October 2019 - Aur-dev - lists.archlinux.org

aur client
by Alberto Salvia Novella 29 Oct '19

29 Oct '19

Since publishing to the AUR is something that all packagers do quite frequently, I have developed a software that reduces the related operations to the bare minimum, making publishing to the AUR instant. Basically it's a SMED <https://www.youtube.com/watch?v=Aoqra9bXAAg> system. The software is called "aur <https://aur.archlinux.org/packages/aur-git>" itself, and you can check its manual out by in the terminal entering: curl --silent https://gitlab.com/es20490446e/aur/raw/master/assets/aur.1 > aur.1; man ./aur.1; rm aur.1 As long as constructive, suggestions are very welcome. When replying please include my email address in the recipients list. Alberto <https://es20490446e.wordpress.com>

1 0

[PATCH] Display popularity with less decimal points
by Lukas Fleischer 27 Oct '19

27 Oct '19

Limit the display to two decimal points for packages with a popularity of at least 0.2. Suggested-by: Allan McRae <allan(a)archlinux.org> Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/template/pkg_details.php | 2 +- web/template/pkgbase_details.php | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/web/template/pkg_details.php b/web/template/pkg_details.php index 650c245..93b5f1e 100644 --- a/web/template/pkg_details.php +++ b/web/template/pkg_details.php @@ -259,7 +259,7 @@ endif; </tr> <tr> <th><?= __('Popularity') . ': ' ?></th> - <td><?= number_format($popularity, 6) ?></td> + <td><?= number_format($popularity, $popularity >= .2 ? 2 : 6) ?></td> </tr> <tr> <th><?= __('First Submitted') . ': ' ?></th> diff --git a/web/template/pkgbase_details.php b/web/template/pkgbase_details.php index 8a6e2b4..b2ce8cb 100644 --- a/web/template/pkgbase_details.php +++ b/web/template/pkgbase_details.php @@ -108,7 +108,7 @@ endif; </tr> <tr> <th><?= __('Popularity') . ': ' ?></th> - <td><?= number_format($popularity, 6) ?></td> + <td><?= number_format($popularity, $popularity >= .2 ? 2 : 6) ?></td> </tr> <tr> <th><?= __('First Submitted') . ': ' ?></th> -- 2.23.0

1 0

aurweb 4.8.0 released
by Lukas Fleischer 26 Oct '19

26 Oct '19

Dear aurweb contributors and users, This is a bit of a late announcement but we are pleased to announce that aurweb 4.8.0 has been released last week! Several bugs have been fixed, we made some significant performance improvements by caching results of expensive database queries, and a simple CAPTCHA has been added to combat the growing number of spam accounts. For a comprehensive list of changes, please consult the Git log [2]. As usual, bugs should be reported to the aurweb bug tracker [3]. [1] https://aur.archlinux.org/ [2] https://projects.archlinux.org/aurweb.git/log/?id=v4.8.0 [3] https://bugs.archlinux.org/index.php?project=2

1 0

[PATCH] Make package details cache TTL configurable
by Lukas Fleischer 07 Oct '19

