add login widget.

WebApplication/CMakeLists.txt

@@ -1,5 +1,6 @@
 add_library(WebApplication
     WebApplication.h WebApplication.cpp
+    LoginWidget.h LoginWidget.cpp
     User.h User.cpp
     Hello.h Hello.cpp
     Restful.h Restful.cpp

WebApplication/Dialog.h

@@ -2,6 +2,7 @@
 #define __DIALOG_H__
 
 #include <Wt/WContainerWidget.h>
+#include <Wt/WMessageBox.h>
 
 class Dialog : public Wt::WContainerWidget {
 public:

WebApplication/Hello.cpp

@@ -1,12 +1,10 @@
 #include "Hello.h"
 #include "BoostLog.h"
 #include "Dialog.h"
+#include "LoginWidget.h"
 #include "Session.h"
 #include "WebApplication.h"
-#include <Wt/Auth/AuthService.h>
-#include <Wt/Auth/AuthWidget.h>
 #include <Wt/Auth/Identity.h>
-#include <Wt/Auth/PasswordService.h>
 #include <Wt/WBootstrap2Theme.h>
 #include <Wt/WContainerWidget.h>
 #include <Wt/WEnvironment.h>
@@ -14,18 +12,22 @@
 #include <Wt/WPushButton.h>
 #include <Wt/WText.h>
 
-Hello::Hello(const Wt::WEnvironment &env, Wt::Dbo::SqlConnectionPool &connectionPool, bool embedded) : Wt::WApplication(env) {
+Hello::Hello(const Wt::WEnvironment &env, Wt::Dbo::SqlConnectionPool &connectionPool, bool embedded)
+    : Wt::WApplication(env) {
+    messageResourceBundle().use(appRoot() + "wt");
+    messageResourceBundle().use(appRoot() + "auth_strings");
+    messageResourceBundle().use(appRoot() + "auth_css_theme");
+    useStyleSheet("/resources/app.css");
     LOG(info) << "app root: " << appRoot();
     m_session = std::make_unique<Session>(connectionPool);
     m_session->login().changed().connect(this, &Hello::authEvent);
     setTitle("Hello world");
-    Wt::WContainerWidget *top = nullptr;
     if (!embedded) {
         setTheme(std::make_shared<Wt::WBootstrap2Theme>());
-        top = root();
+        m_root = root();
     } else {
         std::unique_ptr<Wt::WContainerWidget> topPtr = std::make_unique<Wt::WContainerWidget>();
-        top = topPtr.get();
+        m_root = topPtr.get();
         const std::string *div = env.getParameter("div");
         if (div) {
             setJavaScriptClass(*div);
@@ -37,7 +39,7 @@ Hello::Hello(const Wt::WEnvironment &env, Wt::Dbo::SqlConnectionPool &connection
         auto externalPath = env.getParameter("path");
         if (externalPath != nullptr) {
             m_externalPath = *externalPath;
-
+            LOG(info) << "external path: " << m_externalPath;
         } else {
             auto parameters = env.getParameterMap();
             for (auto &p : parameters) {
@@ -54,29 +56,27 @@ Hello::Hello(const Wt::WEnvironment &env, Wt::Dbo::SqlConnectionPool &connection
                                                       "from within <a href=\"hello.html\">a web page</a>.</emph></p>"));
     }
 
-    top->addWidget(std::make_unique<Wt::WText>("Your name, please ? "));
-    m_nameEdit = top->addWidget(std::make_unique<Wt::WLineEdit>());
+    m_root->addWidget(std::make_unique<Wt::WText>("Your name, please ? "));
+    m_nameEdit = m_root->addWidget(std::make_unique<Wt::WLineEdit>());
     m_nameEdit->setFocus();
 
-    auto b = top->addWidget(std::make_unique<Wt::WPushButton>("点击我!"));
+    auto b = m_root->addWidget(std::make_unique<Wt::WPushButton>("点击我!"));
     b->setMargin(5, Wt::Side::Left);
 
-    top->addWidget(std::make_unique<Wt::WBreak>());
+    m_root->addWidget(std::make_unique<Wt::WBreak>());
 
-    m_greeting = top->addWidget(std::make_unique<Wt::WText>());
+    m_greeting = m_root->addWidget(std::make_unique<Wt::WText>());
 
     b->clicked().connect(this, &Hello::greet);
     m_nameEdit->enterPressed().connect(this, &Hello::greet);
 
     auto app = Amass::Singleton<WebApplication>::instance();
-    auto authWidget = std::make_unique<Wt::Auth::AuthWidget>(app->authService(), m_session->users(), m_session->login());
-    authWidget->setInternalBasePath("/");
-    authWidget->model()->addPasswordAuth(&app->passwordService());
-    authWidget->setRegistrationEnabled(true);
-    authWidget->processEnvironment();
-    top->addWidget(std::move(authWidget));
 
-    top->addWidget(std::make_unique<Dialog>());
+    m_root->addWidget(std::make_unique<Dialog>());
+
+    if (!m_externalPath.empty()) {
+        handlePathChange(m_externalPath);
+    }
 }
 
 Hello::~Hello() {
@@ -99,4 +99,9 @@ void Hello::authEvent() {
 
 void Hello::handlePathChange(const std::string &path) {
     LOG(info) << "handlePathChange: " << path;
+    if (path.starts_with("/wt/login") || path.starts_with("/wt/register")) {
+        m_root->clear();
+        m_root->setStyleClass("WtCenterContainer");
+        m_root->addNew<LoginWidget>(m_session->users(), m_session->login());
+    }
 }

WebApplication/Hello.h

@@ -20,6 +20,8 @@ private:
     Wt::WText *m_greeting = nullptr;
     std::unique_ptr<Session> m_session;
     std::string m_externalPath;
+
+    Wt::WContainerWidget *m_root = nullptr;
 };
 
 #endif // __HELLO_H__

WebApplication/LoginWidget.cpp

@@ -0,0 +1,17 @@
+#include "LoginWidget.h"
+#include "WebApplication.h"
+#include <Wt/Auth/AuthService.h>
+#include <Wt/Auth/AuthWidget.h>
+#include <Wt/Auth/PasswordService.h>
+#include <Wt/WVBoxLayout.h>
+
+LoginWidget::LoginWidget(Wt::Auth::AbstractUserDatabase &users, Wt::Auth::Login &login) {
+    auto app = Amass::Singleton<WebApplication>::instance();
+    auto authWidget = std::make_unique<Wt::Auth::AuthWidget>(app->authService(), users, login);
+    authWidget->setInternalBasePath("/wt");
+    authWidget->model()->addPasswordAuth(&app->passwordService());
+    authWidget->setRegistrationEnabled(true);
+    authWidget->processEnvironment();
+    setAttributeValue("style", "transform: translateY(-100px);");
+    addWidget(std::move(authWidget));
+}

WebApplication/LoginWidget.h

@@ -0,0 +1,11 @@
+#ifndef __LOGINWIDGET_H__
+#define __LOGINWIDGET_H__
+
+#include <Wt/WContainerWidget.h>
+
+class LoginWidget : public Wt::WContainerWidget {
+public:
+    LoginWidget(Wt::Auth::AbstractUserDatabase &users, Wt::Auth::Login &login);
+};
+
+#endif // __LOGINWIDGET_H__

WebApplication/WebApplication.cpp

@@ -18,6 +18,7 @@ WebApplication::WebApplication() {
         std::vector<std::string> args;
         args.push_back("--approot=./build");
         args.push_back("--docroot=./build");
+        args.push_back("--config=resources/wt_config.xml");
         args.push_back("--http-listen=127.0.0.1:8855");
         // --docroot=. --no-compression --http-listen 127.0.0.1:8855
         initializeAuthenticationService();
@@ -30,7 +31,7 @@ WebApplication::WebApplication() {
                                 "/hello");
         m_server->addEntryPoint(Wt::EntryPointType::WidgetSet,
                                 std::bind(&WebApplication::createApplication, this, std::placeholders::_1, true),
-                                "/wt.js");
+                                "/wt/app.js");
         m_server->addResource(std::make_shared<AuthenticationResource>(*m_sqlConnectionPool), "/auth");
         m_server->addResource(std::make_shared<PlaintextResource>(), "/plaintext");
         m_server->addResource(std::make_shared<DbResource>("database.sqlite"), "/db");

resources/app.css

@@ -0,0 +1,7 @@
+
+.WtCenterContainer {
+    display: flex;
+    flex: 1;
+    justify-content: center;
+    align-items: center;
+}

