September 2012 - Aur-dev - lists.archlinux.org

[aur-dev] [PATCH] Do not notify if status is unchanged in pkg_flag()
by Lukas Fleischer 30 Sep '12

30 Sep '12

Check if a package actually changed its status before sending an email to prevent from spamming. Addresses FS#31745. Signed-off-by: Lukas Fleischer <archlinux(a)cryptocrack.de> --- web/lib/pkgfuncs.inc.php | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/web/lib/pkgfuncs.inc.php b/web/lib/pkgfuncs.inc.php index 6a7cbb5..06f348c 100644 --- a/web/lib/pkgfuncs.inc.php +++ b/web/lib/pkgfuncs.inc.php @@ -699,9 +699,13 @@ function pkg_flag ($atype, $ids, $action=… [View More]

1 0

[aur-dev] [PATCH] pkgfuncs.inc.php: Fix undefined variable notice
by Lukas Fleischer 30 Sep '12

30 Sep '12

Fixes a undefined variable notice in getvotes() that popped up when a package without any votes was requested. Signed-off-by: Lukas Fleischer <archlinux(a)cryptocrack.de> --- web/lib/pkgfuncs.inc.php | 1 + 1 file changed, 1 insertion(+) diff --git a/web/lib/pkgfuncs.inc.php b/web/lib/pkgfuncs.inc.php index 3589dbb..6a7cbb5 100644 --- a/web/lib/pkgfuncs.inc.php +++ b/web/lib/pkgfuncs.inc.php @@ -993,6 +993,7 @@ function getvotes($pkgid, $dbh=NULL) { return; } + $votes = array(); … [View More]

1 0

[aur-dev] [PATCH 1/3] Move package deletion to a separate page
by canyonknight 27 Sep '12

27 Sep '12

Package actions now have a separate box on the package details page. Make a package deletion link in that box. Link leads to a new page (pkgdel.php) that can be used to confirm package deletion. A separate page with confirmation is used to avoid CSRFs. Signed-off-by: canyonknight <canyonknight(a)gmail.com> --- web/html/index.php | 3 +++ web/html/pkgdel.php | 45 ++++++++++++++++++++++++++++++++++++++++++++ web/template/pkg_details.php | 3 +++ 3 files changed, 51 … [View More]insertions(+) create mode 100644 web/html/pkgdel.php diff --git a/web/html/index.php b/web/html/index.php index ce8fa52..3fe6338 100644 --- a/web/html/index.php +++ b/web/html/index.php @@ -43,6 +43,9 @@ if (isset($tokens[1]) && '/' . $tokens[1] == get_pkg_route()) { case "unflag": $_POST['do_UnFlag'] = __('UnFlag'); break; + case "delete": + include('pkgdel.php'); + return; } if (isset($_COOKIE['AURSID'])) { diff --git a/web/html/pkgdel.php b/web/html/pkgdel.php new file mode 100644 index 0000000..a581176 --- /dev/null +++ b/web/html/pkgdel.php @@ -0,0 +1,45 @@ +<?php + +set_include_path(get_include_path() . PATH_SEPARATOR . '../lib'); + +include_once("aur.inc.php"); +include_once("pkgfuncs.inc.php"); + +set_lang(); +check_sid(); + +html_header(__("Package Deletion")); + +$atype = ""; + +if (isset($_COOKIE["AURSID"])) { + $atype = account_from_sid($_COOKIE["AURSID"]); +} + +if ($atype == "Trusted User" || $atype == "Developer"): ?> +<div class="box"> + <h2><?php echo __('Delete Package: %s', htmlspecialchars($pkgname)) ?></h2> + <p> + <?php echo __('Use this form to delete the package (%s%s%s) from the AUR. ', + '<strong>', htmlspecialchars($pkgname), '</strong>' + ); + echo __('Deletion of a package is permanent. '); + echo __('Select the checkbox to confirm action.') ?> + </p> + <form action="<?php echo get_uri('/packages/'); ?>" method="post"> + <fieldset> + <input type="hidden" name="IDs[<?php echo $pkgid ?>]" value="1" /> + <input type="hidden" name="ID" value="<?php echo $pkgid ?>" /> + <input type="hidden" name="token" value="<?php echo htmlspecialchars($_COOKIE['AURSID']) ?>" /> + <p><input type="checkbox" name="confirm_Delete" value="1" /> + <?php echo __("Confirm package deletion") ?></p> + <p><input type="submit" class="button" name="do_Delete" value="<?php echo __("Delete") ?>" /></p> + </fieldset> + </form> +</div> + +<?php else: + print __("Only Trusted Users and Developers can delete packages."); +endif; + +html_footer(AUR_VERSION); diff --git a/web/template/pkg_details.php b/web/template/pkg_details.php index 4e9e073..dcc086b 100644 --- a/web/template/pkg_details.php +++ b/web/template/pkg_details.php @@ -54,6 +54,9 @@ $sources = package_sources($row["ID"]); <?php else: ?> <li><a href="<?= get_pkg_uri($row['Name']) . 'notify/'; ?>"><?= __('Notify of new comments'); ?></a></li> <?php endif; ?> + <?php if ($atype == "Trusted User" || $atype == "Developer"): ?> + <li><a href="<?= get_pkg_uri($row['Name']) . 'delete/'; ?>"><?= __('Delete Package'); ?></a></li> + <?php endif; ?> <?php endif; ?> </ul> <?php if ($uid): ?> -- 1.7.12.1 [View Less]

3 7

[aur-dev] [PATCH] pkg_details.php: Utilize account details virtual URL
by canyonknight 27 Sep '12

