deployment
-# system will cry.
-SURVEY_SECRET: ''
-SURVEY_URL: ''
diff --git a/config/httpd.conf b/config/httpd.conf
index 6428a2006..36f567964 100644
--- a/config/httpd.conf
+++ b/config/httpd.conf
@@ -5,7 +5,7 @@
 #
 # Copyright (c) 2007 UK Citizens Online Democracy. All rights reserved.
 # Email: francis@mysociety.org; WWW: http://www.mysociety.org
-# 
+#
 # $Id: httpd.conf,v 1.31 2009-09-02 13:05:48 matthew Exp $
 
 # This is needed for the PHP spell checker
@@ -25,7 +25,7 @@ RewriteEngine On
 # it.
 RewriteCond %{LA-U:REMOTE_USER} (.+)
 RewriteRule . - [E=RU:%1]
-RequestHeader add X-Forwarded-User %{RU}e 
+RequestHeader add X-Forwarded-User %{RU}e
 
 # Old /files URL to new subdomain (as can't use Alias with passenger,
 # so we do it on its own domain). This is for custom admin upload
diff --git a/config/initializers/single_quote_escape_workaround.rb b/config/initializers/single_quote_escape_workaround.rb
new file mode 100644
index 000000000..2e713b982
--- /dev/null
+++ b/config/initializers/single_quote_escape_workaround.rb
@@ -0,0 +1,31 @@
+class ERB

+  module Util

+

+    if "html_safe exists".respond_to?(:html_safe)

+      def html_escape(s)

+        s = s.to_s

+        if s.html_safe?

+          s

+        else

+          Rack::Utils.escape_html(s).html_safe

+        end

+      end

+    else

+      def html_escape(s)

+        s = s.to_s

+        Rack::Utils.escape_html(s).html_safe

+      end

+    end

+

+    remove_method :h

+    alias h html_escape

+

+    class << self

+      remove_method :html_escape

+      remove_method :h

+    end

+

+    module_function :html_escape

+    module_function :h

+  end

+end

diff --git a/config/routes.rb b/config/routes.rb
index a9c2c889a..34232b55b 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -80,7 +80,7 @@ ActionController::Routing::Routes.draw do |map|
 
     # Use /profile for things to do with the currently signed in user.
     # Use /user/XXXX for things that anyone can see about that user.
-    # Note that /profile isn't indexe by search (see robots.txt)
+    # Note that /profile isn't indexed by search (see robots.txt)
     map.with_options :controller => 'user' do |user|
         user.signin '/profile/sign_in',        :action => 'signin'
         user.signup '/profile/sign_up',        :action => 'signup'
diff --git a/db/migrate/113_add_external_fields_to_info_requests.rb b/db/migrate/113_add_external_fields_to_info_requests.rb
index 3aea57766..1ad7634ff 100644
--- a/db/migrate/113_add_external_fields_to_info_requests.rb
+++ b/db/migrate/113_add_external_fields_to_info_requests.rb
@@ -4,6 +4,7 @@ class AddExternalFieldsToInfoRequests < ActiveRecord::Migration
     add_column :info_requests, :external_user_name, :string, :null => true
     add_column :info_requests, :external_url, :string, :null => true
     
+    # NB This is corrected in 20120822145640
     if ActiveRecord::Base.connection.adapter_name == "PostgreSQL"
         execute "ALTER TABLE info_requests ADD CONSTRAINT info_requests_external_ck CHECK ( (user_id is null) = (external_url is not null) and (external_user_name is not null or external_url is null) )"
     end
diff --git a/db/migrate/20120822145640_correct_external_request_constraint.rb b/db/migrate/20120822145640_correct_external_request_constraint.rb
new file mode 100644
index 000000000..6902f3cb2
--- /dev/null
+++ b/db/migrate/20120822145640_correct_external_request_constraint.rb
@@ -0,0 +1,15 @@
+class CorrectExternalRequestConstraint < ActiveRecord::Migration
+  def self.up
+    if ActiveRecord::Base.connection.adapter_name == "PostgreSQL"
+      execute "ALTER TABLE info_requests DROP CONSTRAINT info_requests_external_ck"
+      execute "ALTER TABLE info_requests ADD CONSTRAINT info_requests_external_ck CHECK ( (user_id is null) = (external_url is not null) and (external_url is not null or external_user_name is null) )"
+    end
+  end
+
+  def self.down
+    if ActiveRecord::Base.connection.adapter_name == "PostgreSQL"
+      execute "ALTER TABLE info_requests DROP CONSTRAINT info_requests_external_ck"
+      execute "ALTER TABLE info_requests ADD CONSTRAINT info_requests_external_ck CHECK ( (user_id is null) = (external_url is not null) and (external_user_name is not null or external_url is null) )"
+    end
+  end
+end
diff --git a/doc/CHANGES.md b/doc/CHANGES.md
index 4115389d5..42f408bab 100644
--- a/doc/CHANGES.md
+++ b/doc/CHANGES.md
@@ -1,3 +1,14 @@
+# Version 0.6.4
+## Highlighted features
+* This is a minor bugfix release, mainly to fix bugs related to external request handling. 
+* [List of issues on github](https://github.com/sebbacon/alaveteli/issues?milestone=18&state=closed)
+* [List of commits since last release](https://github.com/sebbacon/alaveteli/compare/master...release/0.6.4)
+
+## Upgrade notes
+
+* No special action required -- just check out this version and run
+  `rails-post-deploy` as usual.
+
 # Version 0.6.3
 ## Highlighted features
 * This is a minor release, mainly to publish new customisation
@@ -11,8 +22,7 @@
   customisation in themes
 * Themes can now provide a `post_install.rb` script that is executed
   by `rails-post-deploy`
-* [List of isses on github](https://github.com/sebbacon/alaveteli/issues?milestone=17&state=closed)
-* [List of commits since last release](https://github.com/sebbacon/alaveteli/compare/master...release/0.6.3)
+* [List of issues on github](https://github.com/sebbacon/alaveteli/issues?milestone=17&state=closed)
 
 ## Upgrade notes
 
diff --git a/doc/INSTALL.md b/doc/INSTALL.md
index b71b89676..588f8e4fe 100644
--- a/doc/INSTALL.md
+++ b/doc/INSTALL.md
@@ -19,12 +19,11 @@ Next, get hold of the Alaveteli source code from github:
     git clone https://github.com/sebbacon/alaveteli.git
     cd alaveteli
 
-This will get the current stable release from the master branch (which
-always contains the latest release).  If you are a developer and want
-to add or try new features, you might want to swap to the development
-branch:
+This will get the development branch, which has the latest (possibly
+buggy) code. If you don't want to add or try new features, swap to the
+master branch (which always contains the latest stable release):
 
