September 2015 - Aur-dev - lists.archlinux.org

[aur-dev] [PATCH v2] Add search for keywords only
by Marcel Korpel 23 Sep '15

23 Sep '15

Implements FS#45619. Signed-off-by: Marcel Korpel <marcel.korpel(a)gmail.com> --- Changes since v1: * refactor sophiticated keyword search functionality to function * use this function to search for package keywords * update PHPDoc web/lib/pkgfuncs.inc.php | 103 ++++++++++++++++++++++++--------------- web/template/pkg_search_form.php | 1 + 2 files changed, 65 insertions(+), 39 deletions(-) diff --git a/web/lib/pkgfuncs.inc.php b/web/lib/pkgfuncs.inc.php index d760429..67cd10c 100644 --- a/web/lib/pkgfuncs.inc.php +++ b/web/lib/pkgfuncs.inc.php @@ -516,7 +516,10 @@ function pkg_display_details($id=0, $row, $SID="") { * SeB- property that search string (K) represents * values: n - package name * nd - package name & description - * x - package name (exact match) + * b - package base name + * N - package name (exact match) + * B - package base name (exact match) + * k - package keyword(s) * m - package maintainer's username * s - package submitter's username * do_Orphans - boolean. whether to search packages @@ -608,6 +611,10 @@ function pkg_search_page($SID="") { $K = "%" . addcslashes($_GET['K'], '%_') . "%"; $q_where .= "AND (PackageBases.Name LIKE " . $dbh->quote($K) . ") "; } + elseif (isset($_GET["SeB"]) && $_GET["SeB"] == "k") { + /* Search by keywords. */ + $q_where .= construct_keyword_search($dbh, false); + } elseif (isset($_GET["SeB"]) && $_GET["SeB"] == "N") { /* Search by name (exact match). */ $q_where .= "AND (Packages.Name = " . $dbh->quote($_GET['K']) . ") "; @@ -618,44 +625,7 @@ function pkg_search_page($SID="") { } else { /* Keyword search (default). */ - $count = 0; - $q_keywords = ""; - $op = ""; - - foreach (str_getcsv($_GET['K'], ' ') as $term) { - if ($term == "") { - continue; - } - if ($count > 0 && strtolower($term) == "and") { - $op = "AND "; - continue; - } - if ($count > 0 && strtolower($term) == "or") { - $op = "OR "; - continue; - } - if ($count > 0 && strtolower($term) == "not") { - $op .= "NOT "; - continue; - } - - $term = "%" . addcslashes($term, '%_') . "%"; - $q_keywords .= $op . " (Packages.Name LIKE " . $dbh->quote($term) . " OR "; - $q_keywords .= "Description LIKE " . $dbh->quote($term) . " OR "; - $q_keywords .= "EXISTS (SELECT * FROM PackageKeywords WHERE "; - $q_keywords .= "PackageKeywords.PackageBaseID = Packages.PackageBaseID AND "; - $q_keywords .= "PackageKeywords.Keyword LIKE " . $dbh->quote($term) . ")) "; - - $count++; - if ($count >= 20) { - break; - } - $op = "AND "; - } - - if (!empty($q_keywords)) { - $q_where .= "AND (" . $q_keywords . ") "; - } + $q_where .= construct_keyword_search($dbh, true); } } @@ -771,6 +741,61 @@ function pkg_search_page($SID="") { } /** + * Construct a WHERE part of sophiticated keyword search + * + * @param handle $dbh Database handle + * @param boolean $namedesc Search name and description fields? + * + * @return string WHERE part of SQL clause + */ +function construct_keyword_search($dbh, $namedesc) { + $count = 0; + $where_part = ""; + $q_keywords = ""; + $op = ""; + + foreach (str_getcsv($_GET['K'], ' ') as $term) { + if ($term == "") { + continue; + } + if ($count > 0 && strtolower($term) == "and") { + $op = "AND "; + continue; + } + if ($count > 0 && strtolower($term) == "or") { + $op = "OR "; + continue; + } + if ($count > 0 && strtolower($term) == "not") { + $op .= "NOT "; + continue; + } + + $term = "%" . addcslashes($term, '%_') . "%"; + $q_keywords .= $op . " ("; + if ($namedesc) { + $q_keywords .= "Packages.Name LIKE " . $dbh->quote($term) . " OR "; + $q_keywords .= "Description LIKE " . $dbh->quote($term) . " OR "; + } + $q_keywords .= "EXISTS (SELECT * FROM PackageKeywords WHERE "; + $q_keywords .= "PackageKeywords.PackageBaseID = Packages.PackageBaseID AND "; + $q_keywords .= "PackageKeywords.Keyword LIKE " . $dbh->quote($term) . ")) "; + + $count++; + if ($count >= 20) { + break; + } + $op = "AND "; + } + + if (!empty($q_keywords)) { + $where_part = "AND (" . $q_keywords . ") "; + } + + return $where_part; +} + +/** * Determine if a POST string has been sent by a visitor * * @param string $action String to check has been sent via POST diff --git a/web/template/pkg_search_form.php b/web/template/pkg_search_form.php index 404d16e..cce3b6a 100644 --- a/web/template/pkg_search_form.php +++ b/web/template/pkg_search_form.php @@ -7,6 +7,7 @@ $searchby = array( 'b' => __('Package Base'), 'N' => __('Exact Name'), 'B' => __('Exact Package Base'), + 'k' => __('Keywords'), 'm' => __('Maintainer'), 's' => __('Submitter') ); -- 2.5.3