27 Sep '12

When virtual URLs are enabled, simpler links can be used to access a user's account details page. Change this for both the maintainer and submitter links. Keeps backwards compatibility with virtual URLs being disabled. Signed-off-by: canyonknight <canyonknight(a)gmail.com> --- web/template/pkg_details.php | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/web/template/pkg_details.php b/web/template/pkg_details.php index 182722d..b286664 100644 --- a/web/template/pkg_details.… [View More]

1 0

[aur-dev] [PATCH] aur.inc.php: Document all functions using PHPDoc format
by canyonknight 24 Sep '12

24 Sep '12

PHPDoc is a standardized format for commenting on PHP code. Using it allows for a more cohesive use of IDEs and documentation generators with the AUR code. Signed-off-by: canyonknight <canyonknight(a)gmail.com> --- web/lib/aur.inc.php | 231 +++++++++++++++++++++++++++++++++++++++++++--------- 1 file changed, 191 insertions(+), 40 deletions(-) diff --git a/web/lib/aur.inc.php b/web/lib/aur.inc.php index a23cd3e..93ae23b 100644 --- a/web/lib/aur.inc.php +++ b/web/lib/aur.inc.php @@ -16,… [View More]8 +16,19 @@ include_once("version.inc.php"); include_once("acctfuncs.inc.php"); include_once("cachefuncs.inc.php"); -# see if the visitor is already logged in -# +/** + * Check if a visitor is logged in + * + * Query "Sessions" table with supplied cookie. Determine if the cookie is valid + * or not. Unset the cookie if invalid or session timeout reached. Update the + * session timeout if it is still valid. + * + * @global array $_COOKIE User cookie values + * @global string $LOGIN_TIMEOUT Time until session times out + * @param \PDO $dbh Already established database connection + * + * @return void + */ function check_sid($dbh=NULL) { global $_COOKIE; global $LOGIN_TIMEOUT; @@ -77,8 +88,11 @@ function check_sid($dbh=NULL) { return; } -# Verify the supplied token matches the expected token for POST forms -# +/** + * Verify the supplied CSRF token matches expected token + * + * @return bool True if the CSRF token is the same as the cookie SID, otherwise false + */ function check_token() { if (isset($_POST['token'])) { return ($_POST['token'] == $_COOKIE['AURSID']); @@ -87,8 +101,13 @@ function check_token() { } } -# verify that an email address looks like it is legitimate -# +/** + * Verify a user supplied e-mail against RFC 3696 and DNS records + * + * @param string $addy E-mail address being validated in foo(a)example.com format + * + * @return bool True if e-mail passes validity checks, otherwise false + */ function valid_email($addy) { // check against RFC 3696 if (filter_var($addy, FILTER_VALIDATE_EMAIL) === false) { @@ -104,15 +123,23 @@ function valid_email($addy) { return true; } -# generate a (hopefully) unique session id -# +/** + * Generate a unique session ID + * + * @return string MD5 hash of the concatenated user IP, random number, and current time + */ function new_sid() { return md5($_SERVER['REMOTE_ADDR'] . uniqid(mt_rand(), true)); } - -# obtain the username if given their Users.ID -# +/** + * Determine the user's username in the database using a user ID + * + * @param string $id User's ID + * @param \PDO $dbh Already established database connection + * + * @return string Username if it exists, otherwise "None" + */ function username_from_id($id="", $dbh=NULL) { if (!$id) { return ""; @@ -130,9 +157,14 @@ function username_from_id($id="", $dbh=NULL) { return $row[0]; } - -# obtain the username if given their current SID -# +/** + * Determine the user's username in the database using a session ID + * + * @param string $sid User's session ID + * @param \PDO $dbh Already established database connection + * + * @return string Username of the visitor + */ function username_from_sid($sid="", $dbh=NULL) { if (!$sid) { return ""; @@ -153,8 +185,14 @@ function username_from_sid($sid="", $dbh=NULL) { return $row[0]; } -# obtain the email address if given their current SID -# +/** + * Determine the user's e-mail address in the database using a session ID + * + * @param string $sid User's session ID + * @param \PDO $dbh Already established database connection + * + * @return string User's e-mail address as given during registration + */ function email_from_sid($sid="", $dbh=NULL) { if (!$sid) { return ""; @@ -175,9 +213,14 @@ function email_from_sid($sid="", $dbh=NULL) { return $row[0]; } -# obtain the account type if given their current SID -# Return either "", "User", "Trusted User", "Developer" -# +/** + * Determine the user's account type in the database using a session ID + * + * @param string $sid User's session ID + * @param \PDO $dbh Already established database connection + * + * @return string Account type of user ("User", "Trusted User", or "Developer") + */ function account_from_sid($sid="", $dbh=NULL) { if (!$sid) { return ""; @@ -199,8 +242,14 @@ function account_from_sid($sid="", $dbh=NULL) { return $row[0]; } -# obtain the Users.ID if given their current SID -# +/** + * Determine the user's ID in the database using a session ID + * + * @param string $sid User's session ID + * @param \PDO $dbh Already established database connection + * + * @return string|int The user's name, 0 on query failure + */ function uid_from_sid($sid="", $dbh=NULL) { if (!$sid) { return ""; @@ -221,8 +270,11 @@ function uid_from_sid($sid="", $dbh=NULL) { return $row[0]; } -# connect to the database -# +/** + * Establish a connection with a database using PDO + * + * @return \PDO A database connection + */ function db_connect() { try { $dbh = new PDO(AUR_db_DSN_prefix . ":" . AUR_db_host . ";dbname=" . AUR_db_name, AUR_db_user, AUR_db_pass); @@ -236,8 +288,15 @@ function db_connect() { return $dbh; } -# common header -# +/** + * Common AUR header displayed on all pages + * + * @global string $LANG Language selected by the visitor + * @global array $SUPPORTED_LANGS Languages that are supported by the AUR + * @param string $title Name of the AUR page to be displayed on browser + * + * @return void + */ function html_header($title="") { global $LANG; global $SUPPORTED_LANGS; @@ -248,16 +307,27 @@ function html_header($title="") { return; } - -# common footer -# +/** + * Common AUR footer displayed on all pages + * + * @param string $ver The AUR version + * + * @return void + */ function html_footer($ver="") { include('footer.php'); return; } -# check to see if the user can submit a package -# +/** + * Determine if a user has permission to submit a package + * + * @param string $name Name of the package to be submitted + * @param string $sid User's session ID + * @param \PDO $dbh Already established database connection + * + * @return int 0 if the user can't submit, 1 if the user can submit + */ function can_submit_pkg($name="", $sid="", $dbh=NULL) { if (!