March 2013 - Aur-dev - lists.archlinux.org

[aur-dev] AUR 2.1.0 released
by Lukas Fleischer 10 Jul '13

10 Jul '13

Changes since 2.0.1: * Typeahead suggest for packages. * Fix account editing and hijacking vulnerability. * Fix account privilege escalation vulnerability. * Clear a user's active sessions following account suspension. * Several translation fixes/updates. * pkgsubmit.php: Parse .AURINFO metadata. .AURINFO files can now be included in source packages to overwrite specific PKGBUILD fields. .AURINFO files are parsed line by line. The syntax for each line is "key = value", where key is any of the following field names: * pkgname * pkgver * pkgdesc * url * license * depend Multiple "depend" lines can be specified to add multiple dependencies. You can check the Git log [1] for a complete list of commits. The official Arch Linux AUR setup [2] has already been upgraded! [1] https://projects.archlinux.org/aur.git/log/?id=v2.1.0 [2] https://aur.archlinux.org/

7 11

[aur-dev] Removing spammer accounts
by Lukas Fleischer 23 Apr '13

23 Apr '13

I analyzed recent additions to the AUR user database in the hope of finding a way to delete all spammer accounts. Unfortunately, the account creation bot seems to be a bit more clever than I thought. Various different user names (both random user names, user names extracted from IRC channels etc.) and various different email addresses (different hosts, some local parts match the user name and some don't) were used. The only obvious pattern is that following fields are always empty: * RealName * IRCNick * PGPKey However, using that filter and also filtering by ID (51617 is the first account obviously created by a bot) and last login (1363737600 is 2013-03-20 00:00:00 which is after the login form has been disabled for Tor users) still leaves 18378 accounts: mysql> SELECT COUNT(*) FROM Users WHERE RealName = '' AND -> IRCNick = '' AND PGPKey = '' AND ID >= 51617 AND -> ID <= 70072 AND LastLogin < 1363737600; +----------+ | COUNT(*) | +----------+ | 18378 | +----------+ 1 row in set (0.01 sec) My suggestion is: 1. Set the password field of these accounts to "", so that they will no longer be able to login. They can still use the password reset form. 2. Delete all accounts that still have an empty password field in ~2 weeks. If there are any objections or alternative suggestions, please let me know. Otherwise, I will unset password fields before I re-enable the registration form (on Tuesday, 2013-03-26). Regards, Lukas

2 3

[aur-dev] AUR Android app
by Pedro Veloso 27 Mar '13

27 Mar '13

My name is Pedro Veloso and I'm an Android developer for more than 3 years now. I would like to contribute to Arch by making an application that could provide the user with functionality for searching packages, seeing their details and dependencies etc. All of this in a convenient way trough a native Android application. This application would be of course Apache licensed (or similar one, point being I intent to open-source the whole thing from the beginning). For this to work I would need a working API on the server side, I did a brief search and I found some work is already underway in that sense ( https://wiki.archlinux.org/index.php/AUR_2) where there seems to be a discussion on doing a REST API with OAuth authentication (which is great because I've worked with both standards in several projects as well). However I did not find what the current progress is on this, so that's what I intend to find out sending this email to the aur-dev mailing list. Thanks in advance, Pedro

4 3

[aur-dev] AUR 2.2.0 released
by Lukas Fleischer 26 Mar '13

26 Mar '13

Changes since 2.1.0: * Email address validation during registration. * Track last login IP address in the user database. * Add a table that allows for banning IP addresses. * Use minified typeahead JS from archweb (fixes several typeahead bugs). You can check the Git log [1] for a complete list of commits. The official Arch Linux AUR setup [2] has already been upgraded! [1] https://projects.archlinux.org/aur.git/log/?id=v2.2.0 [2] https://aur.archlinux.org/

1 0

[aur-dev] [PATCH] Show hint if password is empty during login
by Lukas Fleischer 24 Mar '13