2 3

[aur-dev] [PATCH] Add option to hide one's email address
by Marcel Korpel 20 Sep '15

20 Sep '15

Implements FS#42343. Signed-off-by: Marcel Korpel <marcel.korpel(a)gmail.com> --- schema/aur-schema.sql | 1 + upgrading/4.1.0.txt | 7 +++++++ web/html/account.php | 19 ++++++++++--------- web/html/register.php | 6 +++--- web/lib/acctfuncs.inc.php | 11 +++++++++-- web/template/account_details.php | 12 +++++++++++- web/template/account_edit_form.php | 5 +++++ 7 files changed, 46 insertions(+), 15 deletions(-) diff --git a/schema/aur-schema.sql b/schema/aur-schema.sql index 2c45a97..53dc468 100644 --- a/schema/aur-schema.sql +++ b/schema/aur-schema.sql @@ -26,6 +26,7 @@ CREATE TABLE Users ( Suspended TINYINT UNSIGNED NOT NULL DEFAULT 0, Username VARCHAR(32) NOT NULL, Email VARCHAR(64) NOT NULL, + HideEmail TINYINT UNSIGNED NOT NULL DEFAULT 0, Passwd CHAR(32) NOT NULL, Salt CHAR(32) NOT NULL DEFAULT '', ResetKey CHAR(32) NOT NULL DEFAULT '', diff --git a/upgrading/4.1.0.txt b/upgrading/4.1.0.txt index 439562f..26f9f65 100644 --- a/upgrading/4.1.0.txt +++ b/upgrading/4.1.0.txt @@ -17,3 +17,10 @@ ALTER TABLE PackageBases ADD COLUMN FlaggerComment VARCHAR(255) NOT NULL, ADD FOREIGN KEY (FlaggerUID) REFERENCES Users(ID) ON DELETE SET NULL; ---- + +3. Add field to store the state of a user's email address: + +---- +ALTER TABLE Users + ADD COLUMN HideEmail TINYINT UNSIGNED NOT NULL DEFAULT 0; +---- diff --git a/web/html/account.php b/web/html/account.php index adc2542..b2886fc 100644 --- a/web/html/account.php +++ b/web/html/account.php @@ -32,10 +32,10 @@ if ($action == "UpdateAccount") { list($success, $update_account_message) = process_account_form( "edit", "UpdateAccount", in_request("U"), in_request("T"), in_request("S"), - in_request("E"), in_request("P"), in_request("C"), - in_request("R"), in_request("L"), in_request("I"), - in_request("K"), in_request("PK"), in_request("J"), - in_request("ID"), $row["Username"]); + in_request("E"), in_request("H"), in_request("P"), + in_request("C"), in_request("R"), in_request("L"), + in_request("I"), in_request("K"), in_request("PK"), + in_request("J"), in_request("ID"), $row["Username"]); } } @@ -79,8 +79,8 @@ if (isset($_COOKIE["AURSID"])) { if (can_edit_account($row)) { display_account_form("UpdateAccount", $row["Username"], $row["AccountTypeID"], $row["Suspended"], $row["Email"], - "", "", $row["RealName"], $row["LangPreference"], - $row["IRCNick"], $row["PGPKey"], $PK, + $row["HideEmail"], "", "", $row["RealName"], + $row["LangPreference"], $row["IRCNick"], $row["PGPKey"], $PK, $row["InactivityTS"] ? 1 : 0, $row["ID"], $row["Username"]); } else { print __("You do not have permission to edit this account."); @@ -115,9 +115,10 @@ if (isset($_COOKIE["AURSID"])) { if (!$success) { display_account_form("UpdateAccount", in_request("U"), in_request("T"), - in_request("S"), in_request("E"), in_request("P"), in_request("C"), - in_request("R"), in_request("L"), in_request("I"), in_request("K"), - in_request("PK"), in_request("J"), in_request("ID"), $row["Username"]); + in_request("S"), in_request("E"), in_request("H"), in_request("P"), + in_request("C"), in_request("R"), in_request("L"), in_request("I"), + in_request("K"), in_request("PK"), in_request("J"), in_request("ID"), + $row["Username"]); } } else { diff --git a/web/html/register.php b/web/html/register.php index 9c5c1cc..f8400a3 100644 --- a/web/html/register.php +++ b/web/html/register.php @@ -21,7 +21,7 @@ echo '<h2>' . __('Register') . '</h2>'; if (in_request("Action") == "NewAccount") { list($success, $message) = process_account_form( "new", "NewAccount", in_request("U"), 1, 0, - in_request("E"), '', '', in_request("R"), + in_request("E"), in_request("H"), '', '', in_request("R"), in_request("L"), in_request("I"), in_request("K"), in_request("PK")); @@ -29,13 +29,13 @@ if (in_request("Action") == "NewAccount") { if (!