$name || !$sid) {return 0;} if(!$dbh) { @@ -280,8 +350,13 @@ function can_submit_pkg($name="", $sid="", $dbh=NULL) { return 0; } -# recursive delete directory -# +/** + * Recursively delete a directory + * + * @param string $dirname Name of the directory to be removed + * + * @return void + */ function rm_tree($dirname) { if (empty($dirname) || !is_dir($dirname)) return; @@ -302,8 +377,14 @@ function rm_tree($dirname) { return; } -# obtain the uid given a Users.Username -# + /** + * Determine the user's ID in the database using a username + * + * @param string $username The username of an account + * @param \PDO $dbh Already established database connection + * + * @return string Return user ID if exists for username, otherwise "None" + */ function uid_from_username($username="", $dbh=NULL) { if (!$username) { return ""; @@ -321,8 +402,14 @@ function uid_from_username($username="", $dbh=NULL) { return $row[0]; } -# obtain the uid given a Users.Email -# +/** + * Determine the user's ID in the database using an e-mail address + * + * @param string $email An e-mail address in foo(a)example.com format + * @param \PDO $dbh Already established database connection + * + * @return string The user's ID + */ function uid_from_email($email="", $dbh=NULL) { if (!$email) { return ""; @@ -340,8 +427,11 @@ function uid_from_email($email="", $dbh=NULL) { return $row[0]; } -# check user privileges -# +/** + * Determine if a user has TU or Developer privileges + * + * @return bool Return true if the user is a TU or developer, otherwise false + */ function check_user_privileges() { $type = account_from_sid($_COOKIE['AURSID']); return ($type == 'Trusted User' || $type == 'Developer'); @@ -353,10 +443,10 @@ function check_user_privileges() { * Makes a clean string of variables for use in URLs based on current $_GET and * list of values to edit/add to that. Any empty variables are discarded. * - * ex. print "http://example.com/test.php?" . mkurl("foo=bar&bar=baz") + * @example print "http://example.com/test.php?" . mkurl("foo=bar&bar=baz") * * @param string $append string of variables and values formatted as in URLs - * ex. mkurl("foo=bar&bar=baz") + * * @return string clean string of variables to append to URL, urlencoded */ function mkurl($append) { @@ -381,6 +471,14 @@ function mkurl($append) { return substr($out, 5); } +/** + * Determine a user's salt from the database + * + * @param string $user_id The user ID of the user trying to log in + * @param \PDO $dbh Already established database connection + * + * @return string|void Return the salt for the requested user, otherwise void + */ function get_salt($user_id, $dbh=NULL) { if(!$dbh) { $dbh = db_connect(); @@ -394,6 +492,13 @@ function get_salt($user_id, $dbh=NULL) { return; } +/** + * Save a user's salted password in the database + * + * @param string $user_id The user ID of the user who is salting their password + * @param string $passwd The password of the user logging in + * @param \PDO $dbh Already established database connection + */ function save_salt($user_id, $passwd, $dbh=NULL) { if(!$dbh) { $dbh = db_connect(); @@ -405,10 +510,23 @@ function save_salt($user_id, $passwd, $dbh=NULL) { $result = $dbh->exec($q); } +/** + * Generate a string to be used for salting passwords + * + * @return string MD5 hash of concatenated random number and current time + */ function generate_salt() { return md5(uniqid(mt_rand(), true)); } +/** + * Combine salt and password to form a hash + * + * @param string $passwd User plaintext password + * @param string $salt MD5 hash to be used as user salt + * + * @return string The MD5 hash of the concatenated salt and user password + */ function salted_hash($passwd, $salt) { if (strlen($salt) != 32) { trigger_error('Salt does not look like an md5 hash', E_USER_WARNING); @@ -416,6 +534,13 @@ function salted_hash($passwd, $salt) { return md5($salt . $passwd); } +/** + * Process submitted comments so any links can be followed + * + * @param string $comment Raw user submitted package comment + * + * @return string User comment with links printed in HTML + */ function parse_comment($comment) { $url_pattern = '/(\b(?:https?|ftp):\/\/[\w\/\#~:.?+=&%@!\-;,]+?' . '(?=[.:?\-;,]*(?:[^\w\/\#~:.?+=&%@!\-;,]|$)))/iS'; @@ -439,6 +564,11 @@ function parse_comment($comment) { return $html; } +/** + * Wrapper for beginning a database transaction + * + * @param \PDO $dbh Already established database connection + */ function begin_atomic_commit($dbh=NULL) { if(!$dbh) { $dbh = db_connect(); @@ -446,6 +576,11 @@ function begin_atomic_commit($dbh=NULL) { $dbh->beginTransaction(); } +/** + * Wrapper for committing a database transaction + * + * @param \PDO $dbh Already established database connection + */ function end_atomic_commit($dbh=NULL) { if(!$dbh) { $dbh = db_connect(); @@ -453,6 +588,14 @@ function end_atomic_commit($dbh=NULL) { $dbh->commit(); } +/** + * + * Determine the row ID for the most recently insterted row + * + * @param \PDO $dbh Already established database connection + * + * @return string The ID of the last inserted row + */ function last_insert_id($dbh=NULL) { if(!$dbh) { $dbh = db_connect(); @@ -460,6 +603,14 @@ function last_insert_id($dbh=NULL) { return $dbh->lastInsertId(); } +/** + * Determine package information for latest package + * + * @param int $numpkgs Number of packages to get information on + * @param \PDO $dbh Already established database connection + * + * @return array $packages Package info for the specified number of recent packages + */ function latest_pkgs($numpkgs, $dbh=NULL) { if(!$dbh) { $dbh = db_connect(); -- 1.7.12.1 [View Less]