24 Mar '13

A user might have an empty password due to two reasons: * The user just created an account and needs to set an initial password. * The password has been reset by the administrator. In both cases, the user might be confused as to why the login does not work. Add a message that helps users debug the issue in both cases. Signed-off-by: Lukas Fleischer <archlinux(a)cryptocrack.de> --- web/lib/acctfuncs.inc.php | 33 +++++++++++++++++++++++++++++++-- 1 file changed, 31 insertions(+), 2 deletions(-) diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index aa4c70b..28f9f93 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -486,8 +486,16 @@ function try_login() { else { $login_error = "Error trying to generate session id."; } - } - else { + } elseif (passwd_is_empty($userID)) { + $login_error = __('Your password has been reset. ' . + 'If you just created a new account, please ' . + 'use the link from the confirmation email ' . + 'to set an initial password. Otherwise, ' . + 'please request a reset key on the %s' . + 'Password Reset%s page.', '<a href="' . + htmlspecialchars(get_uri('/passreset')) . '">', + '</a>'); + } else { $login_error = __("Bad username or password."); } } @@ -746,6 +754,27 @@ function valid_passwd($userID, $passwd) { } /** + * Determine if a user's password is empty + * + * @param string $uid The user ID to check for an empty password + * + * @return bool True if the user's password is empty, otherwise false + */ +function passwd_is_empty($uid) { + $dbh = DB::connect(); + + $q = "SELECT * FROM Users WHERE ID = " . $dbh->quote($uid) . " "; + $q .= "AND Passwd = " . $dbh->quote(''); + $result = $dbh->query($q); + + if ($result->fetchColumn()) { + return true; + } else { + return false; + } +} + +/** * Determine if the PGP key fingerprint is valid (must be 40 hexadecimal digits) * * @param string $fingerprint PGP fingerprint to check if valid -- 1.8.2.411.g65a544e

1 2

[aur-dev] 2.2.0 string freeze
by Lukas Fleischer 24 Mar '13

24 Mar '13

I just uploaded new strings for 2.2.0. Note that the string freeze already ends on Tuesday, 2013-03-26. I would like to release 2.2.0 as soon as possible so that the account creation page can be re-enabled in the near term. There will probably be another release soon.

1 0

[aur-dev] [PATCH 1/2] Add "Bans" table to database schema
by canyonknight 24 Mar '13

24 Mar '13

The "Bans" table creates a DB structure for the ability to ban IP addresses. It takes an IP address converted by ip2long(). It can easily be extended for other features such as time limits (for temporary bans). The table will eventually be able to be populated directly through the web interface by Trusted Users and Developers. Signed-off-by: canyonknight <canyonknight(a)gmail.com> --- UPGRADING | 11 +++++++++++ support/schema/aur-schema.sql | 9 +++++++++ 2 files changed, 20 insertions(+) diff --git a/UPGRADING b/UPGRADING index 9c05467..7d13c43 100644 --- a/UPGRADING +++ b/UPGRADING @@ -11,6 +11,17 @@ ALTER TABLE Users ADD COLUMN LastLoginIPAddress INTEGER UNSIGNED NOT NULL DEFAULT 0; ---- +2. Add a new "Bans" table: + +---- +CREATE TABLE Bans ( + ID INTEGER UNSIGNED NOT NULL AUTO_INCREMENT, + IPAddress INTEGER UNSIGNED NOT NULL DEFAULT 0, + PRIMARY KEY (ID), + UNIQUE (IPAddress) +) ENGINE = InnoDB; +---- + From 2.0.0 to 2.1.0 ------------------- diff --git a/support/schema/aur-schema.sql b/support/schema/aur-schema.sql index fab40d6..2d268fa 100644 --- a/support/schema/aur-schema.sql +++ b/support/schema/aur-schema.sql @@ -213,3 +213,12 @@ CREATE TABLE IF NOT EXISTS TU_Votes ( FOREIGN KEY (VoteID) REFERENCES TU_VoteInfo(ID) ON DELETE CASCADE, FOREIGN KEY (UserID) REFERENCES Users(ID) ON DELETE CASCADE ) ENGINE = InnoDB; + +-- Malicious user banning +-- +CREATE TABLE Bans ( + ID INTEGER UNSIGNED NOT NULL AUTO_INCREMENT, + IPAddress INTEGER UNSIGNED NOT NULL DEFAULT 0, + PRIMARY KEY (ID), + UNIQUE (IPAddress) +) ENGINE = InnoDB; -- 1.8.2

