diff --git a/src/applications/auth/provider/PhabricatorAuthProviderOAuth1JIRA.php b/src/applications/auth/provider/PhabricatorAuthProviderOAuth1JIRA.php
index 9c835790d9..085f757951 100644
--- a/src/applications/auth/provider/PhabricatorAuthProviderOAuth1JIRA.php
+++ b/src/applications/auth/provider/PhabricatorAuthProviderOAuth1JIRA.php
@@ -1,286 +1,286 @@
 <?php
 
 final class PhabricatorAuthProviderOAuth1JIRA
   extends PhabricatorAuthProviderOAuth1 {
 
   public function getJIRABaseURI() {
     return $this->getProviderConfig()->getProperty(self::PROPERTY_JIRA_URI);
   }
 
   public function getProviderName() {
     return pht('JIRA');
   }
 
   public function getDescriptionForCreate() {
     return pht('Configure JIRA OAuth. NOTE: Only supports JIRA 6.');
   }
 
   public function getConfigurationHelp() {
     if ($this->isSetup()) {
       return pht(
         "**Step 1 of 2**: Provide the name and URI for your JIRA install.\n\n".
         "In the next step, you will configure JIRA.");
     } else {
       $login_uri = PhabricatorEnv::getURI($this->getLoginURI());
       return pht(
         "**Step 2 of 2**: In this step, you will configure JIRA.\n\n".
         "**Create a JIRA Application**: Log into JIRA and go to ".
         "**Administration**, then **Add-ons**, then **Application Links**. ".
         "Click the button labeled **Add Application Link**, and use these ".
         "settings to create an application:\n\n".
         "  - **Server URL**: `%s`\n".
         "  - Then, click **Next**. On the second page:\n".
         "  - **Application Name**: `Phabricator`\n".
         "  - **Application Type**: `Generic Application`\n".
         "  - Then, click **Create**.\n\n".
         "**Configure Your Application**: Find the application you just ".
         "created in the table, and click the **Configure** link under ".
         "**Actions**. Select **Incoming Authentication** and click the ".
         "**OAuth** tab (it may be selected by default). Then, use these ".
         "settings:\n\n".
         "  - **Consumer Key**: Set this to the \"Consumer Key\" value in the ".
         "form above.\n".
         "  - **Consumer Name**: `Phabricator`\n".
         "  - **Public Key**: Set this to the \"Public Key\" value in the ".
         "form above.\n".
         "  - **Consumer Callback URL**: `%s`\n".
         "Click **Save** in JIRA. Authentication should now be configured, ".
         "and this provider should work correctly.",
         PhabricatorEnv::getProductionURI('/'),
         $login_uri);
     }
   }
 
   protected function newOAuthAdapter() {
     $config = $this->getProviderConfig();
 
     return id(new PhutilAuthAdapterOAuthJIRA())
       ->setAdapterDomain($config->getProviderDomain())
       ->setJIRABaseURI($config->getProperty(self::PROPERTY_JIRA_URI))
       ->setPrivateKey(
         new PhutilOpaqueEnvelope(
           $config->getProperty(self::PROPERTY_PRIVATE_KEY)));
   }
 
   protected function getLoginIcon() {
     return 'Jira';
   }
 
   private function isSetup() {
     return !$this->getProviderConfig()->getID();
   }
 
   const PROPERTY_JIRA_NAME = 'oauth1:jira:name';
   const PROPERTY_JIRA_URI = 'oauth1:jira:uri';
   const PROPERTY_PUBLIC_KEY = 'oauth1:jira:key:public';
   const PROPERTY_PRIVATE_KEY = 'oauth1:jira:key:private';
 
 
   public function readFormValuesFromProvider() {
     $config = $this->getProviderConfig();
     $uri = $config->getProperty(self::PROPERTY_JIRA_URI);
 
     return array(
       self::PROPERTY_JIRA_NAME => $this->getProviderDomain(),
       self::PROPERTY_JIRA_URI => $uri,
     );
   }
 
   public function readFormValuesFromRequest(AphrontRequest $request) {
     $is_setup = $this->isSetup();
     if ($is_setup) {
       $name = $request->getStr(self::PROPERTY_JIRA_NAME);
     } else {
       $name = $this->getProviderDomain();
     }
 
     return array(
       self::PROPERTY_JIRA_NAME => $name,
       self::PROPERTY_JIRA_URI => $request->getStr(self::PROPERTY_JIRA_URI),
     );
   }
 
   public function processEditForm(
     AphrontRequest $request,
     array $values) {
     $errors = array();
     $issues = array();
 
     $is_setup = $this->isSetup();
 
     $key_name = self::PROPERTY_JIRA_NAME;
     $key_uri = self::PROPERTY_JIRA_URI;
 
     if (!strlen($values[$key_name])) {
       $errors[] = pht('JIRA instance name is required.');
       $issues[$key_name] = pht('Required');
-    } else if (!preg_match('/^[a-z0-9.]+$/', $values[$key_name])) {
+    } else if (!preg_match('/^[a-z0-9.]+\z/', $values[$key_name])) {
       $errors[] = pht(
         'JIRA instance name must contain only lowercase letters, digits, and '.
         'period.');
       $issues[$key_name] = pht('Invalid');
     }
 
     if (!strlen($values[$key_uri])) {
       $errors[] = pht('JIRA base URI is required.');
       $issues[$key_uri] = pht('Required');
     } else {
       $uri = new PhutilURI($values[$key_uri]);
       if (!$uri->getProtocol()) {
         $errors[] = pht(
           'JIRA base URI should include protocol (like "https://").');
         $issues[$key_uri] = pht('Invalid');
       }
     }
 
     if (!$errors && $is_setup) {
       $config = $this->getProviderConfig();
 
       $config->setProviderDomain($values[$key_name]);
 
       $consumer_key = 'phjira.'.Filesystem::readRandomCharacters(16);
       list($public, $private) = PhutilAuthAdapterOAuthJIRA::newJIRAKeypair();
 
       $config->setProperty(self::PROPERTY_PUBLIC_KEY, $public);
       $config->setProperty(self::PROPERTY_PRIVATE_KEY, $private);
       $config->setProperty(self::PROPERTY_CONSUMER_KEY, $consumer_key);
     }
 
     return array($errors, $issues, $values);
   }
 
   public function extendEditForm(
     AphrontRequest $request,
     AphrontFormView $form,
     array $values,
     array $issues) {
 
     if (!function_exists('openssl_pkey_new')) {
       // TODO: This could be a bit prettier.
       throw new Exception(
         pht(
           "The PHP 'openssl' extension is not installed. You must install ".
           "this extension in order to add a JIRA authentication provider, ".
           "because JIRA OAuth requests use the RSA-SHA1 signing algorithm. ".
           "Install the 'openssl' extension, restart your webserver, and try ".
           "again."));
     }
 
     $form->appendRemarkupInstructions(
       pht(
         'NOTE: This provider **only supports JIRA 6**. It will not work with '.
         'JIRA 5 or earlier.'));
 
     $is_setup = $this->isSetup();
 
     $e_required = $request->isFormPost() ? null : true;
 
     $v_name = $values[self::PROPERTY_JIRA_NAME];
     if ($is_setup) {
       $e_name = idx($issues, self::PROPERTY_JIRA_NAME, $e_required);
     } else {
       $e_name = null;
     }
 
     $v_uri = $values[self::PROPERTY_JIRA_URI];
     $e_uri = idx($issues, self::PROPERTY_JIRA_URI, $e_required);
 
     if ($is_setup) {
       $form
         ->appendRemarkupInstructions(
           pht(
             "**JIRA Instance Name**\n\n".
             "Choose a permanent name for this instance of JIRA. Phabricator ".
             "uses this name internally to keep track of this instance of ".
             "JIRA, in case the URL changes later.\n\n".
             "Use lowercase letters, digits, and period. For example, ".
             "`jira`, `jira.mycompany` or `jira.engineering` are reasonable ".
             "names."))
         ->appendChild(
           id(new AphrontFormTextControl())
             ->setLabel(pht('JIRA Instance Name'))
             ->setValue($v_name)
             ->setName(self::PROPERTY_JIRA_NAME)
             ->setError($e_name));
     } else {
       $form
         ->appendChild(
           id(new AphrontFormStaticControl())
             ->setLabel(pht('JIRA Instance Name'))
             ->setValue($v_name));
     }
 
     $form
       ->appendChild(
         id(new AphrontFormTextControl())
           ->setLabel(pht('JIRA Base URI'))
           ->setValue($v_uri)
           ->setName(self::PROPERTY_JIRA_URI)
           ->setCaption(
             pht(
               'The URI where JIRA is installed. For example: %s',
               phutil_tag('tt', array(), 'https://jira.mycompany.com/')))
           ->setError($e_uri));
 
     if (!$is_setup) {
       $config = $this->getProviderConfig();
 
 
       $ckey = $config->getProperty(self::PROPERTY_CONSUMER_KEY);
       $ckey = phutil_tag('tt', array(), $ckey);
 
       $pkey = $config->getProperty(self::PROPERTY_PUBLIC_KEY);
       $pkey = phutil_escape_html_newlines($pkey);
       $pkey = phutil_tag('tt', array(), $pkey);
 
       $form
         ->appendRemarkupInstructions(
           pht(
             'NOTE: **To complete setup**, copy and paste these keys into JIRA '.
             'according to the instructions below.'))
         ->appendChild(
           id(new AphrontFormStaticControl())
             ->setLabel(pht('Consumer Key'))
             ->setValue($ckey))
         ->appendChild(
           id(new AphrontFormStaticControl())
             ->setLabel(pht('Public Key'))
             ->setValue($pkey));
     }
 
   }
 
 
   /**
    * JIRA uses a setup step to generate public/private keys.
    */
   public function hasSetupStep() {
     return true;
   }
 
   public static function getJIRAProvider() {
     $providers = self::getAllEnabledProviders();
 
     foreach ($providers as $provider) {
       if ($provider instanceof PhabricatorAuthProviderOAuth1JIRA) {
         return $provider;
       }
     }
 
     return null;
   }
 
   public function newJIRAFuture(
     PhabricatorExternalAccount $account,
     $path,
     $method,
     $params = array()) {
 
     $adapter = clone $this->getAdapter();
     $adapter->setToken($account->getProperty('oauth1.token'));
     $adapter->setTokenSecret($account->getProperty('oauth1.token.secret'));
 
     return $adapter->newJIRAFuture($path, $method, $params);
   }
 
 }
diff --git a/src/applications/diffusion/conduit/ConduitAPI_diffusion_getcommits_Method.php b/src/applications/diffusion/conduit/ConduitAPI_diffusion_getcommits_Method.php
index 1ccc6a50a6..95c55b5a2c 100644
--- a/src/applications/diffusion/conduit/ConduitAPI_diffusion_getcommits_Method.php
+++ b/src/applications/diffusion/conduit/ConduitAPI_diffusion_getcommits_Method.php
@@ -1,300 +1,300 @@
 <?php
 
 /**
  * @group conduit
  */
 final class ConduitAPI_diffusion_getcommits_Method
   extends ConduitAPI_diffusion_Method {
 
   public function getMethodDescription() {
     return pht('Retrieve Diffusion commit information.');
   }
 
   public function getMethodStatus() {
     return self::METHOD_STATUS_DEPRECATED;
   }
 
   public function getMethodStatusDescription() {
     return pht('Obsoleted by diffusion.querycommits.');
   }
 
   public function defineParamTypes() {
     return array(
       'commits' => 'required list<string>',
     );
   }
 
   public function defineReturnType() {
     return 'nonempty list<dict<string, wild>>';
   }
 
   public function defineErrorTypes() {
     return array(
     );
   }
 
   protected function execute(ConduitAPIRequest $request) {
 
     $results = array();
 
     $commits = $request->getValue('commits');
     $commits = array_fill_keys($commits, array());
     foreach ($commits as $name => $info) {
       $matches = null;
-      if (!preg_match('/^r([A-Z]+)([0-9a-f]+)$/', $name, $matches)) {
+      if (!preg_match('/^r([A-Z]+)([0-9a-f]+)\z/', $name, $matches)) {
         $results[$name] = array(
           'error' => 'ERR-UNPARSEABLE',
         );
         unset($commits[$name]);
         continue;
       }
       $commits[$name] = array(
         'callsign'          => $matches[1],
         'commitIdentifier'  => $matches[2],
       );
     }
 
     if (!$commits) {
       return $results;
     }
 
     $callsigns = ipull($commits, 'callsign');
     $callsigns = array_unique($callsigns);
     $repos = id(new PhabricatorRepositoryQuery())
       ->setViewer($request->getUser())
       ->withCallsigns($callsigns)
       ->execute();
     $repos = mpull($repos, null, 'getCallsign');
 
     foreach ($commits as $name => $info) {
       $repo = idx($repos, $info['callsign']);
       if (!$repo) {
         $results[$name] = $info + array(
           'error' => 'ERR-UNKNOWN-REPOSITORY',
         );
         unset($commits[$name]);
         continue;
       }
       $commits[$name] += array(
         'repositoryPHID' => $repo->getPHID(),
         'repositoryID' => $repo->getID(),
       );
     }
 
     if (!$commits) {
       return $results;
     }
 
     // Execute a complicated query to figure out the primary commit information
     // for each referenced commit.
     $cdata = $this->queryCommitInformation($commits, $repos);
 
     // We've built the queries so that each row also has the identifier we used
     // to select it, which might be a git prefix rather than a full identifier.
     $ref_map = ipull($cdata, 'commitIdentifier', 'commitRef');
 
     $cobjs = id(new PhabricatorRepositoryCommit())->loadAllFromArray($cdata);
     $cobjs = mgroup($cobjs, 'getRepositoryID', 'getCommitIdentifier');
     foreach ($commits as $name => $commit) {
 
       // Expand short git names into full identifiers. For SVN this map is just
       // the identity.
       $full_identifier = idx($ref_map, $commit['commitIdentifier']);
 
       $repo_id = $commit['repositoryID'];
       unset($commits[$name]['repositoryID']);
 
       if (empty($full_identifier) ||
           empty($cobjs[$commit['repositoryID']][$full_identifier])) {
         $results[$name] = $commit + array(
           'error' => 'ERR-UNKNOWN-COMMIT',
         );
         unset($commits[$name]);
         continue;
       }
 
       $cobj_arr = $cobjs[$commit['repositoryID']][$full_identifier];
       $cobj = head($cobj_arr);
 
       $commits[$name] += array(
         'epoch'             => $cobj->getEpoch(),
         'commitPHID'        => $cobj->getPHID(),
         'commitID'          => $cobj->getID(),
       );
 
       // Upgrade git short references into full commit identifiers.
       $identifier = $cobj->getCommitIdentifier();
       $commits[$name]['commitIdentifier'] = $identifier;
 
       $callsign = $commits[$name]['callsign'];
       $uri = "/r{$callsign}{$identifier}";
       $commits[$name]['uri'] = PhabricatorEnv::getProductionURI($uri);
     }
 
     if (!$commits) {
       return $results;
     }
 
     $commits = $this->addRepositoryCommitDataInformation($commits);
     $commits = $this->addDifferentialInformation($commits);
     $commits = $this->addManiphestInformation($commits);
 
     foreach ($commits as $name => $commit) {
       $results[$name] = $commit;
     }
 
     return $results;
   }
 
   /**
    * Retrieve primary commit information for all referenced commits.
    */
   private function queryCommitInformation(array $commits, array $repos) {
     assert_instances_of($repos, 'PhabricatorRepository');
     $conn_r = id(new PhabricatorRepositoryCommit())->establishConnection('r');
     $repos = mpull($repos, null, 'getID');
 
     $groups = array();
     foreach ($commits as $name => $commit) {
       $groups[$commit['repositoryID']][] = $commit['commitIdentifier'];
     }
 
