April 2017 - Aur-dev - lists.archlinux.org

[aur-dev] [PATCH] Add support for Terms of Service documents
by Lukas Fleischer 30 Apr '17

30 Apr '17

This allows for adding Terms of Service documents to the database that registered users need to accept before using the AUR. A revision field can be used to indicate whether a document was updated. If it is increased, all users are again asked to accept the new terms. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- schema/aur-schema.sql | 20 +++++++++++++ upgrading/4.6.0.txt | 20 +++++++++++++ web/html/tos.php | 50 ++++++++++++++++++++++++++++++++ web/lib/acctfuncs.inc.php | 74 +++++++++++++++++++++++++++++++++++++++++++++++ web/lib/aur.inc.php | 23 +++++++++++++++ web/lib/routing.inc.php | 1 + 6 files changed, 188 insertions(+) create mode 100644 web/html/tos.php diff --git a/schema/aur-schema.sql b/schema/aur-schema.sql index e584165..45272bb 100644 --- a/schema/aur-schema.sql +++ b/schema/aur-schema.sql @@ -379,3 +379,23 @@ CREATE TABLE Bans ( BanTS TIMESTAMP NOT NULL, PRIMARY KEY (IPAddress) ) ENGINE = InnoDB; + +-- Terms and Conditions +-- +CREATE TABLE Terms ( + ID INTEGER UNSIGNED NOT NULL AUTO_INCREMENT, + Description VARCHAR(255) NOT NULL, + URL VARCHAR(8000) NOT NULL, + Revision INTEGER UNSIGNED NOT NULL DEFAULT 1, + PRIMARY KEY (ID) +) ENGINE = InnoDB; + +-- Terms and Conditions accepted by users +-- +CREATE TABLE AcceptedTerms ( + UsersID INTEGER UNSIGNED NOT NULL, + TermsID INTEGER UNSIGNED NOT NULL, + Revision INTEGER UNSIGNED NOT NULL DEFAULT 0, + FOREIGN KEY (UsersID) REFERENCES Users(ID) ON DELETE CASCADE, + FOREIGN KEY (TermsID) REFERENCES Terms(ID) ON DELETE CASCADE +) ENGINE = InnoDB; diff --git a/upgrading/4.6.0.txt b/upgrading/4.6.0.txt index b051bac..816409d 100644 --- a/upgrading/4.6.0.txt +++ b/upgrading/4.6.0.txt @@ -15,3 +15,23 @@ UPDATE PackageDepends --- ALTER TABLE PackageComments ADD COLUMN RenderedComment TEXT NOT NULL; --- + +3. Add Terms and AcceptedTerms tables: + +--- +CREATE TABLE Terms ( + ID INTEGER UNSIGNED NOT NULL AUTO_INCREMENT, + Description VARCHAR(255) NOT NULL, + URL VARCHAR(8000) NOT NULL, + Revision INTEGER UNSIGNED NOT NULL DEFAULT 1, + PRIMARY KEY (ID) +) ENGINE = InnoDB; + +CREATE TABLE AcceptedTerms ( + UsersID INTEGER UNSIGNED NOT NULL, + TermsID INTEGER UNSIGNED NOT NULL, + Revision INTEGER UNSIGNED NOT NULL DEFAULT 0, + FOREIGN KEY (UsersID) REFERENCES Users(ID) ON DELETE CASCADE, + FOREIGN KEY (TermsID) REFERENCES Terms(ID) ON DELETE CASCADE +) ENGINE = InnoDB; +--- diff --git a/web/html/tos.php b/web/html/tos.php new file mode 100644 index 0000000..135fa1e --- /dev/null +++ b/web/html/tos.php @@ -0,0 +1,50 @@ +<?php +set_include_path(get_include_path() . PATH_SEPARATOR . '../lib'); + +include_once("aur.inc.php"); + +$uid = uid_from_sid($_COOKIE["AURSID"]); + +if (isset($_POST["accept"]) && $_POST["accept"]) { + accept_terms($uid, $_POST["rev"]); + header("Location: " . get_uri('/')); +} + +$terms = fetch_updated_terms($uid); +if (!$terms) { + header("Location: " . get_uri('/')); +} + +html_header('AUR ' . __("Terms of Service")); +?> +<div id="dev-login" class="box"> + <h2>AUR <?= __('Terms of Service') ?></h2> + <?php if (isset($_COOKIE["AURSID"])): ?> + <form method="post" action="<?= get_uri('/tos') ?>"> + <fieldset> + <p> + <?= __("Logged-in as: %s", '<strong>' . username_from_sid($_COOKIE["AURSID"]) . '</strong>'); ?> + </p> + <p> + <?= __("The following documents have been updated. Please review them carefully:"); ?> + </p> + <ul> + <?php foreach($terms as $row): ?> + <li><a href="<?= urlencode(sprintf($row["URL"], $row["Revision"])) ?>"><?= htmlspecialchars($row["Description"]) ?></a> (<?= __('revision %d', $row["Revision"]) ?>)</li> + <?php endforeach; ?> + </ul> + <p> + <?php foreach($terms as $row): ?