07 Oct '19

The TTL for package details can be much longer than for generic values since they never change. Note that when an update is pushed via Git, all packages belonging to that package base are deleted and new packages are created. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- conf/config.defaults | 1 + web/lib/aurjson.class.php | 6 ++++-- web/lib/pkgfuncs.inc.php | 15 ++++++++++----- 3 files changed, 15 insertions(+), 7 deletions(-) diff --git a/conf/config.defaults b/conf/config.defaults index c8bc3a7..c519eae 100644 --- a/conf/config.defaults +++ b/conf/config.defaults @@ -38,6 +38,7 @@ render-comment-cmd = /usr/local/bin/aurweb-rendercomment localedir = /srv/http/aurweb/aur.git/web/locale/ # memcache or apc cache = none +cache_pkginfo_ttl = 86400 memcache_servers = 127.0.0.1:11211 [ratelimit] diff --git a/web/lib/aurjson.class.php b/web/lib/aurjson.class.php index bfb8cd1..1c31a65 100644 --- a/web/lib/aurjson.class.php +++ b/web/lib/aurjson.class.php @@ -292,7 +292,8 @@ class AurJSON { "FROM Licenses INNER JOIN PackageLicenses " . "ON PackageLicenses.PackageID = " . $pkgid . " " . "AND PackageLicenses.LicenseID = Licenses.ID"; - $rows = db_cache_result($query, 'extended-fields:' . $pkgid, PDO::FETCH_ASSOC); + $ttl = config_get_int('options', 'cache_pkginfo_ttl'); + $rows = db_cache_result($query, 'extended-fields:' . $pkgid, PDO::FETCH_ASSOC, $ttl); $type_map = array( 'depends' => 'Depends', @@ -315,7 +316,8 @@ class AurJSON { $query = "SELECT Keyword FROM PackageKeywords " . "WHERE PackageBaseID = " . intval($base_id) . " " . "ORDER BY Keyword ASC"; - $rows = db_cache_result($query, 'keywords:' . intval($base_id)); + $ttl = config_get_int('options', 'cache_pkginfo_ttl'); + $rows = db_cache_result($query, 'keywords:' . intval($base_id), PDO::FETCH_NUM, $ttl); $data['Keywords'] = array_map(function ($x) { return $x[0]; }, $rows); } diff --git a/web/lib/pkgfuncs.inc.php b/web/lib/pkgfuncs.inc.php index be4bb06..b5035df 100644 --- a/web/lib/pkgfuncs.inc.php +++ b/web/lib/pkgfuncs.inc.php @@ -165,7 +165,8 @@ function pkg_licenses($pkgid) { $q = "SELECT l.Name FROM Licenses l "; $q.= "INNER JOIN PackageLicenses pl ON pl.LicenseID = l.ID "; $q.= "WHERE pl.PackageID = ". $pkgid; - $rows = db_cache_result($q, 'licenses:' . $pkgid); + $ttl = config_get_int('options', 'cache_pkginfo_ttl'); + $rows = db_cache_result($q, 'licenses:' . $pkgid, PDO::FETCH_NUM, $ttl); return array_map(function ($x) { return $x[0]; }, $rows); } @@ -184,7 +185,8 @@ function pkg_groups($pkgid) { $q = "SELECT g.Name FROM `Groups` g "; $q.= "INNER JOIN PackageGroups pg ON pg.GroupID = g.ID "; $q.= "WHERE pg.PackageID = ". $pkgid; - $rows = db_cache_result($q, 'groups:' . $pkgid); + $ttl = config_get_int('options', 'cache_pkginfo_ttl'); + $rows = db_cache_result($q, 'groups:' . $pkgid, PDO::FETCH_NUM, $ttl); return array_map(function ($x) { return $x[0]; }, $rows); } @@ -208,7 +210,8 @@ function pkg_providers($name) { $q.= "UNION "; $q.= "SELECT 0, Name FROM OfficialProviders "; $q.= "WHERE Provides = " . $dbh->quote($name); - return db_cache_result($q, 'providers:' . $name); + $ttl = config_get_int('options', 'cache_pkginfo_ttl'); + return db_cache_result($q, 'providers:' . $name, PDO::FETCH_NUM, $ttl); } /** @@ -231,7 +234,8 @@ function pkg_dependencies($pkgid, $limit) { $q.= "LEFT JOIN DependencyTypes dt ON dt.ID = pd.DepTypeID "; $q.= "WHERE pd.PackageID = ". $pkgid . " "; $q.= "ORDER BY pd.DepName LIMIT " . intval($limit); - return db_cache_result($q, 'dependencies:' . $pkgid); + $ttl = config_get_int('options', 'cache_pkginfo_ttl'); + return db_cache_result($q, 'dependencies:' . $pkgid, PDO::FETCH_NUM, $ttl); } /** @@ -251,7 +255,8 @@ function pkg_relations($pkgid) { $q.= "LEFT JOIN RelationTypes rt ON rt.ID = pr.RelTypeID "; $q.= "WHERE pr.PackageID = ". $pkgid . " "; $q.= "ORDER BY pr.RelName"; - return db_cache_result($q, 'relations:' . $pkgid); + $ttl = config_get_int('options', 'cache_pkginfo_ttl'); + return db_cache_result($q, 'relations:' . $pkgid, PDO::FETCH_NUM, $ttl); } /** -- 2.23.0

1 0

[PATCH] Cache package licenses, groups and relations
by Lukas Fleischer 07 Oct '19