2 1

[aur-dev] [PATCH] stats.inc.php: Document all functions using PHPDoc format
by canyonknight 23 Sep '12

23 Sep '12

Signed-off-by: canyonknight <canyonknight(a)gmail.com> --- web/lib/stats.inc.php | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/web/lib/stats.inc.php b/web/lib/stats.inc.php index 2c26d43..60973e9 100644 --- a/web/lib/stats.inc.php +++ b/web/lib/stats.inc.php @@ -2,6 +2,13 @@ include_once('aur.inc.php'); +/** + * Display the most recent 10 packages + * + * @param \PDO $dbh An already established database connection + * + * @return void + */ function … [View More]

1 0

[aur-dev] [PATCH] acctfuncs.inc.php: Document all functions using PHPDoc format
by canyonknight 23 Sep '12

23 Sep '12

Signed-off-by: canyonknight <canyonknight(a)gmail.com> --- web/lib/acctfuncs.inc.php | 351 +++++++++++++++++++++++++++++++++++----------- 1 file changed, 270 insertions(+), 81 deletions(-) diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index 8c96e6f..bce00f8 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -1,6 +1,12 @@ <?php -# Helper function- retrieve request param if available, "" otherwise +/** + * Determine if an HTTP request … [View More]variable is set + * + * @param string $name The request variable to test for + * + * @return string Return the value of the request variable, otherwise blank + */ function in_request($name) { if (isset($_REQUEST[$name])) { return $_REQUEST[$name]; @@ -8,7 +14,13 @@ function in_request($name) { return ""; } -# Format PGP key fingerprint +/** + * Format the PGP key fingerprint + * + * @param string $fingerprint An unformatted PGP key fingerprint + * + * @return string PGP fingerprint with spaces every 4 characters + */ function html_format_pgp_fingerprint($fingerprint) { if (strlen($fingerprint) != 40 || !ctype_xdigit($fingerprint)) { return $fingerprint; @@ -26,49 +38,58 @@ function html_format_pgp_fingerprint($fingerprint) { substr($fingerprint, 36, 4) . " ", ENT_QUOTES); } -# Display the standard Account form, pass in default values if any - +/** + * Loads the account editing form, with any values that are already saved + * + * @global array $SUPPORTED_LANGS Languages that are supported by the AUR + * @param string $UTYPE User type of the account accessing the form + * @param string $A Form to use, either UpdateAccount or NewAccount + * @param string $U The username to display + * @param string $T The account type of the displayed user + * @param string $S Whether the displayed user has a suspended account + * @param string $E The e-mail address of the displayed user + * @param string $P The password value of the displayed user + * @param string $C The confirmed password value of the displayed user + * @param string $R The real name of the displayed user + * @param string $L The language preference of the displayed user + * @param string $I The IRC nickname of the displayed user + * @param string $K The PGP key fingerprint of the displayed user + * @param string $UID The user ID of the displayed user + * + * @return void + */ function display_account_form($UTYPE,$A,$U="",$T="",$S="", $E="",$P="",$C="",$R="",$L="",$I="",$K="",$UID=0) { - # UTYPE: what user type the form is being displayed for - # A: what "form" name to use - # U: value to display for username - # T: value to display for account type - # S: value to display for account suspended - # E: value to display for email address - # P: password value - # C: confirm password value - # R: value to display for RealName - # L: value to display for Language preference - # I: value to display for IRC nick - # N: new package notify value - # UID: Users.ID value in case form is used for editing - global $SUPPORTED_LANGS; include("account_edit_form.php"); return; } # function display_account_form() - -# process form input from a new/edit account form -# +/** + * Process information given to new/edit account form + * + * @global array $SUPPORTED_LANGS Languages that are supported by the AUR + * @param string $UTYPE The account type of the user modifying the account + * @param string $TYPE Either "edit" for editing or "new" for registering an account + * @param string $A Form to use, either UpdateAccount or NewAccount + * @param string $U The username for the account + * @param string $T The account type for the user + * @param string $S Whether or not the account is suspended + * @param string $E The e-mail address for the user + * @param string $P The password for the user + * @param string $C The confirmed password for the user + * @param string $R The real name of the user + * @param string $L The language preference of the user + * @param string $I The IRC nickname of the user + * @param string $K The PGP fingerprint of the user + * @param string $UID The user ID of the modified account + * @param \PDO $dbh An already established database connection + * + * @return string|void Return void if successful, otherwise return error + */ function process_account_form($UTYPE,$TYPE,$A,$U="",$T="",$S="",$E="", $P="",$C="",$R="",$L="",$I="",$K="",$UID=0,$dbh=NULL) { - # UTYPE: The user's account type - # TYPE: either "edit" or "new" - # A: what parent "form" name to use - # U: value to display for username - # T: value to display for account type - # S: value to display for account suspended - # E: value to display for email address - # P: password value - # C: confirm password value - # R: value to display for RealName - # L: value to display for Language preference - # I: value to display for IRC nick - # N: new package notify value - # UID: database Users.ID value # error check and process request for a new/modified account global $SUPPORTED_LANGS; @@ -236,27 +257,35 @@ function process_account_form($UTYPE,$TYPE,$A,$U="",$T="",$S="",$E="", return; } -# search existing accounts -# +/** + * Include the search accounts form + * + * @return void + */ function search_accounts_form() { include("search_accounts_form.php"); return; } - -# search results page -# +/** + * Display the search results page + * + * @param string $UTYPE User type of the account accessing the form + * @param string $O The offset for the results page + * @param string $SB The column to sort the results page by + * @param string $U The username search criteria + * @param string $T The account type search criteria + * @param string $S Whether the account is suspended search criteria + * @param string $E The e-mail address search criteria + * @param string $R The