> + <input type="hidden" name="rev[<?= $row["ID"] ?>]" value="<?= $row["Revision"] ?>" /> + <?php endforeach; ?> + <input type="checkbox" name="accept" /> <?= __("I accept the terms and conditions above."); ?> + </p> + <p> + <input type="submit" name="submit" value="<?= __("Continue") ?>" /> + </p> + </fieldset> + </form> + <?php endif; ?> +</div> +<?php +html_footer(AURWEB_VERSION); diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index 22b3ca8..e45d735 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -1325,3 +1325,77 @@ function notify($params) { return proc_close($p); } + +/* + * Obtain a list of terms a given user has not yet accepted. + * + * @param int $uid The ID of the user to obtain terms for. + * + * @return array A list of terms the user has not yet accepted. + */ +function fetch_updated_terms($uid) { + $dbh = DB::connect(); + + $q = "SELECT ID, Terms.Revision, Description, URL "; + $q .= "FROM Terms LEFT JOIN AcceptedTerms "; + $q .= "ON AcceptedTerms.TermsID = Terms.ID "; + $q .= "AND AcceptedTerms.UsersID = " . intval($uid) . " "; + $q .= "WHERE AcceptedTerms.Revision IS NULL OR "; + $q .= "AcceptedTerms.Revision < Terms.Revision"; + + $result = $dbh->query($q); + + if ($result) { + return $result->fetchAll(); + } else { + return array(); + } +} + +/* + * Accept a list of given terms. + * + * @param int $uid The ID of the user to accept the terms. + * @param array $termrev An array mapping each term to the accepted revision. + * + * @return void + */ +function accept_terms($uid, $termrev) { + $dbh = DB::connect(); + + $q = "SELECT TermsID, Revision FROM AcceptedTerms "; + $q .= "WHERE UsersID = " . intval($uid); + + $result = $dbh->query($q); + + if (!$result) { + return; + } + + $termrev_update = array(); + while ($row = $result->fetch(PDO::FETCH_ASSOC)) { + $id = $row['TermsID']; + if (!array_key_exists($id, $termrev)) { + continue; + } + if ($row['Revision'] < $termrev[$id]) { + $termrev_update[$id] = $termrev[$id]; + } + } + $termrev_add = array_diff_key($termrev, $termrev_update); + + foreach ($termrev_add as $id => $rev) { + $q = "INSERT INTO AcceptedTerms (TermsID, UsersID, Revision) "; + $q .= "VALUES (" . intval($id) . ", " . intval($uid) . ", "; + $q .= intval($rev) . ")"; + $dbh->exec($q); + } + + foreach ($termrev_update as $id => $rev) { + $q = "UPDATE AcceptedTerms "; + $q .= "SET Revision = " . intval($rev) . " "; + $q .= "WHERE TermsID = " . intval($id) . " AND "; + $q .= "UsersID = " . intval($uid); + $dbh->exec($q); + } +} diff --git a/web/lib/aur.inc.php b/web/lib/aur.inc.php index 063de8f..ce569ea 100644 --- a/web/lib/aur.inc.php +++ b/web/lib/aur.inc.php @@ -22,6 +22,7 @@ include_once('timezone.inc.php'); set_tz(); check_sid(); +check_tos(); /** * Check if a visitor is logged in @@ -92,6 +93,28 @@ function check_sid() { } /** + * Redirect user to the Terms of Service agreement if there are updated terms. + * + * @return void + */ +function check_tos() { + if (!isset($_COOKIE["AURSID"])) { + return; + } + + $path = $_SERVER['PATH_INFO']; + $route = get_route($path); + if (!$route || $route == "tos.php") { + return; + } + + if (count(fetch_updated_terms(uid_from_sid($_COOKIE["AURSID"]))) > 0) { + header('Location: ' . get_uri('/tos')); + exit(); + } +} + +/** * Verify the supplied CSRF token matches expected token * * @return bool True if the CSRF token is the same as the cookie SID, otherwise false diff --git a/web/lib/routing.inc.php b/web/lib/routing.inc.php index 8c45c62..7d9750a 100644 --- a/web/lib/routing.inc.php +++ b/web/lib/routing.inc.php @@ -16,6 +16,7 @@ $ROUTES = array( '/passreset' => 'passreset.php', '/rpc' => 'rpc.php', '/rss' => 'rss.php', + '/tos' => 'tos.php', '/tu' => 'tu.php', '/addvote' => 'addvote.php', ); -- 2.12.2