07 Oct '19

Cache more package details if the global caching mechanism is enabled. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/lib/pkgfuncs.inc.php | 66 ++++++++++++++-------------------------- 1 file changed, 22 insertions(+), 44 deletions(-) diff --git a/web/lib/pkgfuncs.inc.php b/web/lib/pkgfuncs.inc.php index 3e4b2a8..be4bb06 100644 --- a/web/lib/pkgfuncs.inc.php +++ b/web/lib/pkgfuncs.inc.php @@ -158,22 +158,15 @@ function pkg_from_name($name="") { * @return array All licenses for the package */ function pkg_licenses($pkgid) { - $lics = array(); $pkgid = intval($pkgid); - if ($pkgid > 0) { - $dbh = DB::connect(); - $q = "SELECT l.Name FROM Licenses l "; - $q.= "INNER JOIN PackageLicenses pl ON pl.LicenseID = l.ID "; - $q.= "WHERE pl.PackageID = ". $pkgid; - $result = $dbh->query($q); - if (!$result) { - return array(); - } - while ($row = $result->fetch(PDO::FETCH_COLUMN, 0)) { - $lics[] = $row; - } + if (!$pkgid) { + return array(); } - return $lics; + $q = "SELECT l.Name FROM Licenses l "; + $q.= "INNER JOIN PackageLicenses pl ON pl.LicenseID = l.ID "; + $q.= "WHERE pl.PackageID = ". $pkgid; + $rows = db_cache_result($q, 'licenses:' . $pkgid); + return array_map(function ($x) { return $x[0]; }, $rows); } /** @@ -184,22 +177,15 @@ function pkg_licenses($pkgid) { * @return array All package groups for the package */ function pkg_groups($pkgid) { - $grps = array(); $pkgid = intval($pkgid); - if ($pkgid > 0) { - $dbh = DB::connect(); - $q = "SELECT g.Name FROM `Groups` g "; - $q.= "INNER JOIN PackageGroups pg ON pg.GroupID = g.ID "; - $q.= "WHERE pg.PackageID = ". $pkgid; - $result = $dbh->query($q); - if (!$result) { - return array(); - } - while ($row = $result->fetch(PDO::FETCH_COLUMN, 0)) { - $grps[] = $row; - } + if (!$pkgid) { + return array(); } - return $grps; + $q = "SELECT g.Name FROM `Groups` g "; + $q.= "INNER JOIN PackageGroups pg ON pg.GroupID = g.ID "; + $q.= "WHERE pg.PackageID = ". $pkgid; + $rows = db_cache_result($q, 'groups:' . $pkgid); + return array_map(function ($x) { return $x[0]; }, $rows); } /** @@ -256,24 +242,16 @@ function pkg_dependencies($pkgid, $limit) { * @return array All package relations for the package */ function pkg_relations($pkgid) { - $rels = array(); $pkgid = intval($pkgid); - if ($pkgid > 0) { - $dbh = DB::connect(); - $q = "SELECT pr.RelName, rt.Name, pr.RelCondition, pr.RelArch, p.ID FROM PackageRelations pr "; - $q.= "LEFT JOIN Packages p ON pr.RelName = p.Name "; - $q.= "LEFT JOIN RelationTypes rt ON rt.ID = pr.RelTypeID "; - $q.= "WHERE pr.PackageID = ". $pkgid . " "; - $q.= "ORDER BY pr.RelName"; - $result = $dbh->query($q); - if (!$result) { - return array(); - } - while ($row = $result->fetch(PDO::FETCH_NUM)) { - $rels[] = $row; - } + if (!$pkgid) { + return array(); } - return $rels; + $q = "SELECT pr.RelName, rt.Name, pr.RelCondition, pr.RelArch, p.ID FROM PackageRelations pr "; + $q.= "LEFT JOIN Packages p ON pr.RelName = p.Name "; + $q.= "LEFT JOIN RelationTypes rt ON rt.ID = pr.RelTypeID "; + $q.= "WHERE pr.PackageID = ". $pkgid . " "; + $q.= "ORDER BY pr.RelName"; + return db_cache_result($q, 'relations:' . $pkgid); } /** -- 2.23.0