resources/auth_css_theme.xml

@@ -0,0 +1,175 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<messages xmlns:if="Wt.WTemplate.conditions">
+  <message id="Wt.Auth.field">
+    <![CDATA[
+    ${<if:{1}>}
+      <label for="${id:{1}}">${tr:Wt.Auth.{1}}
+        ${{1}-info class="Wt-info"}
+      </label>
+      ${{1}}
+    ${</if:{1}>}
+    ]]>
+  </message>
+
+  <message id="Wt.Auth.template.login">
+    <div class="Wt-form Wt-auth-login">
+      <h2>${tr:Wt.Auth.login-form-title}</h2>
+      <p>${tr:Wt.Auth.login-form-info}</p>
+
+      <div class="Wt-fields">
+        ${<if:passwords>}
+          <label for="${id:user-name}">${user-name-label}
+            ${user-name-info class="Wt-info"}
+            ${user-confirm-email class="Wt-info"}
+          </label>
+          ${user-name}
+
+          ${block:Wt.Auth.field password}
+          ${block:Wt.Auth.field remember-me}
+         ${</if:passwords>}
+      </div>
+
+      ${<if:oauth>}
+
+        <div class="Wt-col-right">
+          <h3>Or use:</h3>
+          ${icons}
+        </div>
+
+      ${</if:oauth>}
+
+      <div class="Wt-buttons">
+        ${login}
+      </div>
+
+      <div class="Wt-buttons">
+        ${lost-password} ${sep} ${register}
+      </div>
+    </div>
+  </message>
+
+  <message id="Wt.Auth.template.registration">
+    <div class="Wt-form Wt-auth-registration">
+      <h2>${tr:Wt.Auth.registration-form-title}</h2>
+      <p>${tr:Wt.Auth.registration-form-info}</p>
+
+      ${password-description}
+
+      <div class="Wt-fields">
+        ${<if:user-name>}
+          <label for="${id:user-name}">${user-name-label}
+            ${user-name-info class="Wt-info"}
+            ${confirm-is-you class="Wt-info"}
+          </label>
+          ${user-name}
+        ${</if:user-name>}
+
+        ${block:Wt.Auth.field choose-password}
+        ${block:Wt.Auth.field repeat-password}
+        ${block:Wt.Auth.field email}
+      </div>
+
+      ${<if:oauth>}
+        <br clear="both" />
+        ${oauth-description}
+        <label>${tr:Wt.Auth.oauth}
+          <span class="Wt-info">${tr:Wt.Auth.oauth-info}</span>
+        </label>
+        ${icons}
+      ${</if:oauth>}
+
+      <div class="Wt-buttons">
+        ${ok-button} ${cancel-button}
+      </div>
+    </div>
+  </message>
+
+  <message id="Wt.Auth.template.update-password">
+    <div class="Wt-form Wt-auth-update-password">
+      <h2>${tr:Wt.Auth.update-password-form-title}</h2>
+      <p>${tr:Wt.Auth.update-password-form-info}</p>
+
+      <div class="Wt-fields">
+        <label for="${id:user-name}">${tr:Wt.Auth.user-name}
+        </label>
+        ${user-name}
+
+        ${block:Wt.Auth.field password}
+        ${block:Wt.Auth.field choose-password}
+        ${block:Wt.Auth.field repeat-password}
+      </div>
+
+      <div class="Wt-buttons">
+        ${ok-button} ${cancel-button}
+      </div>
+    </div>
+  </message>
+
+  <message id="Wt.Auth.template.lost-password">
+    <div class="Wt-form Wt-auth-lost-password">
+      <h2>${tr:Wt.Auth.lost-password-form-title}</h2>
+      <p>${tr:Wt.Auth.lost-password-form-info}</p>
+
+      <div class="Wt-fields">
+        <label for="${id:email}">${tr:Wt.Auth.email}
+          <span class="Wt-info">${tr:Wt.Auth.email-info}</span>
+        </label>
+        ${email}
+      </div>
+
+      <div class="Wt-buttons">
+        ${send-button} ${cancel-button}
+      </div>
+    </div>
+  </message>
+
+  <message id="Wt.Auth.template.password-prompt">
+    <div class="Wt-form Wt-auth-password-prompt">
+      <h2>${tr:Wt.Auth.password-prompt-form-title}</h2>
+      <p>${tr:Wt.Auth.password-prompt-form-info}</p>
+
+      <div class="Wt-fields">
+        <label for="${id:user-name}">${tr:Wt.Auth.user-name}
+        </label>
+        ${user-name}
+
+        ${block:Wt.Auth.field password}
+      </div>
+
+      <div class="Wt-buttons">
+        ${ok-button} ${cancel-button}
+      </div>
+    </div>
+  </message>
+
+  <message id="Wt.Auth.template.logged-in">
+    <div class="Wt-auth-logged-in">
+      <b>${user-name}</b> ${logout}
+    </div>
+  </message>
+
+  <message id="Wt.Auth.template.totp">
+    <div class="Wt-form Wt-auth-login">
+      <h2>${tr:Wt.Auth.totp-title}</h2>
+      <p>${tr:Wt.Auth.totp-info}</p>
+
+      <div class="Wt-fields">
+        ${<if:no-secret-key>}
+          ${qr-code}
+          ${tr:Wt.Auth.totp-qr-code-explanation}
+          <p> Secret key: ${secret-key}</p>
+        ${</if:no-secret-key>}
+        <label for="${id:totp-code}">${tr:Wt.Auth.totp-code}
+          <span class="Wt-info">${totp-code-info}</span>
+        </label>
+        ${totp-code}
+
+        ${block:Wt.Auth.field remember-me}
+      </div>
+
+      <div class="Wt-buttons">
+        ${login}
+      </div>
+    </div>
+  </message>
+</messages>

