@expose('/labs/<id>/', methods = ['GET','POST'])
    def labs(self, id):
        # 
        # TODO: CSRF is not used here. Security hole
        # 
        rlms_db = self.session.query(RLMS).filter_by(id = id).first()
        if rlms_db is None:
            return abort(404)

        query = request.args.get('q')
        if query is not None:
            page = request.args.get('p', '1')
            try:
                page = int(page)
            except:
                page = 1
        else:
            page = 1

        RLMS_CLASS = get_manager_class(rlms_db.kind, rlms_db.version, rlms_db.id)
        rlms = RLMS_CLASS(rlms_db.configuration)
        if query:
            query_results = rlms.search(query = query, page = page)
            labs = query_results['laboratories']
            force_search = False
            number_of_pages = query_results.get('pages', 1)
            pages = []
            if number_of_pages > 1:
                for p in xrange(1, number_of_pages + 1):
                    obj = {
                        'label' : unicode(p),
                        'link'  : url_for('.labs', id = id, q = query, p = p)
                    }
                    obj['active'] = (p != page)
                    pages.append(obj)
        else:
            query_results = {}
            labs = rlms.get_laboratories()
            capabilities = rlms.get_capabilities()
            force_search = Capabilities.FORCE_SEARCH in capabilities
            pages = []

        registered_labs = [ lab.laboratory_id for lab in rlms_db.laboratories ]
        if request.method == 'POST':
            selected = []
            for name, value in request.form.items():
                if name != 'action' and value == 'on':
                    for lab in labs:
                        if lab.laboratory_id == name:
                            selected.append(lab)
            changes = False
            if request.form['action'] == 'register':
                for lab in selected:
                    if not lab.laboratory_id in registered_labs:
                        self.session.add(Laboratory(name = lab.name, laboratory_id = lab.laboratory_id, rlms = rlms_db))
                        changes = True
            elif request.form['action'] == 'unregister':
                for lab in selected:
                    if lab.laboratory_id in registered_labs:
                        cur_lab_db = None
                        for lab_db in rlms_db.laboratories:
                            if lab_db.laboratory_id == lab.laboratory_id:
                                cur_lab_db = lab_db
                                break
                        if cur_lab_db is not None:
                            self.session.delete(cur_lab_db)
                            changes = True
            if changes:
                self.session.commit()
        registered_labs = [ lab.laboratory_id for lab in rlms_db.laboratories ]
        return self.render('labmanager_admin/lab-list.html', rlms = rlms_db, labs = labs, registered_labs = registered_labs, query = query, force_search = force_search, pages = pages, page = page, id = id)
dataset/ETHPy150Open gateway4labs/labmanager/labmanager/views/admin.py/RLMSPanel.labs/original