-    git checkout develop
+    git checkout master
 
 # Install system dependencies
 
diff --git a/doc/TRANSLATE.md b/doc/TRANSLATE.md
index 97ef39954..543c16cd9 100644
--- a/doc/TRANSLATE.md
+++ b/doc/TRANSLATE.md
@@ -66,7 +66,7 @@ must:
         * this updates the PO template, but also merges it with the
           individual PO files, marking strings that have only changed
           slightly as "fuzzy"
-    * reupload (`tx push -s -t`) the POT and PO files to Transifex to the
+    * reupload (`tx push -s -t`) the POT and PO files to Transifex from the
       current release branch
         * The point of uploading the PO files is that Transifex
           converts the "fuzzy" suggestions from Transifex into
diff --git a/lib/quiet_opener.rb b/lib/quiet_opener.rb
index 8cedad250..bde645d0b 100644
--- a/lib/quiet_opener.rb
+++ b/lib/quiet_opener.rb
@@ -5,7 +5,7 @@ require 'net/http/local'
 def quietly_try_to_open(url)
     begin 
         result = open(url).read.strip
-    rescue OpenURI::HTTPError, SocketError, Errno::ETIMEDOUT, Errno::ECONNREFUSED, Errno::EHOSTUNREACH
+    rescue OpenURI::HTTPError, SocketError, Errno::ETIMEDOUT, Errno::ECONNREFUSED, Errno::EHOSTUNREACH, Errno::ECONNRESET
         Rails.logger.warn("Unable to open third-party URL #{url}")
         result = ""
     end
@@ -24,7 +24,7 @@ def quietly_try_to_purge(host, url)
                 result_body = response.body
             }
         end
-    rescue OpenURI::HTTPError, SocketError, Errno::ETIMEDOUT, Errno::ECONNREFUSED, Errno::EHOSTUNREACH
+    rescue OpenURI::HTTPError, SocketError, Errno::ETIMEDOUT, Errno::ECONNREFUSED, Errno::EHOSTUNREACH, Errno::ECONNRESET
         Rails.logger.warn("PURGE: Unable to reach host #{host}")
     end
     if result == "200"
diff --git a/spec/controllers/admin_request_controller_spec.rb b/spec/controllers/admin_request_controller_spec.rb
index eb6f7aebc..252818452 100644
--- a/spec/controllers/admin_request_controller_spec.rb
+++ b/spec/controllers/admin_request_controller_spec.rb
@@ -220,6 +220,56 @@ describe AdminRequestController, "when administering the holding pen" do
             post :hide_request, :id => ir.id, :explanation => "Foo", :reason => "vexatious"
         end
 
+        describe 'when hiding an external request' do
+
+            before do
+                @controller.stub!(:expire_for_request)
+                @info_request = mock_model(InfoRequest, :prominence= => nil,
+                                                        :log_event => nil,
+                                                        :set_described_state => nil,
+                                                        :save! => nil,
+                                                        :user => nil,
+                                                        :user_name => 'External User',
+                                                        :is_external? => true)
+                InfoRequest.stub!(:find).with(@info_request.id.to_s).and_return(@info_request)
+                @default_params = { :id => @info_request.id,
+                                    :explanation => 'Foo',
+                                    :reason => 'vexatious' }
+            end
+
+            def make_request(params=@default_params)
+                post :hide_request, params
+            end
+
+            it 'should redirect the the admin page for the request' do
+                make_request
+                response.should redirect_to(:controller => 'admin_request',
+                                            :action => 'show',
+                                            :id => @info_request.id)
+            end
+
+            it 'should set the request prominence to "requester_only"' do
+                @info_request.should_receive(:prominence=).with('requester_only')
+                @info_request.should_receive(:save!)
+                make_request
+            end
+
+            it 'should not send a notification email' do
+                ContactMailer.should_not_receive(:deliver_from_admin_message)
+                make_request
+            end
+
+            it 'should add a notice to the flash saying that the request has been hidden' do
+                make_request
+                response.flash[:notice].should == "This external request has been hidden"
+            end
+
+            it 'should expire the file cache for the request' do
+                @controller.should_receive(:expire_for_request)
+                make_request
+            end
+        end
+
     end
 
 end
diff --git a/spec/controllers/comment_controller_spec.rb b/spec/controllers/comment_controller_spec.rb
index 93752537c..b71bc0aea 100644
--- a/spec/controllers/comment_controller_spec.rb
+++ b/spec/controllers/comment_controller_spec.rb
@@ -54,6 +54,26 @@ describe CommentController, "when commenting on a request" do
         response.should render_template('new')
     end
 
+    describe 'when commenting on an external request' do
+
+        describe 'when responding to a GET request on a successful request' do
+
+            before do
+                @external_request = info_requests(:external_request)
+                @external_request.described_state = 'successful'
+                @external_request.save!
+            end
+
+            it 'should be successful' do
+                get :new, :url_title => @external_request.url_title,
+                          :type => 'request'
+                response.should be_success
+            end
+
+        end
+
+    end
+
 end
 
 
diff --git a/spec/controllers/request_controller_spec.rb b/spec/controllers/request_controller_spec.rb
index 8cadbd238..0ff795029 100644
--- a/spec/controllers/request_controller_spec.rb
+++ b/spec/controllers/request_controller_spec.rb
@@ -114,6 +114,7 @@ describe RequestController, "when listing recent requests" do
         assigns[:list_results].size.should == 25
         assigns[:show_no_more_than].should == RequestController::MAX_RESULTS
     end
+
     it "should return 404 for pages we don't want to serve up" do
         xap_results = mock_model(ActsAsXapian::Search,
                    :results => (1..25).to_a.map { |m| { :model => m } },
@@ -123,6 +124,12 @@ describe RequestController, "when listing recent requests" do
         }.should raise_error(ActiveRecord::RecordNotFound)
     end
 
+    it 'should not raise an error for a page param of less than zero, but should treat it as
+        a param of 1' do
+        lambda{ get :list, :view => 'all', :page => "-1" }.should_not raise_error
+        assigns[:page].should == 1
+    end
+
 end
 
 describe RequestController, "when changing things that appear on the request page" do
@@ -226,8 +233,177 @@ describe RequestController, "when showing one request" do
         response.should redirect_to(:action => 'show', :url_title => info_requests(:naughty_chicken_request).url_title)
     end
 
