April 2013 - Aur-dev - lists.archlinux.org

[aur-dev] AUR 2.1.0 released
by Lukas Fleischer 10 Jul '13

10 Jul '13

Changes since 2.0.1: * Typeahead suggest for packages. * Fix account editing and hijacking vulnerability. * Fix account privilege escalation vulnerability. * Clear a user's active sessions following account suspension. * Several translation fixes/updates. * pkgsubmit.php: Parse .AURINFO metadata. .AURINFO files can now be included in source packages to overwrite specific PKGBUILD fields. .AURINFO files are parsed line by line. The syntax for each line is "key = value", where key is any of the following field names: * pkgname * pkgver * pkgdesc * url * license * depend Multiple "depend" lines can be specified to add multiple dependencies. You can check the Git log [1] for a complete list of commits. The official Arch Linux AUR setup [2] has already been upgraded! [1] https://projects.archlinux.org/aur.git/log/?id=v2.1.0 [2] https://aur.archlinux.org/

7 11

[aur-dev] Notification System Overhaul
by canyonknight 08 May '13

08 May '13

Hello all, The current notification system for the AUR is lacking in features and isn't too pretty on the code side of things. Before I try and finalize the code I have, I wanted to lay out what I was planning for some feedback. Right now the AUR only allows for notifications when a user adds a comment. I would like users to have access to notifications for the following package actions: - New comments on packages - Package updates - Package adoption/orphaning - Package deletion/merging I think having the ability to select those 4 types of notifications brings a lot more flexibility while not being overly complicated. As for the AUR web interface changes, the package details page would feature a link to modify that specific package's notifications. The page would feature a list of all potential types of notifications the user can subscribe to with a check box next to each option. The user can then select all/some/none of the notifications for that specific package. On the backend side of things, swiftmailer seems to be a decent choice for sending the notifications. It is actively developed, has all the features the AUR would really need, and has a nice interface on the programming side of things. All the notification code mixed in with package functions and the like could be ripped out allowing for easier modification down the road. Ideally the following bugs should be closed after everything is implemented: FS#15412 - Send a notification when a package is orphaned or adopted FS#19948 - Add whether or not I'm the maintainer to the aur-notify email su FS#27687 - Merging packages does not transfer the notify list. FS#30109 - email notification upon package update FS#31850 - Send notification e-mails in preferred user language FS#31851 - Overhaul e-mail notification system FS#34843 - Make bugs/AUR messages more visible Does anyone have anything major they would like to see out of the notification system? Is there anything anyone disagrees with? Regards, Jason

3 4

[aur-dev] [PATCH] aurblup: Update for pacman 4.1 API changes
by Lukas Fleischer 28 Apr '13

28 Apr '13

alpm_db_register_sync() and alpm_option_get_syncdbs() have been renamed. Update aurblup sources accordingly. Signed-off-by: Lukas Fleischer <archlinux(a)cryptocrack.de> --- scripts/aurblup/aurblup.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scripts/aurblup/aurblup.c b/scripts/aurblup/aurblup.c index be398f8..f072669 100644 --- a/scripts/aurblup/aurblup.c +++ b/scripts/aurblup/aurblup.c @@ -189,11 +189,11 @@ dblist_create(void) int i; for (i = 0; i < sizeof(alpm_repos) / sizeof(char *); i++) { - if (!alpm_db_register_sync(handle, alpm_repos[i], 0)) + if (!alpm_register_syncdb(handle, alpm_repos[i], 0)) alpm_die("failed to register sync db \"%s\": %s\n", alpm_repos[i]); } - if (!(dblist = alpm_option_get_syncdbs(handle))) + if (!(dblist = alpm_get_syncdbs(handle))) alpm_die("failed to get sync DBs: %s\n"); for (d = dblist; d; d = alpm_list_next(d)) { -- 1.8.2.675.gda3bb24.dirty

1 0

[aur-dev] [PATCH] FS#34843: Send AUR notifications directly to user to make it more visible
by Anatol Pomozov 24 Apr '13