$success) { display_account_form("NewAccount", in_request("U"), 1, 0, - in_request("E"), '', '', in_request("R"), + in_request("E"), in_request("H"), '', '', in_request("R"), in_request("L"), in_request("I"), in_request("K"), in_request("PK")); } } else { print '<p>' . __("Use this form to create an account.") . '</p>'; - display_account_form("NewAccount", "", "", "", "", "", "", "", $LANG); + display_account_form("NewAccount", "", "", "", "", "", "", "", "", $LANG); } echo '</div>'; diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index 756c847..a200998 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -47,6 +47,7 @@ function html_format_pgp_fingerprint($fingerprint) { * @param string $T The account type of the displayed user * @param string $S Whether the displayed user has a suspended account * @param string $E The e-mail address of the displayed user + * @param string $H Whether the e-mail address of the displayed user is hidden * @param string $P The password value of the displayed user * @param string $C The confirmed password value of the displayed user * @param string $R The real name of the displayed user @@ -60,7 +61,7 @@ function html_format_pgp_fingerprint($fingerprint) { * * @return void */ -function display_account_form($A,$U="",$T="",$S="",$E="",$P="",$C="",$R="", +function display_account_form($A,$U="",$T="",$S="",$E="",$H="",$P="",$C="",$R="", $L="",$I="",$K="",$PK="",$J="",$UID=0,$N="") { global $SUPPORTED_LANGS; @@ -78,6 +79,7 @@ function display_account_form($A,$U="",$T="",$S="",$E="",$P="",$C="",$R="", * @param string $T The account type for the user * @param string $S Whether or not the account is suspended * @param string $E The e-mail address for the user + * @param string $H Whether or not the e-mail address should be hidden * @param string $P The password for the user * @param string $C The confirmed password for the user * @param string $R The real name of the user @@ -91,7 +93,7 @@ function display_account_form($A,$U="",$T="",$S="",$E="",$P="",$C="",$R="", * * @return array Boolean indicating success and message to be printed */ -function process_account_form($TYPE,$A,$U="",$T="",$S="",$E="",$P="",$C="", +function process_account_form($TYPE,$A,$U="",$T="",$S="",$E="",$H="",$P="",$C="", $R="",$L="",$I="",$K="",$PK="",$J="",$UID=0,$N="") { global $SUPPORTED_LANGS; @@ -324,6 +326,11 @@ function process_account_form($TYPE,$A,$U="",$T="",$S="",$E="",$P="",$C="", $q.= ", Suspended = 0"; } $q.= ", Email = " . $dbh->quote($E); + if ($H) { + $q.= ", HideEmail = 1"; + } else { + $q.= ", HideEmail = 0"; + } if ($P) { $salt = generate_salt(); $hash = salted_hash($P, $salt); diff --git a/web/template/account_details.php b/web/template/account_details.php index 9282b2c..59a6a63 100644 --- a/web/template/account_details.php +++ b/web/template/account_details.php @@ -25,7 +25,17 @@ </tr> <tr> <th><?= __("Email Address") . ":" ?></th> - <td><a href="mailto:<?= htmlspecialchars($row["Email"], ENT_QUOTES) ?>"><?= htmlspecialchars($row["Email"], ENT_QUOTES) ?></a></td> + <td> + <?php + if ($row["HideEmail"] == 1 && !has_credential(CRED_ACCOUNT_SEARCH)): + print "<em>" . __("hidden") . "</em>"; + else: + ?> + <a href="mailto:<?= htmlspecialchars($row["Email"], ENT_QUOTES) ?>"><?= htmlspecialchars($row["Email"], ENT_QUOTES) ?></a> + <?php + endif; + ?> + </td> </tr> <tr> <th><?= __("Real Name") . ":" ?></th> diff --git a/web/template/account_edit_form.php b/web/template/account_edit_form.php index 83aedb0..16655c0 100644 --- a/web/template/account_edit_form.php +++ b/web/template/account_edit_form.php @@ -76,6 +76,11 @@ <em><?= __("Please ensure you correctly entered your email address, otherwise you will be locked out.") ?></em> </p> + <p> + <label for="id_hide"><?= __("Hide Email Address") ?>:</label> + <input type="checkbox" name="H" id="id_hide" <?= $H ? 'checked="checked"' : '' ?> /> + </p> + <?php if ($A == "UpdateAccount"): ?> <p> <label for="id_passwd1"><?= __("Password") ?>:</label> -- 2.5.2

