March 2013 - Aur-dev - lists.archlinux.org

[aur-dev] [PATCH] Update AUTHORS file
by Lukas Fleischer 19 Mar '13

19 Mar '13

* Update maintainer list. * Replace contributor list by a reference to `git shortlog -s`. * Sync introduction and formatting of translators with pacman. Signed-off-by: Lukas Fleischer <archlinux(a)cryptocrack.de> --- AUTHORS | 217 ++++++++++++++++++++++++---------------------------------------- 1 file changed, 81 insertions(+), 136 deletions(-) diff --git a/AUTHORS b/AUTHORS index cf33a14..6581e81 100644 --- a/AUTHORS +++ b/AUTHORS @@ -1,141 +1,86 @@ -Names Sorted Alphabetically: - Current Maintainers --------------------- -Loui Chang (louipc) <louipc.ist(a)gmail.com> -Lukas Fleischer (cryptocrack) <archlinux(a)cryptocrack.de> - -Contributors --------------------- -Andrea Scarpino <bash.lnx(a)gmail.com> -Angel Velasquez (angvp) <angvp(a)archlinux.com.ve> -Athurg Gooth <athurg(a)gooth.cn> -Callan Barrett (wizzo) <wizzomafizzo(a)gmail.com> -Damir Perisa (dp) -Dan McGee <dan(a)archlinux.org> -Dusty Phillips (dusty) -Douglas Soares de Andrade (dsa) <dsandrade at gmail dot com> -Eli Janssen (eliott/cactus) <eliott(a)cactuswax.net> -Eric Johnson (eric) <eric(a)coding-zone.com> -Evangelos Foutras <foutrelis(a)gmail.com> -Gergely Imreh <imrehg(a)gmail.com> -Jaroslaw Swierczynski (swiergot) -Jason Chu (jchu) <jason(a)archlinux.org> -Joerie de Gram (Thralas) <j.de.gram(a)gmail.com> -Laszlo Papp <djszapi2(a)gmail.com> -Michael Klier <chi(a)chimeric.de> -Nathan Jones <nathanj(a)insightbb.com> -Paul Mattal (pjmattal) <paul(a)archlinux.org> -Sebastian Nowicki (Xilon) <xilonmu(a)gmail.com> -Simo Leone (simo) <simo(a)archlinux.org> -tardo <tardo(a)nagi-fanboi.net> - -Translations -==================== - -Català ------- -Sergio Jovani Guzman <moret.sjg(a)gmail.com> - -Croatian --------- -Dino Krtanjek <krtanjekdino(a)gmail.com> - -Czech ------ -Daniel Kozák <kozzi11(a)gmail.com> -Jaroslav Lichtblau <dragonlord(a)aur.archlinux.org> - -Dansk ------- -Jacob Bang <julemand101(a)gmail.com> - -Deutsch -------- -Gerhard Brauer <gerbra(a)archlinux.de> -Lukas Kropatschek -Matthias Gorissen <matthias(a)archlinux.de> -Niclas Pfeifer -Pierre Schmitz <pierre(a)archlinux.de> -Wieland Hoffmann <themineo(a)gmail.com> - -Español -------- -Víctor Martínez Romanos <vmromanos(a)gmail.com> - -Français --------- -Cédric Girard <girard.cedric(a)gmail.com> -Cilyan Olowen <gaknar(a)gmail.com> -Morgan Lefieux <comete(a)archlinuxfr.org> +------------------- -Greek ------ -artem -dimpard -Duryodhana -gtklocker -Panos Filip (flamelab) <panosfilip(a)gmail.com> -paschalis.m -ranger -shadowman -WAntilles -Zaxariadis +* canyonknight <canyonknight(a)gmail.com> +* Lukas Fleischer (cryptocrack) <archlinux(a)cryptocrack.de> -Hungarian --------- -Gergely Imreh <imrehg(a)gmail.com> -Laszlo Papp <djszapi2(a)gmail.com> - -Italiano --------- -Andrea Scarpino <bash.lnx(a)gmail.com> -Giovanni Scafora (voidnull) <giovanni(a)archlinux.org> -Pierluigi Picciau <pierluigi88(a)gmail.com> - -Norwegian ---------- -Hans-Kristian Arntzen <maister(a)archlinux.us> - -Polski ------- -Jaroslaw Swierczynski <swiergot(a)gmail.com> -Mateusz Herych <heniekk(a)gmail.com> - -Português ---------- -Douglas Soares de Andrade (dsa) <dsandrade at gmail dot com> - -Русский -------- -Pierre Schmitz -Sergej Pupykin - -Română ------- -Bîru Ionuț Mircea <ionut(a)archlinux.ro> - -Srpski ------- -Slobodan Terzić <githzerai06(a)gmail.com> - -Türkçe ------- -H.Gökhan SARI <hsa2(a)difuzyon.net> -Samed Beyribey <ras0ir(a)eventualis.org> - -Українська ----------- -Danylo Korostil <ted.korostiled(a)gmail.com> -sevenfourk <sevenfourk(a)gmail.com> - -简体中文 --------- -gDD <usrgdd(a)gmail.com> -Huntxu <mhuntxu(a)gmail.com> -supern_lee <supern.lee(a)gmail.com> +Contributors +------------ -עברית ------ -Netanel Shine <netanelshine(a)gmail.com> +Use `git shortlog -s` for a list of AUR contributors. +Translations +------------ + +Our translations are currently maintained in Transifex; please read TRANSLATING +for more details. + +Below is a list of past translators before we switched to Transifex; more can +be found by looking in the Git history. + +Català: + Sergio Jovani Guzman <moret.sjg(a)gmail.com> +Croatian: + Dino Krtanjek <krtanjekdino(a)gmail.com> +Czech: + Daniel Kozák <kozzi11(a)gmail.com> + Jaroslav Lichtblau <dragonlord(a)aur.archlinux.org> +Dansk: + Jacob Bang <julemand101(a)gmail.com> +Deutsch: + Gerhard Brauer <gerbra(a)archlinux.de> + Lukas Kropatschek + Matthias Gorissen <matthias(a)archlinux.de> + Niclas Pfeifer + Pierre Schmitz <pierre(a)archlinux.de> + Wieland Hoffmann <themineo(a)gmail.com> +Español: + Víctor Martínez Romanos <vmromanos(a)gmail.com> +Français: + Cédric Girard <girard.cedric(a)gmail.com> + Cilyan Olowen <gaknar(a)gmail.com> + Morgan Lefieux <comete(a)archlinuxfr.org> +Greek: + artem + dimpard + Duryodhana + gtklocker + Panos Filip (flamelab) <panosfilip(a)gmail.com> + paschalis.m + ranger + shadowman + WAntilles + Zaxariadis +Hungarian: + Gergely Imreh <imrehg(a)gmail.com> + Laszlo Papp <djszapi2(a)gmail.com> +Italiano: + Andrea Scarpino <bash.lnx(a)gmail.com> + Giovanni Scafora (voidnull) <giovanni(a)archlinux.org> + Pierluigi Picciau <pierluigi88(a)gmail.com> +Norwegian: + Hans-Kristian Arntzen <maister(a)archlinux.us> +Polski: + Jaroslaw Swierczynski <swiergot(a)gmail.com> + Mateusz Herych <heniekk(a)gmail.com> +Português: + Douglas Soares de Andrade (dsa) <dsandrade at gmail dot com> +Русский: + Pierre Schmitz + Sergej Pupykin +Română: + Bîru Ionuț Mircea <ionut(a)archlinux.ro> +Srpski: + Slobodan Terzić <githzerai06(a)gmail.com> +Türkçe: + H.Gökhan SARI <hsa2(a)difuzyon.net> + Samed Beyribey <ras0ir(a)eventualis.org> +Українська: + Danylo Korostil <ted.korostiled(a)gmail.com> + sevenfourk <sevenfourk(a)gmail.com> +简体中文: + gDD <usrgdd(a)gmail.com> + Huntxu <mhuntxu(a)gmail.com> + supern_lee <supern.lee(a)gmail.com> +עברית: + Netanel Shine <netanelshine(a)gmail.com> -- 1.8.2.480.g556678c