24 Apr '13

Signed-off-by: Anatol Pomozov <anatol.pomozov(a)gmail.com> --- web/lib/pkgfuncs.inc.php | 24 +++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-) diff --git a/web/lib/pkgfuncs.inc.php b/web/lib/pkgfuncs.inc.php index 53b7e54..ee150ca 100644 --- a/web/lib/pkgfuncs.inc.php +++ b/web/lib/pkgfuncs.inc.php @@ -260,11 +260,11 @@ function add_package_comment($pkgid, $uid, $comment) { $q.= "AND CommentNotify.UserID != " . $uid . " "; $q.= "AND CommentNotify.PkgID = " . intval($pkgid); $result = $dbh->query($q); - $bcc = array(); + $recipients = array(); if ($result) { while ($row = $result->fetch(PDO::FETCH_ASSOC)) { - array_push($bcc, $row['Email']); + array_push($recipients, $row['Email']); } $q = "SELECT Packages.* "; @@ -282,9 +282,10 @@ function add_package_comment($pkgid, $uid, $comment) { . $comment . "\n\n---\nIf you no longer wish to receive notifications about this package, please go the the above package page and click the UnNotify button."; $body = wordwrap($body, 70); - $bcc = implode(', ', $bcc); - $headers = "Bcc: $bcc\nReply-to: nobody(a)archlinux.org\nFrom: aur-notify(a)archlinux.org\nX-Mailer: AUR\n"; - @mail('undisclosed-recipients: ;', "AUR Comment for " . $row['Name'], $body, $headers); + $headers = "Reply-to: nobody(a)archlinux.org\nFrom: aur-notify(a)archlinux.org\nX-Mailer: AUR\n"; + foreach ($recipients as $to) { + @mail($to, "AUR Comment for " . $row['Name'], $body, $headers); + } } } @@ -873,12 +874,12 @@ function pkg_delete ($atype, $ids, $mergepkgid) { $q.= "AND CommentNotify.UserID != " . uid_from_sid($_COOKIE['AURSID']) . " "; $q.= "AND CommentNotify.PkgID = " . $pkgid; $result = $dbh->query($q); - $bcc = array(); + $recipients = array(); while ($row = $result->fetch(PDO::FETCH_ASSOC)) { - array_push($bcc, $row['Email']); + array_push($recipients, $row['Email']); } - if (!empty($bcc)) { + if (!empty($recipients)) { $pkgname = pkgname_from_id($pkgid); # TODO: native language emails for users, based on their prefs @@ -893,9 +894,10 @@ function pkg_delete ($atype, $ids, $mergepkgid) { $body .= "You will no longer receive notifications about this package."; } $body = wordwrap($body, 70); - $bcc = implode(', ', $bcc); - $headers = "Bcc: $bcc\nReply-to: nobody(a)archlinux.org\nFrom: aur-notify(a)archlinux.org\nX-Mailer: AUR\n"; - @mail('undisclosed-recipients: ;', "AUR Package deleted: " . $pkgname, $body, $headers); + $headers = "Reply-to: nobody(a)archlinux.org\nFrom: aur-notify(a)archlinux.org\nX-Mailer: AUR\n"; + foreach ($recipients as $to) { + @mail($to, "AUR Package deleted: " . $pkgname, $body, $headers); + } } } -- 1.8.2.1

3 4

[aur-dev] [PATCH] Add PackagerUID column to Packages table
by canyonknight 24 Apr '13

24 Apr '13

The last packager is not currently saved despite there being many instances of the last packager being different than either the submitter or the maintainer. Signed-off-by: canyonknight <canyonknight(a)gmail.com> --- UPGRADING | 10 ++++++++++ support/schema/aur-schema.sql | 4 +++- 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/UPGRADING b/UPGRADING index a04471f..a003e9b 100644 --- a/UPGRADING +++ b/UPGRADING @@ -1,6 +1,16 @@ Upgrading ========= +From 2.2.0 to 2.3.0 +------------------- + +1. Add new last packager column to "Packages" table: + +---- +ALTER TABLE Packages ADD COLUMN PackagerUID INT(10) UNSIGNED NULL DEFAULT NULL; +ALTER TABLE Packages ADD FOREIGN KEY (PackagerUID) REFERENCES Users(ID) ON DELETE SET NULL; +---- + From 2.1.0 to 2.2.0 ------------------- diff --git a/support/schema/aur-schema.sql b/support/schema/aur-schema.sql index 0d04f12..c797970 100644 --- a/support/schema/aur-schema.sql +++ b/support/schema/aur-schema.sql @@ -106,6 +106,7 @@ CREATE TABLE Packages ( ModifiedTS BIGINT UNSIGNED NOT NULL, SubmitterUID INTEGER UNSIGNED NULL DEFAULT NULL, -- who submitted it? MaintainerUID INTEGER UNSIGNED NULL DEFAULT NULL, -- User + PackagerUID INTEGER UNSIGNED NULL DEFAULT NULL, PRIMARY KEY (ID), UNIQUE (Name), INDEX (CategoryID), @@ -115,7 +116,8 @@ CREATE TABLE Packages ( FOREIGN KEY (CategoryID) REFERENCES PackageCategories(ID) ON DELETE NO ACTION, -- deleting a user will cause packages to be orphaned, not deleted FOREIGN KEY (SubmitterUID) REFERENCES Users(ID) ON DELETE SET NULL, - FOREIGN KEY (MaintainerUID) REFERENCES Users(ID) ON DELETE SET NULL + FOREIGN KEY (MaintainerUID) REFERENCES Users(ID) ON DELETE SET NULL, + FOREIGN KEY (PackagerUID) REFERENCES Users(ID) ON DELETE SET NULL ) ENGINE = InnoDB; -- 1.8.2.1