resources/auth_strings_zh.xml

@@ -0,0 +1,284 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<messages xmlns:if="Wt.WTemplate.conditions"
+          nplurals="2"
+          plural="n == 1 ? 0 : 1">
+
+  <!-- BaseAuth, PasswordAuth and OAuth models -->
+
+  <message id="Wt.Auth.error-invalid-token">The operation could not be completed: invalid token.</message>
+  <message id="Wt.Auth.error-token-expired">The operation could not be completed: the token has expired.</message>
+  <message id="Wt.Auth.mail-sent">An email has been sent. Follow the instructions to set a new password.</message>
+  <message id="Wt.Auth.info-email-confirmed">Your email address is now confirmed.</message>
+
+  <message id="Wt.Auth.passwdqc.reason-error">
+    Check failed
+  </message>
+  <message id="Wt.Auth.passwdqc.reason-same">
+    The same as the old one
+  </message>
+  <message id="Wt.Auth.passwdqc.reason-similar">
+    Based on the old one
+  </message>
+  <message id="Wt.Auth.passwdqc.reason-short">
+    长度太短
+  </message>
+  <message id="Wt.Auth.passwdqc.reason-long">
+    超出长度
+  </message>
+  <message id="Wt.Auth.passwdqc.reason-simpleshort">
+    Not enough different characters or classes for this length
+  </message>
+  <message id="Wt.Auth.passwdqc.reason-simple">
+    Not enough different characters or classes
+  </message>
+  <message id="Wt.Auth.passwdqc.reason-personal">
+    Based on personal information
+  </message>
+  <message id="Wt.Auth.passwdqc.reason-word">
+    Based on a dictionary word and not a passphrase
+  </message>
+  <message id="Wt.Auth.passwdqc.reason-seq">
+    Based on a common sequence of characters
+  </message>
+  <message id="Wt.Auth.passwdqc.reason-ok">
+    Valid
+  </message>
+
+  <message id="Wt.Auth.GoogleService.badresponse">
+    <p>Sorry, could not login using your Google account.</p>
+    <small>
+      <p>Google's identification server generated an unexpected
+        response.</p>
+    </small>
+  </message>
+
+  <message id="Wt.Auth.FacebookService.badresponse">
+    <p>Sorry, could not login using your Facebook account.</p>
+    <small>
+      <p>Facebook's identification server generated an unexpected
+        response.</p>
+    </small>
+  </message>
+
+  <!-- LoginWidget -->
+
+  <message id="Wt.Auth.login-form-title">登录</message>
+  <message id="Wt.Auth.login-form-info"></message>
+  <message id="Wt.Auth.user-name">用户名</message>
+  <message id="Wt.Auth.user-name-info">请输入您的用户名</message>
+  <message id="Wt.Auth.user-name-invalid">Invalid</message>
+  <message id="Wt.Auth.email">Email address</message>
+  <message id="Wt.Auth.email-info">Enter your email address</message>
+  <message id="Wt.Auth.optional-email-info">
+    Enter your email address (optional)
+  </message>
+  <message id="Wt.Auth.password">密码</message>
+  <message id="Wt.Auth.password-info">请输入您的密码</message>
+  <message id="Wt.Auth.remember-me">记住我</message>
+  <message id="Wt.Auth.remember-me-info.days">
+    <plural case="0">Keeps login for one day</plural>
+    <plural case="1">Keeps login for {1} days</plural>
+  </message>
+  <message id="Wt.Auth.remember-me-info.weeks">
+    <plural case="0">保持登录状态1周</plural>
+    <plural case="1">保持登录状态{1}周</plural>
+  </message>
+  <message id="Wt.Auth.remember-me-info.dynamic">Keeps login for {1}</message>
+  <message id="Wt.Auth.lost-password">Lost password</message>
+  <message id="Wt.Auth.login">登录</message>
+  <message id="Wt.Auth.logout">退出</message>
+  <message id="Wt.Auth.throttle-retry">{1}s后重试</message>
+
+  <message id="Wt.Auth.resend-email-verification">Resend?</message>
+  <message id="Wt.Auth.resend-verification-title">Resend Email Verification</message>
+  <message id="Wt.Auth.resend-verification-msg">Please enter your email address again below to resend the verification email. Make sure to check your spam folder in case the email does not show up in your inbox.</message>
+  <message id="Wt.Auth.resend-email-error">Email address does not match this user</message>
+  <message id="Wt.Auth.verification-sent-title">Email verification</message>
+
+
+  <!-- RegistrationWidget -->
+
+  <message id="Wt.Auth.registration-form-title">注册</message>
+  <message id="Wt.Auth.registration-form-info">请填写以下信息进行注册</message>
+  <message id="Wt.Auth.password-registration">Register using a user name and password:</message>
+  <message id="Wt.Auth.oauth-registration">Register with an identity provider:</message>
+  <message id="Wt.Auth.or-oauth-registration">Or, register with an identity provider:</message>
+  <message id="Wt.Auth.valid">Valid</message>
+  <message id="Wt.Auth.choose-password">Choose Password</message>
+  <message id="Wt.Auth.choose-password-info">Choose a password</message>
+  <message id="Wt.Auth.repeat-password">Repeat password</message>
+  <message id="Wt.Auth.repeat-password-info">Re-enter your password</message>
+  <message id="Wt.Auth.email-invalid">Invalid email address</message>
+  <message id="Wt.Auth.email-exists">Email already registered</message>
+  <message id="Wt.Auth.oauth">Your external account</message>
+  <message id="Wt.Auth.oauth-info">Choose one of your accounts</message>
+  <message id="Wt.Auth.user-name-exists">User already exists</message>
+  <message id="Wt.Auth.confirm-is-you">User exists, is this you?</message>
+  <message id="Wt.Auth.user-name-tooshort">Min. size {1} characters</message>
+  <message id="Wt.Auth.password-tooshort">Min. size {1} characters</message>
+  <message id="Wt.Auth.passwords-dont-match">Passwords don't match</message>
+  <message id="Wt.Auth.registration">注册</message>
+  <message id="Wt.Auth.register">注册</message>
+  <message id="Wt.Auth.error-user-invalid">注册失败</message>
+  <message id="Wt.Auth.email-unverified">Please confirm your email first.</message>
+  <message id="Wt.Auth.confirm-email-first">
+    <h5>Welcome!</h5>
+
+    You will be able to login after confirming your email address using the
+    email we've just sent you.
+  </message>
+
+  <!-- PasswordPromptDialog -->
+
+  <message id="Wt.Auth.enter-password">Enter your password</message>
+  <message id="Wt.Auth.password-prompt-form-title">Enter your password</message>
+  <message id="Wt.Auth.password-prompt-form-info"></message>
+  <message id="Wt.Auth.password-invalid">Invalid password</message>
+
+  <!-- UpdatePasswordWidget -->
+
+  <message id="Wt.Auth.updatepassword">Update password</message>
+  <message id="Wt.Auth.update-password-form-title">Update password</message>
+  <message id="Wt.Auth.update-password-form-info">Enter a new password below</message>
+
+  <!-- LostPasswordDialog -->
+
+  <message id="Wt.Auth.lostpassword">Forgot your password? No sweat!</message>
+  <message id="Wt.Auth.lost-password-form-title">Recover your password</message>
+  <message id="Wt.Auth.lost-password-form-info">Please enter below the
+  email address which you used during registration. A mail will be
+  sent with instructions to enter a new password.</message>
+  <message id="Wt.Auth.send">Send</message>
+
+  <!-- Message boxes -->
+
+  <message id="Wt.Auth.error">Error</message>
+  <message id="Wt.Auth.notice">Notice</message>
+
+  <!-- Emails -->
+
+  <message id="Wt.Auth.confirmmail.subject">User account activation Link</message>
+
+  <message id="Wt.Auth.confirmmail.body">
+Hello {1},
+
+Thank you for joining!
+
+To complete your registration, please finally confirm your account by
+clicking on the following link or copying the URL into your browser.
+
+Please click here to confirm your registration or copy and paste the
+following URL into your browser: (Note: be sure to copy the entire
+URL, including any part of it which goes onto a second line.)
+
+{3}
+
+This text is resolved from the "Wt.Auth.confirmmail.subject",
+"Wt.Auth.confirmmail.body", and "Wt.Auth.confirmmail.htmlbody"
+resource keys.
+
+Good luck with your Wt application,
+
+The Wt team.
+  </message>
+
+  <message id="Wt.Auth.confirmmail.htmlbody">
+    <h3>Hello {1},</h3>
+
+    <p>Thank you for joining!</p>
+
+    <p>To complete your registration, please finally confirm your
+    account by clicking on the following link or copying the URL into
+    your browser.</p>
+
+    <p>Please <a href="{3}">click here to confirm</a> your
+    registration or copy and paste the following URL into your
+    browser: <i>(Note: be sure to copy the entire URL, including any
+    part of it which goes onto a second line.)</i></p>
+
+    <b>{3}</b>
+
+    <p>
+      <i>Note to developer:</i>
+    </p>
+    <p>
+      This text is resolved from the "Wt.Auth.confirmmail.subject",
+      "Wt.Auth.confirmmail.body", and "Wt.Auth.confirmmail.htmlbody"
+      resource keys.
+    </p>
+
+    <p>Good luck with your Wt application,</p>
+
+    <p>The Wt team.</p>
+  </message>
+
+  <message id="Wt.Auth.lostpasswordmail.subject">Lost password instructions</message>
+
+  <message id="Wt.Auth.lostpasswordmail.body">
+Hello {1},
+
+This mail has been sent to you, because someone (presumably you?)
+indicated that he wishes to choose a new password, because the current
+password escapes his mind.
+
+If you requested this, then choose a new password by clicking on the
+following link or copying the URL into your browser. If you didn't
+request this, you can safely ignore and discard this email.
+
+Please copy and paste the following URL into your browser: (Note: be
+sure to copy the entire URL, including any part of it which goes onto
+a second line.)
+
+{3}
+
+This text is resolved from the "Wt.Auth.lostpasswordmail.subject",
+"Wt.Auth.lostpasswordmail.body", and "Wt.Auth.lostpasswordmail.htmlbody"
+resource keys.
+
+Good luck with your Wt application,
+
+The Wt team.
+  </message>
+
+  <message id="Wt.Auth.lostpasswordmail.htmlbody">
+    <h3>Hello {1},</h3>
+
+    <p>This mail has been sent to you, because someone (presumably
+    you?)  indicated that he wishes to choose a new password, because
+    the current password escapes his mind.</p>
+
+    <p>If you requested this, then choose a new password by clicking
+    on the following link or copying the URL into your browser. If you
+    didn't request this, you can safely ignore and discard this
+    email.</p>
+
+    <p>Please <a href="{3}">click here to choose a new password</a> or
+    copy and paste the following URL into your browser: <i>(Note: be
+    sure to copy the entire URL, including any part of it which goes
+    onto a second line.)</i></p>
+
+    <b>{3}</b>
+
+    <p>
+      <i>Note to developer:</i>
+    </p>
+    <p>
+      This text is resolved from the
+      "Wt.Auth.lostpasswordmail.subject",
+      "Wt.Auth.lostpasswordmail.body", and
+      "Wt.Auth.lostpasswordmail.htmlbody" resource keys.
+    </p>
+
+    <p>Good luck with your Wt application,</p>
+
+    <p>The Wt team.</p>
+  </message>
+
+  <message id="Wt.Auth.totp-title">TOTP Verification</message>
+  <message id="Wt.Auth.totp-info">Use your authenticator app/extension to generate a TOTP code.</message>
+  <message id="Wt.Auth.totp-qr-code-explanation">This QR code can be scanned by an authenticator app. It will allow you to generate TOTP codes. This will serve as an additional layer of security.</message>
+  <message id="Wt.Auth.totp-code">Code</message>
+  <message id="Wt.Auth.totp-code-info">Enter the TOTP code</message>
+  <message id="Wt.Auth.totp-code-info-invalid">Invalid TOTP code</message>
+  <message id="Wt.Auth.totp-code-info-throttle">Throtteling TOTP validation attempts</message>
+</messages>

resources/build.sh

@@ -24,6 +24,8 @@ function build() {
     # reset
     # pkill -9 HttpServer
     # cp -r /opt/Libraries/wt-4.11.1/share/Wt/* ./build
+    # cp resources/*.css build/resources/
+    # cp resources/*.xml build/
 