1 0

[aur-dev] [PATCH] Save last login IP address
by Lukas Fleischer 19 Mar '13

19 Mar '13

Save the IP address used for the last login in the "Users" table. This makes it a bit easier to create IP ban lists for spammers without looking at web server logs. Signed-off-by: Lukas Fleischer <archlinux(a)cryptocrack.de> --- UPGRADING | 10 ++++++++++ support/schema/aur-schema.sql | 1 + web/lib/acctfuncs.inc.php | 3 ++- 3 files changed, 13 insertions(+), 1 deletion(-) diff --git a/UPGRADING b/UPGRADING index c39330b..9c05467 100644 --- a/UPGRADING +++ b/UPGRADING @@ -1,6 +1,16 @@ Upgrading ========= +From 2.1.0 to 2.2.0 +------------------- + +1. Add new "Users" table login IP address column: + +---- +ALTER TABLE Users + ADD COLUMN LastLoginIPAddress INTEGER UNSIGNED NOT NULL DEFAULT 0; +---- + From 2.0.0 to 2.1.0 ------------------- diff --git a/support/schema/aur-schema.sql b/support/schema/aur-schema.sql index d55cf1a..fab40d6 100644 --- a/support/schema/aur-schema.sql +++ b/support/schema/aur-schema.sql @@ -34,6 +34,7 @@ CREATE TABLE Users ( PGPKey VARCHAR(40) NULL DEFAULT NULL, LastVoted BIGINT UNSIGNED NOT NULL DEFAULT 0, LastLogin BIGINT UNSIGNED NOT NULL DEFAULT 0, + LastLoginIPAddress INTEGER UNSIGNED NOT NULL DEFAULT 0, PRIMARY KEY (ID), UNIQUE (Username), UNIQUE (Email), diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index 61a856b..c13d7f9 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -462,7 +462,8 @@ function try_login() { } if ($logged_in) { - $q = "UPDATE Users SET LastLogin = UNIX_TIMESTAMP() "; + $q = "UPDATE Users SET LastLogin = UNIX_TIMESTAMP(), "; + $q.= "LastLoginIPAddress = " . $dbh->quote(ip2long($_SERVER['REMOTE_ADDR'])) . " "; $q.= "WHERE ID = '$userID'"; $dbh->exec($q); -- 1.8.2.480.g556678c

1 0

[aur-dev] [PATCH] process_account_form(): Highlight errors
by Lukas Fleischer 19 Mar '13

19 Mar '13

Signed-off-by: Lukas Fleischer <archlinux(a)cryptocrack.de> --- web/lib/acctfuncs.inc.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index c202f47..61a856b 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -184,7 +184,7 @@ function process_account_form($UTYPE,$TYPE,$A,$U="",$T="",$S="",$E="", } } if ($error) { - print "<span class='error'>".$error."</span><br/>\n"; + print "<ul class='errorlist'><li>".$error."</li></ul>\n"; display_account_form($UTYPE, $A, $U, $T, $S, $E, "", "", $R, $L, $I, $K, $UID); } else { -- 1.8.2.480.g556678c

1 0

[aur-dev] [PATCH 1/3] Move reset key submission to a separate function
by Lukas Fleischer 19 Mar '13

