September 2015 - Aur-dev - lists.archlinux.org

[aur-dev] [PATCH 1/2] Remove superfluous function valid_user()
by Lukas Fleischer 11 Sep '15

11 Sep '15

This helper function was almost 100% identical to uid_from_username(). Switch to using uid_from_username(), which has a much better name and implementation, everywhere. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/html/addvote.php | 2 +- web/lib/acctfuncs.inc.php | 27 +-------------------------- 2 files changed, 2 insertions(+), 27 deletions(-) diff --git a/web/html/addvote.php b/web/html/addvote.php index 0372518..d152941 100644 --- a/web/html/addvote.php +++ b/web/html/addvote.php @@ -24,7 +24,7 @@ if (has_credential(CRED_TU_ADD_VOTE)) { $error = ""; if (!empty($_POST['user'])) { - if (!valid_user($_POST['user'])) { + if (!uid_from_username($_POST['user'])) { $error.= __("Username does not exist."); } else { diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index f718a77..ee8f0e3 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -479,7 +479,7 @@ function try_login() { } $dbh = DB::connect(); - $userID = valid_user($_REQUEST['user']); + $userID = uid_from_username($_REQUEST['user']); if (user_suspended($userID)) { $login_error = __('Account suspended'); @@ -609,31 +609,6 @@ function valid_username($user) { } /** - * Determine if a username exists in the database - * - * @param string $user Username to check in the database - * - * @return string|void Return user ID if in database, otherwise void - */ -function valid_user($user) { - if (!$user) { - return false; - } - - $dbh = DB::connect(); - - $q = "SELECT ID FROM Users WHERE "; - $q.= "Username = " . $dbh->quote($user); - $result = $dbh->query($q); - if (!$result) { - return null; - } - - $row = $result->fetch(PDO::FETCH_NUM); - return $row[0]; -} - -/** * Determine if a user already has a proposal open about themselves * * @param string $user Username to checkout for open proposal -- 2.5.1

1 1

[aur-dev] [PATCH 1/2] Move package base flagging to a separate form
by Lukas Fleischer 11 Sep '15

11 Sep '15

Show a separate confirmation page when flagging a package out-of-date. Implements FS#44967. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/html/index.php | 4 ++-- web/html/pkgflag.php | 44 ++++++++++++++++++++++++++++++++++++++++ web/template/pkgbase_actions.php | 2 +- 3 files changed, 47 insertions(+), 3 deletions(-) create mode 100644 web/html/pkgflag.php diff --git a/web/html/index.php b/web/html/index.php index 7068d76..ec99bb7 100644 --- a/web/html/index.php +++ b/web/html/index.php @@ -68,8 +68,8 @@ if (!empty($tokens[1]) && '/' . $tokens[1] == get_pkg_route()) { $_POST['do_UnNotify'] = __('UnNotify'); break; case "flag": - $_POST['do_Flag'] = __('Flag'); - break; + include('pkgflag.php'); + return; case "unflag": $_POST['do_UnFlag'] = __('UnFlag'); break; diff --git a/web/html/pkgflag.php b/web/html/pkgflag.php new file mode 100644 index 0000000..9d86909 --- /dev/null +++ b/web/html/pkgflag.php @@ -0,0 +1,44 @@ +<?php + +set_include_path(get_include_path() . PATH_SEPARATOR . '../lib'); + +include_once("aur.inc.php"); +include_once("pkgfuncs.inc.php"); + +set_lang(); +check_sid(); + +html_header(__("Flag Package Out-Of-Date")); + +if (has_credential(CRED_PKGBASE_FLAG)): ?> +<div class="box"> + <h2><?= __('Flag Package Out-Of-Date: %s', htmlspecialchars($pkgbase_name)) ?></h2> + <p> + <?= __('Use this form to flag the package base %s%s%s and the following packages out-of-date: ', + '<strong>', htmlspecialchars($pkgbase_name), '</strong>'); ?> + </p> + <ul> + <?php foreach(pkgbase_get_pkgnames($base_id) as $pkgname): ?> + <li><?= htmlspecialchars($pkgname) ?></li> + <?php endforeach; ?> + </ul> + <p> + <?= __('Please do %snot%s use this form to report bugs. Use the package comments instead.', + '<strong>', '</strong>'); ?> + </p> + <form action="<?= get_uri('/pkgbase/'); ?>" method="post"> + <fieldset> + <input type="hidden" name="IDs[<?= $base_id ?>]" value="1" /> + <input type="hidden" name="ID" value="<?= $base_id ?>" /> + <input type="hidden" name="token" value="<?= htmlspecialchars($_COOKIE['AURSID']) ?>" /> + <p><input type="submit" class="button" name="do_Flag" value="<?= __("Flag") ?>" /></p> + </fieldset> + </form> +</div> + +<?php +else: + print __("Only registered users can flag packages out-of-date."); +endif; + +html_footer(AURWEB_VERSION); diff --git a/web/template/pkgbase_actions.php b/web/template/pkgbase_actions.php index dea348e..198f7ab 100644 --- a/web/template/pkgbase_actions.php +++ b/web/template/pkgbase_actions.php @@ -10,7 +10,7 @@ <li><a href="https://wiki.archlinux.org/index.php/Special:Search?search=<?= urlencode($row['Name']) ?>"><?= __('Search wiki') ?></a></li> <li><span class="flagged"><?php if ($row["OutOfDateTS"] !== NULL) { echo __('Flagged out-of-date')." (${out_of_date_time})"; } ?></span></li> <?php if ($row["OutOfDateTS"] === NULL): ?> - <li><?= html_action_form($base_uri . 'flag/', "do_Flag", __('Flag package out-of-date')) ?></li> + <li><?= html_action_link($base_uri . 'flag/', __('Flag package out-of-date')) ?></li> <?php elseif (($row["OutOfDateTS"] !== NULL) && has_credential(CRED_PKGBASE_UNFLAG, $unflaggers)): ?> <li><?= html_action_form($base_uri . 'unflag/', "do_UnFlag", __('Unflag package')) ?></li> <?php endif; ?> -- 2.5.1