1 1

[aur-dev] [PATCH] Call check_sid() from a central location
by Lukas Fleischer 28 Apr '17

28 Apr '17

Instead of calling check_sid() from every single PHP script representing a web page, add the call to aur.inc.php which is sourced by all of them. Also, remove set_lang() calls from the scripts since these are also already included in aur.inc.php. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/html/account.php | 3 --- web/html/addvote.php | 2 -- web/html/comaintainers.php | 3 --- web/html/commentedit.php | 3 --- web/html/home.php | 3 --- web/html/login.php | 2 -- web/html/logout.php | 1 - web/html/packages.php | 2 -- web/html/passreset.php | 3 --- web/html/pkgbase.php | 2 -- web/html/pkgdel.php | 3 --- web/html/pkgdisown.php | 3 --- web/html/pkgflag.php | 3 --- web/html/pkgflagcomment.php | 3 --- web/html/pkgmerge.php | 3 --- web/html/pkgreq.php | 3 --- web/html/register.php | 3 --- web/html/tu.php | 2 -- web/lib/aur.inc.php | 2 ++ 19 files changed, 2 insertions(+), 47 deletions(-) diff --git a/web/html/account.php b/web/html/account.php index 549f852..c30a89a 100644 --- a/web/html/account.php +++ b/web/html/account.php @@ -5,9 +5,6 @@ set_include_path(get_include_path() . PATH_SEPARATOR . '../lib'); include_once('aur.inc.php'); # access AUR common functions include_once('acctfuncs.inc.php'); # access Account specific functions -set_lang(); # this sets up the visitor's language -check_sid(); # see if they're still logged in - $action = in_request("Action"); $need_userinfo = array( diff --git a/web/html/addvote.php b/web/html/addvote.php index d152941..3672c03 100644 --- a/web/html/addvote.php +++ b/web/html/addvote.php @@ -3,8 +3,6 @@ set_include_path(get_include_path() . PATH_SEPARATOR . '../lib'); include_once("aur.inc.php"); -set_lang(); -check_sid(); $title = __("Add Proposal"); diff --git a/web/html/comaintainers.php b/web/html/comaintainers.php index 23d8d19..9733558 100644 --- a/web/html/comaintainers.php +++ b/web/html/comaintainers.php @@ -5,9 +5,6 @@ set_include_path(get_include_path() . PATH_SEPARATOR . '../lib'); include_once("aur.inc.php"); include_once("pkgbasefuncs.inc.php"); -set_lang(); -check_sid(); - if (!isset($base_id) || !has_credential(CRED_PKGBASE_EDIT_COMAINTAINERS, array(pkgbase_maintainer_uid($base_id)))) { header('Location: /'); exit(); diff --git a/web/html/commentedit.php b/web/html/commentedit.php index 2a0628e..53ec289 100644 --- a/web/html/commentedit.php +++ b/web/html/commentedit.php @@ -5,9 +5,6 @@ set_include_path(get_include_path() . PATH_SEPARATOR . '../lib'); include_once("aur.inc.php"); include_once("pkgbasefuncs.inc.php"); -set_lang(); -check_sid(); - $comment_id = intval($_REQUEST['comment_id']); list($user_id, $comment) = comment_by_id($comment_id); diff --git a/web/html/home.php b/web/html/home.php index 2675491..0ce89f4 100644 --- a/web/html/home.php +++ b/web/html/home.php @@ -3,9 +3,6 @@ set_include_path(get_include_path() . PATH_SEPARATOR . '../lib'); include_once("aur.inc.php"); -set_lang(); -check_sid(); - include_once('stats.inc.php'); if (isset($_COOKIE["AURSID"])) { diff --git a/web/html/login.php b/web/html/login.php index 7345439..a55ce05 100644 --- a/web/html/login.php +++ b/web/html/login.php @@ -2,8 +2,6 @@ set_include_path(get_include_path() . PATH_SEPARATOR . '../lib'); include_once("aur.inc.php"); -set_lang(); -check_sid(); $disable_http_login = config_get_bool('options', 'disable_http_login'); if (!$disable_http_login || (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'])) { diff --git a/web/html/logout.php b/web/html/logout.php index 5e8e8f4..1402200 100644 --- a/web/html/logout.php +++ b/web/html/logout.php @@ -5,7 +5,6 @@ set_include_path(get_include_path() . PATH_SEPARATOR . '../lib'); include_once("aur.inc.php"); # access AUR common functions include_once("acctfuncs.inc.php"); # access AUR common functions - # if they've got a cookie, log them out - need to do this before # sending any HTML output. # diff --git a/web/html/packages.php b/web/html/packages.php index 7d5b207..db9606d 100644 --- a/web/html/packages.php +++ b/web/html/packages.php @@ -3,9 +3,7 @@ set_include_path(get_include_path() . PATH_SEPARATOR . '../lib'); include_once("aur.inc.php"); # access AUR common functions -set_lang(); # this sets up the visitor's language include_once('pkgfuncs.inc.php'); # package specific functions -check_sid(); # see if they're still logged in # Retrieve package ID and name, unless initialized