     if [ ! -f "${build_path}/CMakeCache.txt" ]; then
         cmake_scan

resources/wt_config.xml

@@ -0,0 +1,841 @@
+<!--
+    Wt Configuration File.
+
+    The Wt configuration file manages, for every Wt application, settings
+    for session management, debugging, directory for runtime information
+    such as session sockets, and some security settings.
+
+    Settings may be specified globally, or for a single application path.
+
+    The path should be as configured in the Wt build process, where it
+    defaults to /etc/wt/wt_config.xml. It can be overridden in the environment
+    variable WT_CONFIG_XML, or with the -c startup option of wthttp.
+
+    The values listed here are the default values, which are used when the
+    declaration is missing or no configuration file is used.
+  -->
+
+<server>
+
+    <!-- Default application settings
+
+      The special location "*" always matches. See below for an example
+      of settings specific to a single application.
+      -->
+    <application-settings location="*">
+
+        <!-- Session management. -->
+        <session-management>
+            <!-- Every session runs within a dedicated process.
+
+               This mode guarantees kernel-level session privacy, but as every
+               session requires a separate process, it is also an easy target
+               for DoS attacks if not shielded by access control.
+
+               Note: currently only supported by the wtfcgi and wthttp
+               connectors.
+
+               max-num-sessions determines the maximum number of sessions
+
+               num-session-threads determines the number of threads for every
+               session process. If not specified, the number of threads for every
+               session process is the same as the number of threads for the parent
+               process.
+              -->
+
+            <!--
+               <dedicated-process>
+                 <max-num-sessions>100</max-num-sessions>
+                 <num-session-threads>10</num-session-threads>
+               </dedicated-process>
+            -->
+
+            <!-- Multiple sessions within one process.
+
+               This mode spawns a number of processes, and sessions are
+               allocated randomly to one of these processes (you should not
+               use this for dynamic FCGI servers, but only in conjunction
+               with a fixed number of static FCGI servers.
+
+               This requires careful programming, as memory corruption in one
+               session will kill all of the sessions in the same process. You
+               should debug extensively using valgrind. Also, it is your
+               responsibility to keep session state not interfering and
+               separated.
+
+               On the other hand, sessions are inexpensive, and this mode
+               suffers far less from DoS attacks than dedicated-process mode.
+               Use it for non-critical and well-debugged web applications.
+
+               Note: the wthttp connector will ignore the num-processes
+               setting and use only process.
+              -->
+            <shared-process>
+                <num-processes>1</num-processes>
+            </shared-process>
+
+            <!-- Session tracking strategy.
+
+               Possible values:
+                 Auto: cookies if available, otherwise URL rewriting
+                 URL:  only URL rewriting
+                 Combined: uses URL rewriting, with a multi-session cookie to
+                           prevent stealing of sessions through the URL. Will
+                           not fall back to URL rewriting if cookies are not
+                           available. This is the most secure strategy.
+
+               It is recommended to stick to URL rewriting or Combined for session
+               tracking as this is more secure (it avoids the risk of attacks
+               like CSRF or BREACH), and also provides proper support for
+               concurrent sessions in a single browser.
+              -->
+            <tracking>URL</tracking>
+
+            <!-- How reload should be handled.
+
+               When reload should (or rather, may) spawn a new session, then
+               even in the case cookies are not used for session management,
+               the URL will not be cluttered with a sessionid.
+               However, WApplication::refresh() will never be called.
+              -->
+            <reload-is-new-session>true</reload-is-new-session>
+
+            <!-- Session timeout (seconds).
+
+               When a session remains inactive for this amount of time, it is
+               cleaned up.
+              -->
+            <timeout>600</timeout>
+
+            <!-- Idle timeout (seconds).
+
+               When the user does not interact with the application for the set number of seconds,
+               WApplication::idleTimeout() is called. By default, this
+               method quits the application immediately, but it can be overridden
+               if different behaviour is desired.
+
+               This feature can be used to prevent others from taking over a session
+               when the device that the Wt application is being used from is left behind,
+               and is most effective in combination with a fairly short session timeout (<timeout>)
+
+               When omitted, or left empty, this feature is disabled.
+               -->
+            <!--<idle-timeout>900</idle-timeout>-->
+
+            <!-- Server push timeout (seconds).
+
+               When using server-initiated updates, the client uses
+               long-polling requests. Proxies (including reverse
+               proxies) are notorious for silently closing idle
+               requests; the client therefore cancels the request
+               periodically and issues a new one. This timeout sets
+               the frequency.
+              -->
+            <server-push-timeout>50</server-push-timeout>
+        </session-management>
+
+        <!-- Settings that apply only to the FastCGI connector.
+
+           To configure the wthttp connector, use command line options, or
+           configure default options in /etc/wt/wthttpd
+          -->
+        <connector-fcgi>
+            <!-- Valgrind path
+
+               If debugging is enabled and this path is not empty, then valgrind
+               will be started for every shared process, or for every session
+               which has ?debug appended to the command line.
+
+               The variable is slighly misnamed. Not only a path can be set,
+               but also options, like for example:
+
+                 /usr/bin/valgrind - -leak-check=full
+             -->
+            <valgrind-path></valgrind-path>
+
+            <!-- Run directory
+
+               Path used by Wt to do session management.
+              -->
+            <run-directory>/opt/Libraries/wt-4.11.1/var/run/wt</run-directory>
+
+        </connector-fcgi>
+
+        <!-- Settings that apply only to the MS IIS ISAPI connector.
+
+           To configure the wthttp connector, use command line options, or
+           configure default options in /etc/wt/wthttpd
+          -->
+        <connector-isapi>
+
+            <!-- Maximum Request Size spooled in memory (KiB)
+
+               Normally, Wt keeps incoming requests (POST data) in memory.
+               However, malicious users could send a big POST and as such
+               use up all memory of your HTTP server. With this parameter,
+               you tune how big a request can be before Wt spools it in a
+               file before processing it. Legitimate big POST messages may
+               occur when users are expected to upload files.
+
+               See also max-request-size.
+
+               The default value is 128K, which is more than enough for
+               any interactive Wt event.
+              -->
+            <max-memory-request-size>128</max-memory-request-size>
+        </connector-isapi>
+
+        <!-- Javascript debug options
+
+             Values:
+             - naked: JavaScript errors are not caught at all
+             - false: JavaScript errors are caught and a simple error message
+                      is printed to indicate that something is terribly wrong
+             - stack: equivalent to 'false'
+             - true: JavaScript errors are rethrown after server-side logging
+
+             Unless the value is 'naked',
+             WApplication::handleJavaScriptError() is called which by
+             default logs the error and terminates the session.
+          -->
+        <debug>false</debug>
+
+        <!-- Log file
+
+           When the log file is empty, or omitted, logging is done to
+           stderr. This may end up in the web server error log file
+           (e.g. for apache + fastcgi module), or on stderr (e.g. for
+           the built-in httpd).
+         -->
+        <log-file></log-file>
+
+        <!-- Logger configuration
+
+           This configures the logger. With the default configuration,
+           everything except for debugging messages are logged.
+
+           The configuration is a string that defines rules for
+           enabling or disabling certain logging. It is a white-space
+           delimited list of rules, and each rule is of the form:
+
+             [-]level : enables (or disables) logging of messages of
+             the given level; '*' is a wild-card that matches all
+             levels
+
+             [-]level:scope : enables (or disables) logging of
+             messages of the given level and scope; '*' is a wild-card
+             that matches all levels or scopes.  The default
+             configuration is "* -debug", i.e. by default everything
+             is logged, except for "debug" messages.
+
+           Some other examples:
+
+             "* -debug debug:wthttp": logs everything, including
+             debugging messages of scope "wthttp", but no other
+             debugging messages.
+
+             "* -info -debug": disables logging of info messages
+             in addition to debugging messages.
+
+           Note debugging messages are only emitted when debugging
+           has been enabled while building Wt.
+          -->
+        <log-config>* -debug</log-config>
+
+        <!-- Maximum HTTP request size (KiB)
+
+           Maximum size of an incoming POST request. This value must be
+           increased when the user is allowed to upload files.
+         -->
+        <max-request-size>128</max-request-size>
+
+        <!-- Maximum form data (KiB)
+
+           Maximum size of the data in a POST request of type
+           'application/x-www-form-urlencoded' (used for Wt form-field values)
+           Note that the maximum size is also limited by the value of
+           'max-request-size'.
+        -->
+        <max-formdata-size>5120</max-formdata-size>
+
+        <!--- Maximum number of pending events
+
+            Client-side events (user-interaction, WTimer, custom js signals) are
+            queued if the server did not yet respond to a previous update.
+            This allows you to configure the maximum number of events in the queue.
+            When the maximum is exceeded, the session stops and an error is logged
+            in the server.
+            Setting it to zero will disable the limit.
+        -->
+        <max-pending-events>1000</max-pending-events>
+
+        <!-- Number of threads per process
+
+           You may want to change this value if you would like to
+           support more reentrant event loops, where you block one
+           event loop using WDialog::exec() or related static
+           methods. Everytime you enter such an event loop, one
+           thread is blocked, and therefore the total number of
+           sessions that reliably can do this is limited to the
+           number of thread you have (minus one to unblock).
+
+           You may also want to increase this number if your Wt
+           application is regularly waiting for IO (databases, network,
+           files, ...). If this number is too low, all threads could
+           be waiting for IO operations to complete while your CPU
+           is idle. Increasing the number of threads may help.
+
+           Computing intensive applications may also increase this number,
+           even though it is better to offload computations to a helper
+           thread and user server push or a WTimer to check for
+           completion of the task in order to keep your GUI responsive
+           during the computations.
+