     // NOTE: MySQL goes crazy and does a massive table scan if we build a more
     // sensible version of this query. Make sure the query plan is OK if you
     // attempt to reduce the craziness here. METANOTE: The addition of prefix
     // selection for Git further complicates matters.
     $query = array();
     $commit_table = id(new PhabricatorRepositoryCommit())->getTableName();
 
     foreach ($groups as $repository_id => $identifiers) {
       $vcs = $repos[$repository_id]->getVersionControlSystem();
       $is_git = ($vcs == PhabricatorRepositoryType::REPOSITORY_TYPE_GIT);
       if ($is_git) {
         foreach ($identifiers as $identifier) {
           if (strlen($identifier) < 7) {
             // Don't bother with silly stuff like 'rX2', which will select
             // 1/16th of all commits. Note that with length 7 we'll still get
             // collisions in repositories at the tens-of-thousands-of-commits
             // scale.
             continue;
           }
           $query[] = qsprintf(
             $conn_r,
             'SELECT %T.*, %s commitRef
               FROM %T WHERE repositoryID = %d
               AND commitIdentifier LIKE %>',
             $commit_table,
             $identifier,
             $commit_table,
             $repository_id,
             $identifier);
         }
       } else {
         $query[] = qsprintf(
           $conn_r,
           'SELECT %T.*, commitIdentifier commitRef
             FROM %T WHERE repositoryID = %d
             AND commitIdentifier IN (%Ls)',
           $commit_table,
           $commit_table,
           $repository_id,
           $identifiers);
       }
     }
 
     return queryfx_all(
       $conn_r,
       '%Q',
       implode(' UNION ALL ', $query));
   }
 
   /**
    * Enhance the commit list with RepositoryCommitData information.
    */
   private function addRepositoryCommitDataInformation(array $commits) {
     $commit_ids = ipull($commits, 'commitID');
 
     $data = id(new PhabricatorRepositoryCommitData())->loadAllWhere(
       'commitID in (%Ld)',
       $commit_ids);
     $data = mpull($data, null, 'getCommitID');
 
     foreach ($commits as $name => $commit) {
       if (isset($data[$commit['commitID']])) {
         $dobj = $data[$commit['commitID']];
         $commits[$name] += array(
           'commitMessage' => $dobj->getCommitMessage(),
           'commitDetails' => $dobj->getCommitDetails(),
         );
       }
 
       // Remove this information so we don't expose it via the API since
       // external services shouldn't be storing internal Commit IDs.
       unset($commits[$name]['commitID']);
     }
 
     return $commits;
   }
 
   /**
    * Enhance the commit list with Differential information.
    */
   private function addDifferentialInformation(array $commits) {
     $commit_phids = ipull($commits, 'commitPHID');
 
     // TODO: (T603) This should be policy checked, either by moving to
     // DifferentialRevisionQuery or by doing a followup query to make sure
     // the matched objects are visible.
 
     $rev_conn_r = id(new DifferentialRevision())->establishConnection('r');
     $revs = queryfx_all(
       $rev_conn_r,
       'SELECT r.id id, r.phid phid, c.commitPHID commitPHID FROM %T r JOIN %T c
         ON r.id = c.revisionID
         WHERE c.commitPHID in (%Ls)',
       id(new DifferentialRevision())->getTableName(),
       DifferentialRevision::TABLE_COMMIT,
       $commit_phids);
 
     $revs = ipull($revs, null, 'commitPHID');
     foreach ($commits as $name => $commit) {
       if (isset($revs[$commit['commitPHID']])) {
         $rev = $revs[$commit['commitPHID']];
         $commits[$name] += array(
           'differentialRevisionID'    => 'D'.$rev['id'],
           'differentialRevisionPHID'  => $rev['phid'],
         );
       }
     }
 
     return $commits;
   }
 
   /**
    * Enhances the commits list with Maniphest information.
    */
   private function addManiphestInformation(array $commits) {
     $task_type = PhabricatorEdgeConfig::TYPE_COMMIT_HAS_TASK;
 
     $commit_phids = ipull($commits, 'commitPHID');
 
     $edge_query = id(new PhabricatorEdgeQuery())
       ->withSourcePHIDs($commit_phids)
       ->withEdgeTypes(array($task_type));
 
     $edges = $edge_query->execute();
 
     foreach ($commits as $name => $commit) {
       $task_phids = $edge_query->getDestinationPHIDs(
         array($commit['commitPHID']),
         array($task_type));
 
       $commits[$name] += array(
         'taskPHIDs' => $task_phids,
       );
     }
 
     return $commits;
   }
 
 }
diff --git a/src/applications/diffusion/controller/DiffusionRepositoryCreateController.php b/src/applications/diffusion/controller/DiffusionRepositoryCreateController.php
index 417119704f..71f55c1c9d 100644
--- a/src/applications/diffusion/controller/DiffusionRepositoryCreateController.php
+++ b/src/applications/diffusion/controller/DiffusionRepositoryCreateController.php
@@ -1,920 +1,920 @@
 <?php
 
 final class DiffusionRepositoryCreateController
   extends DiffusionRepositoryEditController {
 
   private $edit;
   private $repository;
 
   public function willProcessRequest(array $data) {
     parent::willProcessRequest($data);
     $this->edit = $data['edit'];
   }
 
   public function processRequest() {
     $request = $this->getRequest();
     $viewer = $request->getUser();
 
     // NOTE: We can end up here via either "Create Repository", or via
     // "Import Repository", or via "Edit Remote", or via "Edit Policies". In
     // the latter two cases, we show only a few of the pages.
 
     $repository = null;
     switch ($this->edit) {
       case 'remote':
       case 'policy':
         $repository = $this->getDiffusionRequest()->getRepository();
 
         // Make sure we have CAN_EDIT.
         PhabricatorPolicyFilter::requireCapability(
           $viewer,
           $repository,
           PhabricatorPolicyCapability::CAN_EDIT);
 
         $this->setRepository($repository);
 
         $cancel_uri = $this->getRepositoryControllerURI($repository, 'edit/');
         break;
       case 'import':
       case 'create':
         $this->requireApplicationCapability(
           DiffusionCapabilityCreateRepositories::CAPABILITY);
 
         $cancel_uri = $this->getApplicationURI('new/');
         break;
       default:
         throw new Exception("Invalid edit operation!");
     }
 
     $form = id(new PHUIPagedFormView())
       ->setUser($viewer)
       ->setCancelURI($cancel_uri);
 
     switch ($this->edit) {
       case 'remote':
         $title = pht('Edit Remote');
         $form
           ->addPage('remote-uri', $this->buildRemoteURIPage())
           ->addPage('auth', $this->buildAuthPage());
         break;
       case 'policy':
         $title = pht('Edit Policies');
         $form
           ->addPage('policy', $this->buildPolicyPage());
         break;
       case 'create':
         $title = pht('Create Repository');
         $form
           ->addPage('vcs', $this->buildVCSPage())
           ->addPage('name', $this->buildNamePage())
           ->addPage('policy', $this->buildPolicyPage())
           ->addPage('done', $this->buildDonePage());
         break;
       case 'import':
         $title = pht('Import Repository');
         $form
           ->addPage('vcs', $this->buildVCSPage())
           ->addPage('name', $this->buildNamePage())
           ->addPage('remote-uri', $this->buildRemoteURIPage())
           ->addPage('auth', $this->buildAuthPage())
           ->addPage('policy', $this->buildPolicyPage())
           ->addPage('done', $this->buildDonePage());
         break;
     }
 
     if ($request->isFormPost()) {
       $form->readFromRequest($request);
       if ($form->isComplete()) {
 
         $is_create = ($this->edit === 'import' || $this->edit === 'create');
         $is_auth = ($this->edit == 'import' || $this->edit == 'remote');
         $is_policy = ($this->edit != 'remote');
         $is_init = ($this->edit == 'create');
 
         if ($is_create) {
           $repository = PhabricatorRepository::initializeNewRepository(
             $viewer);
         }
 
         $template = id(new PhabricatorRepositoryTransaction());
 
         $type_name = PhabricatorRepositoryTransaction::TYPE_NAME;
         $type_vcs = PhabricatorRepositoryTransaction::TYPE_VCS;
         $type_activate = PhabricatorRepositoryTransaction::TYPE_ACTIVATE;
         $type_local_path = PhabricatorRepositoryTransaction::TYPE_LOCAL_PATH;
         $type_remote_uri = PhabricatorRepositoryTransaction::TYPE_REMOTE_URI;
         $type_hosting = PhabricatorRepositoryTransaction::TYPE_HOSTING;
         $type_credential = PhabricatorRepositoryTransaction::TYPE_CREDENTIAL;
         $type_view = PhabricatorTransactions::TYPE_VIEW_POLICY;
         $type_edit = PhabricatorTransactions::TYPE_EDIT_POLICY;
         $type_push = PhabricatorRepositoryTransaction::TYPE_PUSH_POLICY;
 
         $xactions = array();
 
         // If we're creating a new repository, set all this core stuff.
         if ($is_create) {
           $callsign = $form->getPage('name')
             ->getControl('callsign')->getValue();
 
           // We must set this to a unique value to save the repository
           // initially, and it's immutable, so we don't bother using
           // transactions to apply this change.
           $repository->setCallsign($callsign);
 
           // Put the repository in "Importing" mode until we finish
           // parsing it.
           $repository->setDetail('importing', true);
 
           $xactions[] = id(clone $template)
             ->setTransactionType($type_name)
             ->setNewValue(
               $form->getPage('name')->getControl('name')->getValue());
 
           $xactions[] = id(clone $template)
             ->setTransactionType($type_vcs)
             ->setNewValue(
               $form->getPage('vcs')->getControl('vcs')->getValue());
 
           $activate = $form->getPage('done')
             ->getControl('activate')->getValue();
           $xactions[] = id(clone $template)
             ->setTransactionType($type_activate)
             ->setNewValue(
               ($activate == 'start'));
 
           $default_local_path = PhabricatorEnv::getEnvConfig(
             'repository.default-local-path');
 
           $default_local_path = rtrim($default_local_path, '/');
           $default_local_path = $default_local_path.'/'.$callsign.'/';
 
           $xactions[] = id(clone $template)
             ->setTransactionType($type_local_path)
             ->setNewValue($default_local_path);
         }
 
         if ($is_init) {
           $xactions[] = id(clone $template)
             ->setTransactionType($type_hosting)
             ->setNewValue(true);
         }
 
         if ($is_auth) {
           $xactions[] = id(clone $template)
             ->setTransactionType($type_remote_uri)
             ->setNewValue(
               $form->getPage('remote-uri')->getControl('remoteURI')
                 ->getValue());
 
           $xactions[] = id(clone $template)
             ->setTransactionType($type_credential)
             ->setNewValue(
               $form->getPage('auth')->getControl('credential')->getValue());
         }
 
         if ($is_policy) {
           $xactions[] = id(clone $template)
             ->setTransactionType($type_view)
             ->setNewValue(
               $form->getPage('policy')->getControl('viewPolicy')->getValue());
 
           $xactions[] = id(clone $template)
             ->setTransactionType($type_edit)
             ->setNewValue(
               $form->getPage('policy')->getControl('editPolicy')->getValue());
 
           if ($is_init || $repository->isHosted()) {
             $xactions[] = id(clone $template)
               ->setTransactionType($type_push)
               ->setNewValue(
                 $form->getPage('policy')->getControl('pushPolicy')->getValue());
           }
         }
 
         id(new PhabricatorRepositoryEditor())
           ->setContinueOnNoEffect(true)
           ->setContentSourceFromRequest($request)
           ->setActor($viewer)
           ->applyTransactions($repository, $xactions);
 
         $repo_uri = $this->getRepositoryControllerURI($repository, 'edit/');
         return id(new AphrontRedirectResponse())->setURI($repo_uri);
       }
     } else {
       $dict = array();
       if ($repository) {
         $dict = array(
           'remoteURI' => $repository->getRemoteURI(),
           'credential' => $repository->getCredentialPHID(),
           'viewPolicy' => $repository->getViewPolicy(),
           'editPolicy' => $repository->getEditPolicy(),
           'pushPolicy' => $repository->getPushPolicy(),
         );
       }
       $form->readFromObject($dict);
     }
 
     $crumbs = $this->buildApplicationCrumbs();
     $crumbs->addTextCrumb($title);
 
     return $this->buildApplicationPage(
       array(
         $crumbs,
         $form,
       ),
       array(
         'title' => $title,
         'device' => true,
       ));
   }
 
 
 /* -(  Page: VCS Type  )----------------------------------------------------- */
 
 
   private function buildVCSPage() {
 
     $is_import = ($this->edit == 'import');
 
     if ($is_import) {
       $git_str = pht(
         'Import a Git repository (for example, a repository hosted '.
         'on GitHub).');
       $hg_str = pht(
         'Import a Mercurial repository (for example, a repository '.
         'hosted on Bitbucket).');
       $svn_str = pht('Import a Subversion repository.');
     } else {
       $git_str = pht('Create a new, empty Git repository.');
       $hg_str = pht('Create a new, empty Mercurial repository.');
       $svn_str = pht('Create a new, empty Subversion repository.');
     }
 
     $control = id(new AphrontFormRadioButtonControl())
       ->setName('vcs')
       ->setLabel(pht('Type'))
       ->addButton(
         PhabricatorRepositoryType::REPOSITORY_TYPE_GIT,
         pht('Git'),
         $git_str)
       ->addButton(
         PhabricatorRepositoryType::REPOSITORY_TYPE_MERCURIAL,
         pht('Mercurial'),
         $hg_str)
       ->addButton(
         PhabricatorRepositoryType::REPOSITORY_TYPE_SVN,
         pht('Subversion'),
         $svn_str);
 
     if ($is_import) {
       $control->addButton(
         PhabricatorRepositoryType::REPOSITORY_TYPE_PERFORCE,
         pht('Perforce'),
         pht(
           'Perforce is not directly supported, but you can import '.
           'a Perforce repository as a Git repository using %s.',
           phutil_tag(
             'a',
             array(
               'href' =>
                 'http://www.perforce.com/product/components/git-fusion',
               'target' => '_blank',
             ),
             pht('Perforce Git Fusion'))),
         'disabled',
         $disabled = true);
     }
 
     return id(new PHUIFormPageView())
       ->setPageName(pht('Repository Type'))
       ->setUser($this->getRequest()->getUser())
       ->setValidateFormPageCallback(array($this, 'validateVCSPage'))
       ->addControl($control);
   }
 
   public function validateVCSPage(PHUIFormPageView $page) {
     $valid = array(
       PhabricatorRepositoryType::REPOSITORY_TYPE_GIT => true,
       PhabricatorRepositoryType::REPOSITORY_TYPE_MERCURIAL => true,
       PhabricatorRepositoryType::REPOSITORY_TYPE_SVN => true,
     );
 
     $c_vcs = $page->getControl('vcs');
     $v_vcs = $c_vcs->getValue();
     if (!$v_vcs) {
       $c_vcs->setError(pht('Required'));
       $page->addPageError(
         pht('You must select a version control system.'));
     } else if (empty($valid[$v_vcs])) {
       $c_vcs->setError(pht('Invalid'));
       $page->addPageError(
         pht('You must select a valid version control system.'));
     }
 
     return $c_vcs->isValid();
   }
 
 
 /* -(  Page: Name and Callsign  )-------------------------------------------- */
 
 
   private function buildNamePage() {
     return id(new PHUIFormPageView())
       ->setUser($this->getRequest()->getUser())
       ->setPageName(pht('Repository Name and Location'))
       ->setValidateFormPageCallback(array($this, 'validateNamePage'))
       ->addRemarkupInstructions(
         pht(
           '**Choose a human-readable name for this repository**, like '.
           '"CompanyName Mobile App" or "CompanyName Backend Server". You '.
           'can change this later.'))
       ->addControl(
         id(new AphrontFormTextControl())
           ->setName('name')
           ->setLabel(pht('Name'))
           ->setCaption(pht('Human-readable repository name.')))
       ->addRemarkupInstructions(
         pht(
           '**Choose a "Callsign" for the repository.** This is a short, '.
           'unique string which identifies commits elsewhere in Phabricator. '.
           'For example, you might use `M` for your mobile app repository '.
           'and `B` for your backend repository.'.
           "\n\n".
           '**Callsigns must be UPPERCASE**, and can not be edited after the '.
           'repository is created. Generally, you should choose short '.
           'callsigns.'))
       ->addControl(
         id(new AphrontFormTextControl())
           ->setName('callsign')
           ->setLabel(pht('Callsign'))
           ->setCaption(pht('Short UPPERCASE identifier.')));
   }
 
   public function validateNamePage(PHUIFormPageView $page) {
     $c_name = $page->getControl('name');
     $v_name = $c_name->getValue();
     if (!strlen($v_name)) {
       $c_name->setError(pht('Required'));
       $page->addPageError(
         pht('You must choose a name for this repository.'));
     }
 