by the routing framework if (!isset($pkgid) || !isset($pkgname)) { diff --git a/web/html/passreset.php b/web/html/passreset.php index e89967d..9e7cee8 100644 --- a/web/html/passreset.php +++ b/web/html/passreset.php @@ -4,9 +4,6 @@ set_include_path(get_include_path() . PATH_SEPARATOR . '../lib'); include_once("aur.inc.php"); # access AUR common functions -set_lang(); # this sets up the visitor's language -check_sid(); # see if they're still logged in - if (isset($_COOKIE["AURSID"])) { header('Location: /'); exit(); diff --git a/web/html/pkgbase.php b/web/html/pkgbase.php index a593af1..03b0eee 100644 --- a/web/html/pkgbase.php +++ b/web/html/pkgbase.php @@ -3,9 +3,7 @@ set_include_path(get_include_path() . PATH_SEPARATOR . '../lib'); include_once("aur.inc.php"); -set_lang(); include_once('pkgfuncs.inc.php'); -check_sid(); /* * Retrieve package base ID and name, unless initialized by the routing diff --git a/web/html/pkgdel.php b/web/html/pkgdel.php index 591ccce..4620beb 100644 --- a/web/html/pkgdel.php +++ b/web/html/pkgdel.php @@ -5,9 +5,6 @@ set_include_path(get_include_path() . PATH_SEPARATOR . '../lib'); include_once("aur.inc.php"); include_once("pkgfuncs.inc.php"); -set_lang(); -check_sid(); - html_header(__("Package Deletion")); if (has_credential(CRED_PKGBASE_DELETE)): ?> diff --git a/web/html/pkgdisown.php b/web/html/pkgdisown.php index 036fe6d..4b04e85 100644 --- a/web/html/pkgdisown.php +++ b/web/html/pkgdisown.php @@ -5,9 +5,6 @@ set_include_path(get_include_path() . PATH_SEPARATOR . '../lib'); include_once("aur.inc.php"); include_once("pkgfuncs.inc.php"); -set_lang(); -check_sid(); - html_header(__("Disown Package")); $maintainer_uids = array(pkgbase_maintainer_uid($base_id)); diff --git a/web/html/pkgflag.php b/web/html/pkgflag.php index 25c8ccb..61346b9 100644 --- a/web/html/pkgflag.php +++ b/web/html/pkgflag.php @@ -5,9 +5,6 @@ set_include_path(get_include_path() . PATH_SEPARATOR . '../lib'); include_once("aur.inc.php"); include_once("pkgfuncs.inc.php"); -set_lang(); -check_sid(); - /* Grab the list of package base IDs to be operated on. */ $ids = array(); if (isset($_POST['IDs'])) { diff --git a/web/html/pkgflagcomment.php b/web/html/pkgflagcomment.php index 98680ef..c0363c8 100644 --- a/web/html/pkgflagcomment.php +++ b/web/html/pkgflagcomment.php @@ -5,9 +5,6 @@ set_include_path(get_include_path() . PATH_SEPARATOR . '../lib'); include_once("aur.inc.php"); include_once("pkgbasefuncs.inc.php"); -set_lang(); -check_sid(); - if (!isset($base_id)) { header('Location: /'); exit(); diff --git a/web/html/pkgmerge.php b/web/html/pkgmerge.php index e8e7ca9..6ee7423 100644 --- a/web/html/pkgmerge.php +++ b/web/html/pkgmerge.php @@ -5,9 +5,6 @@ set_include_path(get_include_path() . PATH_SEPARATOR . '../lib'); include_once("aur.inc.php"); include_once("pkgfuncs.inc.php"); -set_lang(); -check_sid(); - html_header(__("Package Merging")); if (has_credential(CRED_PKGBASE_DELETE)): ?> diff --git a/web/html/pkgreq.php b/web/html/pkgreq.php index f981c25..d2f9461 100644 --- a/web/html/pkgreq.php +++ b/web/html/pkgreq.php @@ -5,9 +5,6 @@ set_include_path(get_include_path() . PATH_SEPARATOR . '../lib'); include_once("aur.inc.php"); include_once("pkgfuncs.inc.php"); -set_lang(); -check_sid(); - if (isset($base_id)) { if (!has_credential(CRED_PKGREQ_FILE)) { header('Location: /'); diff --git a/web/html/register.php b/web/html/register.php index 843fea9..368999a 100644 --- a/web/html/register.php +++ b/web/html/register.php @@ -5,9 +5,6 @@ set_include_path(get_include_path() . PATH_SEPARATOR . '../lib'); include_once('aur.inc.php'); # access AUR common functions include_once('acctfuncs.inc.php'); # access Account specific functions -set_lang(); # this sets up the visitor's language -check_sid(); # see if they're still logged in - if (isset($_COOKIE["AURSID"])) { header('Location: /'); exit(); diff --git a/web/html/tu.php b/web/html/tu.php index cc77d62..34e64ea 100644 --- a/web/html/tu.php +++ b/web/html/tu.php @@ -3,8 +3,6 @@ set_include_path(get_include_path() . PATH_SEPARATOR . '../lib'); include_once("aur.inc.php"); -set_lang(); -check_sid(); $title = __("Trusted User"); diff --git a/web/lib/aur.inc.php b/web/lib/aur.inc.php index d58df40..063de8f 100644 --- a/web/lib/aur.inc.php +++ b/web/lib/aur.inc.php @@ -21,6 +21,8 @@ include_once("credentials.inc.php"); include_once('timezone.inc.php'); set_tz(); +check_sid(); + /** * Check if a visitor is logged in * -- 2.12.2