real name search criteria + * @param string $I The IRC nickname search criteria + * @param string $K The PGP key fingerprint search criteria + * @param \PDO $dbh An already established database connection + * + * @return void + */ function search_results_page($UTYPE,$O=0,$SB="",$U="",$T="", $S="",$E="",$R="",$I="",$K="",$dbh=NULL) { - # UTYPE: what account type the user belongs to - # O: what row offset we're at - # SB: how to sort the results - # U: value to display for username - # T: value to display for account type - # S: value to display for account suspended - # E: value to display for email address - # R: value to display for RealName - # I: value to display for IRC nick $HITS_PER_PAGE = 50; if ($O) { @@ -349,9 +378,14 @@ function search_results_page($UTYPE,$O=0,$SB="",$U="",$T="", return; } -/* - * Returns SID (Session ID) and error (error message) in an array - * SID of 0 means login failed. +/** + * Attempt to login and generate a session + * + * @global int $MAX_SESSIONS_PER_USER Maximum sessions a single user may have open + * @global int $PERSISTENT_COOKIE_TIMEOUT Time until cookie expires + * @param \PDO $dbh An already established database connection + * + * @return array Session ID for user, error message if applicable */ function try_login($dbh=NULL) { global $MAX_SESSIONS_PER_USER, $PERSISTENT_COOKIE_TIMEOUT; @@ -441,14 +475,17 @@ function try_login($dbh=NULL) { return array('SID' => $new_sid, 'error' => $login_error); } -/* - * Only checks if the name itself is valid - * Longer or equal to USERNAME_MIN_LEN - * Shorter or equal to USERNAME_MAX_LEN - * Starts and ends with a letter or number - * Contains at most ONE dot, hyphen, or underscore - * Returns the username if it is valid - * Returns nothing if it isn't valid +/** + * Validate a username against a collection of rules + * + * The username must be longer or equal to USERNAME_MIN_LEN. It must be shorter + * or equal to USERNAME_MAX_LEN. It must start and end with either a letter or + * a number. It can contain one period, hypen, or underscore. Returns username + * if it meets all of those rules. + * + * @param string $user Username to validate + * + * @return string|void Return username if it meets criteria, otherwise void */ function valid_username($user) { if (!empty($user)) { @@ -472,9 +509,13 @@ function valid_username($user) { return; } -/* - * Checks if the username is valid and if it exists in the database - * Returns the username ID or nothing +/** + * Determine if a username exists in the database + * + * @param string $user Username to check in the database + * @param \PDO $dbh An already established database connection + * + * @return string|void Return user ID if in database, otherwise void */ function valid_user($user, $dbh=NULL) { /* if ( $user = valid_username($user) ) { */ @@ -497,7 +538,14 @@ function valid_user($user, $dbh=NULL) { return; } -# Check for any open proposals about a user. Used to prevent multiple proposals. +/** + * Determine if a user already has a proposal open about themselves + * + * @param string $user Username to checkout for open proposal + * @param \PDO $dbh An already established database connection + * + * @return bool True if there is an open proposal about the user, otherwise false + */ function open_user_proposals($user, $dbh=NULL) { if(!$dbh) { $dbh = db_connect(); @@ -513,8 +561,17 @@ function open_user_proposals($user, $dbh=NULL) { } } -# Creates a new trusted user proposal from entered agenda. -# Optionally takes proposal about specific user. Length of vote set by submitter. +/** + * Add a new Trusted User proposal to the database + * + * @param string $agenda The agenda of the vote + * @param string $user The use the vote is about + * @param int $votelength The length of time for the vote to last + * @param string $submitteruid The user ID of the individual who submitted the proposal + * @param \PDO $dbh An already established database connection + * + * @return void + */ function add_tu_proposal($agenda, $user, $votelength, $submitteruid, $dbh=NULL) { if(!$dbh) { $dbh = db_connect(); @@ -527,7 +584,15 @@ function add_tu_proposal($agenda, $user, $votelength, $submitteruid, $dbh=NULL) $result = $dbh->exec($q); } -# Add a reset key for a specific user +/** + * Add a reset key to the database for a specified user + * + * @param string $resetkey A password reset key to be stored in database + * @param string $uid The user ID to store the reset key for + * @param \PDO $dbh An already established database connection + * + * @return void + */ function create_resetkey($resetkey, $uid, $dbh=NULL) { if(!$dbh) { $dbh = db_connect(); @@ -538,7 +603,17 @@ function create_resetkey($resetkey, $uid, $dbh=NULL) { $dbh->exec($q); } -# Change a password and save the salt only if reset key and email are correct +/** + * Change a user's password in the database if reset key and e-mail are correct + * + * @param string $hash New MD5 hash of a user's password + * @param string $salt New salt for the user's password + * @param string $resetkey Code e-mailed to a user to reset a password + * @param string $email E-mail address of the user resetting their password + * @param \PDO $dbh An already established database connection + * + * @return string|void Redirect page if successful, otherwise return error message + */ function password_reset($hash, $salt, $resetkey, $email, $dbh=NULL) { if(!$dbh) { $dbh = db_connect(); @@ -561,6 +636,13 @@ function password_reset($hash, $salt, $resetkey, $email, $dbh=NULL) { } } +/** + * Determine if the password is longer than the minimum length + * + * @param string $passwd The password to check + * + * @return bool True if longer than minimum length, otherwise false + */ function good_passwd($passwd) { if ( strlen($passwd) >= PASSWD_MIN_LEN ) { return true; @@ -568,8 +650,14 @@ function good_passwd($passwd) { return false; } -/* Verifies that the password is correct for the userID specified. - * Returns true or false +/** + * Determine if the password is correct and salt it if it hasn't been already + * + * @param string $userID The user ID to check the password against + * @param string $passwd The password the visitor sent + * @param \PDO $dbh An already established database connection + * + * @return bool True if password was correct and properly salted, otherwise false */ function valid_passwd($userID, $passwd, $dbh=NULL) { if (!