19 Mar '13

This allows for reusing reset key submission for other things, such as sending an initial password reset code during account registration. Signed-off-by: Lukas Fleischer <archlinux(a)cryptocrack.de> --- web/html/passreset.php | 22 +++++----------------- web/lib/acctfuncs.inc.php | 26 ++++++++++++++++++++++++++ 2 files changed, 31 insertions(+), 17 deletions(-) diff --git a/web/html/passreset.php b/web/html/passreset.php index 064e3de..94a1ad9 100644 --- a/web/html/passreset.php +++ b/web/html/passreset.php @@ -37,24 +37,12 @@ if (isset($_GET['resetkey'], $_POST['email'], $_POST['password'], $_POST['confir } } elseif (isset($_POST['email'])) { $email = $_POST['email']; - $uid = uid_from_email($email); - if ($uid != NULL && $uid != 'None') { - # We (ab)use new_sid() to get a random 32 characters long string - $resetkey = new_sid(); - create_resetkey($resetkey, $uid); - # Send email with confirmation link - $body = __('A password reset request was submitted for the account '. - 'associated with your e-mail address. If you wish to reset '. - 'your password follow the link below, otherwise ignore '. - 'this message and nothing will happen.'). - "\n\n". - "{$AUR_LOCATION}/" . get_uri('/passreset/') . "?". - "resetkey={$resetkey}"; - $body = wordwrap($body, 70); - $headers = "Reply-to: nobody@archlinux.org\nFrom:aur-notify@archlinux.org\nX-Mailer: PHP\nX-MimeOLE: Produced By AUR"; - @mail($email, 'AUR Password Reset', $body, $headers); + $body = __('A password reset request was submitted for the account '. + 'associated with your e-mail address. If you wish to reset '. + 'your password follow the link below, otherwise ignore '. + 'this message and nothing will happen.'). + send_resetkey($email, $body); - } header('Location: ' . get_uri('/passreset/') . '?step=confirm'); exit(); } diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index 9c0998a..edca8a3 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -582,6 +582,32 @@ function create_resetkey($resetkey, $uid) { } /** + * Send a reset key to a specific e-mail address + * + * @param string $email E-mail address of the user resetting their password + * @param string $body Body of the email + * + * @return void + */ +function send_resetkey($email, $body) { + global $AUR_LOCATION; + + $uid = uid_from_email($email); + if ($uid != NULL && $uid != 'None') { + # We (ab)use new_sid() to get a random 32 characters long string + $resetkey = new_sid(); + create_resetkey($resetkey, $uid); + # Send email with confirmation link + $body = wordwrap($body, 70); + $body .= "\n\n". + "{$AUR_LOCATION}/" . get_uri('/passreset/') . "?". + "resetkey={$resetkey}"; + $headers = "Reply-to: nobody@archlinux.org\nFrom:aur-notify@archlinux.org\nX-Mailer: PHP\nX-MimeOLE: Produced By AUR"; + @mail($email, 'AUR Password Reset', $body, $headers); + } +} + +/** * Change a user's password in the database if reset key and e-mail are correct * * @param string $hash New MD5 hash of a user's password -- 1.8.2.480.g556678c

1 2

[aur-dev] Fighting spam on the AUR
by Lukas Fleischer 18 Mar '13

18 Mar '13

Status quo: 06:54 < gtmanfred> ok, it really is time for something else 06:54 < gtmanfred> the spammer is now creating a new account for every comment and flag out of date The account suspension feature does not help here. Options: * Allow package maintainers to block the "Flag package out-of-date" feature for a certain amount of time. Note that this might eventually cripple the "out-of-date" function. Also, this does not work for comments. * Use CAPTCHAs during account registration. We could either use MAPTCHAs ("What is 1 + 1?") or something like reCAPTCHA [1]. * Moderate new accounts. Might be a lot of work. We need some TUs that review and unlock accounts. Also, it might be hard to distinguish a spam bot from a regular user. If we require a short application text, this might result in less users joining the AUR. * Block IP addresses. Bye-bye, Tor users! Comments and suggestions welcome! We need to find a proper solution as soon as possible! [1] http://www.google.com/recaptcha