2 1

[aur-dev] [PATCH 1/2] Fix type of FlaggerUID in table PackageBases
by Marcel Korpel 20 Sep '15

20 Sep '15

Signed-off-by: Marcel Korpel <marcel.korpel(a)gmail.com> --- schema/aur-schema.sql | 2 +- upgrading/4.1.0.txt | 5 +++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/schema/aur-schema.sql b/schema/aur-schema.sql index ff137dc..2c45a97 100644 --- a/schema/aur-schema.sql +++ b/schema/aur-schema.sql @@ -85,7 +85,7 @@ CREATE TABLE PackageBases ( FlaggerComment VARCHAR(255) NOT NULL, SubmittedTS BIGINT UNSIGNED NOT NULL, ModifiedTS BIGINT UNSIGNED NOT NULL, - FlaggerUID BIGINT UNSIGNED NULL DEFAULT NULL, -- who flagged the package out-of-date? + FlaggerUID INTEGER UNSIGNED NULL DEFAULT NULL, -- who flagged the package out-of-date? SubmitterUID INTEGER UNSIGNED NULL DEFAULT NULL, -- who submitted it? MaintainerUID INTEGER UNSIGNED NULL DEFAULT NULL, -- User PackagerUID INTEGER UNSIGNED NULL DEFAULT NULL, -- Last packager diff --git a/upgrading/4.1.0.txt b/upgrading/4.1.0.txt index e9545ff..439562f 100644 --- a/upgrading/4.1.0.txt +++ b/upgrading/4.1.0.txt @@ -13,6 +13,7 @@ package out-of-date: ---- ALTER TABLE PackageBases - ADD COLUMN FlaggerUID BIGINT UNSIGNED NULL DEFAULT NULL, - ADD COLUMN FlaggerComment VARCHAR(255) NOT NULL; + ADD COLUMN FlaggerUID INTEGER UNSIGNED NULL DEFAULT NULL, + ADD COLUMN FlaggerComment VARCHAR(255) NOT NULL, + ADD FOREIGN KEY (FlaggerUID) REFERENCES Users(ID) ON DELETE SET NULL; ---- -- 2.5.2

2 5

[aur-dev] [PATCH] Rename "Age" search order to "Last modified"
by Lukas Fleischer 20 Sep '15

20 Sep '15

Use a better description for sorting by modification time, as it is not clear whether "Age" refers to the package creation date or to the modification date. The possibility to sort by "Age" is kept internally (but hidden from the user interface) such that old links to search results still work. Fixes FS#46319. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/lib/pkgfuncs.inc.php | 4 ++++ web/template/pkg_search_form.php | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/web/lib/pkgfuncs.inc.php b/web/lib/pkgfuncs.inc.php index 62bea65..600e590 100644 --- a/web/lib/pkgfuncs.inc.php +++ b/web/lib/pkgfuncs.inc.php @@ -755,7 +755,11 @@ function pkg_search_page($SID="") { case 'm': $q_sort .= "Maintainer " . $order . ", "; break; + case 'l': + $q_sort .= "ModifiedTS " . $order . ", "; + break; case 'a': + /* For compatibility with old search links. */ $q_sort .= "-ModifiedTS " . $order . ", "; break; default: diff --git a/web/template/pkg_search_form.php b/web/template/pkg_search_form.php index 404d16e..1cc5fb2 100644 --- a/web/template/pkg_search_form.php +++ b/web/template/pkg_search_form.php @@ -24,7 +24,7 @@ $sortby = array( 'w' => __('Voted'), 'o' => __('Notify'), 'm' => __('Maintainer'), - 'a' => __('Age') + 'l' => __('Last modified') ); $orderby = array( -- 2.5.2