     $c_call = $page->getControl('callsign');
     $v_call = $c_call->getValue();
     if (!strlen($v_call)) {
       $c_call->setError(pht('Required'));
       $page->addPageError(
         pht('You must choose a callsign for this repository.'));
-    } else if (!preg_match('/^[A-Z]+$/', $v_call)) {
+    } else if (!preg_match('/^[A-Z]+\z/', $v_call)) {
       $c_call->setError(pht('Invalid'));
       $page->addPageError(
         pht('The callsign must contain only UPPERCASE letters.'));
     } else {
       $exists = false;
       try {
         $repo = id(new PhabricatorRepositoryQuery())
           ->setViewer($this->getRequest()->getUser())
           ->withCallsigns(array($v_call))
           ->executeOne();
         $exists = (bool)$repo;
       } catch (PhabricatorPolicyException $ex) {
         $exists = true;
       }
       if ($exists) {
         $c_call->setError(pht('Not Unique'));
         $page->addPageError(
           pht(
             'Another repository already uses that callsign. You must choose '.
             'a unique callsign.'));
       }
     }
 
     return $c_name->isValid() &&
            $c_call->isValid();
   }
 
 
 /* -(  Page: Remote URI  )--------------------------------------------------- */
 
 
   private function buildRemoteURIPage() {
     return id(new PHUIFormPageView())
       ->setUser($this->getRequest()->getUser())
       ->setPageName(pht('Repository Remote URI'))
       ->setValidateFormPageCallback(array($this, 'validateRemoteURIPage'))
       ->setAdjustFormPageCallback(array($this, 'adjustRemoteURIPage'))
       ->addControl(
         id(new AphrontFormTextControl())
           ->setName('remoteURI'));
   }
 
   public function adjustRemoteURIPage(PHUIFormPageView $page) {
     $form = $page->getForm();
 
     $is_git = false;
     $is_svn = false;
     $is_mercurial = false;
 
     if ($this->getRepository()) {
       $vcs = $this->getRepository()->getVersionControlSystem();
     } else {
       $vcs = $form->getPage('vcs')->getControl('vcs')->getValue();
     }
 
     switch ($vcs) {
       case PhabricatorRepositoryType::REPOSITORY_TYPE_GIT:
         $is_git = true;
         break;
       case PhabricatorRepositoryType::REPOSITORY_TYPE_SVN:
         $is_svn = true;
         break;
       case PhabricatorRepositoryType::REPOSITORY_TYPE_MERCURIAL:
         $is_mercurial = true;
         break;
       default:
         throw new Exception("Unsupported VCS!");
     }
 
     $has_local = ($is_git || $is_mercurial);
     if ($is_git) {
       $uri_label = pht('Remote URI');
       $instructions = pht(
         'Enter the URI to clone this Git repository from. It should usually '.
         'look like one of these examples:'.
         "\n\n".
         "| Example Git Remote URIs |\n".
         "| ----------------------- |\n".
         "| `git@github.com:example/example.git` |\n".
         "| `ssh://user@host.com/git/example.git` |\n".
         "| `file:///local/path/to/repo` |\n".
         "| `https://example.com/repository.git` |\n");
     } else if ($is_mercurial) {
       $uri_label = pht('Remote URI');
       $instructions = pht(
         'Enter the URI to clone this Mercurial repository from. It should '.
         'usually look like one of these examples:'.
         "\n\n".
         "| Example Mercurial Remote URIs |\n".
         "| ----------------------- |\n".
         "| `ssh://hg@bitbucket.org/example/repository` |\n".
         "| `file:///local/path/to/repo` |\n");
     } else if ($is_svn) {
       $uri_label = pht('Repository Root');
       $instructions = pht(
         'Enter the **Repository Root** for this Subversion repository. '.
         'You can figure this out by running `svn info` in a working copy '.
         'and looking at the value in the `Repository Root` field. It '.
         'should be a URI and will usually look like these:'.
         "\n\n".
         "| Example Subversion Repository Root URIs |\n".
         "| ------------------------------ |\n".
         "| `http://svn.example.org/svnroot/` |\n".
         "| `svn+ssh://svn.example.com/svnroot/` |\n".
         "| `svn://svn.example.net/svnroot/` |\n".
         "| `file:///local/path/to/svnroot/` |\n".
         "\n\n".
         "You **MUST** specify the root of the repository, not a ".
         "subdirectory. (If you want to import only part of a Subversion ".
         "repository, use the //Import Only// option at the end of this ".
         "workflow.)");
     } else {
       throw new Exception("Unsupported VCS!");
     }
 
     $page->addRemarkupInstructions($instructions, 'remoteURI');
     $page->getControl('remoteURI')->setLabel($uri_label);
   }
 
   public function validateRemoteURIPage(PHUIFormPageView $page) {
     $c_remote = $page->getControl('remoteURI');
     $v_remote = $c_remote->getValue();
 
     if (!strlen($v_remote)) {
       $c_remote->setError(pht('Required'));
       $page->addPageError(
         pht("You must specify a URI."));
     } else {
       $proto = $this->getRemoteURIProtocol($v_remote);
 
       if ($proto === 'file') {
         if (!preg_match('@^file:///@', $v_remote)) {
           $c_remote->setError(pht('Invalid'));
           $page->addPageError(
             pht(
               "URIs using the 'file://' protocol should have three slashes ".
               "(e.g., 'file:///absolute/path/to/file'). You only have two. ".
               "Add another one."));
         }
       }
 
       // Catch confusion between Git/SCP-style URIs and normal URIs. See T3619
       // for discussion. This is usually a user adding "ssh://" to an implicit
       // SSH Git URI.
       if ($proto == 'ssh') {
         if (preg_match('(^[^:@]+://[^/:]+:[^\d])', $v_remote)) {
           $c_remote->setError(pht('Invalid'));
           $page->addPageError(
             pht(
               "The Remote URI is not formatted correctly. Remote URIs ".
               "with an explicit protocol should be in the form ".
               "'proto://domain/path', not 'proto://domain:/path'. ".
               "The ':/path' syntax is only valid in SCP-style URIs."));
         }
       }
 
       switch ($proto) {
         case 'ssh':
         case 'http':
         case 'https':
         case 'file':
         case 'git':
         case 'svn':
         case 'svn+ssh':
           break;
         default:
           $c_remote->setError(pht('Invalid'));
           $page->addPageError(
             pht(
               "The URI protocol is unrecognized. It should begin ".
               "'ssh://', 'http://', 'https://', 'file://', 'git://', ".
               "'svn://', 'svn+ssh://', or be in the form ".
               "'git@domain.com:path'."));
           break;
       }
     }
 
     return $c_remote->isValid();
   }
 
 
 /* -(  Page: Authentication  )----------------------------------------------- */
 
 
   public function buildAuthPage() {
     return id(new PHUIFormPageView())
       ->setPageName(pht('Authentication'))
       ->setUser($this->getRequest()->getUser())
       ->setAdjustFormPageCallback(array($this, 'adjustAuthPage'))
       ->addControl(
         id(new PassphraseCredentialControl())
           ->setName('credential'));
   }
 
 
   public function adjustAuthPage($page) {
     $form = $page->getForm();
 
     if ($this->getRepository()) {
       $vcs = $this->getRepository()->getVersionControlSystem();
     } else {
       $vcs = $form->getPage('vcs')->getControl('vcs')->getValue();
     }
 
     $remote_uri = $form->getPage('remote-uri')
       ->getControl('remoteURI')
       ->getValue();
     $proto = $this->getRemoteURIProtocol($remote_uri);
     $remote_user = $this->getRemoteURIUser($remote_uri);
 
     $c_credential = $page->getControl('credential');
     $c_credential->setDefaultUsername($remote_user);
 
     if ($this->isSSHProtocol($proto)) {
       $c_credential->setLabel(pht('SSH Key'));
       $c_credential->setCredentialType(
         PassphraseCredentialTypeSSHPrivateKeyText::CREDENTIAL_TYPE);
       $provides_type = PassphraseCredentialTypeSSHPrivateKey::PROVIDES_TYPE;
 
       $page->addRemarkupInstructions(
         pht(
           'Choose or add the SSH credentials to use to connect to the the '.
           'repository hosted at:'.
           "\n\n".
           "  lang=text\n".
           "  %s",
           $remote_uri),
         'credential');
     } else if ($this->isUsernamePasswordProtocol($proto)) {
       $c_credential->setLabel(pht('Password'));
       $c_credential->setAllowNull(true);
       $c_credential->setCredentialType(
         PassphraseCredentialTypePassword::CREDENTIAL_TYPE);
       $provides_type = PassphraseCredentialTypePassword::PROVIDES_TYPE;
 
       $page->addRemarkupInstructions(
         pht(
           'Choose the a username and pasword used to connect to the '.
           'repository hosted at:'.
           "\n\n".
           "  lang=text\n".
           "  %s".
           "\n\n".
           "If this repository does not require a username or password, ".
           "you can continue to the next step.",
           $remote_uri),
         'credential');
     } else if ($proto == 'file') {
       $c_credential->setHidden(true);
       $provides_type = null;
 
       $page->addRemarkupInstructions(
         pht(
           'You do not need to configure any credentials for repositories '.
           'accessed over the `file://` protocol. Continue to the next step.'),
         'credential');
     } else {
       throw new Exception("Unknown URI protocol!");
     }
 
     if ($provides_type) {
       $viewer = $this->getRequest()->getUser();
 
       $options = id(new PassphraseCredentialQuery())
         ->setViewer($viewer)
         ->withIsDestroyed(false)
         ->withProvidesTypes(array($provides_type))
         ->execute();
 
       $c_credential->setOptions($options);
     }
 
   }
 
   public function validateAuthPage(PHUIFormPageView $page) {
     $form = $page->getForm();
     $remote_uri = $form->getPage('remote')->getControl('remoteURI')->getValue();
     $proto = $this->getRemoteURIProtocol($remote_uri);
 
     $c_credential = $page->getControl('credential');
     $v_credential = $c_credential->getValue();
 
     // NOTE: We're using the omnipotent user here because the viewer might be
     // editing a repository they're allowed to edit which uses a credential they
     // are not allowed to see. This is fine, as long as they don't change it.
     $credential = id(new PassphraseCredentialQuery())
       ->setViewer(PhabricatorUser::getOmnipotentUser())
       ->withPHIDs(array($v_credential))
       ->executeOne();
 
     if ($this->isSSHProtocol($proto)) {
       if (!$credential) {
         $c_credential->setError(pht('Required'));
         $page->addPageError(
           pht('You must choose an SSH credential to connect over SSH.'));
       }
 
       $ssh_type = PassphraseCredentialTypeSSHPrivateKey::PROVIDES_TYPE;
       if ($credential->getProvidesType() !== $ssh_type) {
         $c_credential->setError(pht('Invalid'));
         $page->addPageError(
           pht(
             'You must choose an SSH credential, not some other type '.
             'of credential.'));
       }
 
     } else if ($this->isUsernamePasswordProtocol($proto)) {
       if ($credential) {
         $password_type = PassphraseCredentialTypePassword::PROVIDES_TYPE;
         if ($credential->getProvidesType() !== $password_type) {
         $c_credential->setError(pht('Invalid'));
         $page->addPageError(
           pht(
             'You must choose a username/password credential, not some other '.
             'type of credential.'));
         }
       }
 
       return $c_credential->isValid();
     } else {
       return true;
     }
   }
 
 
 /* -(  Page: Policy  )------------------------------------------------------- */
 
 
   private function buildPolicyPage() {
     $viewer = $this->getRequest()->getUser();
     if ($this->getRepository()) {
       $repository = $this->getRepository();
     } else {
       $repository = PhabricatorRepository::initializeNewRepository($viewer);
     }
 
     $policies = id(new PhabricatorPolicyQuery())
       ->setViewer($viewer)
       ->setObject($repository)
       ->execute();
 
     $view_policy = id(new AphrontFormPolicyControl())
       ->setUser($viewer)
       ->setCapability(PhabricatorPolicyCapability::CAN_VIEW)
       ->setPolicyObject($repository)
       ->setPolicies($policies)
       ->setName('viewPolicy');
 
     $edit_policy = id(new AphrontFormPolicyControl())
       ->setUser($viewer)
       ->setCapability(PhabricatorPolicyCapability::CAN_EDIT)
       ->setPolicyObject($repository)
       ->setPolicies($policies)
       ->setName('editPolicy');
 
     $push_policy = id(new AphrontFormPolicyControl())
       ->setUser($viewer)
       ->setCapability(DiffusionCapabilityPush::CAPABILITY)
       ->setPolicyObject($repository)
       ->setPolicies($policies)
       ->setName('pushPolicy');
 
     return id(new PHUIFormPageView())
         ->setPageName(pht('Policies'))
         ->setValidateFormPageCallback(array($this, 'validatePolicyPage'))
         ->setAdjustFormPageCallback(array($this, 'adjustPolicyPage'))
         ->setUser($viewer)
         ->addRemarkupInstructions(
           pht(
             "Select access policies for this repository."))
         ->addControl($view_policy)
         ->addControl($edit_policy)
         ->addControl($push_policy);
   }
 
   public function adjustPolicyPage(PHUIFormPageView $page) {
     if ($this->getRepository()) {
       $repository = $this->getRepository();
       $show_push = $repository->isHosted();
     } else {
       $show_push = ($this->edit == 'create');
     }
 
     if (!$show_push) {
       $c_push = $page->getControl('pushPolicy');
       $c_push->setHidden(true);
     }
   }
 
   public function validatePolicyPage(PHUIFormPageView $page) {
     $form = $page->getForm();
     $viewer = $this->getRequest()->getUser();
 
     $c_view = $page->getControl('viewPolicy');
     $c_edit = $page->getControl('editPolicy');
     $c_push = $page->getControl('pushPolicy');
     $v_view = $c_view->getValue();
     $v_edit = $c_edit->getValue();
     $v_push = $c_push->getValue();
 
     if ($this->getRepository()) {
       $repository = $this->getRepository();
     } else {
       $repository = PhabricatorRepository::initializeNewRepository($viewer);
     }
 
     $proxy = clone $repository;
     $proxy->setViewPolicy($v_view);
     $proxy->setEditPolicy($v_edit);
 
     $can_view = PhabricatorPolicyFilter::hasCapability(
       $viewer,
       $proxy,
       PhabricatorPolicyCapability::CAN_VIEW);
 
     $can_edit = PhabricatorPolicyFilter::hasCapability(
       $viewer,
       $proxy,
       PhabricatorPolicyCapability::CAN_EDIT);
 
     if (!$can_view) {
       $c_view->setError(pht('Invalid'));
       $page->addPageError(
         pht(
           'You can not use the selected policy, because you would be unable '.
           'to see the repository.'));
     }
 
     if (!$can_edit) {
       $c_edit->setError(pht('Invalid'));
       $page->addPageError(
         pht(
           'You can not use the selected edit policy, because you would be '.
           'unable to edit the repository.'));
     }
 
     return $c_view->isValid() &&
            $c_edit->isValid();
   }
 
 /* -(  Page: Done  )--------------------------------------------------------- */
 
 
   private function buildDonePage() {
 
     $is_create = ($this->edit == 'create');
     if ($is_create) {
       $now_label = pht('Create Repository Now');
       $now_caption = pht(
         'Create the repository right away. This will create the repository '.
         'using default settings.');
 