+    it 'should show actions the request owner can take' do
+        get :show, :url_title => 'why_do_you_have_such_a_fancy_dog'
+        response.should have_tag('div#owner_actions')
+    end
+
+    describe 'when the request is being viewed by an admin' do
+
+        describe 'if the request is awaiting description' do
+
+            before do
+                dog_request = info_requests(:fancy_dog_request)
+                dog_request.awaiting_description = true
+                dog_request.save!
+            end
+
+            it 'should show the describe state form' do
+                get :show, { :url_title => 'why_do_you_have_such_a_fancy_dog' },
+                           { :user_id => users(:admin_user).id }
+                response.should have_tag('div.describe_state_form')
+            end
+
+            it 'should ask the user to use the describe state from' do
+                get :show, { :url_title => 'why_do_you_have_such_a_fancy_dog' },
+                           { :user_id => users(:admin_user).id }
+                response.should have_tag('p#request_status', :text => /answer the question above/)
+            end
+
+        end
+
+        describe 'if the request is waiting for a response and very overdue' do
+
+            before do
+                dog_request = info_requests(:fancy_dog_request)
+                dog_request.awaiting_description = false
+                dog_request.described_state = 'waiting_response'
+                dog_request.save!
+                dog_request.calculate_status.should == 'waiting_response_very_overdue'
+            end
+
+            it 'should give a link to requesting an internal review' do
+                get :show, { :url_title => 'why_do_you_have_such_a_fancy_dog' },
+                           { :user_id => users(:admin_user).id }
+                response.should have_tag('p#request_status', :text =>/requesting an internal review/)
+            end
+
+        end
+
+        describe 'if the request is waiting clarification' do
+
+            before do
+                dog_request = info_requests(:fancy_dog_request)
+                dog_request.awaiting_description = false
+                dog_request.described_state = 'waiting_clarification'
+                dog_request.save!
+                dog_request.calculate_status.should == 'waiting_clarification'
+            end
+
+            it 'should give a link to make a followup' do
+                get :show, { :url_title => 'why_do_you_have_such_a_fancy_dog' },
+                           { :user_id => users(:admin_user).id }
+                response.should have_tag('p#request_status a', :text =>/send a follow up message/)
+            end
+        end
+
+    end
+
+    describe 'when showing an external request' do
+
+        describe 'when viewing with no logged in user' do
+
+            it 'should be successful' do
+                get :show, { :url_title => 'balalas' }, { :user_id => nil }
+                response.should be_success
+            end
+
+            it 'should not display actions the request owner can take' do
+                get :show, :url_title => 'balalas'
+                response.should_not have_tag('div#owner_actions')
+            end
+
+        end
+
+        describe 'when the request is being viewed by an admin' do
+
+            def make_request
+                get :show, { :url_title => 'balalas' }, { :user_id => users(:admin_user).id }
+            end
+
+            it 'should be successful' do
+                make_request
+                response.should be_success
+            end
+
+            describe 'if the request is awaiting description' do
+
+                before do
+                    external_request = info_requests(:external_request)
+                    external_request.awaiting_description = true
+                    external_request.save!
+                end
+
+                it 'should not show the describe state form' do
+                    make_request
+                    response.should_not have_tag('div.describe_state_form')
+                end
+
+                it 'should not ask the user to use the describe state form' do
+                    make_request
+                    response.should_not have_tag('p#request_status', :text => /answer the question above/)
+                end
+
+            end
+
+            describe 'if the request is waiting for a response and very overdue' do
+
+                before do
+                    external_request = info_requests(:external_request)
+                    external_request.awaiting_description = false
+                    external_request.described_state = 'waiting_response'
+                    external_request.save!
+                    external_request.calculate_status.should == 'waiting_response_very_overdue'
+                end
+
+                it 'should not give a link to requesting an internal review' do
+                    make_request
+                    response.should_not have_tag('p#request_status', :text =>/requesting an internal review/)
+                end
+            end
+
+            describe 'if the request is waiting clarification' do
+
+                before do
+                    external_request = info_requests(:external_request)
+                    external_request.awaiting_description = false
+                    external_request.described_state = 'waiting_clarification'
+                    external_request.save!
+                    external_request.calculate_status.should == 'waiting_clarification'
+                end
+
+                it 'should not give a link to make a followup' do
+                    make_request
+                    response.should_not have_tag('p#request_status a', :text =>/send a follow up message/)
+                end
+
+                it 'should not give a link to sign in (in the request status paragraph)' do
+                    make_request
+                    response.should_not have_tag('p#request_status a', :text => /sign in/)
+                end
+
+            end
+
+        end
+
+    end
 
     describe 'when handling an update_status parameter' do
+
+        describe 'when the request is external' do
+
+            it 'should assign the "update status" flag to the view as false if the parameter is present' do
+                get :show, :url_title => 'balalas', :update_status => 1
+                assigns[:update_status].should be_false
+            end
+
+            it 'should assign the "update status" flag to the view as false if the parameter is not present' do
+                get :show, :url_title => 'balalas'
+                assigns[:update_status].should be_false
+            end
+
+        end
+
         it 'should assign the "update status" flag to the view as true if the parameter is present' do
             get :show, :url_title => 'why_do_you_have_such_a_fancy_dog', :update_status => 1
             assigns[:update_status].should be_true
@@ -533,38 +709,48 @@ describe RequestController, "when showing one request" do
             end
         end
 
-        it "should make a zipfile available, which has a different URL when it changes" do
-            title = 'why_do_you_have_such_a_fancy_dog'
-            ir = info_requests(:fancy_dog_request)
-            session[:user_id] = ir.user.id # bob_smith_user
-            get :download_entire_request, :url_title => title
-            assigns[:url_path].should have_text(/#{title}.zip$/)
-            old_path = assigns[:url_path]
-            response.location.should have_text(/#{assigns[:url_path]}$/)
-            zipfile = Zip::ZipFile.open(File.join(File.dirname(__FILE__), "../../cache/zips", old_path)) { |zipfile|
-                zipfile.count.should == 1 # just the message
-            }
-            receive_incoming_mail('incoming-request-two-same-name.email', ir.incoming_email)
-            get :download_entire_request, :url_title => title
-            assigns[:url_path].should have_text(/#{title}.zip$/)
-            old_path = assigns[:url_path]
-            response.location.should have_text(/#{assigns[:url_path]}$/)
-            zipfile = Zip::ZipFile.open(File.join(File.dirname(__FILE__), "../../cache/zips", old_path)) { |zipfile|
-                zipfile.count.should == 3 # the message plus two "hello.txt" files
-            }
-
-            # The path of the zip file is based on the hash of the timestamp of the last request
-            # in the thread, so we wait for a second to make sure this one will have a different
-            # timestamp than the previous.
-            sleep 1
-            receive_incoming_mail('incoming-request-attachment-unknown-extension.email', ir.incoming_email)
-            get :download_entire_request, :url_title => title
-            assigns[:url_path].should have_text(/#{title}.zip$/)
-            assigns[:url_path].should_not == old_path
-            response.location.should have_text(/#{assigns[:url_path]}/)
-            zipfile = Zip::ZipFile.open(File.join(File.dirname(__FILE__), "../../cache/zips", assigns[:url_path])) { |zipfile|
-                zipfile.count.should == 5 # the message, two hello.txt, the unknown attachment, and its empty message
-            }
+        describe 'when making a zipfile available' do
+
+            it "should have a different zipfile URL when the request changes" do
+                title = 'why_do_you_have_such_a_fancy_dog'
+                ir = info_requests(:fancy_dog_request)
+                session[:user_id] = ir.user.id # bob_smith_user
+                get :download_entire_request, :url_title => title
+                assigns[:url_path].should have_text(/#{title}.zip$/)
+                old_path = assigns[:url_path]
+                response.location.should have_text(/#{assigns[:url_path]}$/)
+                zipfile = Zip::ZipFile.open(File.join(File.dirname(__FILE__), "../../cache/zips", old_path)) { |zipfile|
+                    zipfile.count.should == 1 # just the message
+                }
+                receive_incoming_mail('incoming-request-two-same-name.email', ir.incoming_email)
+                get :download_entire_request, :url_title => title
+                assigns[:url_path].should have_text(/#{title}.zip$/)
+                old_path = assigns[:url_path]
+                response.location.should have_text(/#{assigns[:url_path]}$/)
+                zipfile = Zip::ZipFile.open(File.join(File.dirname(__FILE__), "../../cache/zips", old_path)) { |zipfile|
+                    zipfile.count.should == 3 # the message plus two "hello.txt" files
+                }
+
+                # The path of the zip file is based on the hash of the timestamp of the last request
+                # in the thread, so we wait for a second to make sure this one will have a different
+                # timestamp than the previous.
+                sleep 1
+                receive_incoming_mail('incoming-request-attachment-unknown-extension.email', ir.incoming_email)
+                get :download_entire_request, :url_title => title
+                assigns[:url_path].should have_text(/#{title}.zip$/)
+                assigns[:url_path].should_not == old_path
+                response.location.should have_text(/#{assigns[:url_path]}/)
+                zipfile = Zip::ZipFile.open(File.join(File.dirname(__FILE__), "../../cache/zips", assigns[:url_path])) { |zipfile|
+                    zipfile.count.should == 5 # the message, two hello.txt, the unknown attachment, and its empty message
+                }
+            end
+
+            it 'should successfully make a zipfile for an external request' do
+                info_request = info_requests(:external_request)
+                get :download_entire_request, { :url_title => info_request.url_title },
+                                              { :user_id => users(:bob_smith_user) }
+                response.location.should have_text(/#{assigns[:url_path]}/)
+            end
         end
     end
 end
@@ -985,76 +1171,150 @@ describe RequestController, "when viewing an individual response for reply/follo
         get :show_response, :id => info_requests(:fancy_dog_request).id, :incoming_message_id => incoming_messages(:useless_incoming_message)
         response.should render_template('request/hidden')
     end
+
+    describe 'when viewing a response for an external request' do
+
+        it 'should show a message saying that external requests cannot be followed up' do
+            get :show_response, :id => info_requests(:external_request).id
+            response.should render_template('request/followup_bad')
+            assigns[:reason].should == 'external'
+        end
+
+        it 'should be successful' do
+            get :show_response, :id => info_requests(:external_request).id
+            response.should be_success
+        end
+
+    end
+
 end
 
 describe RequestController, "when classifying an information request" do
 
-    before(:each) do
-        @dog_request = info_requests(:fancy_dog_request)
-        @dog_request.stub!(:is_old_unclassified?).and_return(false)
-        InfoRequest.stub!(:find).and_return(@dog_request)
-        load_raw_emails_data
-    end
+    describe 'if the request is external' do
 