11 17

[aur-dev] Using git as a backend for the AUR
by William Giokas 17 Mar '13

17 Mar '13

All, So in my spare time I was thinking about the AUR and how it could be better. Back in January I commented on a bug[1] about integrating the AUR and git to have a powerful, robust backend for the AUR. I think that the original idea of creating one massive repository was inherently flawed for most users, as it requires that the entire repository be cloned, and that is no trivial task for people with only moderate internet speeds. Were it similar to the way the official repositories git setup is, then it would be okay for fetching, but using single repositories for each project would make access control much less of a nightmare. At the moment I have no experience with PHP or messing with the AUR, but I have been playing around with git and using it to track packages and the like, as well as some minimal experience with access control and git. Currently, this is kind of the roadmap I see in my head: * Set up access controls for the AUR users to access over ssh using keys. While I could see this being somewhat arduous, it shouldn't be terribly hard to automate or set up. Something like gitolite or whatever should make it simpler. * Each repository on the server would contain a single package (if someone decides to do a split package on the AUR it would contain the whole set of packages), allowing for multiple users to have push access and maintain the packages. * The repositories would be limited to 5M, unless given special permission (certain kernel packages with lots of massive configuration files) which should make enough room for the needed files, while helping to enforce the idea of not putting retrievable sources in the source tarball. I did some quick math using the number of packages on the AUR right now, and if every repo used that 5M limit, it would require a bit over 200G. Granted, I doubt that this limit would be reached for most packages. * With the repository set up, give maintainers a week or so to upload history for their packages (in case they already keep their repos in this set up), and new packages would get put directly into a new repo. * Once the week for transition is over, begin moving all of the current packages in the AUR to the git format. This basically concludes setting up the git stuff, which I have done on a local machine on a very small scale (5 packages) in the past. One thing I was thinking of was the use of `makepkg -S` tarballs still being available. cryptocrack came up with a good point, that just simply copying things over could overwrite the .git directory in the designated directory. I don't think that would be too hard to get around, but I'm no expert. I wrote a quick and dirty script that extracts and commits to the respective repository. Currently, almost no packages use a .changelog file, but there could be some minimal parsing done of a packages .changelog file to craft a git commit message from a tarball. Obviously there needs to be some kind of security check, but that could be done by the frontend using the system we have now for source tarballs. At the moment, I am unsure exactly how the AUR parses the PKGBUILDs it receives, but I'm sure that this could easily be adapted to the git system. One major advantage to having the AUR managed this way is that it would allow users to check for updates on the AUR without the need for complex helpers outside of git. Secondly, it would make mirroring the AUR, or just parts of the AUR extremely easy. In case something happens to the AUR, people can still get their packages and maintainers can still update them very easily using git. It would also still allow people to grab tarballs of the current master branch. This way git is not a requirement to use the AUR, it just makes things a butt ton easier. Also, it would allow users to see the entire source of the package, not just the PKGBUILD, similar to how the official repository works, just that things would be in distinct git repositories not branches. I would really like to see this kind of thing come to fruition, and if anyone would be willing to help, then please say so. Pardon my scattered thoughts, -- William Giokas | KaiSforza GnuPG Key: 0x73CD09CF Fingerprint: F73F 50EF BBE2 9846 8306 E6B8 6902 06D8 73CD 09CF [1]: https://bugs.archlinux.org/task/23010

5 9

[aur-dev] [PATCH] pkgsubmit.php: Parse .SRCINFO metadata
by Lukas Fleischer 17 Mar '13

