November 2012 - Aur-dev - lists.archlinux.org

[aur-dev] AUR 2.0.0 released
by Lukas Fleischer 03 Jan '13

03 Jan '13

We're glad to announce the release of the long-awaited AUR 2.0.0! The official AUR setup on aur.archlinux.org [1] will be updated soon. Please note that while I know that some AUR helpers have already been updated, other clients accessing the RPC or the HTML interface might need to be patched in order to work with the new release. Huge thanks fly out to canyonknight who contributed almost 50% of the patches that made the AUR 2.0.0 what it is today! As usual, you can check the Git log [2] for a complete list of changes. [1] https://aur.archlinux.org/ [2] http://projects.archlinux.org/aur.git/log/?id=v2.0.0

6 7

[aur-dev] [PATCH] Fix account privilege escalation vulnerability
by canyonknight 30 Nov '12

30 Nov '12

A check is only done to verify a Trusted User isn't promoting their account. An attacker can send tampered account type POST data to change their "User" level account to a "Developer" account. Add check so that all users cannot increase their own account permissions. Signed-off-by: canyonknight <canyonknight(a)gmail.com> Signed-off-by: Lukas Fleischer <archlinux(a)cryptocrack.de> --- Already applied to maint branch and aur.archlinux.org setup. Anyone using a custom AUR setup should apply this patch. web/lib/acctfuncs.inc.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index 81e06b6..a41659e 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -145,8 +145,8 @@ function process_account_form($UTYPE,$TYPE,$A,$U="",$T="",$S="",$E="", $error = __("The PGP key fingerprint is invalid."); } - if ($UTYPE == "Trusted User" && $T == 3) { - $error = __("A Trusted User cannot assign Developer status."); + if (($UTYPE == "User" && $T > 1) || ($UTYPE == "Trusted User" && $T > 2)) { + $error = __("Cannot increase account permissions."); } if (!$error && !array_key_exists($L, $SUPPORTED_LANGS)) { $error = __("Language is not currently supported."); -- 1.8.0.1

1 0

[aur-dev] [PATCH] Fix account editing and hijacking vulnerability
by canyonknight 30 Nov '12

30 Nov '12

Checks are in place to avoid users getting account editing forms they shouldn't have access to. The appropriate checks before editing the account in the backend are not in place. This vulnerability allows a user to craft malicious POST data to edit other user accounts, thereby allowing account hijacking. Add a new flexible function can_edit_account() to determine if a user has appropriate permissions. Run the permission check before processing any account information in the backend. Signed-off-by: canyonknight <canyonknight(a)gmail.com> Signed-off-by: Lukas Fleischer <archlinux(a)cryptocrack.de> --- Already applied to maint branch and aur.archlinux.org setup. Anyone using a custom AUR setup should apply this patch. web/html/account.php | 11 ++++++++--- web/lib/acctfuncs.inc.php | 29 +++++++++++++++++++++++++++++ 2 files changed, 37 insertions(+), 3 deletions(-) diff --git a/web/html/account.php b/web/html/account.php index 786ae02..cccdd76 100644 --- a/web/html/account.php +++ b/web/html/account.php @@ -73,9 +73,14 @@ if (isset($_COOKIE["AURSID"])) { } } elseif ($action == "UpdateAccount") { - # user is submitting their modifications to an existing account - # - if (check_token()) { + $uid = uid_from_sid($_COOKIE['AURSID']); + + /* Details for account being updated */ + $acctinfo = account_details(in_request('ID'), in_request('U')); + + /* Verify user permissions and that the request is a valid POST */ + if (can_edit_account($atype, $acctinfo, $uid) && check_token()) { + /* Update the details for the existing account */ process_account_form($atype, "edit", "UpdateAccount", in_request("U"), in_request("T"), in_request("S"), in_request("E"), in_request("P"), in_request("C"), diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index 3fd23ae..81e06b6 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -1015,3 +1015,32 @@ function cast_proposal_vote($voteid, $uid, $vote, $newtotal, $dbh=NULL) { $q = "INSERT INTO TU_Votes (VoteID, UserID) VALUES (" . intval($voteid) . ", " . intval($uid) . ")"; $result = $dbh->exec($q); } + +/** + * Verify a user has the proper permissions to edit an account + * + * @param string $atype Account type of the editing user + * @param array $acctinfo User account information for edited account + * @param int $uid User ID of the editing user + * + * @return bool True if permission to edit the account, otherwise false + */ +function can_edit_account($atype, $acctinfo, $uid) { + /* Developers can edit any account */ + if ($atype == 'Developer') { + return true; + } + + /* Trusted Users can edit all accounts except Developer accounts */ + if ($atype == 'Trusted User' && + $acctinfo['AccountType'] != 'Developer') { + return true; + } + + /* Users can edit only their own account */ + if ($acctinfo['ID'] == $uid) { + return true; + } + + return false; +} -- 1.8.0.1

1 0

[aur-dev] [PATCH] login.php: Properly link to logout page when already logged in
by canyonknight 21 Nov '12