$dbh) { @@ -613,16 +701,25 @@ function valid_passwd($userID, $passwd, $dbh=NULL) { return false; } -/* - * Checks if the PGP key fingerprint is valid (must be 40 hexadecimal digits). +/** + * Determine if the PGP key fingerprint is valid (must be 40 hexadecimal digits) + * + * @param string $fingerprint PGP fingerprint to check if valid + * + * @return bool True if the fingerprint is 40 hexadecimal digits, otherwise false */ function valid_pgp_fingerprint($fingerprint) { $fingerprint = str_replace(" ", "", $fingerprint); return (strlen($fingerprint) == 40 && ctype_xdigit($fingerprint)); } -/* - * Is the user account suspended? +/** + * Determine if the user account has been suspended + * + * @param string $id The ID of user to check if suspended + * @param \PDO $dbh An already established database connection + * + * @return bool True if the user is suspended, otherwise false */ function user_suspended($id, $dbh=NULL) { if (!$dbh) { @@ -642,8 +739,13 @@ function user_suspended($id, $dbh=NULL) { return false; } -/* - * This should be expanded to return something +/** + * Delete a specified user account from the database + * + * @param int $id The user ID of the account to be deleted + * @param \PDO $dbh An already established database connection + * + * @return void */ function user_delete($id, $dbh=NULL) { if (!$dbh) { @@ -654,9 +756,13 @@ function user_delete($id, $dbh=NULL) { return; } -/* - * A different way of determining a user's privileges - * rather than account_from_sid() +/** + * Determine if a user is either a Trusted User or Developer + * + * @param string $id The ID of the user to check if privileged + * @param \PDO $dbh An already established database connection + * + * @return int|string Return 0 if un-privileged, "2" if Trusted User, "3" if Developer */ function user_is_privileged($id, $dbh=NULL) { if (!$dbh) { @@ -674,7 +780,14 @@ function user_is_privileged($id, $dbh=NULL) { } -# Remove session on logout +/** + * Remove the session from the database on logout + * + * @param string $sid User's session ID + * @param \PDO $dbh An already established database connection + * + * @return void + */ function delete_session_id($sid, $dbh=NULL) { if(!$dbh) { $dbh = db_connect(); @@ -684,7 +797,14 @@ function delete_session_id($sid, $dbh=NULL) { $dbh->query($q); } -# Clear out old expired sessions. +/** + * Remove sessions from the database that have exceed the timeout + * + * @global int $LOGIN_TIMEOUT Time until session expires + * @param \PDO $dbh An already established database connection + * + * @return void + */ function clear_expired_sessions($dbh=NULL) { global $LOGIN_TIMEOUT; @@ -698,6 +818,15 @@ function clear_expired_sessions($dbh=NULL) { return; } +/** + * Get account details for a specific user + * + * @param string $uid The User ID of account to get information for + * @param string $username The username of the account to get for + * @param \PDO $dbh An already established database connection + * + * @return array Account details for the specified user + */ function account_details($uid, $username, $dbh=NULL) { if(!$dbh) { $dbh = db_connect(); @@ -719,6 +848,15 @@ function account_details($uid, $username, $dbh=NULL) { return $row; } +/** + * Determine if a user has already voted on a specific proposal + * + * @param string $voteid The ID of the Trusted User proposal + * @param string $uid The ID to check if the user already voted + * @param \PDO $dbh An already established database connection + * + * @return bool True if the user has already voted, otherwise false + */ function tu_voted($voteid, $uid, $dbh=NULL) { if (!$dbh) { $dbh = db_connect(); @@ -735,6 +873,14 @@ function tu_voted($voteid, $uid, $dbh=NULL) { } } +/** + * Get all current Trusted User proposals from the database + * + * @param string $order Ascending or descending order for the proposal listing + * @param \PDO $dbh An already established database connection + * + * @return array The details for all current Trusted User proposals + */ function current_proposal_list($order, $dbh=NULL) { if (!$dbh) { $dbh = db_connect(); @@ -751,6 +897,15 @@ function current_proposal_list($order, $dbh=NULL) { return $details; } +/** + * Get a subset of all past Trusted User proposals from the database + * + * @param string $order Ascending or descending order for the proposal listing + * @param string $lim The number of proposals to list with the offset + * @param \PDO $dbh An already established database connection + * + * @return array The details for the subset of past Trusted User proposals + */ function past_proposal_list($order, $lim, $dbh=NULL) { if (!$dbh) { $dbh = db_connect(); @@ -767,6 +922,13 @@ function past_proposal_list($order, $lim, $dbh=NULL) { return $details; } +/** + * Determine the total number of Trusted User proposals + * + * @param \PDO $dbh An already established database connection + * + * @return string The total number of Trusted User proposals + */ function proposal_count($dbh=NULL) { if (!$dbh) { $dbh = db_connect(); @@ -779,6 +941,14 @@ function proposal_count($dbh=NULL) { return $row[0]; } +/** + * Get all details related to a specific vote from the database + * + * @param string $voteid The ID of the Trusted User proposal + * @param \PDO $dbh An already established database connection + * + * @return array All stored details for a specific vote + */ function vote_details($voteid, $dbh=NULL) { if (!$dbh) { $dbh = db_connect(); @@ -793,6 +963,14 @@ function vote_details($voteid, $dbh=NULL) { return $row; } +/** + * Get an alphabetical list of users who voted for a proposal with HTML links + * + * @param string $voteid The ID of the Trusted User proposal + * @param \PDO $dbh An already established database connection + * + * @return array All users (and HTML links) who voted for a specific proposal + */ function voter_list($voteid, $dbh=NULL) { if (!$dbh) { $dbh = db_connect(); @@ -815,6 +993,17 @@ function voter_list($voteid, $dbh=NULL) { return $whovoted; } +/** + * Cast a vote for a specific user proposal + * + * @param string $voteid The ID of the proposal being voted on + * @param string $uid The user ID of the individual voting + * @param string $vote Vote position, either "Yes", "No", or "Abstain" + * @param int $newtotal The total number of votes after the user has voted + * @param \PDO $dbh An already established database connection + * + * @return void + */ function cast_proposal_vote($voteid, $uid, $vote, $newtotal, $dbh=NULL) { if (!$dbh) { $dbh = db_connect(); -- 1.7.12.1 [View Less]