1 0

[aur-dev] [PATCH 1/2] Remove legacy code
by Lukas Fleischer 19 Sep '15

19 Sep '15

In 74edb6f (Use Git repositories to store packages, 2014-06-06), package creation was moved to the Python backend. Remove several PHP functions that are no longer needed. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/lib/pkgfuncs.inc.php | 189 ----------------------------------------------- 1 file changed, 189 deletions(-) diff --git a/web/lib/pkgfuncs.inc.php b/web/lib/pkgfuncs.inc.php index b00b22d..d3cad12 100644 --- a/web/lib/pkgfuncs.inc.php +++ b/web/lib/pkgfuncs.inc.php @@ -516,23 +516,6 @@ function pkg_name_from_id($pkgids) { } /** - * Determine if a package name is on the database blacklist - * - * @param string $name The package name to check - * - * @return bool True if the name is blacklisted, otherwise false - */ -function pkg_name_is_blacklisted($name) { - $dbh = DB::connect(); - $q = "SELECT COUNT(*) FROM PackageBlacklist "; - $q.= "WHERE Name = " . $dbh->quote($name); - $result = $dbh->query($q); - - if (!$result) return false; - return ($result->fetchColumn() > 0); -} - -/** * Get the package details * * @param string $id The package ID to get description for @@ -913,178 +896,6 @@ function sanitize_ids($ids) { } /** - * Add package information to the database for a specific package - * - * @param int $base_id ID of the package base - * @param string $pkgname Name of the new package - * @param string $pkgver Version of the new package - * @param string $pkgdesc Description of the new package - * @param string $pkgurl Upstream URL for the new package - * - * @return int ID of the new package - */ -function pkg_create($base_id, $pkgname, $pkgver, $pkgdesc, $pkgurl) { - $dbh = DB::connect(); - $q = sprintf("INSERT INTO Packages (PackageBaseID, Name, Version, " . - "Description, URL) VALUES (%d, %s, %s, %s, %s)", - $base_id, $dbh->quote($pkgname), $dbh->quote($pkgver), - $dbh->quote($pkgdesc), $dbh->quote($pkgurl)); - $dbh->exec($q); - return $dbh->lastInsertId(); -} - -/** - * Add a dependency for a specific package to the database - * - * @param int $pkgid The package ID to add the dependency for - * @param string $type The type of dependency to add - * @param string $depname The name of the dependency to add - * @param string $depcondition The type of dependency for the package - * @param string $deparch The architecture of the dependency to add - * - * @return void - */ -function pkg_add_dep($pkgid, $type, $depname, $depcondition, $deparch) { - $dbh = DB::connect(); - $q = sprintf("INSERT INTO PackageDepends (PackageID, DepTypeID, DepName, DepCondition, DepArch) VALUES (%d, %d, %s, %s, %s)", - $pkgid, - pkg_dependency_type_id_from_name($type), - $dbh->quote($depname), - $dbh->quote($depcondition), - $deparch ? $dbh->quote($deparch) : 'NULL' - ); - $dbh->exec($q); -} - -/** - * Add a relation for a specific package to the database - * - * @param int $pkgid The package ID to add the relation for - * @param string $type The type of relation to add - * @param string $relname The name of the relation to add - * @param string $relcondition The version requirement of the relation - * @param string $relarch The architecture of the relation to add - * - * @return void - */ -function pkg_add_rel($pkgid, $type, $relname, $relcondition, $relarch) { - $dbh = DB::connect(); - $q = sprintf("INSERT INTO PackageRelations (PackageID, RelTypeID, RelName, RelCondition, RelArch) VALUES (%d, %d, %s, %s, %s)", - $pkgid, - pkg_relation_type_id_from_name($type), - $dbh->quote($relname), - $dbh->quote($relcondition), - $relarch ? $dbh->quote($relarch) : 'NULL' - ); - $dbh->exec($q); -} - -/** - * Add a source for a specific package to the database - * - * @param int $pkgid The package ID to add the source for - * @param string $pkgsrc The package source to add to the database - * @param string $srcarch The architecture of the source to add - * - * @return void - */ -function pkg_add_src($pkgid, $pkgsrc, $srcarch) { - $dbh = DB::connect(); - $q = sprintf("INSERT INTO PackageSources (PackageID, Source, SourceArch) VALUES (%d, %s, %s)", - $pkgid, - $dbh->quote($pkgsrc), - $srcarch ? $dbh->quote($srcarch) : 'NULL' - ); - $dbh->exec($q); -} - -/** - * Creates a new group and returns its ID - * - * If the groups already exists, the ID of the already existing group is - * returned. - * - * @param string $name The name of the group to create - * - * @return int The ID of the group - */ -function pkg_create_group($name) { - $dbh = DB::connect(); - $q = sprintf("SELECT ID FROM Groups WHERE Name = %s", $dbh->quote($name)); - $result = $dbh->query($q); - if ($result) { - $grpid = $result->fetch(PDO::FETCH_COLUMN, 0); - if ($grpid > 0) { - return $grpid; - } - } - - $q = sprintf("INSERT INTO Groups (Name) VALUES (%s)", $dbh->quote($name)); - $dbh->exec($q); - return $dbh->lastInsertId(); -} - -/** - * Add a package to a group - * - * @param int $pkgid The package ID of the package to add - * @param int $grpid The group ID of the group to add the package to - * - * @return void - */ -function pkg_add_grp($pkgid, $grpid) { - $dbh = DB::connect(); - $q = sprintf("INSERT INTO PackageGroups (PackageID, GroupID) VALUES (%d, %d)", - $pkgid, - $grpid - ); - $dbh->exec($q); -} - -/** - * Creates a new license and returns its ID - * - * If the license already exists, the ID of the already existing license is - * returned. - * - * @param string $name The name of the license to create - * - * @return int The ID of the license - */ -function pkg_create_license($name) { - $dbh = DB::connect(); - $q = sprintf("SELECT ID FROM Licenses WHERE Name = %s", $dbh->quote($name)); - $result = $dbh->query($q); - if ($result) { - $licid = $result->fetch(PDO::FETCH_COLUMN, 0); - if ($licid > 0) { - return $licid; - } - } - - $q = sprintf("INSERT INTO Licenses (Name) VALUES (%s)", $dbh->quote($name)); - $dbh->exec($q); - return $dbh->lastInsertId(); -} - -/** - * Add a license to a package - * - * @param int $pkgid The package ID of the package - * @param int $grpid The ID of the license to add - * - * @return void - */ -function pkg_add_lic($pkgid, $licid) { - $dbh = DB::connect(); - $q = sprintf("INSERT INTO PackageLicenses (PackageID, LicenseID) VALUES (%d, %d)", - $pkgid, - $licid - ); - $dbh->exec($q); -} - -/** * Determine package information for latest package * * @param int $numpkgs Number of packages to get information on -- 2.5.2