       $wait_label = pht('Configure More Options First');
       $wait_caption = pht(
         'Configure more options before creating the repository. '.
         'This will let you fine-tune settings. You can create the repository '.
         'whenever you are ready.');
     } else {
       $now_label = pht('Start Import Now');
       $now_caption = pht(
         'Start importing the repository right away. This will import '.
         'the entire repository using default settings.');
 
       $wait_label = pht('Configure More Options First');
       $wait_caption = pht(
         'Configure more options before beginning the repository '.
         'import. This will let you fine-tune settings. You can '.
         'start the import whenever you are ready.');
     }
 
     return id(new PHUIFormPageView())
       ->setPageName(pht('Repository Ready!'))
       ->setValidateFormPageCallback(array($this, 'validateDonePage'))
       ->setUser($this->getRequest()->getUser())
       ->addControl(
         id(new AphrontFormRadioButtonControl())
           ->setName('activate')
           ->setLabel(pht('Start Now'))
           ->addButton(
             'start',
             $now_label,
             $now_caption)
           ->addButton(
             'wait',
             $wait_label,
             $wait_caption));
   }
 
   public function validateDonePage(PHUIFormPageView $page) {
     $c_activate = $page->getControl('activate');
     $v_activate = $c_activate->getValue();
 
     if ($v_activate != 'start' && $v_activate != 'wait') {
       $c_activate->setError(pht('Required'));
       $page->addPageError(
         pht('Make a choice about repository activation.'));
     }
 
     return $c_activate->isValid();
   }
 
 
 /* -(  Internal  )----------------------------------------------------------- */
 
 
   private function getRemoteURIProtocol($raw_uri) {
     $uri = new PhutilURI($raw_uri);
     if ($uri->getProtocol()) {
       return strtolower($uri->getProtocol());
     }
 
     $git_uri = new PhutilGitURI($raw_uri);
     if (strlen($git_uri->getDomain()) && strlen($git_uri->getPath())) {
       return 'ssh';
     }
 
     return null;
   }
 
   private function getRemoteURIUser($raw_uri) {
     $uri = new PhutilURI($raw_uri);
     if ($uri->getUser()) {
       return $uri->getUser();
     }
 
     $git_uri = new PhutilGitURI($raw_uri);
     if (strlen($git_uri->getDomain()) && strlen($git_uri->getPath())) {
       return $git_uri->getUser();
     }
 
     return null;
   }
 
   private function isSSHProtocol($proto) {
     return ($proto == 'git' || $proto == 'ssh' || $proto == 'svn+ssh');
   }
 
   private function isUsernamePasswordProtocol($proto) {
     return ($proto == 'http' || $proto == 'https' || $proto == 'svn');
   }
 
   private function setRepository(PhabricatorRepository $repository) {
     $this->repository = $repository;
     return $this;
   }
 
   private function getRepository() {
     return $this->repository;
   }
 
 
 }
diff --git a/src/applications/diffusion/ssh/DiffusionSSHSubversionServeWorkflow.php b/src/applications/diffusion/ssh/DiffusionSSHSubversionServeWorkflow.php
index e4efa50d17..e03dc76967 100644
--- a/src/applications/diffusion/ssh/DiffusionSSHSubversionServeWorkflow.php
+++ b/src/applications/diffusion/ssh/DiffusionSSHSubversionServeWorkflow.php
@@ -1,264 +1,264 @@
 <?php
 
 /**
  * This protocol has a good spec here:
  *
  *   http://svn.apache.org/repos/asf/subversion/trunk/subversion/libsvn_ra_svn/protocol
  *
  */
 final class DiffusionSSHSubversionServeWorkflow
   extends DiffusionSSHSubversionWorkflow {
 
   private $didSeeWrite;
 
   private $inProtocol;
   private $outProtocol;
 
   private $inSeenGreeting;
 
   private $outPhaseCount = 0;
 
   private $internalBaseURI;
   private $externalBaseURI;
 
   public function didConstruct() {
     $this->setName('svnserve');
     $this->setArguments(
       array(
         array(
           'name' => 'tunnel',
           'short' => 't',
         ),
       ));
   }
 
   protected function executeRepositoryOperations() {
     $args = $this->getArgs();
     if (!$args->getArg('tunnel')) {
       throw new Exception("Expected `svnserve -t`!");
     }
 
     $command = csprintf(
       'svnserve -t --tunnel-user=%s',
       $this->getUser()->getUsername());
     $command = PhabricatorDaemon::sudoCommandAsDaemonUser($command);
 
     $future = new ExecFuture('%C', $command);
 
     $this->inProtocol = new DiffusionSubversionWireProtocol();
     $this->outProtocol = new DiffusionSubversionWireProtocol();
 
     $err = id($this->newPassthruCommand())
       ->setIOChannel($this->getIOChannel())
       ->setCommandChannelFromExecFuture($future)
       ->setWillWriteCallback(array($this, 'willWriteMessageCallback'))
       ->setWillReadCallback(array($this, 'willReadMessageCallback'))
       ->execute();
 
     if (!$err && $this->didSeeWrite) {
       $this->getRepository()->writeStatusMessage(
         PhabricatorRepositoryStatusMessage::TYPE_NEEDS_UPDATE,
         PhabricatorRepositoryStatusMessage::CODE_OKAY);
     }
 
     return $err;
   }
 
   public function willWriteMessageCallback(
     PhabricatorSSHPassthruCommand $command,
     $message) {
 
     $proto = $this->inProtocol;
     $messages = $proto->writeData($message);
 
     $result = array();
     foreach ($messages as $message) {
       $message_raw = $message['raw'];
       $struct = $message['structure'];
 
       if (!$this->inSeenGreeting) {
         $this->inSeenGreeting = true;
 
         // The first message the client sends looks like:
         //
         //   ( version ( cap1 ... ) url ... )
         //
         // We want to grab the URL, load the repository, make sure it exists and
         // is accessible, and then replace it with the location of the
         // repository on disk.
 
         $uri = $struct[2]['value'];
         $struct[2]['value'] = $this->makeInternalURI($uri);
 
         $message_raw = $proto->serializeStruct($struct);
       } else if (isset($struct[0]) && $struct[0]['type'] == 'word') {
 
         if (!$proto->isReadOnlyCommand($struct)) {
           $this->didSeeWrite = true;
           $this->requireWriteAccess($struct[0]['value']);
         }
 
         // Several other commands also pass in URLs. We need to translate
         // all of these into the internal representation; this also makes sure
         // they're valid and accessible.
 
         switch ($struct[0]['value']) {
           case 'reparent':
             // ( reparent ( url ) )
             $struct[1]['value'][0]['value'] = $this->makeInternalURI(
               $struct[1]['value'][0]['value']);
             $message_raw = $proto->serializeStruct($struct);
             break;
           case 'switch':
             // ( switch ( ( rev ) target recurse url ... ) )
             $struct[1]['value'][3]['value'] = $this->makeInternalURI(
               $struct[1]['value'][3]['value']);
             $message_raw = $proto->serializeStruct($struct);
             break;
           case 'diff':
             // ( diff ( ( rev ) target recurse ignore-ancestry url ... ) )
             $struct[1]['value'][4]['value'] = $this->makeInternalURI(
               $struct[1]['value'][4]['value']);
             $message_raw = $proto->serializeStruct($struct);
             break;
         }
       }
 
       $result[] = $message_raw;
     }
 
     if (!$result) {
       return null;
     }
 
     return implode('', $result);
   }
 
   public function willReadMessageCallback(
     PhabricatorSSHPassthruCommand $command,
     $message) {
 
     $proto = $this->outProtocol;
     $messages = $proto->writeData($message);
 
     $result = array();
     foreach ($messages as $message) {
       $message_raw = $message['raw'];
       $struct = $message['structure'];
 
       if (isset($struct[0]) && ($struct[0]['type'] == 'word')) {
 
         if ($struct[0]['value'] == 'success') {
           switch ($this->outPhaseCount) {
             case 0:
               // This is the "greeting", which announces capabilities.
               break;
             case 1:
               // This responds to the client greeting, and announces auth.
               break;
             case 2:
               // This responds to auth, which should be trivial over SSH.
               break;
             case 3:
               // This contains the URI of the repository. We need to edit it;
               // if it does not match what the client requested it will reject
               // the response.
               $struct[1]['value'][1]['value'] = $this->makeExternalURI(
                 $struct[1]['value'][1]['value']);
               $message_raw = $proto->serializeStruct($struct);
               break;
             default:
               // We don't care about other protocol frames.
               break;
           }
 
           $this->outPhaseCount++;
         } else if ($struct[0]['value'] == 'failure') {
           // Find any error messages which include the internal URI, and
           // replace the text with the external URI.
           foreach ($struct[1]['value'] as $key => $error) {
             $code = $error['value'][0]['value'];
             $message = $error['value'][1]['value'];
 
             $message = str_replace(
               $this->internalBaseURI,
               $this->externalBaseURI,
               $message);
 
             // Derp derp derp derp derp. The structure looks like this:
             //   ( failure ( ( code message ... ) ... ) )
             $struct[1]['value'][$key]['value'][1]['value'] = $message;
           }
           $message_raw = $proto->serializeStruct($struct);
         }
 
       }
 
       $result[] = $message_raw;
     }
 
     if (!$result) {
       return null;
     }
 
     return implode('', $result);
   }
 
   private function makeInternalURI($uri_string) {
     $uri = new PhutilURI($uri_string);
 
     $proto = $uri->getProtocol();
     if ($proto !== 'svn+ssh') {
       throw new Exception(
         pht(
           'Protocol for URI "%s" MUST be "svn+ssh".',
           $uri_string));
     }
 
     $path = $uri->getPath();
 
     // Subversion presumably deals with this, but make sure there's nothing
     // skethcy going on with the URI.
     if (preg_match('(/\\.\\./)', $path)) {
       throw new Exception(
         pht(
           'String "/../" is invalid in path specification "%s".',
           $uri_string));
     }
 
     $repository = $this->loadRepository($path);
 
     $path = preg_replace(
       '(^/diffusion/[A-Z]+)',
       rtrim($repository->getLocalPath(), '/'),
       $path);
 
-    if (preg_match('(^/diffusion/[A-Z]+/$)', $path)) {
+    if (preg_match('(^/diffusion/[A-Z]+/\z)', $path)) {
       $path = rtrim($path, '/');
     }
 
     $uri->setPath($path);
 
     // If this is happening during the handshake, these are the base URIs for
     // the request.
     if ($this->externalBaseURI === null) {
       $pre = (string)id(clone $uri)->setPath('');
       $this->externalBaseURI = $pre.'/diffusion/'.$repository->getCallsign();
       $this->internalBaseURI = $pre.rtrim($repository->getLocalPath(), '/');
     }
 
     return (string)$uri;
   }
 
   private function makeExternalURI($uri) {
     $internal = $this->internalBaseURI;
     $external = $this->externalBaseURI;
 
     if (strncmp($uri, $internal, strlen($internal)) === 0) {
       $uri = $external.substr($uri, strlen($internal));
     }
 
     return $uri;
   }
 
 }
diff --git a/src/applications/diffusion/ssh/DiffusionSSHWorkflow.php b/src/applications/diffusion/ssh/DiffusionSSHWorkflow.php
index 7b6fe5af9a..74bfcdc728 100644
--- a/src/applications/diffusion/ssh/DiffusionSSHWorkflow.php
+++ b/src/applications/diffusion/ssh/DiffusionSSHWorkflow.php
@@ -1,139 +1,139 @@
 <?php
 
 abstract class DiffusionSSHWorkflow extends PhabricatorSSHWorkflow {
 
   private $args;
   private $repository;
   private $hasWriteAccess;
 
   public function getRepository() {
     if (!$this->repository) {
       throw new Exception("Call loadRepository() before getRepository()!");
     }
     return $this->repository;
   }
 
   public function getArgs() {
     return $this->args;
   }
 
   public function getEnvironment() {
     $env = array(
       DiffusionCommitHookEngine::ENV_USER => $this->getUser()->getUsername(),
       DiffusionCommitHookEngine::ENV_REMOTE_PROTOCOL => 'ssh',
     );
 
     $ssh_client = getenv('SSH_CLIENT');
     if ($ssh_client) {
       // This has the format "<ip> <remote-port> <local-port>". Grab the IP.
       $remote_address = head(explode(' ', $ssh_client));
       $env[DiffusionCommitHookEngine::ENV_REMOTE_ADDRESS] = $remote_address;
     }
 
     return $env;
   }
 
   abstract protected function executeRepositoryOperations();
 
   protected function writeError($message) {
     $this->getErrorChannel()->write($message);
     return $this;
   }
 
   final public function execute(PhutilArgumentParser $args) {
     $this->args = $args;
 
     try {
       return $this->executeRepositoryOperations();
     } catch (Exception $ex) {
       $this->writeError(get_class($ex).': '.$ex->getMessage());
       return 1;
     }
   }
 
   protected function loadRepository($path) {
     $viewer = $this->getUser();
 
-    $regex = '@^/?diffusion/(?P<callsign>[A-Z]+)(?:/|$)@';
+    $regex = '@^/?diffusion/(?P<callsign>[A-Z]+)(?:/|\z)@';
     $matches = null;
     if (!preg_match($regex, $path, $matches)) {
       throw new Exception(
         pht(
           'Unrecognized repository path "%s". Expected a path like '.
           '"%s".',
           $path,
           "/diffusion/X/"));
     }
 
     $callsign = $matches[1];
     $repository = id(new PhabricatorRepositoryQuery())
       ->setViewer($viewer)
       ->withCallsigns(array($callsign))
       ->executeOne();
 
     if (!$repository) {
       throw new Exception(
         pht('No repository "%s" exists!', $callsign));
     }
 
     switch ($repository->getServeOverSSH()) {
       case PhabricatorRepository::SERVE_READONLY:
       case PhabricatorRepository::SERVE_READWRITE:
         // If we have read or read/write access, proceed for now. We will
         // check write access when the user actually issues a write command.
         break;
       case PhabricatorRepository::SERVE_OFF:
       default:
         throw new Exception(
           pht('This repository is not available over SSH.'));
     }
 
     $this->repository = $repository;
 
     return $repository;
   }
 
   protected function requireWriteAccess($protocol_command = null) {
     if ($this->hasWriteAccess === true) {
       return;
     }
 
     $repository = $this->getRepository();
     $viewer = $this->getUser();
 
     switch ($repository->getServeOverSSH()) {
       case PhabricatorRepository::SERVE_READONLY:
         if ($protocol_command !== null) {
           throw new Exception(
             pht(
               'This repository is read-only over SSH (tried to execute '.
               'protocol command "%s").',
               $protocol_command));
         } else {
           throw new Exception(
             pht('This repository is read-only over SSH.'));
         }
         break;
       case PhabricatorRepository::SERVE_READWRITE:
         $can_push = PhabricatorPolicyFilter::hasCapability(
           $viewer,
           $repository,
           DiffusionCapabilityPush::CAPABILITY);
         if (!$can_push) {
           throw new Exception(
             pht('You do not have permission to push to this repository.'));
         }
         break;
       case PhabricatorRepository::SERVE_OFF:
       default:
         // This shouldn't be reachable because we don't get this far if the
         // repository isn't enabled, but kick them out anyway.
         throw new Exception(
           pht('This repository is not available over SSH.'));
     }
 