17 Mar '13

This allows for adding a metadata file called ".SRCINFO" to source tarballs to overwrite specific PKGBUILD fields. .SRCINFO files are parsed line by line. The syntax for each line is "key = value", where key is any of the following field names: * pkgname * pkgver * pkgdesc * url * license * depend Multiple "depend" lines can be specified to add multiple dependencies. This format closely matches the .PKGINFO format that is used for binary packages in pacman/libalpm. It can be extended by field name prefixes or sections to support split packages later. Signed-off-by: Lukas Fleischer <archlinux(a)cryptocrack.de> --- web/html/pkgsubmit.php | 38 ++++++++++++++++++++++++++++++++++---- 1 file changed, 34 insertions(+), 4 deletions(-) diff --git a/web/html/pkgsubmit.php b/web/html/pkgsubmit.php index d9bb6bc..4c14be4 100644 --- a/web/html/pkgsubmit.php +++ b/web/html/pkgsubmit.php @@ -81,8 +81,8 @@ if ($uid): if (!$error) { $tar = new Archive_Tar($_FILES['pfile']['tmp_name']); - # Extract PKGBUILD into a string - $pkgbuild_raw = ''; + # Extract PKGBUILD and .SRCINFO into a string + $pkgbuild_raw = $srcinfo_raw = ''; $dircount = 0; foreach ($tar->listContent() as $tar_file) { if ($tar_file['typeflag'] == 0) { @@ -93,6 +93,9 @@ if ($uid): elseif (substr($tar_file['filename'], -9) == '/PKGBUILD') { $pkgbuild_raw = $tar->extractInString($tar_file['filename']); } + elseif (substr($tar_file['filename'], -9) == '/.SRCINFO') { + $srcinfo_raw = $tar->extractInString($tar_file['filename']); + } } elseif ($tar_file['typeflag'] == 5) { if (substr_count($tar_file['filename'], "/") > 1) { @@ -254,6 +257,31 @@ if ($uid): } } + # Parse .SRCINFO and overwrite PKGBUILD fields accordingly + unset($pkg_version); + $depends = array(); + foreach (explode("\n", $srcinfo_raw) as $line) { + if ($line[0] = '#') { + continue; + } + list($key, $value) = explode(' = ', $line, 2); + + switch ($key) { + case 'pkgname': + case 'pkgdesc': + case 'url': + case 'license': + $new_pkgbuild[$key] = $value; + break; + case 'pkgver': + $pkg_version = $value; + break; + case 'depend': + $depends[] = $value; + break; + } + } + # Validate package name if (!$error) { $pkg_name = $new_pkgbuild['pkgname']; @@ -266,7 +294,7 @@ if ($uid): } # Determine the full package version with epoch - if (!$error) { + if (!$error && !isset($pkg_version)) { if (isset($new_pkgbuild['epoch']) && (int)$new_pkgbuild['epoch'] > 0) { $pkg_version = sprintf('%d:%s-%s', $new_pkgbuild['epoch'], $new_pkgbuild['pkgver'], $new_pkgbuild['pkgrel']); } else { @@ -389,8 +417,10 @@ if ($uid): } # Update package depends - if (!empty($new_pkgbuild['depends'])) { + if (empty($depends) && !empty($new_pkgbuild['depends'])) { $depends = explode(" ", $new_pkgbuild['depends']); + } + if (!empty($depends)) { foreach ($depends as $dep) { $deppkgname = preg_replace("/(<|<=|=|>=|>).*/", "", $dep); $depcondition = str_replace($deppkgname, "", $dep); -- 1.8.2.rc2.352.g908df73

3 8

[aur-dev] 2.1.0 string freeze
by Lukas Fleischer 12 Mar '13

12 Mar '13

I added the 2.1.0 release to Transifex yesterday. The string freeze starts today and ends on 2013-03-17. Not a lot of time, but the top ten translations are already 100% complete and the following four languages require <10 new translations: * French * Greek * Romanian * Spanish Thanks again to all contributors!

1 0

[aur-dev] [PATCH] pkgsubmit.php: Parse .AURINFO metadata
by Lukas Fleischer 08 Mar '13