1 1

[aur-dev] [PATCH 1/2] Use a separate function for "Required by" links
by Lukas Fleischer 17 Sep '15

17 Sep '15

Do not use the same function for generating dependency and inverse dependency links. Instead, factor out common code and create two separate functions for those (rather different) functionalities. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/lib/pkgfuncs.inc.php | 92 +++++++++++++++++++++++++++++++------------- web/template/pkg_details.php | 2 +- 2 files changed, 66 insertions(+), 28 deletions(-) diff --git a/web/lib/pkgfuncs.inc.php b/web/lib/pkgfuncs.inc.php index d83a01f..2939c25 100644 --- a/web/lib/pkgfuncs.inc.php +++ b/web/lib/pkgfuncs.inc.php @@ -239,6 +239,48 @@ function pkg_relations($pkgid) { } /** + * Get the HTML code to display a package dependency link annotation + * (dependency type, architecture, ...) + * + * @param string $type The name of the dependency type + * @param string $arch The package dependency architecture + * @param string $desc An optdepends description + * + * @return string The HTML code of the label to display + */ +function pkg_deplink_annotation($type, $arch, $desc=false) { + if ($type == 'depends' && !$arch) { + return ''; + } + + $link = ' <em>('; + + if ($type == 'makedepends') { + $link .= 'make'; + } elseif ($type == 'checkdepends') { + $link .= 'check'; + } elseif ($type == 'optdepends') { + $link .= 'optional'; + } + + if ($type != 'depends' && $arch) { + $link .= ', '; + } + + if ($arch) { + $link .= htmlspecialchars($arch); + } + + $link .= ')'; + if ($type == 'optdepends' && $desc) { + $link .= ' – ' . htmlspecialchars($desc) . ' </em>'; + } + $link .= '</em>'; + + return $link; +} + +/** * Get the HTML code to display a package dependency link * * @param string $name The name of the dependency @@ -246,11 +288,10 @@ function pkg_relations($pkgid) { * @param string $cond The package dependency condition string * @param string $arch The package dependency architecture * @param int $pkg_id The package of the package to display the dependency for - * @param bool $show_desc Whether the description of optdepends is shown * * @return string The HTML code of the label to display */ -function pkg_depend_link($name, $type, $cond, $arch, $pkg_id, $show_desc=true) { +function pkg_depend_link($name, $type, $cond, $arch, $pkg_id) { if ($type == 'optdepends' && strpos($name, ':') !== false) { $tokens = explode(':', $name, 2); $name = $tokens[0]; @@ -295,33 +336,30 @@ function pkg_depend_link($name, $type, $cond, $arch, $pkg_id, $show_desc=true) { $link .= htmlspecialchars($cond); } - if ($type != 'depends' || $arch) { - $link .= ' <em>('; - - if ($type == 'makedepends') { - $link .= 'make'; - } elseif ($type == 'checkdepends') { - $link .= 'check'; - } elseif ($type == 'optdepends') { - $link .= 'optional'; - } - - if ($type != 'depends' && $arch) { - $link .= ', '; - } - - if ($arch) { - $link .= htmlspecialchars($arch); - } + return $link . pkg_deplink_annotation($type, $arch, $desc); +} - $link .= ')'; - if ($show_desc && $type == 'optdepends') { - $link .= ' – ' . htmlspecialchars($desc) . ' </em>'; - } - $link .= '</em>'; +/** + * Get the HTML code to display a package requirement link + * + * @param string $name The name of the requirement + * @param string $type The name of the dependency type + * @param string $arch The package dependency architecture + * + * @return string The HTML code of the link to display + */ +function pkg_requiredby_link($name, $type, $arch) { + if ($type == 'optdepends' && strpos($name, ':') !== false) { + $tokens = explode(':', $name, 2); + $name = $tokens[0]; } - return $link; + $link = '<a href="'; + $link .= htmlspecialchars(get_pkg_uri($name), ENT_QUOTES); + $link .= '" title="' . __('View packages details for') .' ' . htmlspecialchars($name) . '">'; + $link .= htmlspecialchars($name) . '</a>'; + + return $link . pkg_deplink_annotation($type, $arch); } /** @@ -379,7 +417,7 @@ function pkg_required($name="") { $deps = array(); if ($name != "") { $dbh = DB::connect(); - $q = "SELECT p.Name, dt.Name, '' AS DepCondition, pd.DepArch, p.ID FROM PackageDepends pd "; + $q = "SELECT p.Name, dt.Name, pd.DepArch FROM PackageDepends pd "; $q.= "LEFT JOIN Packages p ON p.ID = pd.PackageID "; $q.= "LEFT JOIN DependencyTypes dt ON dt.ID = pd.DepTypeID "; $q.= "WHERE pd.DepName = " . $dbh->quote($name) . " "; diff --git a/web/template/pkg_details.php b/web/template/pkg_details.php index 5ba3607..0a2d90e 100644 --- a/web/template/pkg_details.php +++ b/web/template/pkg_details.php @@ -285,7 +285,7 @@ endif; <?php if (count($requiredby) > 0): ?> <ul id="pkgreqslist"> <?php while (list($k, $darr) = each($requiredby)): ?> - <li><?= pkg_depend_link($darr[0], $darr[1], $darr[2], $darr[3], $darr[4], false); ?></li> + <li><?= pkg_requiredby_link($darr[0], $darr[1], $darr[2]); ?></li> <?php endwhile; ?> </ul> <?php endif; ?> -- 2.5.2