1 0

[aur-dev] [PATCH 0/5] Recent patches
by Lukas Fleischer 21 Sep '12

21 Sep '12

Looks like two of the patches I just tried to submit were too big and didn't make it through the mailing list. A complete list follows. If you want to have a detailed look at any of these, feel free to pull them from my working tree. Lukas Fleischer (5): Sync account details page with archweb Sync account editing page with archweb UPGRADING: Fix database upgrade instructions Use echo shortcut syntax Avoid use of "<b>"/"</b>" UPGRADING | … [View More]

1 0

[aur-dev] [PATCH] Avoid use of "<b>"/"</b>"
by Lukas Fleischer 21 Sep '12

21 Sep '12

* Use "<label>"/"</label>" for form labels. * Use "<strong>"/"</strong>" for important text. * Use "<h4>"/"</h4>" for headings. * Drop "<b>"/"</b>" everywhere else. Signed-off-by: Lukas Fleischer <archlinux(a)cryptocrack.de> --- web/html/addvote.php | 12 ++++++------ web/html/home.php | 5 ++--- web/html/pkgsubmit.php | 2 +- web/lib/acctfuncs.inc.php | 12 ++++++------ web/lib/feedcreator.class.php | 2 +… [View More]- web/lib/translator.inc.php | 2 +- web/template/tu_details.php | 8 ++++---- 7 files changed, 21 insertions(+), 22 deletions(-) diff --git a/web/html/addvote.php b/web/html/addvote.php index 5575031..43973f3 100644 --- a/web/html/addvote.php +++ b/web/html/addvote.php @@ -70,18 +70,18 @@ if ($atype == "Trusted User" || $atype == "Developer") { <form action="<?= get_uri('/addvote/'); ?>" method="post"> <p> - <b><?= __("Applicant/TU") ?></b> - <input type="text" name="user" value="<?php if (!empty($_POST['user'])) { print htmlentities($_POST['user'], ENT_QUOTES); } ?>" /> + <label for="id_user"><?= __("Applicant/TU") ?></label> + <input type="text" name="user" id="id_user" value="<?php if (!empty($_POST['user'])) { print htmlentities($_POST['user'], ENT_QUOTES); } ?>" /> <?= __("(empty if not applicable)") ?> </p> <p> - <b><?= __("Length in days") ?></b> - <input type="text" name="length" value="<?php if (!empty($_POST['length'])) { print htmlentities($_POST['length'], ENT_QUOTES); } ?>" /> + <label for="id_length"><?= __("Length in days") ?></label> + <input type="text" name="length" id="id_length" value="<?php if (!empty($_POST['length'])) { print htmlentities($_POST['length'], ENT_QUOTES); } ?>" /> <?= __("(defaults to 7 if empty)") ?> </p> <p> - <b><?= __("Proposal") ?></b><br /> - <textarea name="agenda" rows="15" cols="80"><?php if (!empty($_POST['agenda'])) { print htmlentities($_POST['agenda']); } ?></textarea><br /> + <label for="id_agenda"><?= __("Proposal") ?></label><br /> + <textarea name="agenda" id="id_agenda" rows="15" cols="80"><?php if (!empty($_POST['agenda'])) { print htmlentities($_POST['agenda']); } ?></textarea><br /> <input type="hidden" name="addVote" value="1" /> <input type="hidden" name="token" value="<?= htmlspecialchars($_COOKIE['AURSID']) ?>" /> <input type="submit" class="button" value="<?= __("Submit"); ?>" /> diff --git a/web/html/home.php b/web/html/home.php index 3050bd1..f5a9afe 100644 --- a/web/html/home.php +++ b/web/html/home.php @@ -33,7 +33,7 @@ $dbh = db_connect(); <?php echo __( 'Contributed PKGBUILDs %smust%s conform to the %sArch Packaging Standards%s otherwise they will be deleted!', - '<b>', '</b>', + '<strong>', '</strong>', '<a href="http://wiki.archlinux.org/index.php/Arch_Packaging_Standards">', '</a>' ); @@ -67,9 +67,8 @@ $dbh = db_connect(); ?> </p> + <h4><?= __('DISCLAIMER') ?></h4> <div class="important"> - <b><?= __('DISCLAIMER') ?> :</b> - <br /> <?= __('Unsupported packages are user produced content. Any use of the provided files is at your own risk.'); ?> </div> </div> diff --git a/web/html/pkgsubmit.php b/web/html/pkgsubmit.php index ffbc1c9..930add0 100644 --- a/web/html/pkgsubmit.php +++ b/web/html/pkgsubmit.php @@ -324,7 +324,7 @@ if ($uid): $error = __( "Could not create directory %s.", $incoming_pkgdir); } } else { - $error = __( "You are not allowed to overwrite the %s%s%s package.", "<b>", $pkg_name, "</b>"); + $error = __( "You are not allowed to overwrite the %s%s%s package.", "<strong>", $pkg_name, "</strong>"); } if (!