+           When using the MS IIS ISAPI connector, this configures the
+           number of threads that will be used to handle Wt requests.
+           The IIS internal threads are never used to do any
+           processing; all requests are forwarded to be handled in
+           this threadpool. Rather than to configure a so-called
+           'web-garden' in IIS, increase this number. The ISAPI
+           connector will not work correctly when a web-garden is
+           configured.
+
+           The default value is 10.
+              -->
+        <num-threads>10</num-threads>
+
+        <!-- Session id length (number of characters) -->
+        <session-id-length>16</session-id-length>
+
+        <!-- DoS prevention: limit plain HTML sessions
+
+           This is a simple measure which avoids Denial-of-Service
+           attacks on plain HTML sessions, which are easy to mount in
+           particular in the case of progressive bootstrap mode.
+
+           This setting may be used to keep the ratio of plain HTML
+           versus Ajax sessions under a certain ratio. Typically, most
+           of your sessions will be Ajax sessions, and only a tiny
+           fraction (e.g. less than 5%) will be plain HTML
+           sessions. This ratio is only enforced when more than 20 sessions
+           have been created.
+
+           The default is 1 (= 100%), which means that 100% of all sessions
+           may be plain HTML sessions, effectively disabling this feature. If
+           you set it to 0.5 for example, that means that 50% of all sessions
+           may be plain HTML sessions.
+          -->
+        <plain-ajax-sessions-ratio-limit>1</plain-ajax-sessions-ratio-limit>
+
+        <!-- DoS prevention: adds a puzzle to validate Ajax sessions
+
+           This is a simple measure which avoids Denial-of-Service
+           attacks on Ajax sessions.
+
+           When enabled, a puzzle needs to be solved in the first Ajax
+           request which eliminates agents that do not build a proper
+           DOM tree.
+          -->
+        <ajax-puzzle>false</ajax-puzzle>
+
+        <!-- Do strict serialization of events.
+
+           By default events are queued at the client-side, and
+           transmitted to the server so that at any time only one
+           request/response is pending. This scheme has a quality that
+           resembles TCP: on a low-latency link you allow the
+           transmission of many smaller requests, while on a high
+           latency link, events will be propagated less often, but in
+           batches.
+
+           In any case, this scheme does not drop events, no matter
+           how quickly they are generated.
+
+           In rare cases, the scheme may result in unwanted behaviour,
+           because the client-side is allowed to be slighly out of
+           sync at the time an event is recorded with the server-side
+           (and more so on high-latency links). The drastic
+           alternative is to discard events while a response is
+           pending, and can be configured by setting this option to
+           true.
+          -->
+        <strict-event-serialization>false</strict-event-serialization>
+
+        <!-- Enables web socket.
+
+           By default Ajax and long polling are used to communicate
+           between server and browser.
+
+           By enabling web socket support, if the browser supports
+           WebSockets, then WebSocket is the protocol used for
+           communication between client and server. WebSockets are
+           currently only supported by the built-in httpd Connector,
+           which acts as both an HTTP and WebSocket server. The WebSocket
+           protocol is intentionally not compatible with HTTP, through
+           a special hand-shake mechanism, and requires
+           that all (reverse) proxy servers also have explicit support
+           for this protocol.
+          -->
+        <web-sockets>false</web-sockets>
+
+        <!-- Enables the detection of webgl-capabilites.
+
+             When this is enabled, the browser will try to create a
+             webgl-context when loading to verify that it is possible. This
+             is necessary when using WGLWidget.
+
+             This can take up some load time. When your application does not
+             use WGLWidget, this option can be set to false. It will improve
+             the initial loading time of the web application.
+        -->
+        <webgl-detection>true</webgl-detection>
+
+        <!-- Redirect message shown for browsers without JavaScript support
+
+           By default, Wt will use an automatic redirect to start the
+           application when the browser does not support
+           JavaScript. However, browsers are not required to follow
+           the redirection, and in some situations (when using XHTML),
+           such automatic redirection is not supported.
+
+           This configures the text that is shown in the anchor which
+           the user may click to be redirected to a basic HTML version
+           of your application.
+          -->
+        <redirect-message>Load basic HTML</redirect-message>
+
+        <!-- Whether we are sitting behind a reverse proxy
+
+           When deployed behind a reverse proxy (such as Apache or Squid),
+           the server location is not read from the "Host" header,
+           but from the X-Forwarded-For header, if present.
+
+           This option is required to make e.g. clientAddress() return the
+           correct address.
+
+           Deprecated: use trusted-proxy-config instead. If this option is
+           set to true, Wt will take the first non-local IP address from the
+           Client-IP and X-Forwarded-For headers to determine the clientAddress().
+          -->
+        <!--<behind-reverse-proxy>false</behind-reverse-proxy>-->
+
+        <!-- The following configuration options can be used when Wt is behind a reverse proxy.
+          -->
+        <trusted-proxy-config>
+          <!-- Which header to use to get the real client IP address when behind a reverse proxy.
+
+               This could be X-Forwarded-For (default), CF-Connecting-IP for Cloudflare,
+               True-Client-IP, Fastly-Client-IP,...
+
+               This will influence the IP address returned by WEnvironment::clientAddress() and
+               Http::Request::clientAddress().
+            -->
+          <original-ip-header>X-Forwarded-For</original-ip-header>
+
+          <!-- Which proxy servers are trusted
+
+               You can use single IP addresses or subnets in CIDR notation.
+
+               By default, no proxy servers are trusted and any proxy headers are ignored, e.g.
+               X-Forwarded-For, X-Forwarded-Proto, etc.
+            -->
+          <trusted-proxies>
+            <!-- loopback -->
+            <!--
+            <proxy>127.0.0.1/8</proxy>
+            <proxy>::1/128</proxy>
+            -->
+            <!-- link local -->
+            <!--
+            <proxy>169.254.0.0/16</proxy>
+            <proxy>fe80::/10</proxy>
+            -->
+            <!-- local -->
+            <!--
+            <proxy>10.0.0.0/8</proxy>
+            <proxy>172.16.0.0/12</proxy>
+            <proxy>192.168.0.0/16</proxy>
+            <proxy>fc00::/7</proxy>
+            -->
+          </trusted-proxies>
+        </trusted-proxy-config>
+
+        <!-- Whether inline CSS is allowed.
+
+           Some Wt widgets will insert CSS rules in the the inline
+           stylesheet when first used. This can be disabled using this
+           configuration option.
+
+           Note: some widgets, such as WTreeView and WTableView,
+           dynamically manipulate rules in this stylesheet, and will
+           no longer work properly when inline-css is disabled.
+          -->
+        <inline-css>true</inline-css>
+
+        <!-- The timeout before showing the loading indicator.
+
+           The value is specified in ms.
+          -->
+        <indicator-timeout>500</indicator-timeout>
+
+        <!-- The timeout for processing a double click event.
+
+           The value is specified in ms.
+          -->
+        <double-click-timeout>200</double-click-timeout>
+
+        <!-- Ajax user agent list
+
+           Wt considers three types of sessions:
+           - Ajax sessions: use Ajax and JavaScript
+           - plain HTML sessions: use plain old server GETs and POSTs
+           - bots: have clean internal paths and no persistent sessions
+
+           By default, Wt does a browser detection to distinguish between
+           the first two: if a browser supports JavaScript (and has it
+           enabled), and has an Ajax DOM API, then Ajax sessions are chosen,
+           otherwise plain HTML sessions.
+
+           Here, you may indicate which user agents should or should
+           not receive an Ajax session regardless of what they report as
+           capabilities.
+
+           Possible values for 'mode' are "white-list" or "black-list". A
+           white-list will only treat the listed agents as supporting Ajax,
+           all other agents will be served plain HTML sessions. A black-list
+           will always server plain HTML sessions to listed agents and
+           otherwise rely on browser capability detection.
+
+           Each <user-agent> is a regular expression.
+          -->
+        <user-agents type="ajax" mode="black-list">
+          <!-- <user-agent>.*Crappy browser.*</user-agent> -->
+        </user-agents>
+
+        <!-- Bot user agent list
+
+           Here, you can specify user agents that should be should be
+           treated as bots.
+
+           Each <user-agent> is a regular expression.
+          -->
+        <user-agents type="bot">
+            <user-agent>.*Googlebot.*</user-agent>
+            <user-agent>.*msnbot.*</user-agent>
+            <user-agent>.*Slurp.*</user-agent>
+            <user-agent>.*Crawler.*</user-agent>
+            <user-agent>.*Bot.*</user-agent>
+            <user-agent>.*ia_archiver.*</user-agent>
+            <user-agent>.*Twiceler.*</user-agent>
+            <user-agent>.*Yandex.*</user-agent>
+            <user-agent>.*Nutch.*</user-agent>
+            <user-agent>.*MJ12bot.*</user-agent>
+            <user-agent>.*Baiduspider.*</user-agent>
+            <user-agent>.*Ezooms.*</user-agent>
+            <user-agent>.*Sogou web spider.*</user-agent>
+            <user-agent>.*AhrefsBot.*</user-agent>
+        </user-agents>
+
+        <!-- Configures different rendering engines for certain browsers.
+
+           Currently this is only used to select IE7 compatible rendering
+           engine for IE8, which solves problems of unreliable and slow
+           rendering performance for VML which Microsoft broke in IE8.
+
+           Before 3.3.0, the default value was IE8=IE7, but since 3.3.0
+           this has been changed to an empty string (i.e. let IE8 use the
+           standard IE8 rendering engine) to take advantage of IE8's
+           improved CSS support. If you make heavy use of VML, you may need
+           to revert to IE8=IE7.
+          -->
+        <UA-Compatible></UA-Compatible>
+
+        <!-- Configures whether the progressive bootstrap method is used.
+
+           The default bootstrap method first senses whether there is Ajax
+           support, and only then creates the application.
+
+           The progressive bootstrap method first renders a plain HTML
+           version and later upgrades to an Ajax version.
+
+           (Not to be confused with the Twitter Bootstrap theme)
+          -->
+        <progressive-bootstrap>false</progressive-bootstrap>
+
+        <!-- Set session-ID cookie
+
+           In its default (and recommended) configuration, Wt does not
+           rely on cookies for session tracking.
+
+           Wt has several mechanisms in place to prevent session ID stealing:
+           - for an Ajax session, the session ID is not shown in the URL,
+             avoiding session ID stealing through a referer attack.
+           - in case the session ID is present in the URL (e.g. for a plain
+             HTML session), Wt will redirect links to images or external
+             anchors through an intermediate page that censors the session ID
+
+           In case of the loss of a session ID, the impact is minimized:
+           - a full page refresh is not supported if the client IP address
+             changes or the user-agent changes
+           - an Ajax update is protected by other state which is not exposed
+             in the URL
+
+           To still enable a full page refresh when the client IP address
