Allura/allura/public/nf/js/react.development.js (6 lines):
	- line 109: // TODO: this is special because it gets imported during build.
	- line 469: * properties which is confusing. TODO: Expose pendingState or don't use it
	- line 959: * TODO: Test that a single child and an array with one item have the same key
	- line 1696: // TODO: Drop this when these are no longer allowed as the type argument.
	- line 1794: // TODO: remove in React 17.0.
	- line 1807: // TODO: decide on the top-level export form.


ForgeActivity/forgeactivity/nf/activity/js/activity.js (4 lines):
	- line 66: // TODO: This could be made more generic by making the "interesting
	- line 92: // TODO: Page changes should pushState while just scroll changes
	- line 105: // TODO/FIXME: This doesn't record the page for forceAdvancedPaging, and since
	- line 230: $('.show-more').remove();  // TODO: could update HREFs instead of always re-creating links


Allura/allura/controllers/rest.py (3 lines):
	- line 239: # TODO: record and check nonces from reuse
	- line 243: # TODO: have application owner specify redirect uris, save on OAuthConsumerToken
	- line 656: # TODO: currently limited to 'admin' permissions instead of 'register' since not enough validation is in place.


Allura/allura/scripts/trac_export.py (2 lines):
	- line 149: # TODO: currently, any non-csv result treated as 403.
	- line 223: # TODO: Convert to Allura link syntax as needed


Allura/allura/model/repo_refresh.py (2 lines):
	- line 142: # TODO: use ArtifactReference.from_artifact?
	- line 151: # TODO: use Shortlink.from_artifact?


ForgeTracker/forgetracker/tracker_main.py (2 lines):
	- line 776: # TODO: This is a temporary fix for migrated projects, until we make
	- line 1763: # TODO: make milestone custom fields renameable


Allura/allura/lib/security.py (2 lines):
	- line 313: user's project role, return False and deny access.  TODO: make ACL order
	- line 372: # TODO: move deny logic into loop below; see ticket [#6715]


Allura/allura/templates_responsive/jinja_master/master.html (2 lines):
	- line 29: {% do g.register_forge_js('js/jquery.tooltipster.js') %}{#  TODO: use foundation #}
	- line 33: {% do g.register_forge_css('css/forge/tooltipster.css') %}{#  TODO: use foundation #}


Allura/allura/lib/markdown_extensions.py (2 lines):
	- line 49: # TODO: replace these with newer approach, see ForgeLinkPattern
	- line 354: # TODO: convert from extending Pattern to extending InlineProcessor


Allura/allura/lib/package_path_loader.py (2 lines):
	- line 122: **TODO:** Support multiple partial themes
	- line 145: # TODO: How does one handle project-theme?


Allura/allura/nf/allura/css/site_style.css (1 line):
	- line 35: TODO: hacky mixin until compass supports variable multi-arguments?


Allura/allura/lib/custom_middleware.py (1 line):
	- line 318: Timer('ming', ming.odm.odmsession.ODMCursor, 'next',  # FIXME: this may captures timings ok, but is misleading for counts


ForgeImporters/forgeimporters/github/wiki.py (1 line):
	- line 384: # TODO: add embedded images and file links


AlluraTest/alluratest/validation.py (1 line):
	- line 127: # TODO switch to http://validator.w3.org/nu/?out=text but it has more validation errors for us to fix


Allura/allura/lib/plugin.py (1 line):
	- line 548: # TODO: could also factor in User-Agent but hard to know what parts of the UA are meaningful to check here


Allura/allura/model/artifact.py (1 line):
	- line 201: # TODO: This should be refactored. We shouldn't be checking


Allura/allura/lib/helpers.py (1 line):
	- line 872: # TODO: replace with contextlib.redirect_stdout and redirect_stderr?


Allura/allura/model/notification.py (1 line):
	- line 389: FIXME: describe the Mailbox concept better.


scripts/ApacheAccessHandler.py (1 line):
	- line 92: return 'allow_write'  # TODO: Differentiate reads and write for Hg


Allura/allura/websetup/bootstrap.py (1 line):
	- line 235: # TODO: Hope that Ming can be improved to at least avoid stuff below


Allura/allura/scripts/refresh_last_commits.py (1 line):
	- line 164: FIXME: if its needed to recurse into subdirectories, and compute their LCDs as well, something along these


Allura/allura/app.py (1 line):
	- line 139: TODO: deprecate this; use a more clear method of building a tree


Allura/allura/lib/multifactor.py (1 line):
	- line 111: # TODO prohibit re-use of a successful code, although it seems unlikely with a 30s window