2 1

[aur-dev] Removing spammer accounts
by Lukas Fleischer 23 Apr '13

23 Apr '13

I analyzed recent additions to the AUR user database in the hope of finding a way to delete all spammer accounts. Unfortunately, the account creation bot seems to be a bit more clever than I thought. Various different user names (both random user names, user names extracted from IRC channels etc.) and various different email addresses (different hosts, some local parts match the user name and some don't) were used. The only obvious pattern is that following fields are always empty: * RealName * IRCNick * PGPKey However, using that filter and also filtering by ID (51617 is the first account obviously created by a bot) and last login (1363737600 is 2013-03-20 00:00:00 which is after the login form has been disabled for Tor users) still leaves 18378 accounts: mysql> SELECT COUNT(*) FROM Users WHERE RealName = '' AND -> IRCNick = '' AND PGPKey = '' AND ID >= 51617 AND -> ID <= 70072 AND LastLogin < 1363737600; +----------+ | COUNT(*) | +----------+ | 18378 | +----------+ 1 row in set (0.01 sec) My suggestion is: 1. Set the password field of these accounts to "", so that they will no longer be able to login. They can still use the password reset form. 2. Delete all accounts that still have an empty password field in ~2 weeks. If there are any objections or alternative suggestions, please let me know. Otherwise, I will unset password fields before I re-enable the registration form (on Tuesday, 2013-03-26). Regards, Lukas

2 3

Re: [aur-dev] AUR Android app
by Pedro Veloso 21 Apr '13

21 Apr '13

Hi guys, Thank you for the replies. The RPC will do nicely, that was exactly what I was looking for. I guess I'll start with the info provided by the RPC and think about web scraping for package dependencies later on. The notifier for package maintainers should be easy to implement, I'm assuming it is basically keeping track of the "OutOfDate" field. As soon as I start and setup project somewhere (probably on github) I'll inform the list about my progress. Thank you, and cheers :)

2 2

[aur-dev] [PATCH] Remove superfluous search wrapper function
by canyonknight 19 Apr '13

19 Apr '13

The search_accounts_form() wrapper function doesn't have any arguments and only makes it unclear what is happening within account.php Signed-off-by: canyonknight <canyonknight(a)gmail.com> --- web/html/account.php | 2 +- web/lib/acctfuncs.inc.php | 10 ---------- 2 files changed, 1 insertion(+), 11 deletions(-) diff --git a/web/html/account.php b/web/html/account.php index 50d376f..4af3043 100644 --- a/web/html/account.php +++ b/web/html/account.php @@ -88,7 +88,7 @@ if (isset($_COOKIE["AURSID"])) { # display the search page if they're a TU/dev # print __("Use this form to search existing accounts.")."<br />\n"; - search_accounts_form(); + include('search_accounts_form.php'); } else { print __("You are not allowed to access this area."); diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index 28f9f93..1deeac5 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -277,16 +277,6 @@ function process_account_form($UTYPE,$TYPE,$A,$U="",$T="",$S="",$E="", } /** - * Include the search accounts form - * - * @return void - */ -function search_accounts_form() { - include("search_accounts_form.php"); - return; -} - -/** * Display the search results page * * @param string $UTYPE User type of the account accessing the form -- 1.8.2.1

1 0

[aur-dev] [PATCH] Retrieve package details after package actions are processed
by canyonknight 14 Apr '13

14 Apr '13

Fixes FS#34508 Signed-off-by: canyonknight <canyonknight(a)gmail.com> --- web/html/packages.php | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/web/html/packages.php b/web/html/packages.php index a4a480c..b390d76 100644 --- a/web/html/packages.php +++ b/web/html/packages.php @@ -26,12 +26,9 @@ if (!isset($pkgid) || !isset($pkgname)) { } } -# Set the title to the current query and get package details if required -$details = array(); - +# Set the title to the current query or package name if (isset($pkgname)) { $title = $pkgname; - $details = get_package_details($pkgid); } else if (!empty($_GET['K'])) { $title = __("Search Criteria") . ": " . $_GET['K']; } else { @@ -102,6 +99,12 @@ if (check_token()) { } } +# Get package details after package actions have been attempted, FS#34508 +$details = array(); +if (isset($pkgname)) { + $details = get_package_details($pkgid); +} + html_header($title, $details); ?> -- 1.8.2.1

1 0