+           changes, an additional cookie may be set which is used only
+           for this purpose, and can be enabled using this setting.
+          -->
+        <session-id-cookie>false</session-id-cookie>
+
+        <!-- Configure cookie checks
+
+         By default, Wt will test for cookie support using JavaScript.
+         Because cookie manipulation from JavaScript is a common security
+         risk vector, some prefer to disable these checks.
+
+         -->
+        <cookie-checks>true</cookie-checks>
+
+        <!-- Configure meta headers
+
+         The user-agent allows optional filtering based on the
+         user-agent, using a regular expression. You can have multiple
+         set-meta-headers definitions.
+
+         Deprecated: use <head-matter> instead.
+
+        <meta-headers user-agent=".*MSIE.*">
+          <meta name="robots" content="noindex" />
+        </meta-headers>
+         -->
+
+        <!-- Configure <head> matter
+
+          The user-agent allows optional filtering based on the
+          user-agent, using a regular expression. You can have multiple
+          head-matter definitions.
+
+          All contents will be inserted into the <head> tag
+          verbatim. This could be useful for setting <meta> tags or
+          <link> tags that are global for the entire application.
+        -->
+        <head-matter user-agent=".*MSIE.*">
+          <meta name="robots" content="noindex" />
+        </head-matter>
+
+        <!-- Configure allowed origins for CORS (only for WidgetSet entry points)
+
+         Since Wt 3.3.8, cross-origin requests are disallowed by default.
+
+         <allowed-origins> allows to selectively allow cross-origin requests
+         for WidgetSet entry points (cross-origin requests are always disallowed
+         for normal applications).
+
+         Use <allowed-origins> to determine which origins should be allowed.
+         Wt will only allow requests with an Origin header if it is an exact
+         match for one of the origins in the list.
+
+         "null" can be included in the list of allowed origins. In that case,
+         Wt responds with "Access-Control-Allow-Origin: *".
+
+         If <allowed-origins> is omitted or empty, no origins are allowed.
+
+         If <allowed-origins> contains * (the asterisk character),
+         all origins are allowed.
+          -->
+        <allowed-origins>
+          <!-- Leave empty to disallow all origins. -->
+
+          <!-- To allow any origin: -->
+          <!-- * -->
+
+          <!-- To allow only http://example.com and http://example.org: -->
+          <!-- http://example.com,http://example.org -->
+        </allowed-origins>
+
+        <!-- Runtime Properties
+
+           These properties may be used to adapt applications to their
+           deployment environment. Typical use is for paths to resources
+           that may or may not be shared between several applications.
+          -->
+        <properties>
+            <!-- baseURL property
+
+               The absolute URL at which the application is deployed
+               (known to the user). This is needed only in two scenarios.
+
+               a) use of relative URLs in included XHTML
+
+               When you use relative URLs for images, etc... in
+               literal XHTML fragments (e.g. in WTemplate), which need
+               to resolve against the deployment path of the
+               application. This will not work as expected in the
+               presence of an internal application path.  This URL is
+               set as base URL in the HTML, against which relative
+               URLs are resolved so that these work correctly
+               regardless of the internal path. It is also used
+               explicitly in any URL generated by the library.
+
+               b) widgetset mode deployments
+
+               Another situation in which you need to define the baseURL is
+               when deploying a widgetset mode application behind a reverse
+               proxy. A widgetset mode application uses only absolute URLs
+               because it may be hosted in a web page from an entirely
+               different domain.
+
+               By default, no baseURL is specified, in which case Wt will
+               avoid using absolute URLs. Relative URLs passed in API calls
+               will be "fixed" so that they resolve against the location of the
+               application deploy path, even in the presence of an
+               internal path.
+              -->
+            <!-- <property name="baseURL">"http://mysite.com/app</property> -->
+
+            <!-- resourcesURL property
+
+               The URL at which the resources/ folder is deployed that
+               comes distributed with Wt and contains auxiliary files
+               used to primarily for styles and themes.
+
+               The default value is 'resources/'
+              -->
+            <property name="resourcesURL">/resources/</property>
+
+            <!-- favicon property
+
+               By default, a browser will try to fetch a /favicon.ico icon
+               from the root of your web server which is used as an icon
+               for your application. You can specify an alternative location
+               by setting this property, or for an individual application
+               entry point by passing a location to WServer::addEntryPoint().
+              -->
+            <!-- <property name="favicon">images/favicon.ico</property> -->
+
+            <!-- leafletJSURL and leafletCSSURL properties
+
+               This is required if you want to use WLeafletMap, since leaflet itself is not bundled with Wt.
+               leafletJSURL should be a valid URL leading to the leaflet JavaScript, and leafletCSSURL to the leaflet CSS.
+              -->
+            <!-- <property name="leafletJSURL">https://unpkg.com/leaflet@1.5.1/dist/leaflet.js</property> -->
+            <!-- <property name="leafletCSSURL">https://unpkg.com/leaflet@1.5.1/dist/leaflet.css</property> -->
+
+            <!-- google_api_key property
+
+                The Google API key to be used with WGoogleMap.
+            -->
+            <!-- <property name="google_api_key"></property> -->
+
+            <!-- Mail properties
+
+              These properties can be used to change the default settings used by Wt::Mail::Client.
+
+             - smtp-host: the hostname (or IP address) of the SMTP server to connect to (defaults to "localhost")
+             - smtp-port: the port of the SMTP server to connect to (defaults to 25)
+             - smtp-self-host: the hostname that the mail client uses to identify itself (defaults to "localhost")
+             - smtp-transport-encryption: the encryption method to use in the mail client. This can be "none", "starttls", or "tls".
+                                          The default is "none" for no encryption.
+             - smtp-auth-method: the method to use for authentication. This can be "none", "plain", or "login".
+                                 The default is "none" for no authentication.
+             - smtp-auth-username: the username to use for authentication (defaults to empty)
+             - smtp-auth-password: the password to use for authentication (defaults to empty)
+            -->
+            <!-- <property name="smtp-host">localhost</property> -->
+            <!-- <property name="smtp-port">25</property> -->
+            <!-- <property name="smtp-self-host">localhost</property> -->
+            <!-- <property name="smtp-transport-encryption>none</property> -->
+            <!-- <property name="smtp-auth-method">none</property> -->
+            <!-- <property name="smtp-auth-username"></property> -->
+            <!-- <property name="smtp-auth-password"></property> -->
+
+            <!-- AuthService properties
+
+              These properties are used to configure AuthService.
+
+             - auth-mail-sender-name: the sender name when AuthService sends emails, defaults to "Wt Auth module"
+             - auth-mail-sender-address: the sender address when AuthService sends emails, defaults to "noreply-auth@www.webtoolkit.eu"
+            -->
+            <!-- <property name="auth-mail-sender-name">Wt Auth module</property> -->
+            <!-- <property name="auth-mail-sender-address">noreply-auth@www.webtoolkit.eu</property> -->
+
+            <!-- OAuthService properties
+
+              These properties are used to configure OAuthService.
+
+             - oauth2-secret: the secret used to create the OAuth2 'state' hash. By default,
+                              this is randomly generated, which is sufficient for single-process
+                              deployments, but for multi-process deployments the same value must
+                              be used in all processes and thus needs to be pre-configured.
+             - oauth2-redirect-timeout: a timeout (in seconds) for when single-sign-on is used
+                                        without popup. If a user takes longer than this to login,
+                                        the application will be destroyed. The default is 10 minutes.
+            -->
+            <!-- <property name="oauth2-secret"></property> -->
+            <!-- <property name="oauth2-redirect-timeout">600</property> -->
+
+            <!-- SAML properties
+
+              These properties are used to configure Saml::Service.
+
+              - saml-secret: the secret used to create the SAML 'RelayState'. By default,
+                             this is randomly generated, which is sufficient for single-process
+                             deployments, but for multi-process deployments the same value must
+                             be used in all processes and thus needs to be pre-configured.
+              - saml-redirect-timeout: a timeout (in seconds) for when single-sign-on is used
+                                       without popup. If a user takes longer than this to login,
+                                       the application will be destroyed. The default is 10 minutes.
+            -->
+            <!-- <property name="saml-secret"></property> -->
+            <!-- <property name="saml-redirect-timeout">600</property> -->
+
+            <!-- PayPal properties
+
+              These properties can be used to configure Wt::Payment::PayPalService,
+              by calling configureFromProperties().
+
+             - paypal-user: the PayPal API username
+             - paypal-password: the PayPal API password
+             - paypal-signature: the PayPal API signature
+             - paypal-api-server-url: the URL of the PayPal API server
+             - paypal-pay-server-url: the URL of the server where the user is redirected for the payment
+             - paypal-version: the PayPal API version
+            -->
+            <!-- <property name="paypal-user"></property>
+                 <property name="paypal-password"></property>
+                 <property name="paypal-signature"></property>
+                 <property name="paypal-api-server-url"></property>
+                 <property name="paypal-pay-server-url"></property>
+                 <property name="paypal-version"></property> -->
+
+            <!-- TinyMCE properties
+
+              These properties are used to configure TinyMCE for WTextEdit.
+
+             - tinyMCEVersion: the version of TinyMCE to use, currently version 3.x and 4.x are supported
+             - tinyMCEURL: the URL to the main TinyMCE script file
+             - tinyMCEBaseURL: the base URL where TinyMCE is deployed.
+                               The default is resourcesURL/tiny_mce for TinyMCE 3,
+                               and resourcesURL/tinymce for TinyMCE 4 or later.
+                               Note: resourcesURL refers to the resourcesURL property, which itself defaults to "resources/"
+            -->
+            <!-- <property name="tinyMCEVersion">3</property> -->
+            <!-- <property name="tinyMCEURL"></property> -->
+            <!-- <property name="tinyMCEBaseURL">resources/tiny_mce</property> -->
+        </properties>
+
+    </application-settings>
+
+
+    <!-- Override settings for specific applications.
+
+       Location refers to physical filesystem location of the
+       application. The application prints this location (which
+       corresponds to argv[0]) to the log file on startup, and this
+       should match exactly.
+      -->
+    <!--
+    <application-settings
+       location="/var/www/localhost/wt-examples/hello.wt">
+    </application-settings>
+    -->
+</server>