$error) { diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index ed2c7c6..8c96e6f 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -144,7 +144,7 @@ function process_account_form($UTYPE,$TYPE,$A,$U="",$T="",$S="",$E="", if ($row[0]) { $error = __("The username, %s%s%s, is already in use.", - "<b>", htmlspecialchars($U,ENT_QUOTES), "</b>"); + "<strong>", htmlspecialchars($U,ENT_QUOTES), "</strong>"); } } if (!$error) { @@ -161,7 +161,7 @@ function process_account_form($UTYPE,$TYPE,$A,$U="",$T="",$S="",$E="", if ($row[0]) { $error = __("The address, %s%s%s, is already in use.", - "<b>", htmlspecialchars($E,ENT_QUOTES), "</b>"); + "<strong>", htmlspecialchars($E,ENT_QUOTES), "</strong>"); } } if ($error) { @@ -188,12 +188,12 @@ function process_account_form($UTYPE,$TYPE,$A,$U="",$T="",$S="",$E="", $result = $dbh->exec($q); if (!$result) { print __("Error trying to create account, %s%s%s.", - "<b>", htmlspecialchars($U,ENT_QUOTES), "</b>"); + "<strong>", htmlspecialchars($U,ENT_QUOTES), "</strong>"); } else { # account created/modified, tell them so. # print __("The account, %s%s%s, has been successfully created.", - "<b>", htmlspecialchars($U,ENT_QUOTES), "</b>"); + "<strong>", htmlspecialchars($U,ENT_QUOTES), "</strong>"); print "<p>\n"; print __("Click on the Login link above to use your account."); print "</p>\n"; @@ -226,10 +226,10 @@ function process_account_form($UTYPE,$TYPE,$A,$U="",$T="",$S="",$E="", $result = $dbh->exec($q); if (!$result) { print __("Error trying to modify account, %s%s%s.", - "<b>", htmlspecialchars($U,ENT_QUOTES), "</b>"); + "<strong>", htmlspecialchars($U,ENT_QUOTES), "</strong>"); } else { print __("The account, %s%s%s, has been successfully modified.", - "<b>", htmlspecialchars($U,ENT_QUOTES), "</b>"); + "<strong>", htmlspecialchars($U,ENT_QUOTES), "</strong>"); } } } diff --git a/web/lib/feedcreator.class.php b/web/lib/feedcreator.class.php index 1d57fac..802eebb 100644 --- a/web/lib/feedcreator.class.php +++ b/web/lib/feedcreator.class.php @@ -689,7 +689,7 @@ class FeedCreator extends HtmlDescribable { $this->_redirect($filename); } } else { - echo "<br /><b>Error creating feed file, please check write permissions.</b><br />"; + echo "<br /><strong>Error creating feed file, please check write permissions.</strong><br />"; } } diff --git a/web/lib/translator.inc.php b/web/lib/translator.inc.php index 382160c..2093cf7 100644 --- a/web/lib/translator.inc.php +++ b/web/lib/translator.inc.php @@ -9,7 +9,7 @@ set_include_path(get_include_path() . PATH_SEPARATOR . '../lib' . PATH_SEPARATOR # # examples: # print __("%s has %s apples.", "Bill", "5"); -# print __("This is a %smajor%s problem!", "<b>", "</b>"); +# print __("This is a %smajor%s problem!", "<strong>", "</strong>"); include_once('config.inc.php'); include_once('gettext.php'); diff --git a/web/template/tu_details.php b/web/template/tu_details.php index 035cc8d..b53797f 100644 --- a/web/template/tu_details.php +++ b/web/template/tu_details.php @@ -9,18 +9,18 @@ <p> <?= __("User") ?>: - <b> + <strong> <?php if (!empty($row['User'])): ?> <a href="<?= get_uri('/packages/'); ?>?K=<?= $row['User'] ?>&SeB=m"><?= $row['User'] ?></a> <?php else: ?> N/A <?php endif; ?> - </b> + </strong> <br /> - <?= __("Submitted: %s by %s", "<b>" . gmdate("Y-m-d H:i", $row['Submitted']) . "</b>", "<b>" . username_from_id($row['SubmitterID']) . "</b>") ?> + <?= __("Submitted: %s by %s", gmdate("Y-m-d H:i", $row['Submitted']), username_from_id($row['SubmitterID'])) ?> <br /> <?= __("End") ?>: - <b><?= gmdate("Y-m-d H:i", $row['End']) ?></b> + <strong><?= gmdate("Y-m-d H:i", $row['End']) ?></strong> </p> <p> -- 1.7.12 [View Less]

1 0

[aur-dev] [PATCH] UPGRADING: Fix database upgrade instructions
by Lukas Fleischer 21 Sep '12

21 Sep '12

Oversight in commit 985795a21000ea92bcc9e817ddc3a17c380b1ed1. Signed-off-by: Lukas Fleischer <archlinux(a)cryptocrack.de> --- UPGRADING | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/UPGRADING b/UPGRADING index 913da8d..f1d43f1 100644 --- a/UPGRADING +++ b/UPGRADING @@ -4,7 +4,7 @@ Upgrading From 1.9.1 to 2.0.0 ------------------- -1. Add new "Users" table login date column: +1. Add new "Users" table login date and PGP key columns: ---- ALTER TABLE Users ADD … [View More]

1 0