1 0

[aur-dev] [PATCH] Support headings in package comments
by Lukas Fleischer 26 Apr '17

26 Apr '17

Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- aurweb/scripts/rendercomment.py | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/aurweb/scripts/rendercomment.py b/aurweb/scripts/rendercomment.py index f32c827..9c0aa6a 100755 --- a/aurweb/scripts/rendercomment.py +++ b/aurweb/scripts/rendercomment.py @@ -67,6 +67,20 @@ class GitCommitsExtension(markdown.extensions.Extension): md.preprocessors.add('git-commits', preprocessor, '_end') +class HeadingTreeprocessor(markdown.treeprocessors.Treeprocessor): + def run(self, doc): + for elem in doc: + if elem.tag == 'h1': + elem.tag = 'h5' + elif elem.tag in ['h2', 'h3', 'h4', 'h5']: + elem.tag = 'h6' + + +class HeadingExtension(markdown.extensions.Extension): + def extendMarkdown(self, md, md_globals): + md.treeprocessors.add('heading', HeadingTreeprocessor(md), '_end') + + def get_comment(conn, commentid): cur = conn.execute('SELECT PackageComments.Comments, PackageBases.Name ' 'FROM PackageComments INNER JOIN PackageBases ' @@ -88,8 +102,10 @@ def main(): text, pkgbase = get_comment(conn, commentid) html = markdown.markdown(text, extensions=['fenced_code', LinkifyExtension(), - GitCommitsExtension(pkgbase)]) - allowed_tags = bleach.sanitizer.ALLOWED_TAGS + ['p', 'pre'] + GitCommitsExtension(pkgbase), + HeadingExtension()]) + allowed_tags = bleach.sanitizer.ALLOWED_TAGS + \ + ['p', 'pre', 'h4', 'h5', 'h6'] html = bleach.clean(html, tags=allowed_tags) save_rendered_comment(conn, commentid, html) -- 2.12.2

1 0

[aur-dev] [PATCH 1/3] t1300: Factor out package dumping
by Lukas Fleischer 25 Apr '17