1 1

[aur-dev] [PATCH] Fix duplicate escaping of action links
by Lukas Fleischer 11 Sep '15

11 Sep '15

The __() helper function already escapes HTML special characters. Do not escape them again in html_action_*(). Fixes FS#45780. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/lib/aur.inc.php | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/web/lib/aur.inc.php b/web/lib/aur.inc.php index 9997535..7d65913 100644 --- a/web/lib/aur.inc.php +++ b/web/lib/aur.inc.php @@ -225,18 +225,18 @@ function html_format_maintainers($maintainer, $comaintainers) { * Format a link in the package actions box * * @param string $uri The link target - * @param string $desc The link label + * @param string $inner The HTML code to use for the link label * * @return string The generated HTML code for the action link */ -function html_action_link($uri, $desc) { +function html_action_link($uri, $inner) { if (isset($_COOKIE["AURSID"])) { $code = '<a href="' . htmlspecialchars($uri, ENT_QUOTES) . '">'; } else { $code = '<a href="' . get_uri('/login/', true) . '?referer='; $code .= urlencode(rtrim(aur_location(), '/') . $uri) . '">'; } - $code .= htmlspecialchars($desc) . '</a>'; + $code .= $inner . '</a>'; return $code; } @@ -246,11 +246,11 @@ function html_action_link($uri, $desc) { * * @param string $uri The link target * @param string $action The action name (passed as HTTP POST parameter) - * @param string $desc The link label + * @param string $inner The HTML code to use for the link label * * @return string The generated HTML code for the action link */ -function html_action_form($uri, $action, $desc) { +function html_action_form($uri, $action, $inner) { if (isset($_COOKIE["AURSID"])) { $code = '<form action="' . htmlspecialchars($uri, ENT_QUOTES) . '" '; $code .= 'method="post">'; @@ -258,11 +258,11 @@ function html_action_form($uri, $action, $desc) { $code .= htmlspecialchars($_COOKIE['AURSID'], ENT_QUOTES) . '" />'; $code .= '<input type="submit" class="button text-button" name="'; $code .= htmlspecialchars($action, ENT_QUOTES) . '" '; - $code .= 'value="' . htmlspecialchars($desc, ENT_QUOTES) . '" />'; + $code .= 'value="' . $inner . '" />'; $code .= '</form>'; } else { $code = '<a href="' . get_uri('/login/', true) . '">'; - $code .= htmlspecialchars($desc) . '</a>'; + $code .= $inner . '</a>'; } return $code; -- 2.5.1

1 0