1 1

[aur-dev] [PATCH] git-update: Use proper stop value for slice
by Lukas Fleischer 16 Sep '15

16 Sep '15

Fixes a regression introduced in 4112e57 (Add a restore command to the SSH interface, 2015-08-14). Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- git-interface/git-update.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/git-interface/git-update.py b/git-interface/git-update.py index 5ff8b28..4698382 100755 --- a/git-interface/git-update.py +++ b/git-interface/git-update.py @@ -188,7 +188,7 @@ if len(sys.argv) == 2 and sys.argv[1] == "restore": refname = "refs/heads/master" sha1_old = sha1_new = repo.lookup_reference('refs/heads/' + pkgbase).target elif len(sys.argv) == 4: - refname, sha1_old, sha1_new = sys.argv[1:3] + refname, sha1_old, sha1_new = sys.argv[1:4] else: die("invalid arguments") -- 2.5.2

1 0

[aur-dev] [PATCH] Transfer notifications when merging packages
by Lukas Fleischer 16 Sep '15

16 Sep '15

When a package base is merged into another one, followers of the old package base usually want to be notified about comments the new package base as well. Fixes FS#27687. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- scripts/notify.py | 7 +++---- web/lib/pkgbasefuncs.inc.php | 14 ++++++++++++++ 2 files changed, 17 insertions(+), 4 deletions(-) diff --git a/scripts/notify.py b/scripts/notify.py index 55b2911..f6bf6ff 100755 --- a/scripts/notify.py +++ b/scripts/notify.py @@ -167,10 +167,9 @@ def delete(cur, uid, old_pkgbase_id, new_pkgbase_id=None): if new_pkgbase_id: new_pkgbase_uri = aur_location + '/pkgbase/' + new_pkgbase + '/' body = '%s [1] merged %s [2] into %s [3].\n\n' \ - 'You will no longer receive notifications about this ' \ - 'package, please go to [3] and click "%s" if you wish to ' \ - 'receive them again.' % \ - (user, old_pkgbase, new_pkgbase, 'Notify of new comments') + 'If you no longer wish receive notifications about the new ' \ + 'package, please go to [3] and click "%s".' %\ + (user, old_pkgbase, new_pkgbase, 'Disable notifications') body += '\n\n' body += '[1] ' + user_uri + '\n' body += '[2] ' + pkgbase_uri + '\n' diff --git a/web/lib/pkgbasefuncs.inc.php b/web/lib/pkgbasefuncs.inc.php index 799f1da..cb756f6 100644 --- a/web/lib/pkgbasefuncs.inc.php +++ b/web/lib/pkgbasefuncs.inc.php @@ -448,6 +448,20 @@ function pkgbase_delete ($base_ids, $merge_base_id, $via, $grant=false) { $q.= "WHERE PackageBaseID IN (" . implode(",", $base_ids) . ")"; $dbh->exec($q); + /* Merge notifications */ + $q = "SELECT DISTINCT UserID FROM CommentNotify cn "; + $q.= "WHERE PackageBaseID IN (" . implode(",", $base_ids) . ") "; + $q.= "AND NOT EXISTS (SELECT * FROM CommentNotify cn2 "; + $q.= "WHERE cn2.PackageBaseID = " . intval($merge_base_id) . " "; + $q.= "AND cn2.UserID = cn.UserID)"; + $result = $dbh->query($q); + + while ($notify_uid = $result->fetch(PDO::FETCH_COLUMN, 0)) { + $q = "INSERT INTO CommentNotify (UserID, PackageBaseID) "; + $q.= "VALUES (" . intval($notify_uid) . ", " . intval($merge_base_id) . ")"; + $dbh->exec($q); + } + /* Merge votes */ foreach ($base_ids as $base_id) { $q = "UPDATE PackageVotes "; -- 2.5.2