25 Apr '17

Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- test/t1300-git-update.sh | 36 ++++++++++++------------------------ 1 file changed, 12 insertions(+), 24 deletions(-) diff --git a/test/t1300-git-update.sh b/test/t1300-git-update.sh index a65ca3a..dbe6029 100755 --- a/test/t1300-git-update.sh +++ b/test/t1300-git-update.sh @@ -4,6 +4,14 @@ test_description='git-update tests' . ./setup.sh +dump_package_info() { + for t in Packages Licenses PackageLicenses Groups PackageGroups \ + PackageDepends PackageRelations PackageSources \ + PackageNotifications; do + echo "SELECT * FROM $t;" | sqlite3 aur.db + done +} + test_expect_success 'Test update hook on a fresh repository.' ' old=0000000000000000000000000000000000000000 && new=$(git -C aur.git rev-parse HEAD^) && @@ -16,12 +24,7 @@ test_expect_success 'Test update hook on a fresh repository.' ' 1|1|python-pygit2|| 1|1 EOF - >actual && - for t in Packages Licenses PackageLicenses Groups PackageGroups \ - PackageDepends PackageRelations PackageSources \ - PackageNotifications; do - echo "SELECT * FROM $t;" | sqlite3 aur.db >>actual - done && + dump_package_info >actual && test_cmp expected actual ' @@ -44,12 +47,7 @@ test_expect_success 'Test update hook on another fresh repository.' ' 1|1 2|1 EOF - >actual && - for t in Packages Licenses PackageLicenses Groups PackageGroups \ - PackageDepends PackageRelations PackageSources \ - PackageNotifications; do - echo "SELECT * FROM $t;" | sqlite3 aur.db >>actual - done && + dump_package_info >actual && test_cmp expected actual ' @@ -70,12 +68,7 @@ test_expect_success 'Test update hook on an updated repository.' ' 1|1 2|1 EOF - >actual && - for t in Packages Licenses PackageLicenses Groups PackageGroups \ - PackageDepends PackageRelations PackageSources \ - PackageNotifications; do - echo "SELECT * FROM $t;" | sqlite3 aur.db >>actual - done && + dump_package_info >actual && test_cmp expected actual ' @@ -94,12 +87,7 @@ test_expect_success 'Test restore mode.' ' 1|1 2|1 EOF - >actual && - for t in Packages Licenses PackageLicenses Groups PackageGroups \ - PackageDepends PackageRelations PackageSources \ - PackageNotifications; do - echo "SELECT * FROM $t;" | sqlite3 aur.db >>actual - done && + dump_package_info >actual && test_cmp expected actual ' -- 2.12.2

1 2

[aur-dev] [PATCH] Fix the comment collapse feature
by Lukas Fleischer 25 Apr '17

25 Apr '17

In commit 4abde89 (Use JavaScript to collapse long comments, 2017-04-19), support for collapsing/expanding long comments was added. This was broken by the recent Markdown support since comments no longer live inside a single HTML paragraph. Fix this by wrapping each comment in another div container. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/html/packages.php | 23 ++++++++++++----------- web/template/pkg_comments.php | 16 +++++++++------- 2 files changed, 21 insertions(+), 18 deletions(-) diff --git a/web/html/packages.php b/web/html/packages.php index 8d76c76..7d5b207 100644 --- a/web/html/packages.php +++ b/web/html/packages.php @@ -74,32 +74,33 @@ function collapseDependsList(list) { function collapseComment(div) { var linkid = div.attr('id') + 'link', - par = div.find('p'), - height = par.height(), + inner = div.find('div'), + height = inner.height(), maxheight = 200; if (height <= maxheight) return; - par.css({ 'overflow': 'hidden', 'height': maxheight + 'px' }); - par.addClass('collapsed'); - par.after('<p><a id="' + linkid + '" href="#">Show More…</a></p>'); + inner.css({ 'overflow': 'hidden', 'height': maxheight + 'px' }); + inner.addClass('collapsed'); + inner.after('<p><a id="' + linkid + '" href="#">Show More…</a></p>'); $('#' + linkid).click(function(event) { + var inner = $(this).parent().parent().find('div'); var newheight; - if (par.hasClass('collapsed')) { - par.css({ 'height': 'auto' }); - newheight = par.height(); - par.css({ 'height': maxheight }); + if (inner.hasClass('collapsed')) { + inner.css({ 'height': 'auto' }); + newheight = inner.height(); + inner.css({ 'height': maxheight }); $(this).text('Collapse'); } else { newheight = maxheight; $(this).text('Show More…'); } - par.animate({ 'height': newheight }); - par.toggleClass('collapsed'); + inner.animate({ 'height': newheight }); + inner.toggleClass('collapsed'); event.preventDefault(); }); } diff --git a/web/template/pkg_comments.php b/web/template/pkg_comments.php index f973b74..7d9bedc 100644 --- a/web/template/pkg_comments.php +++ b/web/template/pkg_comments.php @@ -103,13 +103,15 @@ if (!isset($count)) { <?php endif; ?> </h4> <div id="<?= isset($pinned) ? "pinned-" : "comment-" ?><?= $row['ID'] ?>-content" class="article-content<?php if ($is_deleted): ?> comment-deleted<?php endif; ?>"> - <?php if (!empty($row['RenderedComment'])): ?> - <?= $row['RenderedComment'] ?> - <?php else: ?> - <p> - <?= parse_comment($row['Comments']) ?> - </p> - <?php endif; ?> + <div> + <?php if (!empty($row['RenderedComment'])): ?> + <?= $row['RenderedComment'] ?> + <?php else: ?> + <p> + <?= parse_comment($row['Comments']) ?> + </p> + <?php endif; ?> + </div> </div> <?php endwhile; ?> -- 2.12.2