-    def post_status(status)
-        post :describe_state, :incoming_message => { :described_state => status },
-                              :id => @dog_request.id,
-                              :last_info_request_event_id => @dog_request.last_event_id_needing_description,
-                              :submitted_describe_state => 1
-    end
+        before do
+            @external_request = info_requests(:external_request)
+        end
 
-    it "should require login" do
-        post_status('rejected')
-        post_redirect = PostRedirect.get_last_post_redirect
-        response.should redirect_to(:controller => 'user', :action => 'signin', :token => post_redirect.token)
-    end
+        it 'should redirect to the request page' do
+            post :describe_state, :id => @external_request.id,
+                                  :submitted_describe_state => 1
+            response.should redirect_to(:action => 'show',
+                                        :controller => 'request',
+                                        :url_title => @external_request.url_title)
+        end
 
-    it 'should ask whether the request is old and unclassified' do
-        @dog_request.should_receive(:is_old_unclassified?)
-        post_status('rejected')
     end
 
-    it "should not classify the request if logged in as the wrong user" do
-        session[:user_id] = users(:silly_name_user).id
-        post_status('rejected')
-        response.should render_template('user/wrong_user')
-    end
+    describe 'when the request is internal' do
 
+        before(:each) do
+            @dog_request = info_requests(:fancy_dog_request)
+            @dog_request.stub!(:is_old_unclassified?).and_return(false)
+            InfoRequest.stub!(:find).and_return(@dog_request)
+            load_raw_emails_data
+        end
 
+        def post_status(status)
+            post :describe_state, :incoming_message => { :described_state => status },
+                                  :id => @dog_request.id,
+                                  :last_info_request_event_id => @dog_request.last_event_id_needing_description,
+                                  :submitted_describe_state => 1
+        end
 
-    describe 'when the request is old and unclassified' do
+        it "should require login" do
+            post_status('rejected')
+            post_redirect = PostRedirect.get_last_post_redirect
+            response.should redirect_to(:controller => 'user', :action => 'signin', :token => post_redirect.token)
+        end
 
-        before do
-            @dog_request.stub!(:is_old_unclassified?).and_return(true)
-            RequestMailer.stub!(:deliver_old_unclassified_updated)
+        it 'should ask whether the request is old and unclassified' do
+            @dog_request.should_receive(:is_old_unclassified?)
+            post_status('rejected')
         end
 
-        describe 'when the user is not logged in' do
+        it "should not classify the request if logged in as the wrong user" do
+            session[:user_id] = users(:silly_name_user).id
+            post_status('rejected')
+            response.should render_template('user/wrong_user')
+        end
+
+        describe 'when the request is old and unclassified' do
+
+            before do
+                @dog_request.stub!(:is_old_unclassified?).and_return(true)
+                RequestMailer.stub!(:deliver_old_unclassified_updated)
+            end
+
+            describe 'when the user is not logged in' do
+
+                it 'should require login' do
+                    session[:user_id] = nil
+                    post_status('rejected')
+                    post_redirect = PostRedirect.get_last_post_redirect
+                    response.should redirect_to(:controller => 'user', :action => 'signin', :token => post_redirect.token)
+                end
 
-            it 'should require login' do
-                session[:user_id] = nil
-                post_status('rejected')
-                post_redirect = PostRedirect.get_last_post_redirect
-                response.should redirect_to(:controller => 'user', :action => 'signin', :token => post_redirect.token)
             end
 
+            describe 'when the user is logged in as a different user' do
+
+                before do
+                    @other_user = mock_model(User)
+                    session[:user_id] = users(:silly_name_user).id
+                end
+
+                it 'should classify the request' do
+                    @dog_request.stub!(:calculate_status).and_return('rejected')
+                    @dog_request.should_receive(:set_described_state).with('rejected')
+                    post_status('rejected')
+                end
+
+                it 'should log a status update event' do
+                    expected_params = {:user_id => users(:silly_name_user).id,
+                                       :old_described_state => 'waiting_response',
+                                       :described_state => 'rejected'}
+                    @dog_request.should_receive(:log_event).with("status_update", expected_params)
+                    post_status('rejected')
+                end
+
+                it 'should send an email to the requester letting them know someone has updated the status of their request' do
+                    RequestMailer.should_receive(:deliver_old_unclassified_updated)
+                    post_status('rejected')
+                end
+
+                it 'should redirect to the request page' do
+                    post_status('rejected')
+                    response.should redirect_to(:action => 'show', :controller => 'request', :url_title => @dog_request.url_title)
+                end
+
+                it 'should show a message thanking the user for a good deed' do
+                    post_status('rejected')
+                    flash[:notice].should == 'Thank you for updating this request!'
+                end
+
+            end
         end
 
-        describe 'when the user is logged in as a different user' do
+        describe 'when logged in as an admin user who is not the actual requester' do
 
             before do
-                @other_user = mock_model(User)
-                session[:user_id] = users(:silly_name_user).id
+                @admin_user = users(:admin_user)
+                session[:user_id] = @admin_user.id
+                @dog_request = info_requests(:fancy_dog_request)
+                InfoRequest.stub!(:find).and_return(@dog_request)
+                @dog_request.stub!(:each).and_return([@dog_request])
             end
 
-            it 'should classify the request' do
+            it 'should update the status of the request' do
                 @dog_request.stub!(:calculate_status).and_return('rejected')
                 @dog_request.should_receive(:set_described_state).with('rejected')
                 post_status('rejected')
             end
 
             it 'should log a status update event' do
-                expected_params = {:user_id => users(:silly_name_user).id,
+                expected_params = {:user_id => @admin_user.id,
                                    :old_described_state => 'waiting_response',
                                    :described_state => 'rejected'}
                 @dog_request.should_receive(:log_event).with("status_update", expected_params)
@@ -1075,258 +1335,219 @@ describe RequestController, "when classifying an information request" do
                 post_status('rejected')
                 flash[:notice].should == 'Thank you for updating this request!'
             end
+         end
 
-        end
-    end
-
-    describe 'when logged in as an admin user who is not the actual requester' do
-
-        before do
-            @admin_user = users(:admin_user)
-            session[:user_id] = @admin_user.id
-            @dog_request = info_requests(:fancy_dog_request)
-            InfoRequest.stub!(:find).and_return(@dog_request)
-            @dog_request.stub!(:each).and_return([@dog_request])
-        end
-
-        it 'should update the status of the request' do
-            @dog_request.stub!(:calculate_status).and_return('rejected')
-            @dog_request.should_receive(:set_described_state).with('rejected')
-            post_status('rejected')
-        end
-
-        it 'should log a status update event' do
-            expected_params = {:user_id => @admin_user.id,
-                               :old_described_state => 'waiting_response',
-                               :described_state => 'rejected'}
-            @dog_request.should_receive(:log_event).with("status_update", expected_params)
-            post_status('rejected')
-        end
-
-        it 'should send an email to the requester letting them know someone has updated the status of their request' do
-            RequestMailer.should_receive(:deliver_old_unclassified_updated)
-            post_status('rejected')
-        end
-
-        it 'should redirect to the request page' do
-            post_status('rejected')
-            response.should redirect_to(:action => 'show', :controller => 'request', :url_title => @dog_request.url_title)
-        end
-
-        it 'should show a message thanking the user for a good deed' do
-            post_status('rejected')
-            flash[:notice].should == 'Thank you for updating this request!'
-        end
-     end
+        describe 'when logged in as an admin user who is also the actual requester' do
 