     $this->hasWriteAccess = true;
     return $this->hasWriteAccess;
   }
 
 }
diff --git a/src/applications/diviner/atom/DivinerAtomRef.php b/src/applications/diviner/atom/DivinerAtomRef.php
index 87e2ce940a..82ac5b7e45 100644
--- a/src/applications/diviner/atom/DivinerAtomRef.php
+++ b/src/applications/diviner/atom/DivinerAtomRef.php
@@ -1,210 +1,210 @@
 <?php
 
 final class DivinerAtomRef {
 
   private $book;
   private $context;
   private $type;
   private $name;
   private $group;
   private $summary;
   private $index;
   private $title;
 
   public function getSortKey() {
     return implode(
       "\0",
       array(
         $this->getName(),
         $this->getType(),
         $this->getContext(),
         $this->getBook(),
         $this->getIndex(),
       ));
   }
 
   public function setIndex($index) {
     $this->index = $index;
     return $this;
   }
 
   public function getIndex() {
     return $this->index;
   }
 
   public function setSummary($summary) {
     $this->summary = $summary;
     return $this;
   }
 
   public function getSummary() {
     return $this->summary;
   }
 
   public function setName($name) {
     $normal_name = self::normalizeString($name);
-    if (preg_match('/^@[0-9]+$/', $normal_name)) {
+    if (preg_match('/^@[0-9]+\z/', $normal_name)) {
       throw new Exception(
         "Atom names must not be in the form '/@\d+/'. This pattern is ".
         "reserved for disambiguating atoms with similar names.");
     }
     $this->name = $normal_name;
     return $this;
   }
 
   public function getName() {
     return $this->name;
   }
 
   public function setType($type) {
     $this->type = self::normalizeString($type);
     return $this;
   }
 
   public function getType() {
     return $this->type;
   }
 
   public function setContext($context) {
     if ($context === null) {
       $this->context = $context;
     } else {
       $this->context = self::normalizeString($context);
     }
     return $this;
   }
 
   public function getContext() {
     return $this->context;
   }
 
   public function setBook($book) {
     if ($book === null) {
       $this->book = $book;
     } else {
       $this->book = self::normalizeString($book);
     }
     return $this;
   }
 
   public function getBook() {
     return $this->book;
   }
 
   public function setGroup($group) {
     $this->group = $group;
     return $this;
   }
 
   public function getGroup() {
     return $this->group;
   }
 
   public function setTitle($title) {
     $this->title = $title;
     return $this;
   }
 
   public function getTitle() {
     return $this->title;
   }
 
   public function getTitleSlug() {
     return self::normalizeTitleString($this->getTitle());
   }
 
   public function toDictionary() {
     return array(
       'book'    => $this->getBook(),
       'context' => $this->getContext(),
       'type'    => $this->getType(),
       'name'    => $this->getName(),
       'group'   => $this->getGroup(),
       'index'   => $this->getIndex(),
       'summary' => $this->getSummary(),
       'title'   => $this->getTitle(),
     );
   }
 
   public function toHash() {
     $dict = $this->toDictionary();
 
     unset($dict['group']);
     unset($dict['index']);
     unset($dict['summary']);
     unset($dict['title']);
 
     ksort($dict);
     return md5(serialize($dict)).'S';
   }
 
   public static function newFromDictionary(array $dict) {
     $obj = new DivinerAtomRef();
     $obj->setBook(idx($dict, 'book'));
     $obj->setContext(idx($dict, 'context'));
     $obj->setType(idx($dict, 'type'));
     $obj->setName(idx($dict, 'name'));
     $obj->group = idx($dict, 'group');
     $obj->index = idx($dict, 'index');
     $obj->summary = idx($dict, 'summary');
     $obj->title = idx($dict, 'title');
 
     return $obj;
   }
 
   public static function normalizeString($str) {
     // These characters create problems on the filesystem or in URIs. Replace
     // them with non-problematic appoximations (instead of simply removing them)
     // to keep the URIs fairly useful and avoid unnecessary collisions. These
     // approximations are selected based on some domain knowledge of common
     // languages: where a character is used as a delimiter, it is more helpful
     // to replace it with a "." or a ":" or similar, while it's better if
     // operator overloads read as, e.g., "operator_div".
 
     $map = array(
       // Hopefully not used anywhere by anything.
       '#'   => '.',
 
       // Used in Ruby methods.
       '?'   => 'Q',
 
       // Used in PHP namespaces.
       '\\'  => '.',
 
       // Used in "operator +" in C++.
       '+'   => 'plus',
 
       // Used in "operator %" in C++.
       '%'   => 'mod',
 
       // Used in "operator /" in C++.
       '/'   => 'div',
     );
     $str = str_replace(array_keys($map), array_values($map), $str);
 
     // Replace all spaces with underscores.
     $str = preg_replace('/ +/', '_', $str);
 
     // Replace control characters with "X".
     $str = preg_replace('/[\x00-\x19]/', 'X', $str);
 
     // Replace specific problematic names with alternative names.
     $alternates = array(
       '.'   => 'dot',
       '..'  => 'dotdot',
       ''    => 'null',
     );
 
     return idx($alternates, $str, $str);
   }
 
   public static function normalizeTitleString($str) {
     // Remove colons from titles. This is mostly to accommodate legacy rules
     // from the old Diviner, which generated a significant number of article
     // URIs without colons present in the titles.
     $str = str_replace(':', '', $str);
     $str = self::normalizeString($str);
     return phutil_utf8_strtolower($str);
   }
 
 }
diff --git a/src/applications/diviner/workflow/DivinerWorkflow.php b/src/applications/diviner/workflow/DivinerWorkflow.php
index e0efa46d9a..896aa63e8d 100644
--- a/src/applications/diviner/workflow/DivinerWorkflow.php
+++ b/src/applications/diviner/workflow/DivinerWorkflow.php
@@ -1,76 +1,76 @@
 <?php
 
 abstract class DivinerWorkflow extends PhabricatorManagementWorkflow {
 
   private $config;
   private $bookConfigPath;
 
   public function getBookConfigPath() {
     return $this->bookConfigPath;
   }
 
   protected function getConfig($key, $default = null) {
     return idx($this->config, $key, $default);
   }
 
   protected function getAllConfig() {
     return $this->config;
   }
 
   protected function readBookConfiguration($book_path) {
     if ($book_path === null) {
       throw new PhutilArgumentUsageException(
         "Specify a Diviner book configuration file with --book.");
     }
 
     $book_data = Filesystem::readFile($book_path);
     $book = json_decode($book_data, true);
     if (!is_array($book)) {
       throw new PhutilArgumentUsageException(
         "Book configuration '{$book_path}' is not in JSON format.");
     }
 
     PhutilTypeSpec::checkMap(
       $book,
       array(
         'name' => 'string',
         'title' => 'optional string',
         'short' => 'optional string',
         'preface' => 'optional string',
         'root' => 'optional string',
         'uri.source' => 'optional string',
         'rules' => 'optional map<regex, string>',
         'exclude' => 'optional regex|list<regex>',
         'groups' => 'optional map<string, map<string, wild>>',
       ));
 
     // If the book specifies a "root", resolve it; otherwise, use the directory
     // the book configuration file lives in.
     $full_path = dirname(Filesystem::resolvePath($book_path));
     if (empty($book['root'])) {
       $book['root'] = '.';
     }
     $book['root'] = Filesystem::resolvePath($book['root'], $full_path);
 
-    if (!preg_match('/^[a-z][a-z-]*$/', $book['name'])) {
+    if (!preg_match('/^[a-z][a-z-]*\z/', $book['name'])) {
       $name = $book['name'];
       throw new PhutilArgumentUsageException(
         "Book configuration '{$book_path}' has name '{$name}', but book names ".
         "must include only lowercase letters and hyphens.");
     }
 
     foreach (idx($book, 'groups', array()) as $group) {
       PhutilTypeSpec::checkmap(
         $group,
         array(
           'name' => 'string',
           'include' => 'optional regex|list<regex>',
         ));
 
     }
 
     $this->bookConfigPath = $book_path;
     $this->config = $book;
   }
 
 }
diff --git a/src/applications/files/engine/PhabricatorLocalDiskFileStorageEngine.php b/src/applications/files/engine/PhabricatorLocalDiskFileStorageEngine.php
index be43e887bc..3f6d7d0f88 100644
--- a/src/applications/files/engine/PhabricatorLocalDiskFileStorageEngine.php
+++ b/src/applications/files/engine/PhabricatorLocalDiskFileStorageEngine.php
@@ -1,124 +1,124 @@
 <?php
 
 /**
  * Local disk storage engine. Keeps files on local disk. This engine is easy
  * to set up, but it doesn't work if you have multiple web frontends!
  *
  * @task impl     Implementation
  * @task internal Internals
  * @group filestorage
  */
 final class PhabricatorLocalDiskFileStorageEngine
   extends PhabricatorFileStorageEngine {
 
 
 /* -(  Implementation  )----------------------------------------------------- */
 
 
   /**
    * This engine identifies as "local-disk".
    * @task impl
    */
   public function getEngineIdentifier() {
     return 'local-disk';
   }
 
 
   /**
    * Write the file data to local disk. Returns the relative path as the
    * file data handle.
    * @task impl
    */
   public function writeFile($data, array $params) {
 
     $root = $this->getLocalDiskFileStorageRoot();
 
     // Generate a random, unique file path like "ab/29/1f918a9ac39201ff". We
     // put a couple of subdirectories up front to avoid a situation where we
     // have one directory with a zillion files in it, since this is generally
     // bad news.
     do {
       $name = md5(mt_rand());
       $name = preg_replace('/^(..)(..)(.*)$/', '\\1/\\2/\\3', $name);
       if (!Filesystem::pathExists($root.'/'.$name)) {
         break;
       }
     } while (true);
 
     $parent = $root.'/'.dirname($name);
     if (!Filesystem::pathExists($parent)) {
       execx('mkdir -p %s', $parent);
     }
 
     AphrontWriteGuard::willWrite();
     Filesystem::writeFile($root.'/'.$name, $data);
 
     return $name;
   }
 
 
   /**
    * Read the file data off local disk.
    * @task impl
    */
   public function readFile($handle) {
     $path = $this->getLocalDiskFileStorageFullPath($handle);
     return Filesystem::readFile($path);
   }
 
 
   /**
    * Deletes the file from local disk, if it exists.
    * @task impl
    */
   public function deleteFile($handle) {
     $path = $this->getLocalDiskFileStorageFullPath($handle);
     if (Filesystem::pathExists($path)) {
       AphrontWriteGuard::willWrite();
       Filesystem::remove($path);
     }
   }
 
 
 /* -(  Internals  )---------------------------------------------------------- */
 
 
   /**
    * Get the configured local disk path for file storage.
    *
    * @return string Absolute path to somewhere that files can be stored.
    * @task internal
    */
   private function getLocalDiskFileStorageRoot() {
     $root = PhabricatorEnv::getEnvConfig('storage.local-disk.path');
 
     if (!$root || $root == '/' || $root[0] != '/') {
       throw new PhabricatorFileStorageConfigurationException(
         "Malformed local disk storage root. You must provide an absolute ".
         "path, and can not use '/' as the root.");
     }
 
     return rtrim($root, '/');
   }
 
 
   /**
    * Convert a handle into an absolute local disk path.
    *
    * @param string File data handle.
    * @return string Absolute path to the corresponding file.
    * @task internal
    */
   private function getLocalDiskFileStorageFullPath($handle) {
     // Make sure there's no funny business going on here. Users normally have
     // no ability to affect the content of handles, but double-check that
     // we're only accessing local storage just in case.
-    if (!preg_match('@^[a-f0-9]{2}/[a-f0-9]{2}/[a-f0-9]{28}$@', $handle)) {
+    if (!preg_match('@^[a-f0-9]{2}/[a-f0-9]{2}/[a-f0-9]{28}\z@', $handle)) {
       throw new Exception(
         "Local disk filesystem handle '{$handle}' is malformed!");
     }
     $root = $this->getLocalDiskFileStorageRoot();
     return $root.'/'.$handle;
   }
 
 }
diff --git a/src/applications/macro/controller/PhabricatorMacroEditController.php b/src/applications/macro/controller/PhabricatorMacroEditController.php
index 667170def8..390fd75807 100644
--- a/src/applications/macro/controller/PhabricatorMacroEditController.php
+++ b/src/applications/macro/controller/PhabricatorMacroEditController.php
@@ -1,266 +1,266 @@
 <?php
 
 final class PhabricatorMacroEditController
   extends PhabricatorMacroController {
 
   private $id;
 
   public function willProcessRequest(array $data) {
     $this->id = idx($data, 'id');
   }
 
   public function processRequest() {
 
     $this->requireApplicationCapability(
       PhabricatorMacroCapabilityManage::CAPABILITY);
 
     $request = $this->getRequest();
     $user = $request->getUser();
 
     if ($this->id) {
       $macro = id(new PhabricatorMacroQuery())
         ->setViewer($user)
         ->withIDs(array($this->id))
         ->executeOne();
       if (!$macro) {
         return new Aphront404Response();
       }
     } else {
       $macro = new PhabricatorFileImageMacro();
       $macro->setAuthorPHID($user->getPHID());
     }
 
     $errors = array();
     $e_name = true;
     $e_file = null;
     $file = null;
     $can_fetch = PhabricatorEnv::getEnvConfig('security.allow-outbound-http');
 
     if ($request->isFormPost()) {
       $original = clone $macro;
 
       $new_name = null;
       if ($request->getBool('name_form') || !$macro->getID()) {
         $new_name = $request->getStr('name');
 
         $macro->setName($new_name);
 
         if (!strlen($macro->getName())) {
           $errors[] = pht('Macro name is required.');
           $e_name = pht('Required');
-        } else if (!preg_match('/^[a-z0-9:_-]{3,}$/', $macro->getName())) {
+        } else if (!preg_match('/^[a-z0-9:_-]{3,}\z/', $macro->getName())) {
           $errors[] = pht(
             'Macro must be at least three characters long and contain only '.
             'lowercase letters, digits, hyphens, colons and underscores.');
           $e_name = pht('Invalid');
         } else {
           $e_name = null;
         }
       }
 
       $file = null;
       if ($request->getFileExists('file')) {
         $file = PhabricatorFile::newFromPHPUpload(
           $_FILES['file'],
           array(
             'name' => $request->getStr('name'),
             'authorPHID' => $user->getPHID(),
             'isExplicitUpload' => true,
           ));
       } else if ($request->getStr('url')) {
         try {
           $file = PhabricatorFile::newFromFileDownload(
             $request->getStr('url'),
             array(
               'name' => $request->getStr('name'),
               'authorPHID' => $user->getPHID(),
               'isExplicitUpload' => true,
             ));
         } catch (Exception $ex) {
           $errors[] = pht('Could not fetch URL: %s', $ex->getMessage());
         }
       } else if ($request->getStr('phid')) {
         $file = id(new PhabricatorFileQuery())
           ->setViewer($user)
           ->withPHIDs(array($request->getStr('phid')))
           ->executeOne();
       }
 
       if ($file) {
         if (!$file->isViewableInBrowser()) {
           $errors[] = pht('You must upload an image.');
           $e_file = pht('Invalid');
         } else {
           $macro->setFilePHID($file->getPHID());
           $macro->attachFile($file);
           $e_file = null;
         }
       }
 
       if (!$macro->getID() && !$file) {
         $errors[] = pht('You must upload an image to create a macro.');
         $e_file = pht('Required');
       }
 
       if (!$errors) {
         try {
           $xactions = array();
 
           if ($new_name !== null) {
             $xactions[] = id(new PhabricatorMacroTransaction())
               ->setTransactionType(PhabricatorMacroTransactionType::TYPE_NAME)
               ->setNewValue($new_name);
           }
 
           if ($file) {
             $xactions[] = id(new PhabricatorMacroTransaction())
               ->setTransactionType(PhabricatorMacroTransactionType::TYPE_FILE)
               ->setNewValue($file->getPHID());
           }
 
           $editor = id(new PhabricatorMacroEditor())
             ->setActor($user)
             ->setContinueOnNoEffect(true)
             ->setContentSourceFromRequest($request);
 
           $xactions = $editor->applyTransactions($original, $xactions);
 
           $view_uri = $this->getApplicationURI('/view/'.$original->getID().'/');
           return id(new AphrontRedirectResponse())->setURI($view_uri);
         } catch (AphrontQueryDuplicateKeyException $ex) {
           throw $ex;
           $errors[] = pht('Macro name is not unique!');
           $e_name = pht('Duplicate');
         }
       }
     }
 
     $current_file = null;
     if ($macro->getFilePHID()) {
       $current_file = $macro->getFile();
     }
 
     $form = new AphrontFormView();
     $form->addHiddenInput('name_form', 1);
     $form->setUser($request->getUser());
 