1 0

[aur-dev] [PATCH 1/2] Do not keep line breaks in comments
by Lukas Fleischer 24 Apr '17

24 Apr '17

With the new Markdown support, text paragraphs are now properly converted to HTML paragraphs, so we no longer need to keep line breaks. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- aurweb/scripts/rendercomment.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/aurweb/scripts/rendercomment.py b/aurweb/scripts/rendercomment.py index 659e18a..c23ef8d 100755 --- a/aurweb/scripts/rendercomment.py +++ b/aurweb/scripts/rendercomment.py @@ -86,9 +86,9 @@ def main(): conn = aurweb.db.Connection() text, pkgbase = get_comment(conn, commentid) - html = markdown.markdown(text, extensions=['nl2br', LinkifyExtension(), + html = markdown.markdown(text, extensions=[LinkifyExtension(), GitCommitsExtension(pkgbase)]) - allowed_tags = bleach.sanitizer.ALLOWED_TAGS + ['p', 'br'] + allowed_tags = bleach.sanitizer.ALLOWED_TAGS + ['p'] html = bleach.clean(html, tags=allowed_tags) save_rendered_comment(conn, commentid, html) -- 2.12.2

1 1

[aur-dev] [PATCH 0/4] Add Markdown syntax to comments
by Lukas Fleischer 24 Apr '17

24 Apr '17

This patch series moves comment rendering to a separate Python script, adds markdown support and also makes Git commit identifiers clickable. Comments welcome! Lukas Fleischer (4): Render comments when storing them in the database Add Markdown support to package comments Reintroduce backwards-compatible hyperlink syntax Make references to Git commits clickable aurweb/scripts/rendercomment.py | 100 ++++++++++++++++++++++++++++++++++++++++ conf/config.proto | 2 + schema/aur-schema.sql | 1 + setup.py | 1 + test/setup.sh | 1 + test/t2600-rendercomment.sh | 23 +++++++++ upgrading/4.6.0.txt | 6 +++ web/lib/pkgbasefuncs.inc.php | 40 ++++++++++++++-- web/template/pkg_comments.php | 4 ++ 9 files changed, 174 insertions(+), 4 deletions(-) create mode 100755 aurweb/scripts/rendercomment.py create mode 100755 test/t2600-rendercomment.sh -- 2.12.2

1 5

[aur-dev] [PATCH] Rerender package comments after editing
by Lukas Fleischer 24 Apr '17

24 Apr '17

Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/lib/pkgbasefuncs.inc.php | 3 +++ 1 file changed, 3 insertions(+) diff --git a/web/lib/pkgbasefuncs.inc.php b/web/lib/pkgbasefuncs.inc.php index 3e78309..ff1bc90 100644 --- a/web/lib/pkgbasefuncs.inc.php +++ b/web/lib/pkgbasefuncs.inc.php @@ -1041,6 +1041,9 @@ function pkgbase_edit_comment($comment) { $q.= "EditedTS = " . strval(time()) . " "; $q.= "WHERE ID = ".intval($comment_id); $dbh->exec($q); + + render_comment($comment_id); + return array(true, __("Comment has been edited.")); } else { return array(false, __("You are not allowed to edit this comment.")); -- 2.12.2

1 0

[aur-dev] [PATCH] t2600: Test Markdown and HTML sanitizing
by Lukas Fleischer 24 Apr '17