-    describe 'when logged in as an admin user who is also the actual requester' do
+            before do
+                @admin_user = users(:admin_user)
+                session[:user_id] = @admin_user.id
+                @dog_request = info_requests(:fancy_dog_request)
+                @dog_request.user = @admin_user
+                @dog_request.save!
+                InfoRequest.stub!(:find).and_return(@dog_request)
+                @dog_request.stub!(:each).and_return([@dog_request])
+            end
 
-        before do
-            @admin_user = users(:admin_user)
-            session[:user_id] = @admin_user.id
-            @dog_request = info_requests(:fancy_dog_request)
-            @dog_request.user = @admin_user
-            @dog_request.save!
-            InfoRequest.stub!(:find).and_return(@dog_request)
-            @dog_request.stub!(:each).and_return([@dog_request])
-        end
+            it 'should update the status of the request' do
+                @dog_request.stub!(:calculate_status).and_return('rejected')
+                @dog_request.should_receive(:set_described_state).with('rejected')
+                post_status('rejected')
+            end
 
-        it 'should update the status of the request' do
-            @dog_request.stub!(:calculate_status).and_return('rejected')
-            @dog_request.should_receive(:set_described_state).with('rejected')
-            post_status('rejected')
-        end
+            it 'should not log a status update event' do
+                @dog_request.should_not_receive(:log_event)
+                post_status('rejected')
+            end
 
-        it 'should not log a status update event' do
-            @dog_request.should_not_receive(:log_event)
-            post_status('rejected')
-        end
+            it 'should not send an email to the requester letting them know someone has updated the status of their request' do
+                RequestMailer.should_not_receive(:deliver_old_unclassified_updated)
+                post_status('rejected')
+            end
 
-        it 'should not send an email to the requester letting them know someone has updated the status of their request' do
-            RequestMailer.should_not_receive(:deliver_old_unclassified_updated)
-            post_status('rejected')
-        end
+            it 'should say it is showing advice as to what to do next' do
+                post_status('rejected')
+                flash[:notice].should match(/Here is what to do now/)
+            end
 
-        it 'should say it is showing advice as to what to do next' do
-            post_status('rejected')
-            flash[:notice].should match(/Here is what to do now/)
-        end
+            it 'should redirect to the unhappy page' do
+                post_status('rejected')
+                response.should redirect_to(:controller => 'help', :action => 'unhappy', :url_title => @dog_request.url_title)
+            end
 
-        it 'should redirect to the unhappy page' do
-            post_status('rejected')
-            response.should redirect_to(:controller => 'help', :action => 'unhappy', :url_title => @dog_request.url_title)
         end
 
-    end
+        describe 'when logged in as the requestor' do
 
-    describe 'when logged in as the requestor' do
+            before do
+                @request_owner = users(:bob_smith_user)
+                session[:user_id] = @request_owner.id
+                @dog_request.awaiting_description.should == true
+                @dog_request.stub!(:each).and_return([@dog_request])
+            end
 
-        before do
-            @request_owner = users(:bob_smith_user)
-            session[:user_id] = @request_owner.id
-            @dog_request.awaiting_description.should == true
-            @dog_request.stub!(:each).and_return([@dog_request])
-        end
+            it "should successfully classify response if logged in as user controlling request" do
+                post_status('rejected')
+                response.should redirect_to(:controller => 'help', :action => 'unhappy', :url_title => @dog_request.url_title)
+                @dog_request.reload
+                @dog_request.awaiting_description.should == false
+                @dog_request.described_state.should == 'rejected'
+                @dog_request.get_last_response_event.should == info_request_events(:useless_incoming_message_event)
+                @dog_request.get_last_response_event.calculated_state.should == 'rejected'
+            end
 
-        it "should successfully classify response if logged in as user controlling request" do
-            post_status('rejected')
-            response.should redirect_to(:controller => 'help', :action => 'unhappy', :url_title => @dog_request.url_title)
-            @dog_request.reload
-            @dog_request.awaiting_description.should == false
-            @dog_request.described_state.should == 'rejected'
-            @dog_request.get_last_response_event.should == info_request_events(:useless_incoming_message_event)
-            @dog_request.get_last_response_event.calculated_state.should == 'rejected'
-        end
+            it 'should not log a status update event' do
+                @dog_request.should_not_receive(:log_event)
+                post_status('rejected')
+            end
 
-        it 'should not log a status update event' do
-            @dog_request.should_not_receive(:log_event)
-            post_status('rejected')
-        end
+            it 'should not send an email to the requester letting them know someone has updated the status of their request' do
+                RequestMailer.should_not_receive(:deliver_old_unclassified_updated)
+                post_status('rejected')
+            end
 
-        it 'should not send an email to the requester letting them know someone has updated the status of their request' do
-            RequestMailer.should_not_receive(:deliver_old_unclassified_updated)
-            post_status('rejected')
-        end
+            it "should send email when classified as requires_admin" do
+                post :describe_state, :incoming_message => { :described_state => "requires_admin" }, :id => @dog_request.id, :incoming_message_id => incoming_messages(:useless_incoming_message), :last_info_request_event_id => @dog_request.last_event_id_needing_description, :submitted_describe_state => 1
+                response.should redirect_to(:controller => 'help', :action => 'contact')
 
-        it "should send email when classified as requires_admin" do
-            post :describe_state, :incoming_message => { :described_state => "requires_admin" }, :id => @dog_request.id, :incoming_message_id => incoming_messages(:useless_incoming_message), :last_info_request_event_id => @dog_request.last_event_id_needing_description, :submitted_describe_state => 1
-            response.should redirect_to(:controller => 'help', :action => 'contact')
+                @dog_request.reload
+                @dog_request.awaiting_description.should == false
+                @dog_request.described_state.should == 'requires_admin'
+                @dog_request.get_last_response_event.calculated_state.should == 'requires_admin'
 
-            @dog_request.reload
-            @dog_request.awaiting_description.should == false
-            @dog_request.described_state.should == 'requires_admin'
-            @dog_request.get_last_response_event.calculated_state.should == 'requires_admin'
+                deliveries = ActionMailer::Base.deliveries
+                deliveries.size.should == 1
+                mail = deliveries[0]
+                mail.body.should =~ /as needing admin/
+                mail.from_addrs.first.to_s.should == @request_owner.name_and_email
+            end
 
-            deliveries = ActionMailer::Base.deliveries
-            deliveries.size.should == 1
-            mail = deliveries[0]
-            mail.body.should =~ /as needing admin/
-            mail.from_addrs.first.to_s.should == @request_owner.name_and_email
-        end
+            it 'should say it is showing advice as to what to do next' do
+                post_status('rejected')
+                flash[:notice].should match(/Here is what to do now/)
+            end
 
-        it 'should say it is showing advice as to what to do next' do
-            post_status('rejected')
-            flash[:notice].should match(/Here is what to do now/)
-        end
+            it 'should redirect to the unhappy page' do
+                post_status('rejected')
+                response.should redirect_to(:controller => 'help', :action => 'unhappy', :url_title => @dog_request.url_title)
+            end
 