     $form
       ->setEncType('multipart/form-data')
       ->appendChild(
         id(new AphrontFormTextControl())
           ->setLabel(pht('Name'))
           ->setName('name')
           ->setValue($macro->getName())
           ->setCaption(
             pht('This word or phrase will be replaced with the image.'))
           ->setError($e_name));
 
     if (!$macro->getID()) {
       if ($current_file) {
         $current_file_view = id(new PhabricatorFileLinkView())
           ->setFilePHID($current_file->getPHID())
           ->setFileName($current_file->getName())
           ->setFileViewable(true)
           ->setFileViewURI($current_file->getBestURI())
           ->render();
         $form->addHiddenInput('phid', $current_file->getPHID());
         $form->appendChild(
           id(new AphrontFormMarkupControl())
             ->setLabel(pht('Selected File'))
             ->setValue($current_file_view));
 
         $other_label = pht('Change File');
       } else {
         $other_label = pht('File');
       }
 
       if ($can_fetch) {
         $form->appendChild(
           id(new AphrontFormTextControl())
             ->setLabel(pht('URL'))
             ->setName('url')
             ->setValue($request->getStr('url'))
             ->setError($request->getFileExists('file') ? false : $e_file));
       }
 
       $form->appendChild(
         id(new AphrontFormFileControl())
           ->setLabel($other_label)
           ->setName('file')
           ->setError($request->getStr('url') ? false : $e_file));
     }
 
 
     $view_uri = $this->getApplicationURI('/view/'.$macro->getID().'/');
 
     if ($macro->getID()) {
       $cancel_uri = $view_uri;
     } else {
       $cancel_uri = $this->getApplicationURI();
     }
 
     $form
       ->appendChild(
         id(new AphrontFormSubmitControl())
           ->setValue(pht('Save Image Macro'))
           ->addCancelButton($cancel_uri));
 
     $crumbs = $this->buildApplicationCrumbs();
 
     if ($macro->getID()) {
       $title = pht('Edit Image Macro');
       $crumb = pht('Edit Macro');
 
       $crumbs->addTextCrumb(pht('Macro "%s"', $macro->getName()), $view_uri);
     } else {
       $title = pht('Create Image Macro');
       $crumb = pht('Create Macro');
     }
 
     $crumbs->addTextCrumb($crumb, $request->getRequestURI());
 
     $upload = null;
     if ($macro->getID()) {
       $upload_form = id(new AphrontFormView())
         ->setEncType('multipart/form-data')
         ->setUser($request->getUser());
 
       if ($can_fetch) {
         $upload_form->appendChild(
           id(new AphrontFormTextControl())
             ->setLabel(pht('URL'))
             ->setName('url')
             ->setValue($request->getStr('url')));
       }
 
       $upload_form
         ->appendChild(
           id(new AphrontFormFileControl())
             ->setLabel(pht('File'))
             ->setName('file'))
         ->appendChild(
           id(new AphrontFormSubmitControl())
             ->setValue(pht('Upload File')));
 
       $upload = id(new PHUIObjectBoxView())
         ->setHeaderText(pht('Upload New File'))
         ->setForm($upload_form);
     }
 
     $form_box = id(new PHUIObjectBoxView())
       ->setHeaderText($title)
       ->setFormErrors($errors)
       ->setForm($form);
 
     return $this->buildApplicationPage(
       array(
         $crumbs,
         $form_box,
         $upload,
       ),
       array(
         'title' => $title,
         'device' => true,
       ));
   }
 }
diff --git a/src/applications/people/storage/PhabricatorUser.php b/src/applications/people/storage/PhabricatorUser.php
index b019c20ac3..5f039c4bca 100644
--- a/src/applications/people/storage/PhabricatorUser.php
+++ b/src/applications/people/storage/PhabricatorUser.php
@@ -1,766 +1,766 @@
 <?php
 
 final class PhabricatorUser
   extends PhabricatorUserDAO
   implements
     PhutilPerson,
     PhabricatorPolicyInterface,
     PhabricatorCustomFieldInterface {
 
   const SESSION_TABLE = 'phabricator_session';
   const NAMETOKEN_TABLE = 'user_nametoken';
   const MAXIMUM_USERNAME_LENGTH = 64;
 
   protected $userName;
   protected $realName;
   protected $sex;
   protected $translation;
   protected $passwordSalt;
   protected $passwordHash;
   protected $profileImagePHID;
   protected $timezoneIdentifier = '';
 
   protected $consoleEnabled = 0;
   protected $consoleVisible = 0;
   protected $consoleTab = '';
 
   protected $conduitCertificate;
 
   protected $isSystemAgent = 0;
   protected $isAdmin = 0;
   protected $isDisabled = 0;
   protected $isEmailVerified = 0;
   protected $isApproved = 0;
 
   private $profileImage = null;
   private $profile = null;
   private $status = self::ATTACHABLE;
   private $preferences = null;
   private $omnipotent = false;
   private $customFields = self::ATTACHABLE;
 
   private $alternateCSRFString = self::ATTACHABLE;
 
   protected function readField($field) {
     switch ($field) {
       case 'timezoneIdentifier':
         // If the user hasn't set one, guess the server's time.
         return nonempty(
           $this->timezoneIdentifier,
           date_default_timezone_get());
       // Make sure these return booleans.
       case 'isAdmin':
         return (bool)$this->isAdmin;
       case 'isDisabled':
         return (bool)$this->isDisabled;
       case 'isSystemAgent':
         return (bool)$this->isSystemAgent;
       case 'isEmailVerified':
         return (bool)$this->isEmailVerified;
       case 'isApproved':
         return (bool)$this->isApproved;
       default:
         return parent::readField($field);
     }
   }
 
 
   /**
    * Is this a live account which has passed required approvals? Returns true
    * if this is an enabled, verified (if required), approved (if required)
    * account, and false otherwise.
    *
    * @return bool True if this is a standard, usable account.
    */
   public function isUserActivated() {
     if ($this->getIsDisabled()) {
       return false;
     }
 
     if (!$this->getIsApproved()) {
       return false;
     }
 
     if (PhabricatorUserEmail::isEmailVerificationRequired()) {
       if (!$this->getIsEmailVerified()) {
         return false;
       }
     }
 
     return true;
   }
 
   public function getConfiguration() {
     return array(
       self::CONFIG_AUX_PHID => true,
       self::CONFIG_PARTIAL_OBJECTS => true,
     ) + parent::getConfiguration();
   }
 
   public function generatePHID() {
     return PhabricatorPHID::generateNewPHID(
       PhabricatorPeoplePHIDTypeUser::TYPECONST);
   }
 
   public function setPassword(PhutilOpaqueEnvelope $envelope) {
     if (!$this->getPHID()) {
       throw new Exception(
         "You can not set a password for an unsaved user because their PHID ".
         "is a salt component in the password hash.");
     }
 
     if (!strlen($envelope->openEnvelope())) {
       $this->setPasswordHash('');
     } else {
       $this->setPasswordSalt(md5(Filesystem::readRandomBytes(32)));
       $hash = $this->hashPassword($envelope);
       $this->setPasswordHash($hash->openEnvelope());
     }
     return $this;
   }
 
   // To satisfy PhutilPerson.
   public function getSex() {
     return $this->sex;
   }
 
   public function getTranslation() {
     try {
       if ($this->translation &&
           class_exists($this->translation) &&
           is_subclass_of($this->translation, 'PhabricatorTranslation')) {
         return $this->translation;
       }
     } catch (PhutilMissingSymbolException $ex) {
       return null;
     }
     return null;
   }
 
   public function isLoggedIn() {
     return !($this->getPHID() === null);
   }
 
   public function save() {
     if (!$this->getConduitCertificate()) {
       $this->setConduitCertificate($this->generateConduitCertificate());
     }
     $result = parent::save();
 
     if ($this->profile) {
       $this->profile->save();
     }
 
     $this->updateNameTokens();
 
     id(new PhabricatorSearchIndexer())
       ->queueDocumentForIndexing($this->getPHID());
 
     return $result;
   }
 
   private function generateConduitCertificate() {
     return Filesystem::readRandomCharacters(255);
   }
 
   public function comparePassword(PhutilOpaqueEnvelope $envelope) {
     if (!strlen($envelope->openEnvelope())) {
       return false;
     }
     if (!strlen($this->getPasswordHash())) {
       return false;
     }
 
     return PhabricatorPasswordHasher::comparePassword(
       $this->getPasswordHashInput($envelope),
       new PhutilOpaqueEnvelope($this->getPasswordHash()));
   }
 
   private function getPasswordHashInput(PhutilOpaqueEnvelope $password) {
     $input =
       $this->getUsername().
       $password->openEnvelope().
       $this->getPHID().
       $this->getPasswordSalt();
 
     return new PhutilOpaqueEnvelope($input);
   }
 
   private function hashPassword(PhutilOpaqueEnvelope $password) {
     $hasher = PhabricatorPasswordHasher::getBestHasher();
 
     $input_envelope = $this->getPasswordHashInput($password);
     return $hasher->getPasswordHashForStorage($input_envelope);
   }
 
   const CSRF_CYCLE_FREQUENCY  = 3600;
   const CSRF_SALT_LENGTH      = 8;
   const CSRF_TOKEN_LENGTH     = 16;
   const CSRF_BREACH_PREFIX    = 'B@';
 
   const EMAIL_CYCLE_FREQUENCY = 86400;
   const EMAIL_TOKEN_LENGTH    = 24;
 
   private function getRawCSRFToken($offset = 0) {
     return $this->generateToken(
       time() + (self::CSRF_CYCLE_FREQUENCY * $offset),
       self::CSRF_CYCLE_FREQUENCY,
       PhabricatorEnv::getEnvConfig('phabricator.csrf-key'),
       self::CSRF_TOKEN_LENGTH);
   }
 
   /**
    * @phutil-external-symbol class PhabricatorStartup
    */
   public function getCSRFToken() {
     $salt = PhabricatorStartup::getGlobal('csrf.salt');
     if (!$salt) {
       $salt = Filesystem::readRandomCharacters(self::CSRF_SALT_LENGTH);
       PhabricatorStartup::setGlobal('csrf.salt', $salt);
     }
 
     // Generate a token hash to mitigate BREACH attacks against SSL. See
     // discussion in T3684.
     $token = $this->getRawCSRFToken();
     $hash = PhabricatorHash::digest($token, $salt);
     return 'B@'.$salt.substr($hash, 0, self::CSRF_TOKEN_LENGTH);
   }
 
   public function validateCSRFToken($token) {
     $salt = null;
     $version = 'plain';
 
     // This is a BREACH-mitigating token. See T3684.
     $breach_prefix = self::CSRF_BREACH_PREFIX;
     $breach_prelen = strlen($breach_prefix);
 
     if (!strncmp($token, $breach_prefix, $breach_prelen)) {
       $version = 'breach';
       $salt = substr($token, $breach_prelen, self::CSRF_SALT_LENGTH);
       $token = substr($token, $breach_prelen + self::CSRF_SALT_LENGTH);
     }
 
     // When the user posts a form, we check that it contains a valid CSRF token.
     // Tokens cycle each hour (every CSRF_CYLCE_FREQUENCY seconds) and we accept
     // either the current token, the next token (users can submit a "future"
     // token if you have two web frontends that have some clock skew) or any of
     // the last 6 tokens. This means that pages are valid for up to 7 hours.
     // There is also some Javascript which periodically refreshes the CSRF
     // tokens on each page, so theoretically pages should be valid indefinitely.
     // However, this code may fail to run (if the user loses their internet
     // connection, or there's a JS problem, or they don't have JS enabled).
     // Choosing the size of the window in which we accept old CSRF tokens is
     // an issue of balancing concerns between security and usability. We could
     // choose a very narrow (e.g., 1-hour) window to reduce vulnerability to
     // attacks using captured CSRF tokens, but it's also more likely that real
     // users will be affected by this, e.g. if they close their laptop for an
     // hour, open it back up, and try to submit a form before the CSRF refresh
     // can kick in. Since the user experience of submitting a form with expired
     // CSRF is often quite bad (you basically lose data, or it's a big pain to
     // recover at least) and I believe we gain little additional protection
     // by keeping the window very short (the overwhelming value here is in
     // preventing blind attacks, and most attacks which can capture CSRF tokens
     // can also just capture authentication information [sniffing networks]
     // or act as the user [xss]) the 7 hour default seems like a reasonable
     // balance. Other major platforms have much longer CSRF token lifetimes,
     // like Rails (session duration) and Django (forever), which suggests this
     // is a reasonable analysis.
     $csrf_window = 6;
 
     for ($ii = -$csrf_window; $ii <= 1; $ii++) {
       $valid = $this->getRawCSRFToken($ii);
       switch ($version) {
         // TODO: We can remove this after the BREACH version has been in the
         // wild for a while.
         case 'plain':
           if ($token == $valid) {
             return true;
           }
           break;
         case 'breach':
           $digest = PhabricatorHash::digest($valid, $salt);
           if (substr($digest, 0, self::CSRF_TOKEN_LENGTH) == $token) {
             return true;
           }
           break;
         default:
           throw new Exception("Unknown CSRF token format!");
       }
     }
 
     return false;
   }
 
   private function generateToken($epoch, $frequency, $key, $len) {
     if ($this->getPHID()) {
       $vec = $this->getPHID().$this->getPasswordHash();
     } else {
       $vec = $this->getAlternateCSRFString();
     }
 
     $time_block = floor($epoch / $frequency);
     $vec = $vec.$key.$time_block;
 
     return substr(PhabricatorHash::digest($vec), 0, $len);
   }
 
   private function generateEmailToken(
     PhabricatorUserEmail $email,
     $offset = 0) {
 
     $key = implode(
       '-',
       array(
         PhabricatorEnv::getEnvConfig('phabricator.csrf-key'),
         $this->getPHID(),
         $email->getVerificationCode(),
       ));
 
     return $this->generateToken(
       time() + ($offset * self::EMAIL_CYCLE_FREQUENCY),
       self::EMAIL_CYCLE_FREQUENCY,
       $key,
       self::EMAIL_TOKEN_LENGTH);
   }
 
   public function validateEmailToken(
     PhabricatorUserEmail $email,
     $token) {
     for ($ii = -1; $ii <= 1; $ii++) {
       $valid = $this->generateEmailToken($email, $ii);
       if ($token == $valid) {
         return true;
       }
     }
     return false;
   }
 
   public function getEmailLoginURI(PhabricatorUserEmail $email = null) {
     if (!$email) {
       $email = $this->loadPrimaryEmail();
       if (!$email) {
         throw new Exception("User has no primary email!");
       }
     }
     $token = $this->generateEmailToken($email);
 
     $uri = '/login/etoken/'.$token.'/';
     try {
       $uri = PhabricatorEnv::getProductionURI($uri);
     } catch (Exception $ex) {
       // If a user runs `bin/auth recover` before configuring the base URI,
       // just show the path. We don't have any way to figure out the domain.
       // See T4132.
     }
 
     $uri = new PhutilURI($uri);
 
     return $uri->alter('email', $email->getAddress());
   }
 
   public function attachUserProfile(PhabricatorUserProfile $profile) {
     $this->profile = $profile;
     return $this;
   }
 
   public function loadUserProfile() {
     if ($this->profile) {
       return $this->profile;
     }
 
     $profile_dao = new PhabricatorUserProfile();
     $this->profile = $profile_dao->loadOneWhere('userPHID = %s',
       $this->getPHID());
 
     if (!$this->profile) {
       $profile_dao->setUserPHID($this->getPHID());
       $this->profile = $profile_dao;
     }
 
     return $this->profile;
   }
 
   public function loadPrimaryEmailAddress() {
     $email = $this->loadPrimaryEmail();
     if (!$email) {
       throw new Exception("User has no primary email address!");
     }
     return $email->getAddress();
   }
 
   public function loadPrimaryEmail() {
     return $this->loadOneRelative(
       new PhabricatorUserEmail(),
       'userPHID',
       'getPHID',
       '(isPrimary = 1)');
   }
 
   public function loadPreferences() {
     if ($this->preferences) {
       return $this->preferences;
     }
 