21 Nov '12

Signed-off-by: canyonknight <canyonknight(a)gmail.com> --- web/html/login.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/web/html/login.php b/web/html/login.php index 9b3715b..e458fec 100644 --- a/web/html/login.php +++ b/web/html/login.php @@ -17,7 +17,7 @@ html_header('AUR ' . __("Login")); <?php if (isset($_COOKIE["AURSID"])): ?> <p> <?= __("Logged-in as: %s", '<strong>' . username_from_sid($_COOKIE["AURSID"]) . '</strong>'); ?> - <a href="<?php get_uri('/logout/'); ?>">[<?= __("Logout"); ?>]</a> + <a href="<?= get_uri('/logout/'); ?>">[<?= __("Logout"); ?>]</a> </p> <?php elseif (!$DISABLE_HTTP_LOGIN || (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'])): ?> <form method="post" action="<?= get_uri('/login') ?>"> -- 1.8.0

1 0

[aur-dev] [PATCH] index.php: Move voter page token check to switch control structure
by canyonknight 21 Nov '12

21 Nov '12

Voter page token check takes place in the same way as other existing token checks. Move the check for consistency. Signed-off-by: canyonknight <canyonknight(a)gmail.com> --- web/html/index.php | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/web/html/index.php b/web/html/index.php index 3b46ab9..a197d0b 100644 --- a/web/html/index.php +++ b/web/html/index.php @@ -22,12 +22,6 @@ if (!empty($tokens[1]) && '/' . $tokens[1] == get_pkg_route()) { } if (!empty($tokens[3])) { - if ($tokens[3] == 'voters') { - $_GET['ID'] = pkgid_from_name($tokens[2]); - include('voters.php'); - return; - } - /* TODO: Remove support for legacy URIs and move these * actions to separate modules. */ switch ($tokens[3]) { @@ -55,6 +49,10 @@ if (!empty($tokens[1]) && '/' . $tokens[1] == get_pkg_route()) { case "merge": include('pkgmerge.php'); return; + case "voters": + $_GET['ID'] = pkgid_from_name($tokens[2]); + include('voters.php'); + return; default: header("HTTP/1.0 404 Not Found"); include "./404.php"; -- 1.8.0

1 0

[aur-dev] [PATCH] Fix default selection in the account edit page
by Lukas Fleischer 18 Nov '12

18 Nov '12

We used a mixture of account type IDs and account type descriptions in the account edit page. This resulted in the account type field always defaulting to "Normal user" after an invalid form had been submitted. Consistently use account type IDs to avoid this. Signed-off-by: Lukas Fleischer <archlinux(a)cryptocrack.de> --- web/html/account.php | 2 +- web/template/account_edit_form.php | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/web/html/account.php b/web/html/account.php index 786ae02..1192da6 100644 --- a/web/html/account.php +++ b/web/html/account.php @@ -54,7 +54,7 @@ if (isset($_COOKIE["AURSID"])) { $row["AccountType"] != "Developer") || ($row["ID"] == uid_from_sid($_COOKIE["AURSID"]))) { display_account_form($atype, "UpdateAccount", $row["Username"], - $row["AccountType"], $row["Suspended"], $row["Email"], + $row["AccountTypeID"], $row["Suspended"], $row["Email"], "", "", $row["RealName"], $row["LangPreference"], $row["IRCNick"], $row["PGPKey"], $row["ID"]); } else { diff --git a/web/template/account_edit_form.php b/web/template/account_edit_form.php index 6c39d53..a41b34c 100644 --- a/web/template/account_edit_form.php +++ b/web/template/account_edit_form.php @@ -22,12 +22,12 @@ <p> <label for="id_type"><?= __("Account Type") ?>:</label> <select name="T" id="id_type"> - <?php if ($T == "User"): ?> + <?php if ($T == 1): ?> <option value="1" selected="selected"><?= __("Normal user") ?></option> <?php else: ?> <option value="1"><?= __("Normal user") ?></option> <?php endif; ?> - <?php if ($T == "Trusted User"): ?> + <?php if ($T == 2): ?> <option value="2" selected="selected"><?= __("Trusted user") ?></option> <?php else: ?> <option value="2"><?= __("Trusted user") ?></option> @@ -37,7 +37,7 @@ if ($UTYPE == "Developer"): ?> <option value="3" - <?php $T == "Developer" ? print " selected=\"selected\">" : print ">"; + <?php $T == 3 ? print " selected=\"selected\">" : print ">"; print __("Developer")."\n"; ?> </option> <?php endif; ?> -- 1.8.0

1 0

[aur-dev] [PATCH] gendummydata.py: Remove extra letter from dummy pkgrel
by canyonknight 15 Nov '12

15 Nov '12

Signed-off-by: canyonknight <canyonknight(a)gmail.com> --- support/schema/gendummydata.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/support/schema/gendummydata.py b/support/schema/gendummydata.py index 160dde5..68f58b6 100755 --- a/support/schema/gendummydata.py +++ b/support/schema/gendummydata.py @@ -76,7 +76,7 @@ def genVersion(): ver.append("%d" % random.randrange(0,20)) if random.randrange(0,2) == 0: ver.append("%d" % random.randrange(0,100)) - return ".".join(ver) + "-u%d" % random.randrange(1,11) + return ".".join(ver) + "-%d" % random.randrange(1,11) def genCategory(): return random.randrange(1,CATEGORIES_COUNT) def genUID(): -- 1.8.0