-        it 'should redirect to the unhappy page' do
-            post_status('rejected')
-            response.should redirect_to(:controller => 'help', :action => 'unhappy', :url_title => @dog_request.url_title)
+            it "knows about extended states" do
+                InfoRequest.send(:require, File.expand_path(File.join(File.dirname(__FILE__), '..', 'models', 'customstates')))
+                InfoRequest.send(:include, InfoRequestCustomStates)
+                InfoRequest.class_eval('@@custom_states_loaded = true')
+                RequestController.send(:require, File.expand_path(File.join(File.dirname(__FILE__), '..', 'models', 'customstates')))
+                RequestController.send(:include, RequestControllerCustomStates)
+                RequestController.class_eval('@@custom_states_loaded = true')
+                Time.stub!(:now).and_return(Time.utc(2007, 11, 10, 00, 01))
+                post_status('deadline_extended')
+                flash[:notice].should == 'Authority has requested extension of the deadline.'
+            end
         end
 
-        it "knows about extended states" do
-            InfoRequest.send(:require, File.expand_path(File.join(File.dirname(__FILE__), '..', 'models', 'customstates')))
-            InfoRequest.send(:include, InfoRequestCustomStates)
-            InfoRequest.class_eval('@@custom_states_loaded = true')
-            RequestController.send(:require, File.expand_path(File.join(File.dirname(__FILE__), '..', 'models', 'customstates')))
-            RequestController.send(:include, RequestControllerCustomStates)
-            RequestController.class_eval('@@custom_states_loaded = true')
-            Time.stub!(:now).and_return(Time.utc(2007, 11, 10, 00, 01))
-            post_status('deadline_extended')
-            flash[:notice].should == 'Authority has requested extension of the deadline.'
-        end
-    end
+        describe 'when redirecting after a successful status update by the request owner' do
 
-    describe 'when redirecting after a successful status update by the request owner' do
+            before do
+                @request_owner = users(:bob_smith_user)
+                session[:user_id] = @request_owner.id
+                @dog_request = info_requests(:fancy_dog_request)
+                @dog_request.stub!(:each).and_return([@dog_request])
+                InfoRequest.stub!(:find).and_return(@dog_request)
+                @old_filters = ActionController::Routing::Routes.filters
+                ActionController::Routing::Routes.filters = RoutingFilter::Chain.new
+            end
+            after do
+                ActionController::Routing::Routes.filters = @old_filters
+            end
 
-        before do
-            @request_owner = users(:bob_smith_user)
-            session[:user_id] = @request_owner.id
-            @dog_request = info_requests(:fancy_dog_request)
-            @dog_request.stub!(:each).and_return([@dog_request])
-            InfoRequest.stub!(:find).and_return(@dog_request)
-            @old_filters = ActionController::Routing::Routes.filters
-            ActionController::Routing::Routes.filters = RoutingFilter::Chain.new
-        end
-        after do
-            ActionController::Routing::Routes.filters = @old_filters
-        end
+            def request_url
+                "request/#{@dog_request.url_title}"
+            end
 
-        def request_url
-            "request/#{@dog_request.url_title}"
-        end
+            def unhappy_url
+                "help/unhappy/#{@dog_request.url_title}"
+            end
 
-        def unhappy_url
-            "help/unhappy/#{@dog_request.url_title}"
-        end
+            def expect_redirect(status, redirect_path)
+                post_status(status)
+                response.should redirect_to("http://test.host/#{redirect_path}")
+            end
 
-        def expect_redirect(status, redirect_path)
-            post_status(status)
-            response.should redirect_to("http://test.host/#{redirect_path}")
-        end
+            it 'should redirect to the "request url" with a message in the right tense when status is updated to "waiting response" and the response is not overdue' do
+                @dog_request.stub!(:date_response_required_by).and_return(Time.now.to_date+1)
+                @dog_request.stub!(:date_very_overdue_after).and_return(Time.now.to_date+40)
 
-        it 'should redirect to the "request url" with a message in the right tense when status is updated to "waiting response" and the response is not overdue' do
-            @dog_request.stub!(:date_response_required_by).and_return(Time.now.to_date+1)
-            @dog_request.stub!(:date_very_overdue_after).and_return(Time.now.to_date+40)
+                expect_redirect("waiting_response", "request/#{@dog_request.url_title}")
+                flash[:notice].should match(/should get a response/)
+            end
 
-            expect_redirect("waiting_response", "request/#{@dog_request.url_title}")
-            flash[:notice].should match(/should get a response/)
-        end
+            it 'should redirect to the "request url" with a message in the right tense when status is updated to "waiting response" and the response is overdue' do
+                @dog_request.stub!(:date_response_required_by).and_return(Time.now.to_date-1)
+                @dog_request.stub!(:date_very_overdue_after).and_return(Time.now.to_date+40)
+                expect_redirect('waiting_response', request_url)
+                flash[:notice].should match(/should have got a response/)
+            end
 
-        it 'should redirect to the "request url" with a message in the right tense when status is updated to "waiting response" and the response is overdue' do
-            @dog_request.stub!(:date_response_required_by).and_return(Time.now.to_date-1)
-            @dog_request.stub!(:date_very_overdue_after).and_return(Time.now.to_date+40)
-            expect_redirect('waiting_response', request_url)
-            flash[:notice].should match(/should have got a response/)
-        end
+            it 'should redirect to the "request url" with a message in the right tense when status is updated to "waiting response" and the response is overdue' do
+                @dog_request.stub!(:date_response_required_by).and_return(Time.now.to_date-2)
+                @dog_request.stub!(:date_very_overdue_after).and_return(Time.now.to_date-1)
+                expect_redirect('waiting_response', unhappy_url)
+                flash[:notice].should match(/is long overdue/)
+                flash[:notice].should match(/by more than 40 working days/)
+                flash[:notice].should match(/within 20 working days/)
+            end
 
-        it 'should redirect to the "request url" with a message in the right tense when status is updated to "waiting response" and the response is overdue' do
-            @dog_request.stub!(:date_response_required_by).and_return(Time.now.to_date-2)
-            @dog_request.stub!(:date_very_overdue_after).and_return(Time.now.to_date-1)
-            expect_redirect('waiting_response', unhappy_url)
-            flash[:notice].should match(/is long overdue/)
-            flash[:notice].should match(/by more than 40 working days/)
-            flash[:notice].should match(/within 20 working days/)
-        end
+            it 'should redirect to the "request url" when status is updated to "not held"' do
+                expect_redirect('not_held', request_url)
+            end
 
-        it 'should redirect to the "request url" when status is updated to "not held"' do
-            expect_redirect('not_held', request_url)
-        end
+            it 'should redirect to the "request url" when status is updated to "successful"' do
+                expect_redirect('successful', request_url)
+            end
 
-        it 'should redirect to the "request url" when status is updated to "successful"' do
-            expect_redirect('successful', request_url)
-        end
+            it 'should redirect to the "unhappy url" when status is updated to "rejected"' do
+                expect_redirect('rejected', "help/unhappy/#{@dog_request.url_title}")
+            end
 
-        it 'should redirect to the "unhappy url" when status is updated to "rejected"' do
-            expect_redirect('rejected', "help/unhappy/#{@dog_request.url_title}")
-        end
+            it 'should redirect to the "unhappy url" when status is updated to "partially successful"' do
+                expect_redirect('partially_successful', "help/unhappy/#{@dog_request.url_title}")
+            end
 