     $preferences = null;
     if ($this->getPHID()) {
       $preferences = id(new PhabricatorUserPreferences())->loadOneWhere(
         'userPHID = %s',
         $this->getPHID());
     }
 
     if (!$preferences) {
       $preferences = new PhabricatorUserPreferences();
       $preferences->setUserPHID($this->getPHID());
 
       $default_dict = array(
         PhabricatorUserPreferences::PREFERENCE_TITLES => 'glyph',
         PhabricatorUserPreferences::PREFERENCE_EDITOR => '',
         PhabricatorUserPreferences::PREFERENCE_MONOSPACED => '',
         PhabricatorUserPreferences::PREFERENCE_DARK_CONSOLE => 0);
 
       $preferences->setPreferences($default_dict);
     }
 
     $this->preferences = $preferences;
     return $preferences;
   }
 
   public function loadEditorLink($path, $line, $callsign) {
     $editor = $this->loadPreferences()->getPreference(
       PhabricatorUserPreferences::PREFERENCE_EDITOR);
 
     if (is_array($path)) {
       $multiedit = $this->loadPreferences()->getPreference(
         PhabricatorUserPreferences::PREFERENCE_MULTIEDIT);
       switch ($multiedit) {
         case '':
           $path = implode(' ', $path);
           break;
         case 'disable':
           return null;
       }
     }
 
     if ($editor) {
       return strtr($editor, array(
         '%%' => '%',
         '%f' => phutil_escape_uri($path),
         '%l' => phutil_escape_uri($line),
         '%r' => phutil_escape_uri($callsign),
       ));
     }
   }
 
   public function getAlternateCSRFString() {
     return $this->assertAttached($this->alternateCSRFString);
   }
 
   public function attachAlternateCSRFString($string) {
     $this->alternateCSRFString = $string;
     return $this;
   }
 
   private static function tokenizeName($name) {
     if (function_exists('mb_strtolower')) {
       $name = mb_strtolower($name, 'UTF-8');
     } else {
       $name = strtolower($name);
     }
     $name = trim($name);
     if (!strlen($name)) {
       return array();
     }
     return preg_split('/\s+/', $name);
   }
 
   /**
    * Populate the nametoken table, which used to fetch typeahead results. When
    * a user types "linc", we want to match "Abraham Lincoln" from on-demand
    * typeahead sources. To do this, we need a separate table of name fragments.
    */
   public function updateNameTokens() {
     $tokens = array_merge(
       self::tokenizeName($this->getRealName()),
       self::tokenizeName($this->getUserName()));
     $tokens = array_unique($tokens);
     $table  = self::NAMETOKEN_TABLE;
     $conn_w = $this->establishConnection('w');
 
     $sql = array();
     foreach ($tokens as $token) {
       $sql[] = qsprintf(
         $conn_w,
         '(%d, %s)',
         $this->getID(),
         $token);
     }
 
     queryfx(
       $conn_w,
       'DELETE FROM %T WHERE userID = %d',
       $table,
       $this->getID());
     if ($sql) {
       queryfx(
         $conn_w,
         'INSERT INTO %T (userID, token) VALUES %Q',
         $table,
         implode(', ', $sql));
     }
   }
 
   public function sendWelcomeEmail(PhabricatorUser $admin) {
     $admin_username = $admin->getUserName();
     $admin_realname = $admin->getRealName();
     $user_username = $this->getUserName();
     $is_serious = PhabricatorEnv::getEnvConfig('phabricator.serious-business');
 
     $base_uri = PhabricatorEnv::getProductionURI('/');
 
     $uri = $this->getEmailLoginURI();
     $body = <<<EOBODY
 Welcome to Phabricator!
 
 {$admin_username} ({$admin_realname}) has created an account for you.
 
   Username: {$user_username}
 
 To login to Phabricator, follow this link and set a password:
 
   {$uri}
 
 After you have set a password, you can login in the future by going here:
 
   {$base_uri}
 
 EOBODY;
 
     if (!$is_serious) {
       $body .= <<<EOBODY
 
 Love,
 Phabricator
 
 EOBODY;
     }
 
     $mail = id(new PhabricatorMetaMTAMail())
       ->addTos(array($this->getPHID()))
       ->setSubject('[Phabricator] Welcome to Phabricator')
       ->setBody($body)
       ->saveAndSend();
   }
 
   public function sendUsernameChangeEmail(
     PhabricatorUser $admin,
     $old_username) {
 
     $admin_username = $admin->getUserName();
     $admin_realname = $admin->getRealName();
     $new_username = $this->getUserName();
 
     $password_instructions = null;
     if (PhabricatorAuthProviderPassword::getPasswordProvider()) {
       $uri = $this->getEmailLoginURI();
       $password_instructions = <<<EOTXT
 If you use a password to login, you'll need to reset it before you can login
 again. You can reset your password by following this link:
 
   {$uri}
 
 And, of course, you'll need to use your new username to login from now on. If
 you use OAuth to login, nothing should change.
 
 EOTXT;
     }
 
     $body = <<<EOBODY
 {$admin_username} ({$admin_realname}) has changed your Phabricator username.
 
   Old Username: {$old_username}
   New Username: {$new_username}
 
 {$password_instructions}
 EOBODY;
 
     $mail = id(new PhabricatorMetaMTAMail())
       ->addTos(array($this->getPHID()))
       ->setSubject('[Phabricator] Username Changed')
       ->setBody($body)
       ->saveAndSend();
   }
 
   public static function describeValidUsername() {
     return pht(
       'Usernames must contain only numbers, letters, period, underscore and '.
       'hyphen, and can not end with a period. They must have no more than %d '.
       'characters.',
       new PhutilNumber(self::MAXIMUM_USERNAME_LENGTH));
   }
 
   public static function validateUsername($username) {
     // NOTE: If you update this, make sure to update:
     //
     //  - Remarkup rule for @mentions.
     //  - Routing rule for "/p/username/".
     //  - Unit tests, obviously.
     //  - describeValidUsername() method, above.
 
     if (strlen($username) > self::MAXIMUM_USERNAME_LENGTH) {
       return false;
     }
 
-    return (bool)preg_match('/^[a-zA-Z0-9._-]*[a-zA-Z0-9_-]$/', $username);
+    return (bool)preg_match('/^[a-zA-Z0-9._-]*[a-zA-Z0-9_-]\z/', $username);
   }
 
   public static function getDefaultProfileImageURI() {
     return celerity_get_resource_uri('/rsrc/image/avatar.png');
   }
 
   public function attachStatus(PhabricatorCalendarEvent $status) {
     $this->status = $status;
     return $this;
   }
 
   public function getStatus() {
     return $this->assertAttached($this->status);
   }
 
   public function hasStatus() {
     return $this->status !== self::ATTACHABLE;
   }
 
   public function attachProfileImageURI($uri) {
     $this->profileImage = $uri;
     return $this;
   }
 
   public function loadProfileImageURI() {
     if ($this->profileImage) {
       return $this->profileImage;
     }
 
     $src_phid = $this->getProfileImagePHID();
 
     if ($src_phid) {
       // TODO: (T603) Can we get rid of this entirely and move it to
       // PeopleQuery with attach/attachable?
       $file = id(new PhabricatorFile())->loadOneWhere('phid = %s', $src_phid);
       if ($file) {
         $this->profileImage = $file->getBestURI();
       }
     }
 
     if (!$this->profileImage) {
       $this->profileImage = self::getDefaultProfileImageURI();
     }
 
     return $this->profileImage;
   }
 
   public function getFullName() {
     return $this->getUsername().' ('.$this->getRealName().')';
   }
 
   public function __toString() {
     return $this->getUsername();
   }
 
   public static function loadOneWithEmailAddress($address) {
     $email = id(new PhabricatorUserEmail())->loadOneWhere(
       'address = %s',
       $address);
     if (!$email) {
       return null;
     }
     return id(new PhabricatorUser())->loadOneWhere(
       'phid = %s',
       $email->getUserPHID());
   }
 
 
 /* -(  Omnipotence  )-------------------------------------------------------- */
 
 
   /**
    * Returns true if this user is omnipotent. Omnipotent users bypass all policy
    * checks.
    *
    * @return bool True if the user bypasses policy checks.
    */
   public function isOmnipotent() {
     return $this->omnipotent;
   }
 
 
   /**
    * Get an omnipotent user object for use in contexts where there is no acting
    * user, notably daemons.
    *
    * @return PhabricatorUser An omnipotent user.
    */
   public static function getOmnipotentUser() {
     static $user = null;
     if (!$user) {
       $user = new PhabricatorUser();
       $user->omnipotent = true;
       $user->makeEphemeral();
     }
     return $user;
   }
 
 
 /* -(  PhabricatorPolicyInterface  )----------------------------------------- */
 
 
   public function getCapabilities() {
     return array(
       PhabricatorPolicyCapability::CAN_VIEW,
       PhabricatorPolicyCapability::CAN_EDIT,
     );
   }
 
   public function getPolicy($capability) {
     switch ($capability) {
       case PhabricatorPolicyCapability::CAN_VIEW:
         return PhabricatorPolicies::POLICY_PUBLIC;
       case PhabricatorPolicyCapability::CAN_EDIT:
         return PhabricatorPolicies::POLICY_NOONE;
     }
   }
 
   public function hasAutomaticCapability($capability, PhabricatorUser $viewer) {
     return $this->getPHID() && ($viewer->getPHID() === $this->getPHID());
   }
 
   public function describeAutomaticCapability($capability) {
     switch ($capability) {
       case PhabricatorPolicyCapability::CAN_EDIT:
         return pht('Only you can edit your information.');
       default:
         return null;
     }
   }
 
 
 /* -(  PhabricatorCustomFieldInterface  )------------------------------------ */
 
 
   public function getCustomFieldSpecificationForRole($role) {
     return PhabricatorEnv::getEnvConfig('user.fields');
   }
 
   public function getCustomFieldBaseClass() {
     return 'PhabricatorUserCustomField';
   }
 
   public function getCustomFields() {
     return $this->assertAttached($this->customFields);
   }
 
   public function attachCustomFields(PhabricatorCustomFieldAttachment $fields) {
     $this->customFields = $fields;
     return $this;
   }
 
 }
diff --git a/src/applications/people/storage/PhabricatorUserEmail.php b/src/applications/people/storage/PhabricatorUserEmail.php
index ec17006b00..85876f27df 100644
--- a/src/applications/people/storage/PhabricatorUserEmail.php
+++ b/src/applications/people/storage/PhabricatorUserEmail.php
@@ -1,245 +1,245 @@
 <?php
 
 /**
  * @task restrictions   Domain Restrictions
  * @task email          Email About Email
  */
 final class PhabricatorUserEmail extends PhabricatorUserDAO {
 
   protected $userPHID;
   protected $address;
   protected $isVerified;
   protected $isPrimary;
   protected $verificationCode;
 
   const MAX_ADDRESS_LENGTH = 128;
 
   public function getVerificationURI() {
     return '/emailverify/'.$this->getVerificationCode().'/';
   }
 
   public function save() {
     if (!$this->verificationCode) {
       $this->setVerificationCode(Filesystem::readRandomCharacters(24));
     }
     return parent::save();
   }
 
 
 /* -(  Domain Restrictions  )------------------------------------------------ */
 
 
   /**
    * @task restrictions
    */
   public static function isValidAddress($address) {
     if (strlen($address) > self::MAX_ADDRESS_LENGTH) {
       return false;
     }
 
     // Very roughly validate that this address isn't so mangled that a
     // reasonable piece of code might completely misparse it. In particular,
     // the major risks are:
     //
     //   - `PhutilEmailAddress` needs to be able to extract the domain portion
     //     from it.
     //   - Reasonable mail adapters should be hard-pressed to interpret one
     //     address as several addresses.
     //
     // To this end, we're roughly verifying that there's some normal text, an
     // "@" symbol, and then some more normal text.
 
-    $email_regex = '(^[a-z0-9_+.!-]+@[a-z0-9_+:.-]+$)i';
+    $email_regex = '(^[a-z0-9_+.!-]+@[a-z0-9_+:.-]+\z)i';
     if (!preg_match($email_regex, $address)) {
       return false;
     }
 
     return true;
   }
 
 
   /**
    * @task restrictions
    */
   public static function describeValidAddresses() {
     return pht(
       "Email addresses should be in the form 'user@domain.com'. The maximum ".
       "length of an email address is %d character(s).",
       new PhutilNumber(self::MAX_ADDRESS_LENGTH));
   }
 
 
   /**
    * @task restrictions
    */
   public static function isAllowedAddress($address) {
     if (!self::isValidAddress($address)) {
       return false;
     }
 
     $allowed_domains = PhabricatorEnv::getEnvConfig('auth.email-domains');
     if (!$allowed_domains) {
       return true;
     }
 
     $addr_obj = new PhutilEmailAddress($address);
 
     $domain = $addr_obj->getDomainName();
     if (!$domain) {
       return false;
     }
 
     return in_array($domain, $allowed_domains);
   }
 
 
   /**
    * @task restrictions
    */
   public static function describeAllowedAddresses() {
     $domains = PhabricatorEnv::getEnvConfig('auth.email-domains');
     if (!$domains) {
       return null;
     }
 
     if (count($domains) == 1) {
       return 'Email address must be @'.head($domains);
     } else {
       return 'Email address must be at one of: '.
         implode(', ', $domains);
     }
   }
 
 
   /**
    * Check if this install requires email verification.
    *
    * @return bool True if email addresses must be verified.
    *
    * @task restrictions
    */
   public static function isEmailVerificationRequired() {
     // NOTE: Configuring required email domains implies required verification.
     return PhabricatorEnv::getEnvConfig('auth.require-email-verification') ||
            PhabricatorEnv::getEnvConfig('auth.email-domains');
   }
 
 
 /* -(  Email About Email  )-------------------------------------------------- */
 
 
   /**
    * Send a verification email from $user to this address.
    *
    * @param PhabricatorUser The user sending the verification.
    * @return this
    * @task email
    */
   public function sendVerificationEmail(PhabricatorUser $user) {
     $username = $user->getUsername();
 
     $address = $this->getAddress();
     $link = PhabricatorEnv::getProductionURI($this->getVerificationURI());
 
 
     $is_serious = PhabricatorEnv::getEnvConfig('phabricator.serious-business');
 
     $signature = null;
     if (!$is_serious) {
       $signature = <<<EOSIGNATURE
 Get Well Soon,
 Phabricator
 EOSIGNATURE;
     }
 
     $body = <<<EOBODY
 Hi {$username},
 
 Please verify that you own this email address ({$address}) by clicking this
 link:
 
   {$link}
 
 {$signature}
 EOBODY;
 
     id(new PhabricatorMetaMTAMail())
       ->addRawTos(array($address))
       ->setSubject('[Phabricator] Email Verification')
       ->setBody($body)
       ->setRelatedPHID($user->getPHID())
       ->saveAndSend();
 
     return $this;
   }
 
 
   /**
    * Send a notification email from $user to this address, informing the
    * recipient that this is no longer their account's primary address.
    *
    * @param PhabricatorUser The user sending the notification.
    * @param PhabricatorUserEmail New primary email address.
    * @return this
    * @task email
    */
   public function sendOldPrimaryEmail(
     PhabricatorUser $user,
     PhabricatorUserEmail $new) {
     $username = $user->getUsername();
 
     $old_address = $this->getAddress();
     $new_address = $new->getAddress();
 
     $body = <<<EOBODY
 Hi {$username},
 
 This email address ({$old_address}) is no longer your primary email address.
 Going forward, Phabricator will send all email to your new primary email
 address ({$new_address}).
 