3 4

[aur-dev] [PATCH] Add an IP ban list
by Lukas Fleischer 23 Mar '13

23 Mar '13

This allows for specifying a list of IP addresses that will no longer be able to register new accounts and login. The list of banned IP addresses can be configured in "web/lib/config.inc.php". Signed-off-by: Lukas Fleischer <archlinux(a)cryptocrack.de> --- web/lib/acctfuncs.inc.php | 24 +++++++++++++++++++++--- web/lib/config.inc.php.proto | 3 +++ 2 files changed, 24 insertions(+), 3 deletions(-) diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index aabb096..c202f47 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -91,7 +91,17 @@ function process_account_form($UTYPE,$TYPE,$A,$U="",$T="",$S="",$E="", $P="",$C="",$R="",$L="",$I="",$K="",$UID=0) { # error check and process request for a new/modified account - global $SUPPORTED_LANGS, $AUR_LOCATION; + global $SUPPORTED_LANGS, $AUR_LOCATION, $BANNED_IPS; + + $error = ""; + + if (in_array($_SERVER['REMOTE_ADDR'], $BANNED_IPS)) { + $error = __('The login form is currently ' . + 'disabled for your IP address, probably due ' . + 'to sustained spam attacks. Sorry for the ' . + 'inconvenience -- we hope to be back up ' . + 'soon.'); + } $dbh = DB::connect(); @@ -102,7 +112,6 @@ function process_account_form($UTYPE,$TYPE,$A,$U="",$T="",$S="",$E="", $editor_user = null; } - $error = ""; if (empty($E) || empty($U)) { $error = __("Missing a required field."); } @@ -393,13 +402,22 @@ function search_results_page($UTYPE,$O=0,$SB="",$U="",$T="", * @return array Session ID for user, error message if applicable */ function try_login() { - global $MAX_SESSIONS_PER_USER, $PERSISTENT_COOKIE_TIMEOUT; + global $MAX_SESSIONS_PER_USER, $PERSISTENT_COOKIE_TIMEOUT, $BANNED_IPS; $login_error = ""; $new_sid = ""; $userID = null; if ( isset($_REQUEST['user']) || isset($_REQUEST['passwd']) ) { + if (in_array($_SERVER['REMOTE_ADDR'], $BANNED_IPS)) { + $login_error = __('The login form is currently ' . + 'disabled for your IP address, probably due ' . + 'to sustained spam attacks. Sorry for the ' . + 'inconvenience -- we hope to be back up ' . + 'soon.'); + return array('SID' => '', 'error' => $login_error); + } + $dbh = DB::connect(); $userID = valid_user($_REQUEST['user']); diff --git a/web/lib/config.inc.php.proto b/web/lib/config.inc.php.proto index 1fe7dbc..0422ac5 100644 --- a/web/lib/config.inc.php.proto +++ b/web/lib/config.inc.php.proto @@ -59,3 +59,6 @@ $USE_VIRTUAL_URLS = true; # Maximum number of package results to return through an RPC connection. # Avoid setting this too high and having a PHP too much memory error. $MAX_RPC_RESULTS = 5000; + +# Prevent a list of remote addresses from logging in and creating new accounts. +$BANNED_IPS = array(); -- 1.8.2.480.g556678c

4 7

[aur-dev] [PATCH] Return 404 error page if invalid package ID is used
by Lukas Fleischer 21 Mar '13

21 Mar '13

We already display the 404 error page if someone tries to access an invalid package via virtual URLs ("/packages/nonexistent"). Add the same check to "web/html/packages.php" to make sure the same error is shown if a user requests package details of a nonexistent package ID via legacy URLs ("/packages.php?ID=-1"). Signed-off-by: Lukas Fleischer <archlinux(a)cryptocrack.de> --- web/html/packages.php | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/web/html/packages.php b/web/html/packages.php index c1e54e1..a4a480c 100644 --- a/web/html/packages.php +++ b/web/html/packages.php @@ -18,6 +18,12 @@ if (!isset($pkgid) || !isset($pkgname)) { } else { unset($pkgid, $pkgname); } + + if (isset($pkgid) && ($pkgid == 0 || $pkgid == NULL || $pkgname == NULL)) { + header("HTTP/1.0 404 Not Found"); + include "./404.php"; + return; + } } # Set the title to the current query and get package details if required -- 1.8.2.480.g556678c

1 0

[aur-dev] [PATCH] Display user's IP address on their user profile page
by canyonknight 19 Mar '13

19 Mar '13

The IP address is only visible to Trusted Users and Developers. Signed-off-by: canyonknight <canyonknight(a)gmail.com> --- web/template/account_details.php | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/web/template/account_details.php b/web/template/account_details.php index fdebfb3..9f7e578 100644 --- a/web/template/account_details.php +++ b/web/template/account_details.php @@ -43,6 +43,14 @@ <?= $row["LastVoted"] ? date("Y-m-d", $row["LastVoted"]) : __("Never"); ?> </td> </tr> + + <?php if ($atype == "Trusted User" || $atype == "Developer"): ?> + <tr> + <th><?= __("Last Login IP Address") . ":" ?></th> + <td><?= long2ip($row["LastLoginIPAddress"]); ?></td> + </tr> + <?php endif; ?> + <tr> <th>Links:</th> <td> -- 1.8.2

1 0