-        it 'should redirect to the "unhappy url" when status is updated to "partially successful"' do
-            expect_redirect('partially_successful', "help/unhappy/#{@dog_request.url_title}")
-        end
+            it 'should redirect to the "response url" when status is updated to "waiting clarification" and there is a last response' do
+                incoming_message = mock_model(IncomingMessage)
+                @dog_request.stub!(:get_last_response).and_return(incoming_message)
+                expect_redirect('waiting_clarification', "request/#{@dog_request.id}/response/#{incoming_message.id}")
+            end
 
-        it 'should redirect to the "response url" when status is updated to "waiting clarification" and there is a last response' do
-            incoming_message = mock_model(IncomingMessage)
-            @dog_request.stub!(:get_last_response).and_return(incoming_message)
-            expect_redirect('waiting_clarification', "request/#{@dog_request.id}/response/#{incoming_message.id}")
-        end
+            it 'should redirect to the "response no followup url" when status is updated to "waiting clarification" and there are no events needing description' do
+                @dog_request.stub!(:get_last_response).and_return(nil)
+                expect_redirect('waiting_clarification', "request/#{@dog_request.id}/response")
+            end
 
-        it 'should redirect to the "response no followup url" when status is updated to "waiting clarification" and there are no events needing description' do
-            @dog_request.stub!(:get_last_response).and_return(nil)
-            expect_redirect('waiting_clarification', "request/#{@dog_request.id}/response")
-        end
+            it 'should redirect to the "respond to last url" when status is updated to "gone postal"' do
+                expect_redirect('gone_postal', "request/#{@dog_request.id}/response/#{@dog_request.get_last_response.id}?gone_postal=1")
+            end
 
-        it 'should redirect to the "respond to last url" when status is updated to "gone postal"' do
-            expect_redirect('gone_postal', "request/#{@dog_request.id}/response/#{@dog_request.get_last_response.id}?gone_postal=1")
-        end
+            it 'should redirect to the "request url" when status is updated to "internal review"' do
+                expect_redirect('internal_review', request_url)
+            end
 
-        it 'should redirect to the "request url" when status is updated to "internal review"' do
-            expect_redirect('internal_review', request_url)
-        end
+            it 'should redirect to the "help general url" when status is updated to "requires admin"' do
+                expect_redirect('requires_admin', "help/contact")
+            end
 
-        it 'should redirect to the "help general url" when status is updated to "requires admin"' do
-            expect_redirect('requires_admin', "help/contact")
-        end
+            it 'should redirect to the "help general url" when status is updated to "error message"' do
+                expect_redirect('error_message', "help/contact")
+            end
 
-        it 'should redirect to the "help general url" when status is updated to "error message"' do
-            expect_redirect('error_message', "help/contact")
-        end
+            it 'should redirect to the "respond to last url url" when status is updated to "user_withdrawn"' do
+                expect_redirect('user_withdrawn', "request/#{@dog_request.id}/response/#{@dog_request.get_last_response.id}")
+            end
 
-        it 'should redirect to the "respond to last url url" when status is updated to "user_withdrawn"' do
-            expect_redirect('user_withdrawn', "request/#{@dog_request.id}/response/#{@dog_request.get_last_response.id}")
         end
 
     end
+
 end
 
 describe RequestController, "when sending a followup message" do
@@ -1591,7 +1812,7 @@ describe RequestController, "comment alerts" do
     end
 
     it "should send an alert (once and once only)" do
-        # delete ficture comment and make new one, so is in last month (as
+        # delete fixture comment and make new one, so is in last month (as
         # alerts are only for comments in last month, see
         # RequestMailer.alert_comment_on_request)
         existing_comment = info_requests(:fancy_dog_request).comments[0]
@@ -1607,10 +1828,7 @@ describe RequestController, "comment alerts" do
         mail.to_addrs.first.to_s.should == info_requests(:fancy_dog_request).user.name_and_email
         mail.body =~ /(http:\/\/.*)/
         mail_url = $1
-
-        # XXX check mail_url here somehow, can't call comment_url like this:
-        # mail_url.should == comment_url(comments(:silly_comment))
-
+        mail_url.should match("/request/why_do_you_have_such_a_fancy_dog#comment-#{new_comment.id}")
 
         # check if we send again, no more go out
         deliveries.clear
@@ -1620,7 +1838,7 @@ describe RequestController, "comment alerts" do
     end
 
     it "should not send an alert when you comment on your own request" do
-        # delete ficture comment and make new one, so is in last month (as
+        # delete fixture comment and make new one, so is in last month (as
         # alerts are only for comments in last month, see
         # RequestMailer.alert_comment_on_request)
         existing_comment = info_requests(:fancy_dog_request).comments[0]
@@ -1635,6 +1853,16 @@ describe RequestController, "comment alerts" do
         deliveries.size.should == 0
     end
 
+    it 'should not send an alert for a comment on an external request' do
+        external_request = info_requests(:external_request)
+        external_request.add_comment("This external request is interesting", users(:silly_name_user))
+        # try to send comment alert
+        RequestMailer.alert_comment_on_request
+
+        deliveries = ActionMailer::Base.deliveries
+        deliveries.size.should == 0
+    end
+
     it "should send an alert when there are two new comments" do
         # add two comments - the second one sould be ignored, as is by the user who made the request.
         # the new comment here, will cause the one in the fixture to be picked up as a new comment by alert_comment_on_request also.
@@ -1650,9 +1878,7 @@ describe RequestController, "comment alerts" do
         mail.to_addrs.first.to_s.should == info_requests(:fancy_dog_request).user.name_and_email
         mail.body =~ /(http:\/\/.*)/
         mail_url = $1
-
-        # XXX check mail_url here somehow, can't call comment_url like this:
-        # mail_url.should == comment_url(comments(:silly_comment))
+        mail_url.should match("/request/why_do_you_have_such_a_fancy_dog#comment-#{comments(:silly_comment).id}")
 
     end
 
@@ -1736,6 +1962,10 @@ describe RequestController, "authority uploads a response from the web interface
         flash[:error].should match(/Please type a message/)
     end
 
+    it 'should 404 for non existent requests' do
+        lambda{ post :upload_response, :url_title => 'i_dont_exist'}.should raise_error(ActiveRecord::RecordNotFound)
+    end
+
     # How do I test a file upload in rails?
     # http://stackoverflow.com/questions/1178587/how-do-i-test-a-file-upload-in-rails
     it "should let the authority upload a file" do
@@ -1887,6 +2117,12 @@ describe RequestController, "when reporting a request (logged in)" do
         session[:user_id] = @user.id
     end
 
+    it "should 404 for non-existent requests" do
+      lambda {
+        post :report_request, :url_title => "hjksfdhjk_louytu_qqxxx"
+      }.should raise_error(ActiveRecord::RecordNotFound)
+    end
+
     it "should mark a request as having been reported" do
         ir = info_requests(:badger_request)
         title = ir.url_title
diff --git a/spec/controllers/track_controller_spec.rb b/spec/controllers/track_controller_spec.rb
index 1d38b3055..7daa23769 100644
--- a/spec/controllers/track_controller_spec.rb
+++ b/spec/controllers/track_controller_spec.rb
@@ -11,7 +11,13 @@ describe TrackController, "when making a new track on a request" do
         TrackThing.stub!(:create_track_for_request).and_return(@track_thing)
         TrackThing.stub!(:create_track_for_search_query).and_return(@track_thing)
         TrackThing.stub!(:find_by_existing_track).and_return(nil)
-        InfoRequest.stub!(:find_by_url_title).and_return(@ir)
+        InfoRequest.stub!(:find_by_url_title!) do |url_title|
+          if url_title == "myrequest"
+            @ir
+          else
+            raise ActiveRecord::RecordNotFound.new("Not found")
+          end
+        end
 