 EOBODY;
 
     id(new PhabricatorMetaMTAMail())
       ->addRawTos(array($old_address))
       ->setSubject('[Phabricator] Primary Address Changed')
       ->setBody($body)
       ->setFrom($user->getPHID())
       ->setRelatedPHID($user->getPHID())
       ->saveAndSend();
   }
 
 
   /**
    * Send a notification email from $user to this address, informing the
    * recipient that this is now their account's new primary email address.
    *
    * @param PhabricatorUser The user sending the verification.
    * @return this
    * @task email
    */
   public function sendNewPrimaryEmail(PhabricatorUser $user) {
     $username = $user->getUsername();
 
     $new_address = $this->getAddress();
 
     $body = <<<EOBODY
 Hi {$username},
 
 This is now your primary email address ({$new_address}). Going forward,
 Phabricator will send all email here.
 
 EOBODY;
 
     id(new PhabricatorMetaMTAMail())
       ->addRawTos(array($new_address))
       ->setSubject('[Phabricator] Primary Address Changed')
       ->setBody($body)
       ->setFrom($user->getPHID())
       ->setRelatedPHID($user->getPHID())
       ->saveAndSend();
 
     return $this;
   }
 
 }
diff --git a/src/applications/people/storage/__tests__/PhabricatorUserEmailTestCase.php b/src/applications/people/storage/__tests__/PhabricatorUserEmailTestCase.php
index 61c436bdb6..7bb2c4250a 100644
--- a/src/applications/people/storage/__tests__/PhabricatorUserEmailTestCase.php
+++ b/src/applications/people/storage/__tests__/PhabricatorUserEmailTestCase.php
@@ -1,41 +1,48 @@
 <?php
 
 final class PhabricatorUserEmailTestCase extends PhabricatorTestCase {
 
   public function testEmailValidation() {
     $tests = array(
       'alincoln@whitehouse.gov' => true,
       '_-.@.-_' => true,
       '.@.com' => true,
       'user+suffix@gmail.com' => true,
       'IAMIMPORTANT@BUSINESS.COM' => true,
       '1@22.33.44.55' => true,
       '999@999.999' => true,
       'user@2001:0db8:85a3:0042:1000:8a2e:0370:7334' => true,
       '!..!@o.O' => true,
 
       '' => false,
       str_repeat('a', 256).'@example.com' => false,
       'quack' => false,
       '@gmail.com' => false,
       'usergmail.com' => false,
       '"user" user@gmail.com' => false,
       'a,b@evil.com' => false,
       'a;b@evil.com' => false,
       'ab@evil.com;cd@evil.com' => false,
       'x@y@z.com' => false,
       '@@' => false,
       '@' => false,
       'user@' => false,
+
+      "user@domain.com\n" => false,
+      "user@\ndomain.com" => false,
+      "\nuser@domain.com" => false,
+      "user@domain.com\r" => false,
+      "user@\rdomain.com" => false,
+      "\ruser@domain.com" => false,
     );
 
     foreach ($tests as $input => $expect) {
       $actual = PhabricatorUserEmail::isValidAddress($input);
       $this->assertEqual(
         $expect,
         $actual,
         $input);
     }
   }
 
 }
diff --git a/src/applications/people/storage/__tests__/PhabricatorUserTestCase.php b/src/applications/people/storage/__tests__/PhabricatorUserTestCase.php
index 3aebe4fe59..561bcb2d63 100644
--- a/src/applications/people/storage/__tests__/PhabricatorUserTestCase.php
+++ b/src/applications/people/storage/__tests__/PhabricatorUserTestCase.php
@@ -1,49 +1,56 @@
 <?php
 
 final class PhabricatorUserTestCase extends PhabricatorTestCase {
 
   public function testUsernameValidation() {
     $map = array(
       'alincoln'    => true,
       'alincoln69'  => true,
       'hd3'         => true,
       'Alincoln'    => true,
       'a.lincoln'   => true,
 
       'alincoln!'   => false,
       ''            => false,
 
       // These are silly, but permitted.
       '7'           => true,
       '0'           => true,
       '____'        => true,
       '-'           => true,
 
       // These are not permitted because they make capturing @mentions
       // ambiguous.
       'joe.'        => false,
 
       // We can never allow these because they invalidate usernames as tokens
       // in commit messages ("Reviewers: alincoln, usgrant"), or as parameters
       // in URIs ("/p/alincoln/", "?user=alincoln"), or make them unsafe in
       // HTML. Theoretically we escape all the HTML/URI stuff, but these
       // restrictions make attacks more difficult and are generally reasonable,
       // since usernames like "<^, ,^>" don't seem very important to support.
       '<script>'    => false,
       'a lincoln'   => false,
       ' alincoln'   => false,
       'alincoln '   => false,
       'a,lincoln'   => false,
       'a&lincoln'   => false,
       'a/lincoln'   => false,
+
+      "username\n"  => false,
+      "user\nname"  => false,
+      "\nusername"  => false,
+      "username\r"  => false,
+      "user\rname"  => false,
+      "\rusername"  => false,
     );
 
     foreach ($map as $name => $expect) {
       $this->assertEqual(
         $expect,
         PhabricatorUser::validateUsername($name),
         "Validity of '{$name}'.");
     }
   }
 
 }
diff --git a/src/applications/phlux/controller/PhluxEditController.php b/src/applications/phlux/controller/PhluxEditController.php
index 45347ede9a..cb2ff99525 100644
--- a/src/applications/phlux/controller/PhluxEditController.php
+++ b/src/applications/phlux/controller/PhluxEditController.php
@@ -1,184 +1,184 @@
 <?php
 
 final class PhluxEditController extends PhluxController {
 
   private $key;
 
   public function willProcessRequest(array $data) {
     $this->key = idx($data, 'key');
   }
 
   public function processRequest() {
     $request = $this->getRequest();
     $user = $request->getUser();
 
     $is_new = ($this->key === null);
     if ($is_new) {
       $var = new PhluxVariable();
       $var->setViewPolicy(PhabricatorPolicies::POLICY_USER);
       $var->setEditPolicy(PhabricatorPolicies::POLICY_USER);
     } else {
       $var = id(new PhluxVariableQuery())
         ->setViewer($user)
         ->requireCapabilities(
           array(
             PhabricatorPolicyCapability::CAN_VIEW,
             PhabricatorPolicyCapability::CAN_EDIT,
           ))
         ->withKeys(array($this->key))
         ->executeOne();
       if (!$var) {
         return new Aphront404Response();
       }
       $view_uri = $this->getApplicationURI('/view/'.$this->key.'/');
     }
 
     $e_key = ($is_new ? true : null);
     $e_value = true;
     $errors = array();
 
     $key = $var->getVariableKey();
 
     $display_value = null;
     $value = $var->getVariableValue();
 
     if ($request->isFormPost()) {
       if ($is_new) {
         $key = $request->getStr('key');
         if (!strlen($key)) {
           $errors[] = pht('Variable key is required.');
           $e_key = pht('Required');
-        } else if (!preg_match('/^[a-z0-9.-]+$/', $key)) {
+        } else if (!preg_match('/^[a-z0-9.-]+\z/', $key)) {
           $errors[] = pht(
             'Variable key "%s" must contain only lowercase letters, digits, '.
             'period, and hyphen.',
             $key);
           $e_key = pht('Invalid');
         }
       }
 
       $raw_value = $request->getStr('value');
       $value = json_decode($raw_value, true);
       if ($value === null && strtolower($raw_value) !== 'null') {
         $e_value = pht('Invalid');
         $errors[] = pht('Variable value must be valid JSON.');
         $display_value = $raw_value;
       }
 
       if (!$errors) {
         $editor = id(new PhluxVariableEditor())
           ->setActor($user)
           ->setContinueOnNoEffect(true)
           ->setContentSourceFromRequest($request);
 
         $xactions = array();
         $xactions[] = id(new PhluxTransaction())
           ->setTransactionType(PhluxTransaction::TYPE_EDIT_KEY)
           ->setNewValue($key);
 
         $xactions[] = id(new PhluxTransaction())
           ->setTransactionType(PhluxTransaction::TYPE_EDIT_VALUE)
           ->setNewValue($value);
 
         $xactions[] = id(new PhluxTransaction())
           ->setTransactionType(PhabricatorTransactions::TYPE_VIEW_POLICY)
           ->setNewValue($request->getStr('viewPolicy'));
 
         $xactions[] = id(new PhluxTransaction())
           ->setTransactionType(PhabricatorTransactions::TYPE_EDIT_POLICY)
           ->setNewValue($request->getStr('editPolicy'));
 
         try {
           $editor->applyTransactions($var, $xactions);
           $view_uri = $this->getApplicationURI('/view/'.$key.'/');
           return id(new AphrontRedirectResponse())->setURI($view_uri);
         } catch (AphrontQueryDuplicateKeyException $ex) {
           $e_key = pht('Not Unique');
           $errors[] = pht('Variable key must be unique.');
         }
       }
     }
 
     if ($display_value === null) {
       if (is_array($value) &&
           (array_keys($value) !== array_keys(array_values($value)))) {
         $json = new PhutilJSON();
         $display_value = $json->encodeFormatted($value);
       } else {
         $display_value = json_encode($value);
       }
     }
 
     $policies = id(new PhabricatorPolicyQuery())
       ->setViewer($user)
       ->setObject($var)
       ->execute();
 
     $form = id(new AphrontFormView())
       ->setUser($user)
       ->appendChild(
         id(new AphrontFormTextControl())
           ->setValue($var->getVariableKey())
           ->setLabel(pht('Key'))
           ->setName('key')
           ->setError($e_key)
           ->setCaption(pht('Lowercase letters, digits, dot and hyphen only.'))
           ->setDisabled(!$is_new))
       ->appendChild(
         id(new AphrontFormTextAreaControl())
           ->setValue($display_value)
           ->setLabel(pht('Value'))
           ->setName('value')
           ->setCaption(pht('Enter value as JSON.'))
           ->setError($e_value))
       ->appendChild(
         id(new AphrontFormPolicyControl())
           ->setName('viewPolicy')
           ->setPolicyObject($var)
           ->setCapability(PhabricatorPolicyCapability::CAN_VIEW)
           ->setPolicies($policies))
       ->appendChild(
         id(new AphrontFormPolicyControl())
           ->setName('editPolicy')
           ->setPolicyObject($var)
           ->setCapability(PhabricatorPolicyCapability::CAN_EDIT)
           ->setPolicies($policies));
 
     if ($is_new) {
       $form->appendChild(
         id(new AphrontFormSubmitControl())
           ->setValue(pht('Create Variable')));
     } else {
       $form->appendChild(
         id(new AphrontFormSubmitControl())
           ->setValue(pht('Update Variable'))
           ->addCancelButton($view_uri));
     }
 
     $crumbs = $this->buildApplicationCrumbs();
 
     if ($is_new) {
       $title = pht('Create Variable');
       $crumbs->addTextCrumb($title, $request->getRequestURI());
     } else {
       $title = pht('Edit %s', $this->key);
       $crumbs->addTextCrumb($title, $request->getRequestURI());
     }
 
     $form_box = id(new PHUIObjectBoxView())
       ->setHeaderText($title)
       ->setFormErrors($errors)
       ->setForm($form);
 
     return $this->buildApplicationPage(
       array(
         $crumbs,
         $form_box,
       ),
       array(
         'title' => $title,
         'device' => true,
       ));
   }
 
 }
diff --git a/src/applications/repository/conduit/ConduitAPI_repository_create_Method.php b/src/applications/repository/conduit/ConduitAPI_repository_create_Method.php
index 630e7c0d53..82e6ef3daf 100644
--- a/src/applications/repository/conduit/ConduitAPI_repository_create_Method.php
+++ b/src/applications/repository/conduit/ConduitAPI_repository_create_Method.php
@@ -1,134 +1,134 @@
 <?php
 
 /**
  * @group conduit
  */
 final class ConduitAPI_repository_create_Method
   extends ConduitAPI_repository_Method {
 
   public function getMethodStatus() {
     return self::METHOD_STATUS_UNSTABLE;
   }
 
   public function getMethodStatusDescription() {
     return "Repository methods are new and subject to change.";
   }
 
   public function getMethodDescription() {
     return "Create a new repository (Admin Only).";
   }
 
   public function defineParamTypes() {
     return array(
       'name'                => 'required string',
       'vcs'                 => 'required enum<git, hg, svn>',
       'callsign'            => 'required string',
       'description'         => 'optional string',
       'encoding'            => 'optional string',
       'tracking'            => 'optional bool',
       'uri'                 => 'optional string',
       'credentialPHID'      => 'optional string',
       'localPath'           => 'optional string',
       'svnSubpath'          => 'optional string',
       'branchFilter'        => 'optional list<string>',
       'closeCommitsFilter'  => 'optional list<string>',
       'pullFrequency'       => 'optional int',
       'defaultBranch'       => 'optional string',
       'heraldEnabled'       => 'optional bool, default = true',
       'autocloseEnabled'    => 'optional bool, default = true',
       'svnUUID'             => 'optional string',
     );
   }
 
   public function defineReturnType() {
     return 'nonempty dict';
   }
 
   public function defineErrorTypes() {
     return array(
       'ERR-PERMISSIONS' =>
         'You do not have the authority to call this method.',
       'ERR-DUPLICATE'   =>
         'Duplicate repository callsign.',
       'ERR-BAD-CALLSIGN' =>
         'Callsign is required and must be ALL UPPERCASE LETTERS.',
       'ERR-UNKNOWN-REPOSITORY-VCS' =>
         'Unknown repository VCS type.',
     );
   }
 
   protected function execute(ConduitAPIRequest $request) {
     $application = id(new PhabricatorApplicationQuery())
       ->setViewer($request->getUser())
       ->withClasses(array('PhabricatorApplicationDiffusion'))
       ->executeOne();
 
     PhabricatorPolicyFilter::requireCapability(
       $request->getUser(),
       $application,
       DiffusionCapabilityCreateRepositories::CAPABILITY);
 
     // TODO: This has some duplication with (and lacks some of the validation
     // of) the web workflow; refactor things so they can share more code as this
     // stabilizes. Specifically, this should move to transactions since they
     // work properly now.
 
     $repository = PhabricatorRepository::initializeNewRepository(
       $request->getUser());
 
     $repository->setName($request->getValue('name'));
 
     $callsign = $request->getValue('callsign');
-    if (!preg_match('/^[A-Z]+$/', $callsign)) {
+    if (!preg_match('/^[A-Z]+\z/', $callsign)) {
       throw new ConduitException('ERR-BAD-CALLSIGN');
     }
     $repository->setCallsign($callsign);
 
     $vcs = $request->getValue('vcs');
 
     $map = array(
       'git' => PhabricatorRepositoryType::REPOSITORY_TYPE_GIT,
       'hg'  => PhabricatorRepositoryType::REPOSITORY_TYPE_MERCURIAL,
       'svn' => PhabricatorRepositoryType::REPOSITORY_TYPE_SVN,
     );
     if (empty($map[$vcs])) {
       throw new ConduitException('ERR-UNKNOWN-REPOSITORY-VCS');
     }
     $repository->setVersionControlSystem($map[$vcs]);
 
     $repository->setCredentialPHID($request->getValue('credentialPHID'));
 
     $details = array(
       'encoding'          => $request->getValue('encoding'),
       'description'       => $request->getValue('description'),
       'tracking-enabled'  => (bool)$request->getValue('tracking', true),
       'remote-uri'        => $request->getValue('uri'),
       'local-path'        => $request->getValue('localPath'),
       'branch-filter'     => array_fill_keys(
         $request->getValue('branchFilter', array()),
         true),
       'close-commits-filter' => array_fill_keys(
         $request->getValue('closeCommitsFilter', array()),
         true),
       'pull-frequency'    => $request->getValue('pullFrequency'),
       'default-branch'    => $request->getValue('defaultBranch'),
       'herald-disabled'   => !$request->getValue('heraldEnabled', true),
       'svn-subpath'       => $request->getValue('svnSubpath'),
       'disable-autoclose' => !$request->getValue('autocloseEnabled', true),
     );
 
     foreach ($details as $key => $value) {
       $repository->setDetail($key, $value);
     }
 
     try {
       $repository->save();
     } catch (AphrontQueryDuplicateKeyException $ex) {
       throw new ConduitException('ERR-DUPLICATE');
     }
 
     return $repository->toDictionary();
   }
 
 
 }