1 0

[aur-dev] [PATCH] Show providers in dependencies
by Lukas Fleischer 16 Sep '15

16 Sep '15

For all "virtual provisions" in package dependencies, show links to the actual packages providing the dependency. This partly implements FS#14125. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/lib/pkgfuncs.inc.php | 65 +++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 59 insertions(+), 6 deletions(-) diff --git a/web/lib/pkgfuncs.inc.php b/web/lib/pkgfuncs.inc.php index d760429..d83a01f 100644 --- a/web/lib/pkgfuncs.inc.php +++ b/web/lib/pkgfuncs.inc.php @@ -155,6 +155,33 @@ function pkg_groups($pkgid) { } /** + * Get providers for a specific package + * + * @param string $name The name of the "package" to get providers for + * + * @return array The IDs and names of all providers of the package + */ +function pkg_providers($name) { + $dbh = DB::connect(); + $q = "SELECT p.ID, p.Name FROM Packages p "; + $q.= "INNER JOIN PackageRelations pr ON pr.PackageID = p.ID "; + $q.= "INNER JOIN RelationTypes rt ON rt.ID = pr.RelTypeID "; + $q.= "WHERE rt.Name = 'provides' "; + $q.= "AND pr.RelName = " . $dbh->quote($name); + $result = $dbh->query($q); + + if (!$result) { + return array(); + } + + $providers = array(); + while ($row = $result->fetch(PDO::FETCH_NUM)) { + $providers[] = $row; + } + return $providers; +} + +/** * Get package dependencies for a specific package * * @param int $pkgid The package to get dependencies for @@ -232,15 +259,41 @@ function pkg_depend_link($name, $type, $cond, $arch, $pkg_id, $show_desc=true) { $desc = '(unknown)'; } - $link = '<a href="'; + $providers = array(); if (is_null($pkg_id)) { - $link .= 'https://www.archlinux.org/packages/?q=' . urlencode($name); + /* + * TODO: We currently perform one SQL query per nonexistent + * package dependency. It would be much better if we could + * annotate dependency data with providers so that we already + * know whether a dependency is a "provision name" or a package + * from the official repositories at this point. + */ + $providers = pkg_providers($name); + } + + if (count($providers) > 0) { + $link = htmlspecialchars($name) . ' '; + $link .= '<span class="virtual-dep">('; + foreach ($providers as $provider) { + $name = $provider[1]; + $link .= '<a href="'; + $link .= htmlspecialchars(get_pkg_uri($name), ENT_QUOTES); + $link .= '" title="' . __('View packages details for') .' ' . htmlspecialchars($name) . '">'; + $link .= htmlspecialchars($name) . '</a>, '; + } + $link = substr($link, 0, -2); + $link .= ')</span>'; } else { - $link .= htmlspecialchars(get_pkg_uri($name), ENT_QUOTES); + $link = '<a href="'; + if (is_null($pkg_id)) { + $link .= 'https://www.archlinux.org/packages/?q=' . urlencode($name); + } else { + $link .= htmlspecialchars(get_pkg_uri($name), ENT_QUOTES); + } + $link .= '" title="' . __('View packages details for') .' ' . htmlspecialchars($name) . '">'; + $link .= htmlspecialchars($name) . '</a>'; + $link .= htmlspecialchars($cond); } - $link .= '" title="' . __('View packages details for') .' ' . htmlspecialchars($name) . '">'; - $link .= htmlspecialchars($name) . '</a>'; - $link .= htmlspecialchars($cond); if ($type != 'depends' || $arch) { $link .= ' <em>('; -- 2.5.2

1 0

[aur-dev] [PATCH] Mitigate JSONP callback vulnerabilities
by Lukas Fleischer 12 Sep '15

12 Sep '15

The callback parameter of the RPC interface currently allows for specifying a prefix of arbitrary length of the returned result. This can be exploited by certain attacks. As a countermeasure, this patch restricts the allowed character set for the callback name to letters, digits, underscores, parenthesis and dots. It also limits the length of the name to 128 characters. Furthermore, the reflected callback name is now always prepended with "/**/", which is a common workaround to protect against attacks such as Rosetta Flash. Fixes FS#46259. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/lib/aurjson.class.php | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/web/lib/aurjson.class.php b/web/lib/aurjson.class.php index e102fed..e646c63 100644 --- a/web/lib/aurjson.class.php +++ b/web/lib/aurjson.class.php @@ -110,9 +110,13 @@ class AurJSON { return; } - if (isset($http_data['callback'])) { + $callback = $http_data['callback']; + if (isset($callback)) { + if (!preg_match('/^[a-zA-Z0-9().]{1,128}$/D', $callback)) { + return $this->json_error('Invalid callback name.'); + } header('content-type: text/javascript'); - return $http_data['callback'] . "({$json})"; + return '/**/' . $callback . '(' . $json . ')'; } else { header('content-type: application/json'); return $json; -- 2.5.1

1 0