resources/wt_zh.xml

@@ -0,0 +1,278 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<messages nplurals="2"
+          plural="n == 1 ? 0 : 1">
+  <message id="Wt.QuittedMessage">
+    The application has stopped running, would you like to restart?
+  </message>
+
+  <message id="Wt.WAbstractItemView.PageIOfN"><b>{1}</b> of <b>{2}</b></message>
+  <message id="Wt.WAbstractItemView.PageBar.First">&#x00ab; First</message>
+  <message id="Wt.WAbstractItemView.PageBar.Previous">&#x2039; Previous</message>
+  <message id="Wt.WAbstractItemView.PageBar.Next">Next &#x203a;</message>
+  <message id="Wt.WAbstractItemView.PageBar.Last">Last &#x00bb;</message>
+
+  <message id="Wt.WCalendar.PrevMonth">&#x00ab;</message>
+  <message id="Wt.WCalendar.NextMonth">&#x00bb;</message>
+  <message id="Wt.WCalendar.today">Today</message>
+
+  <message id="Wt.WDate.Monday">Monday</message>
+  <message id="Wt.WDate.Tuesday">Tuesday</message>
+  <message id="Wt.WDate.Wednesday">Wednesday</message>
+  <message id="Wt.WDate.Thursday">Thursday</message>
+  <message id="Wt.WDate.Friday">Friday</message>
+  <message id="Wt.WDate.Saturday">Saturday</message>
+  <message id="Wt.WDate.Sunday">Sunday</message>
+  <message id="Wt.WDate.3.Mon">Mon</message>
+  <message id="Wt.WDate.3.Tue">Tue</message>
+  <message id="Wt.WDate.3.Wed">Wed</message>
+  <message id="Wt.WDate.3.Thu">Thu</message>
+  <message id="Wt.WDate.3.Fri">Fri</message>
+  <message id="Wt.WDate.3.Sat">Sat</message>
+  <message id="Wt.WDate.3.Sun">Sun</message>
+  <message id="Wt.WDate.January">January</message>
+  <message id="Wt.WDate.February">February</message>
+  <message id="Wt.WDate.March">March</message>
+  <message id="Wt.WDate.April">April</message>
+  <message id="Wt.WDate.May">May</message>
+  <message id="Wt.WDate.June">June</message>
+  <message id="Wt.WDate.July">July</message>
+  <message id="Wt.WDate.August">August</message>
+  <message id="Wt.WDate.September">September</message>
+  <message id="Wt.WDate.October">October</message>
+  <message id="Wt.WDate.November">November</message>
+  <message id="Wt.WDate.December">December</message>
+  <message id="Wt.WDate.3.Jan">Jan</message>
+  <message id="Wt.WDate.3.Feb">Feb</message>
+  <message id="Wt.WDate.3.Mar">Mar</message>
+  <message id="Wt.WDate.3.Apr">Apr</message>
+  <message id="Wt.WDate.3.May">May</message>
+  <message id="Wt.WDate.3.Jun">Jun</message>
+  <message id="Wt.WDate.3.Jul">Jul</message>
+  <message id="Wt.WDate.3.Aug">Aug</message>
+  <message id="Wt.WDate.3.Sep">Sep</message>
+  <message id="Wt.WDate.3.Oct">Oct</message>
+  <message id="Wt.WDate.3.Nov">Nov</message>
+  <message id="Wt.WDate.3.Dec">Dec</message>
+
+  <message id="Wt.WDatePicker.Close">Close</message>
+
+  <message id="Wt.WDateTime.LessThanASecond">less than a second</message>
+  <message id="Wt.WDateTime.seconds">
+    <plural case="0">one second</plural>
+    <plural case="1">{1} seconds</plural>
+  </message>
+  <message id="Wt.WDateTime.minutes">
+    <plural case="0">one minute</plural>
+    <plural case="1">{1} minutes</plural>
+  </message>
+  <message id="Wt.WDateTime.hours">
+    <plural case="0">one hour</plural>
+    <plural case="1">{1} hours</plural>
+  </message>
+  <message id="Wt.WDateTime.days">
+    <plural case="0">one day</plural>
+    <plural case="1">{1} days</plural>
+  </message>
+  <message id="Wt.WDateTime.weeks">
+    <plural case="0">one week</plural>
+    <plural case="1">{1} weeks</plural>
+  </message>
+  <message id="Wt.WDateTime.months">
+    <plural case="0">one month</plural>
+    <plural case="1">{1} months</plural>
+  </message>
+  <message id="Wt.WDateTime.years">
+    <plural case="0">one year</plural>
+    <plural case="1">{1} years</plural>
+  </message>
+  <message id="Wt.WDateTime.null"></message>
+
+  <message id="Wt.WDateValidator.DateTooEarly">The date must be after {1}</message>
+  <message id="Wt.WDateValidator.DateTooLate">The date must be before {1}</message>
+  <message id="Wt.WDateValidator.WrongDateRange">The date must be between {1} and {2}</message>
+  <message id="Wt.WDateValidator.WrongFormat">Must be a date in the format '{1}'</message>
+
+  <message id="Wt.WEmailValidator.Invalid">Must be a valid email address</message>
+  <message id="Wt.WEmailValidator.Invalid.Multiple">Must be a comma-separated list of email addresses</message>
+  <message id="Wt.WEmailValidator.NotMatching">Must be an email address matching the pattern '{1}'</message>
+  <message
+    id="Wt.WEmailValidator.NotMatching.Multiple">Must be a comma-separated list of email addresses matching the pattern '{1}'</message>
+
+  <message id="Wt.WTimeValidator.TimeTooEarly">The time must be after {1}</message>
+  <message id="Wt.WTimeValidator.TimeTooLate">The time must be before {1}</message>
+  <message id="Wt.WTimeValidator.WrongTimeRange">The time must be between {1} and {2}</message>
+  <message id="Wt.WTimeValidator.WrongFormat">Must be a time in the format '{1}'</message>
+
+  <message id="Wt.WDefaultLoadingIndicator.Loading">Loading...</message>
+
+  <message id="Wt.WDialog.template">
+    ${center-script}
+    ${layout}
+  </message>
+
+  <!-- From WDialog-center.js: -->
+  <message id="Wt.WDialog.CenterJS">
+    /* <![CDATA[ */
+      !function(e,t,n){window.addEventListener("DOMContentLoaded",(function(){const i=document.getElementById(e);if("none"!==i.style.display&&"hidden"!==i.style.visibility){const e=function(){let e,t;if("number"==typeof window.innerWidth){e=window.innerWidth;t=window.innerHeight}else{e=document.documentElement.clientWidth;t=document.documentElement.clientHeight}return{x:e,y:t}}(),o=i.offsetWidth,d=i.offsetHeight;if(t){i.style.left=Math.round((e.x-o)/2)+"px";i.style.marginLeft="0px"}if(n){i.style.top=Math.round((e.y-d)/2)+"px";i.style.marginTop="0px"}i.style.visibility="visible"}}),!1)}($el,$centerX,$centerY);