         @user = mock_model(User)
         User.stub!(:find).and_return(@user)
@@ -32,6 +38,13 @@ describe TrackController, "when making a new track on a request" do
         get :track_request, :url_title => @ir.url_title, :feed => 'track'
         response.should redirect_to(:controller => 'request', :action => 'show', :url_title => @ir.url_title)
     end
+    
+    it "should 404 for non-existent requests" do
+      session[:user_id] = @user.id
+      lambda {
+        get :track_request, :url_title => "hjksfdhjk_louytu_qqxxx", :feed => 'track'
+      }.should raise_error(ActiveRecord::RecordNotFound)
+    end
 
     it "should save a search track and redirect to the right place" do
         session[:user_id] = @user.id
diff --git a/spec/models/info_request_spec.rb b/spec/models/info_request_spec.rb
index 6de6e1d25..1ca97f9d8 100644
--- a/spec/models/info_request_spec.rb
+++ b/spec/models/info_request_spec.rb
@@ -353,7 +353,7 @@ describe InfoRequest do
             InfoRequest.should_receive(:find).with(:all,
                   {:select=> anything,
                    :order=> anything,
-                   :conditions=>["awaiting_description = ? and (select created_at from info_request_events where info_request_events.info_request_id = info_requests.id and info_request_events.event_type = 'response' order by created_at desc limit 1) < ? and url_title != 'holding_pen' and prominence != 'backpage'",
+                   :conditions=>["awaiting_description = ? and (select created_at from info_request_events where info_request_events.info_request_id = info_requests.id and info_request_events.event_type = 'response' order by created_at desc limit 1) < ? and url_title != 'holding_pen' and user_id is not null and prominence != 'backpage'",
                     true, Time.now - 21.days]})
             InfoRequest.find_old_unclassified({:conditions => ["prominence != 'backpage'"]})
         end
@@ -362,7 +362,7 @@ describe InfoRequest do
             InfoRequest.should_receive(:find).with(:all,
                   {:select=>"*, (select created_at from info_request_events where info_request_events.info_request_id = info_requests.id and info_request_events.event_type = 'response' order by created_at desc limit 1) as last_response_time",
                    :order=>"last_response_time",
-                   :conditions=>["awaiting_description = ? and (select created_at from info_request_events where info_request_events.info_request_id = info_requests.id and info_request_events.event_type = 'response' order by created_at desc limit 1) < ? and url_title != 'holding_pen'",
+                   :conditions=>["awaiting_description = ? and (select created_at from info_request_events where info_request_events.info_request_id = info_requests.id and info_request_events.event_type = 'response' order by created_at desc limit 1) < ? and url_title != 'holding_pen' and user_id is not null",
                     true, Time.now - 21.days]})
             InfoRequest.find_old_unclassified
         end
@@ -396,7 +396,7 @@ describe InfoRequest do
         end
 
         it 'should return true if it is awaiting description, isn\'t the holding pen and hasn\'t had an event in 21 days' do
-            @info_request.is_old_unclassified?.should be_true
+            (@info_request.is_external? || @info_request.is_old_unclassified?).should be_true
         end
 
     end
@@ -511,4 +511,5 @@ describe InfoRequest do
 
     end
 
+
 end
diff --git a/spec/models/request_mailer_spec.rb b/spec/models/request_mailer_spec.rb
index 64ac35cf7..ea75ec765 100644
--- a/spec/models/request_mailer_spec.rb
+++ b/spec/models/request_mailer_spec.rb
@@ -223,7 +223,7 @@ describe RequestMailer, "when sending reminders to requesters to classify a resp
     end
 
     it 'should ask for all requests that are awaiting description and whose latest response is older than the number of days given and that are not the holding pen' do
-        expected_params = {:conditions => [ "awaiting_description = ? and (select created_at from info_request_events where info_request_events.info_request_id = info_requests.id and info_request_events.event_type = 'response' order by created_at desc limit 1) < ? and url_title != 'holding_pen'",
+        expected_params = {:conditions => [ "awaiting_description = ? and (select created_at from info_request_events where info_request_events.info_request_id = info_requests.id and info_request_events.event_type = 'response' order by created_at desc limit 1) < ? and url_title != 'holding_pen' and user_id is not null",
                            true, Time.now() - 7.days ],
                            :include => [ :user ],
                            :order => "info_requests.id"}
diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb
index c11c7c5bc..6a4d0f2d5 100644
--- a/spec/spec_helper.rb
+++ b/spec/spec_helper.rb
@@ -5,7 +5,7 @@ require File.expand_path(File.join('..', '..', 'config', 'environment'), __FILE_
 require 'spec/autorun'
 require 'spec/rails'
 
-# set a default username and password so we can test 
+# set a default username and password so we can test
 config = MySociety::Config.load_default()
 config['ADMIN_USERNAME'] = 'foo'
 config['ADMIN_PASSWORD'] = 'baz'
@@ -31,7 +31,21 @@ Spec::Runner.configure do |config|
 
   # fixture_path must end in a separator
   config.fixture_path = File.join(Rails.root, 'spec', 'fixtures') + File::SEPARATOR
-  config.global_fixtures = :users, :public_bodies, :public_body_translations, :public_body_versions, :info_requests, :raw_emails, :incoming_messages, :outgoing_messages, :comments, :info_request_events, :track_things, :foi_attachments, :has_tag_string_tags, :holidays, :track_things_sent_emails
+  config.global_fixtures = :users,
+                           :public_bodies,
+                           :public_body_translations,
+                           :public_body_versions,
+                           :info_requests,
+                           :raw_emails,
+                           :incoming_messages,
+                           :outgoing_messages,
+                           :comments,
+                           :info_request_events,
+                           :track_things,
+                           :foi_attachments,
+                           :has_tag_string_tags,
+                           :holidays,
+                           :track_things_sent_emails
 
   # == Fixtures
   #
@@ -66,7 +80,7 @@ Spec::Runner.configure do |config|
   # For more information take a look at Spec::Runner::Configuration and Spec::Runner
 end
 
-# XXX No idea what namespace/class/module to put this in 
+# XXX No idea what namespace/class/module to put this in
 def receive_incoming_mail(email_name, email_to, email_from = 'geraldinequango@localhost')
     email_name = file_fixture_name(email_name)
     content = File.read(email_name)
@@ -97,15 +111,15 @@ def rebuild_xapian_index(terms = true, values = true, texts = true, dropfirst =
     end
     parse_all_incoming_messages
     verbose = false
-    # safe_rebuild=true, which involves forking to avoid memory leaks, doesn't work well with rspec. 
+    # safe_rebuild=true, which involves forking to avoid memory leaks, doesn't work well with rspec.
     # unsafe is significantly faster, and we can afford possible memory leaks while testing.
     safe_rebuild = false
-    ActsAsXapian.rebuild_index(["PublicBody", "User", "InfoRequestEvent"].map{|m| m.constantize}, verbose, terms, values, texts, safe_rebuild) 
+    ActsAsXapian.rebuild_index(["PublicBody", "User", "InfoRequestEvent"].map{|m| m.constantize}, verbose, terms, values, texts, safe_rebuild)
 end
 
 def update_xapian_index
     verbose = false
-    ActsAsXapian.update_index(flush_to_disk=false, verbose) 
+    ActsAsXapian.update_index(flush_to_disk=false, verbose)
 end
 
 # Validate an entire HTML page
@@ -217,5 +231,5 @@ end
 class ApplicationController < ActionController::Base
     def set_popup_banner
         @popup_banner = nil
-    end    
+    end
 end