2 1

[aur-dev] [PATCH] pkgfuncs.inc.php: Rework query to avoid "Required by" duplicates
by canyonknight 15 Nov '12

15 Nov '12

Packages with multiple DepConditions are returned multiple times in the "Required by" column. Limit SQL results to distinct packages. Fixes FS#32478 Signed-off-by: canyonknight <canyonknight(a)gmail.com> --- Ignore previous duplicates fix. This works better as an SQL fix. web/lib/pkgfuncs.inc.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/web/lib/pkgfuncs.inc.php b/web/lib/pkgfuncs.inc.php index 8f84cdf..cfdd9a7 100644 --- a/web/lib/pkgfuncs.inc.php +++ b/web/lib/pkgfuncs.inc.php @@ -169,7 +169,7 @@ function package_required($name="", $dbh=NULL) { if(!$dbh) { $dbh = db_connect(); } - $q = "SELECT p.Name, PackageID FROM PackageDepends pd "; + $q = "SELECT DISTINCT p.Name, PackageID FROM PackageDepends pd "; $q.= "JOIN Packages p ON pd.PackageID = p.ID "; $q.= "WHERE DepName = " . $dbh->quote($name) . " "; $q.= "ORDER BY p.Name"; -- 1.8.0

2 1

[aur-dev] AUR 2.0.1 released
by Lukas Fleischer 07 Nov '12

07 Nov '12

Changes since 2.0.0: * Do not lowercase language selection entries (fixes FS#32453). * Add missing internationalization to a few strings (fixes FS#32449). * Remove plural from the adopt/disown button (fixes FS#32455). * Show a warning when split packages are submitted. * Avoid double slashes in notifications (fixes FS#32460). * Add proper "double slash handling" (fixes FS#32460). * Fix a potential XSS for package names and dependencies. You can check the Git log [1] for a complete list of cimmits. The official Arch Linux AUR setup [2] has already been upgraded! [1] https://projects.archlinux.org/aur.git/log/?id=v2.0.1 [2] https://aur.archlinux.org/

1 0

[aur-dev] [PATCH] pkg_details.php: Fix potential XSS for package names and dep conditions
by Lukas Fleischer 07 Nov '12

07 Nov '12

From: canyonknight <canyonknight(a)gmail.com> Package names and dep conditions can be specially crafted for an XSS attack. Properly sanitize these variables on the package details page. In addition, avoid including dep conditions as part of a package link. Signed-off-by: canyonknight <canyonknight(a)gmail.com> Signed-off-by: Lukas Fleischer <archlinux(a)cryptocrack.de> --- web/template/pkg_details.php | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/web/template/pkg_details.php b/web/template/pkg_details.php index cdf2764..b5d8a9f 100644 --- a/web/template/pkg_details.php +++ b/web/template/pkg_details.php @@ -190,9 +190,9 @@ if ($row["MaintainerUID"]): # darr: (DepName, DepCondition, PackageID), where ID is NULL if it didn't exist if (!is_null($darr[2])): ?> - <li><a href="<?= htmlspecialchars(get_pkg_uri($darr[0]), ENT_QUOTES); ?>" title="<?= __('View packages details for').' '.$darr[0].$darr[1]?>"><?= $darr[0].$darr[1]?></a></li> + <li><a href="<?= htmlspecialchars(get_pkg_uri($darr[0]), ENT_QUOTES); ?>" title="<?= __('View packages details for').' '. htmlspecialchars($darr[0]) ?>"><?= htmlspecialchars($darr[0]) ?></a><?= htmlspecialchars($darr[1]) ?></li> <?php else: ?> - <li><a href="https://www.archlinux.org/packages/?q=<?= urlencode($darr[0])?>" title="<?= __('View packages details for').' '.$darr[0].$darr[1] ?>"><?= $darr[0].$darr[1] ?></a></li> + <li><a href="https://www.archlinux.org/packages/?q=<?= urlencode($darr[0])?>" title="<?= __('View packages details for').' ' . htmlspecialchars($darr[0]) ?>"><?= htmlspecialchars($darr[0]) ?></a><?= htmlspecialchars($darr[1]) ?></li> <?php endif; ?> <?php endwhile; ?> </ul> @@ -206,7 +206,7 @@ if ($row["MaintainerUID"]): # darr: (PackageName, PackageID) while (list($k, $darr) = each($requiredby)): ?> - <li><a href="<?= htmlspecialchars(get_pkg_uri($darr[0]), ENT_QUOTES); ?>" title="<?= __('View packages details for').' '.$darr[0]?>"><?= $darr[0] ?></a></li> + <li><a href="<?= htmlspecialchars(get_pkg_uri($darr[0]), ENT_QUOTES); ?>" title="<?= __('View packages details for').' ' . htmlspecialchars($darr[0]) ?>"><?= htmlspecialchars($darr[0]) ?></a></li> <?php endwhile; ?> </ul> <?php endif; ?> -- 1.8.0

1 0