08 Mar '13

This allows for adding a metadata file called ".AURINFO" to source tarballs to overwrite specific PKGBUILD fields. .AURINFO files are parsed line by line. The syntax for each line is "key = value", where key is any of the following field names: * pkgname * pkgver * pkgdesc * url * license * depend Multiple "depend" lines can be specified to add multiple dependencies. This format closely matches the .PKGINFO format that is used for binary packages in pacman/libalpm. It can be extended by field name prefixes or sections to support split packages later. Signed-off-by: Lukas Fleischer <archlinux(a)cryptocrack.de> --- As shortly discussed with Allan on IRC, rename the metadata file to ".AURINFO" until it is officially supported in makepkg(8). Further comments welcome. I will soon merge this into master and prepare a release. web/html/pkgsubmit.php | 37 +++++++++++++++++++++++++++++++++---- 1 file changed, 33 insertions(+), 4 deletions(-) diff --git a/web/html/pkgsubmit.php b/web/html/pkgsubmit.php index d9bb6bc..d2fe512 100644 --- a/web/html/pkgsubmit.php +++ b/web/html/pkgsubmit.php @@ -81,8 +81,8 @@ if ($uid): if (!$error) { $tar = new Archive_Tar($_FILES['pfile']['tmp_name']); - # Extract PKGBUILD into a string - $pkgbuild_raw = ''; + # Extract PKGBUILD and .AURINFO into a string + $pkgbuild_raw = $srcinfo_raw = ''; $dircount = 0; foreach ($tar->listContent() as $tar_file) { if ($tar_file['typeflag'] == 0) { @@ -93,6 +93,9 @@ if ($uid): elseif (substr($tar_file['filename'], -9) == '/PKGBUILD') { $pkgbuild_raw = $tar->extractInString($tar_file['filename']); } + elseif (substr($tar_file['filename'], -9) == '/.AURINFO') { + $srcinfo_raw = $tar->extractInString($tar_file['filename']); + } } elseif ($tar_file['typeflag'] == 5) { if (substr_count($tar_file['filename'], "/") > 1) { @@ -254,6 +257,30 @@ if ($uid): } } + # Parse .AURINFO and overwrite PKGBUILD fields accordingly + unset($pkg_version); + $depends = array(); + foreach (explode("\n", $srcinfo_raw) as $line) { + if (empty($line) || $line[0] == '#') { + continue; + } + list($key, $value) = explode(' = ', $line, 2); + switch ($key) { + case 'pkgname': + case 'pkgdesc': + case 'url': + case 'license': + $new_pkgbuild[$key] = $value; + break; + case 'pkgver': + $pkg_version = $value; + break; + case 'depend': + $depends[] = $value; + break; + } + } + # Validate package name if (!$error) { $pkg_name = $new_pkgbuild['pkgname']; @@ -266,7 +293,7 @@ if ($uid): } # Determine the full package version with epoch - if (!$error) { + if (!$error && !isset($pkg_version)) { if (isset($new_pkgbuild['epoch']) && (int)$new_pkgbuild['epoch'] > 0) { $pkg_version = sprintf('%d:%s-%s', $new_pkgbuild['epoch'], $new_pkgbuild['pkgver'], $new_pkgbuild['pkgrel']); } else { @@ -389,8 +416,10 @@ if ($uid): } # Update package depends - if (!empty($new_pkgbuild['depends'])) { + if (empty($depends) && !empty($new_pkgbuild['depends'])) { $depends = explode(" ", $new_pkgbuild['depends']); + } + if (!empty($depends)) { foreach ($depends as $dep) { $deppkgname = preg_replace("/(<|<=|=|>=|>).*/", "", $dep); $depcondition = str_replace($deppkgname, "", $dep); -- 1.8.2.rc2.352.g908df73

1 0

[aur-dev] [PATCH 1/2] pkgsubmit.php: Simplify package name validation
by Lukas Fleischer 05 Mar '13

05 Mar '13

Remove redundant filters -- single quotes are already removed in $pkgbuild_new and we do not pass the package name to a shell (additionally, the regular expression already checks for potentially evil characters). Also, move the $pkg_name extraction up to fix the split package check. Signed-off-by: Lukas Fleischer <archlinux(a)cryptocrack.de> --- web/html/pkgsubmit.php | 18 ++++++------------ 1 file changed, 6 insertions(+), 12 deletions(-) diff --git a/web/html/pkgsubmit.php b/web/html/pkgsubmit.php index fefb31e..685d5cb 100644 --- a/web/html/pkgsubmit.php +++ b/web/html/pkgsubmit.php @@ -268,19 +268,13 @@ if ($uid): } } - # Now we've parsed the pkgbuild, let's move it to where it belongs - if (!$error && $pkg_name[0] == '(') { - $error = __("Error - The AUR does not support split packages!"); - } - + # Validate package name if (!$error) { - $pkg_name = str_replace("'", "", $new_pkgbuild['pkgname']); - $pkg_name = escapeshellarg($pkg_name); - $pkg_name = str_replace("'", "", $pkg_name); - - $presult = preg_match("/^[a-z0-9][a-z0-9\.+_-]*$/", $pkg_name); - - if (!$presult) { + $pkg_name = $new_pkgbuild['pkgname']; + if ($pkg_name[0] == '(') { + $error = __("Error - The AUR does not support split packages!"); + } + if (!preg_match("/^[a-z0-9][a-z0-9\.+_-]*$/", $pkg_name)) { $error = __("Invalid name: only lowercase letters are allowed."); } } -- 1.8.2.rc2.352.g908df73

1 1