24 Apr '17

Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- test/t2600-rendercomment.sh | 42 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) diff --git a/test/t2600-rendercomment.sh b/test/t2600-rendercomment.sh index 6db9467..8da1529 100755 --- a/test/t2600-rendercomment.sh +++ b/test/t2600-rendercomment.sh @@ -21,4 +21,46 @@ test_expect_success 'Test comment rendering.' ' test_cmp actual expected ' +test_expect_success 'Test Markdown conversion.' ' + cat <<-EOD | sqlite3 aur.db && + INSERT INTO PackageComments (ID, PackageBaseID, Comments, RenderedComment) VALUES (2, 1, "*Hello* [world](https://www.archlinux.org/)!", ""); + EOD + "$RENDERCOMMENT" 2 && + cat <<-EOD >expected && + <p><em>Hello</em> <a href="https://www.archlinux.org/">world</a>!</p> + EOD + cat <<-EOD | sqlite3 aur.db >actual && + SELECT RenderedComment FROM PackageComments WHERE ID = 2; + EOD + test_cmp actual expected +' + +test_expect_success 'Test HTML sanitizing.' ' + cat <<-EOD | sqlite3 aur.db && + INSERT INTO PackageComments (ID, PackageBaseID, Comments, RenderedComment) VALUES (3, 1, "<script>alert(""XSS!"");</script>", ""); + EOD + "$RENDERCOMMENT" 3 && + cat <<-EOD >expected && + <script>alert("XSS!");</script> + EOD + cat <<-EOD | sqlite3 aur.db >actual && + SELECT RenderedComment FROM PackageComments WHERE ID = 3; + EOD + test_cmp actual expected +' + +test_expect_success 'Test link conversion.' ' + cat <<-EOD | sqlite3 aur.db && + INSERT INTO PackageComments (ID, PackageBaseID, Comments, RenderedComment) VALUES (4, 1, "Visit https://www.archlinux.org/.", ""); + EOD + "$RENDERCOMMENT" 4 && + cat <<-EOD >expected && + <p>Visit <a href="https://www.archlinux.org/">https://www.archlinux.org/</a>.</p> + EOD + cat <<-EOD | sqlite3 aur.db >actual && + SELECT RenderedComment FROM PackageComments WHERE ID = 4; + EOD + test_cmp actual expected +' + test_done -- 2.12.2

1 0

[aur-dev] [PATCH] Replace task references in comments with actual links
by Ragnis Armus 24 Apr '17

24 Apr '17

Search comments for references to Flyspray tasks (in the format FS#???) and make them into clickable links. Signed-off-by: Ragnis Armus <ragnis(a)aragnis.com> --- conf/config.proto | 1 + web/lib/aur.inc.php | 34 +++++++++++++++++++++++++++++++++- 2 files changed, 34 insertions(+), 1 deletion(-) diff --git a/conf/config.proto b/conf/config.proto index df10b99..39257f6 100644 --- a/conf/config.proto +++ b/conf/config.proto @@ -33,6 +33,7 @@ log_uri = https://aur.archlinux.org/cgit/aur.git/log/?h=%s snapshot_uri = /cgit/aur.git/snapshot/%s.tar.gz enable-maintenance = 1 maintenance-exceptions = 127.0.0.1 +fs_task_uri = https://bugs.archlinux.org/task/%d [notifications] notify-cmd = /usr/local/bin/aurweb-notify diff --git a/web/lib/aur.inc.php b/web/lib/aur.inc.php index d58df40..418b7cc 100644 --- a/web/lib/aur.inc.php +++ b/web/lib/aur.inc.php @@ -557,6 +557,35 @@ function comment_by_id($comment_id) { } /** + * Process comment body replacing any references to tasks with an actual link + * + * @param string $text The input text + * + * @return string The text with any task references replaces with HTML links + */ +function parse_comment_flyspray_links($text) { + $matches = preg_split('/(?<=\W|^)FS#(\d+)(?=\W|$)/', $text, -1, + PREG_SPLIT_DELIM_CAPTURE); + + $output = ''; + + for ($i = 0; $i < count($matches); $i++) { + if ($i % 2) { + # link the tasks + $url = sprintf(config_get('options', 'fs_task_uri'), $matches[$i]); + + $output .= '<a href="' . htmlspecialchars($url) . + '" rel="nofollow">FS#' . htmlspecialchars($matches[$i]) . '</a>'; + } else { + # keep everything else + $output .= $matches[$i]; + } + } + + return $output; +} + +/** * Process submitted comments so any links can be followed * * @param string $comment Raw user submitted package comment @@ -579,7 +608,10 @@ function parse_comment($comment) { } else { # convert everything else - $html .= nl2br(htmlspecialchars($matches[$i])); + $value = nl2br(htmlspecialchars($matches[$i])); + $value = parse_comment_flyspray_links($value); + + $html .= $value; } } -- 2.12.2

3 2