+    /* ]]> */
+  </message>
+
+  <message id="Wt.WDoubleValidator.NotANumber">Must be a number</message>
+  <message id="Wt.WDoubleValidator.TooSmall">The number must be larger than {1}</message>
+  <message id="Wt.WDoubleValidator.BadRange">The number must be in the range {1} to {2}</message>
+  <message id="Wt.WDoubleValidator.TooLarge">The number must be smaller than {1}</message>
+
+  <message id="Wt.WInPlaceEdit.Save">Save</message>
+  <message id="Wt.WInPlaceEdit.Cancel">Cancel</message>
+
+  <message id="Wt.WIntValidator.NotAnInteger">Must be an integer number</message>
+  <message id="Wt.WIntValidator.TooSmall">The number must be larger than {1}</message>
+  <message id="Wt.WIntValidator.BadRange">The number must be in the range {1} to {2}</message>
+  <message id="Wt.WIntValidator.TooLarge">The number must be smaller than {1}</message>
+
+  <message id="Wt.WLengthValidator.TooShort">The input must be at least {1} characters</message>
+  <message id="Wt.WLengthValidator.BadRange">The input must have a length between {1} and {2} characters</message>
+  <message id="Wt.WLengthValidator.TooLong">The input must be no more than {1} characters</message>
+
+  <message id="Wt.WMediaPlayer.play">Play</message>
+  <message id="Wt.WMediaPlayer.pause">Pause</message>
+  <message id="Wt.WMediaPlayer.stop">Stop</message>
+  <message id="Wt.WMediaPlayer.mute">Mute</message>
+  <message id="Wt.WMediaPlayer.unmute">Unmute</message>
+  <message id="Wt.WMediaPlayer.volume-max">Maximum volume</message>
+  <message id="Wt.WMediaPlayer.repeat">Repeat</message>
+  <message id="Wt.WMediaPlayer.repeat-off">Repeat off</message>
+  <message id="Wt.WMediaPlayer.video-play-icon">Play</message>
+  <message id="Wt.WMediaPlayer.full-screen">Full screen</message>
+  <message id="Wt.WMediaPlayer.restore-screen">Restore screen</message>
+
+  <message id="Wt.WMessageBox.Abort">Abort</message>
+  <message id="Wt.WMessageBox.Cancel">取消</message>
+  <message id="Wt.WMessageBox.Ignore">Ignore</message>
+  <message id="Wt.WMessageBox.No">No</message>
+  <message id="Wt.WMessageBox.NoToAll">No to All</message>
+  <message id="Wt.WMessageBox.Ok">Ok</message>
+  <message id="Wt.WMessageBox.Retry">Retry</message>
+  <message id="Wt.WMessageBox.Yes">Yes</message>
+  <message id="Wt.WMessageBox.YesToAll">Yes to All</message>
+
+  <message id="Wt.WOverlayLoadingIndicator.Loading">Loading...</message>
+
+  <message id="Wt.WRegExpValidator.Invalid">Invalid input</message>
+
+  <message id="Wt.WValidator.Invalid">This field cannot be empty</message>
+
+  <message id="Wt.true">true</message>
+  <message id="Wt.false">false</message>
+
+  <!-- templates -->
+
+  <message id="Wt.WMediaPlayer.template">
+    <div class="jp-type-single">
+      <div class="jp-jplayer"> </div>
+      ${gui}
+    </div>
+  </message>
+
+  <message id="Wt.WMediaPlayer.defaultgui-video">
+    <div class="jp-video-play">
+      ${video-play-btn}
+    </div>
+    <div class="jp-interface">
+      <div class="jp-progress">
+        ${progress-bar}
+      </div>
+      ${current-time}
+      ${duration}
+      <div class="jp-controls-holder">
+        <ul class="jp-controls">
+          <li>${play-btn}</li>
+          <li>${pause-btn}</li>
+          <li>${stop-btn}</li>
+          <li>${mute-btn}</li>
+          <li>${unmute-btn}</li>
+          <li>${volume-max-btn}</li>
+        </ul>
+        ${volume-bar}
+        <ul class="jp-toggles">
+          <li>${full-screen-btn}</li>
+          <li>${restore-screen-btn}</li>
+          <li>${repeat-btn}</li>
+          <li>${repeat-off-btn}</li>
+        </ul>
+      </div>
+      <div class="jp-title" style="display: ${title-display}">
+        <ul>
+          <li>${title}</li>
+        </ul>
+      </div>
+    </div>
+  </message>
+
+  <message id="Wt.WMediaPlayer.defaultgui-audio">
+    <div class="jp-interface">
+      <ul class="jp-controls">
+        <li>${play-btn}</li>
+        <li>${pause-btn}</li>
+        <li>${stop-btn}</li>
+        <li>${mute-btn}</li>
+        <li>${unmute-btn}</li>
+        <li>${volume-max-btn}</li>
+      </ul>
+      <div class="jp-progress">
+        ${progress-bar}
+      </div>
+      ${volume-bar}
+      <div class="jp-time-holder">
+        ${current-time}
+        ${duration}
+        <ul class="jp-toggles">
+          <li>${repeat-btn}</li>
+          <li>${repeat-off-btn}</li>
+        </ul>
+      </div>
+    </div>
+    <div class="jp-title" style="display: ${title-display}">
+      <ul>
+        <li>${title}</li>
+      </ul>
+    </div>
+  </message>
+
+  <message id="Wt.WNavigationBar.template">
+    <div class="navbar-inner">
+      <div class="container">
+        ${collapse-button}
+        ${expand-button}
+        ${title-link}
+        ${contents}
+      </div>
+    </div>
+  </message>
+
+  <message id="Wt.WNavigationBar.expand-button">
+    <span class="icon-bar"></span>
+    <span class="icon-bar"></span>
+    <span class="icon-bar"></span>
+  </message>
+
+  <message id="Wt.WTimePicker.template">
+    ${hour}${minute}${second}${millisecond}${ampm}
+  </message>
+
+  <message id="Wt.WTreeViewNode.template">
+    ${cols-row}${expand}${no-expand}${col0}
+  </message>
+
+  <message id="Wt.WTreeNode.template">
+    <div class="Wt-item ${trunk-class} ${selected}">
+      ${cols-row}${expand}${no-expand}${label-area}
+    </div>
+    <div style="clear: both"></div>
+    ${children}
+  </message>
+
+  <message id="Wt.WDialog.titlebar">
+    <h4>${title}</h4>
+  </message>
+</messages>