1 0

list of package names, versions[, descriptions]
by Greg Minshall 07 Oct '19

07 Oct '19

hi. i'd like to keep a copy of the list of AUR packages, version numbers, and descriptions on my machine. the list can be somewhat out of date (say, as of the last time i did "pacman -Syu", which, for me, is every week or two). my question is how to do it with minimal overhead? i know packages.gz. that will give me the list of packages. however, without the version numbers, i won't be able to tell whether my cached information for a given package is up to date or not. would it be possible to (put on the list to) provide at some point a "packages-versions.gz"? or, even, "packages-versions-descriptions.gz"? (though the former is probably of more general use.) below is my motivation for wanting this. apologies if i've missed some already existing way of doing this. cheers, Greg ---------------------------------------------------------------------- motivation: for the last several years i've been using a script i "wrote" (inspired by something similar from fink) that, from local information, lists available packages, install status, version numbers, and descriptions [1]. (i'm often in a disconnected, or badly connected, world, so i try to avoid relying on the web.) having converted recently to arch, i pulled my script up to pacman [2], and would like to do an aur version, as well. for "packages-versions.gz", i'd download that, then use the package names and versions to make queries to bring a local database up to date with what AUR has. i'd damp this process to once a week or so. (i've spent some time in the last week, offline, playing with figuring out how efficiently -- in terms of both number of requests and amount of [duplicated] data transmitted -- i can download all the information via repeated RPC searches on frequently-appearing search terms -- using packages.gz as a way of knowing all the entries. but, as fun as that is, it's a hack.) [1] https://github.com/greg-minshall/apt-list [2] https://gitlab.com/minshall/pac-list

6 17

[PATCH] Cache package provider and dependency information
by Lukas Fleischer 06 Oct '19

06 Oct '19

The package provider and dependency queries are quite CPU-intensive and usually yield rather small result sets. Cache these values if the global caching mechanism is enabled. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- We will test this in our production environment for a while to see whether it makes any difference in server load. There are probably more things that we easily cache and there's a lot of room for improvement in general (e.g. increase the TTL and automatically invalidate the cache when a new package version is pushed via Git). web/lib/cachefuncs.inc.php | 17 ++++++++++++++++ web/lib/pkgfuncs.inc.php | 40 +++++++++++--------------------------- 2 files changed, 28 insertions(+), 29 deletions(-) diff --git a/web/lib/cachefuncs.inc.php b/web/lib/cachefuncs.inc.php index 881ad8f..d0e0f6f 100644 --- a/web/lib/cachefuncs.inc.php +++ b/web/lib/cachefuncs.inc.php @@ -79,4 +79,21 @@ function db_cache_value($dbq, $key, $ttl=600) { return $value; } +# Run a simple db query, retrieving and/or caching the result set if APC is +# available for use. Accepts an optional TTL value (defaults to 600 seconds). +function db_cache_result($dbq, $key, $ttl=600) { + $dbh = DB::connect(); + $status = false; + $value = get_cache_value($key, $status); + if (!$status) { + $result = $dbh->query($dbq); + if (!$result) { + return false; + } + $value = $result->fetchAll(PDO::FETCH_NUM); + set_cache_value($key, $value, $ttl); + } + return $value; +} + ?> diff --git a/web/lib/pkgfuncs.inc.php b/web/lib/pkgfuncs.inc.php index 00f0cc4..44e4167 100644 --- a/web/lib/pkgfuncs.inc.php +++ b/web/lib/pkgfuncs.inc.php @@ -222,17 +222,7 @@ function pkg_providers($name) { $q.= "UNION "; $q.= "SELECT 0, Name FROM OfficialProviders "; $q.= "WHERE Provides = " . $dbh->quote($name); - $result = $dbh->query($q); - - if (!$result) { - return array(); - } - - $providers = array(); - while ($row = $result->fetch(PDO::FETCH_NUM)) { - $providers[] = $row; - } - return $providers; + return db_cache_result($q, 'providers:' . $name); } /** @@ -244,26 +234,18 @@ function pkg_providers($name) { * @return array All package dependencies for the package */ function pkg_dependencies($pkgid, $limit) { - $deps = array(); $pkgid = intval($pkgid); - if ($pkgid > 0) { - $dbh = DB::connect(); - $q = "SELECT pd.DepName, dt.Name, pd.DepDesc, "; - $q.= "pd.DepCondition, pd.DepArch, p.ID "; - $q.= "FROM PackageDepends pd "; - $q.= "LEFT JOIN Packages p ON pd.DepName = p.Name "; - $q.= "LEFT JOIN DependencyTypes dt ON dt.ID = pd.DepTypeID "; - $q.= "WHERE pd.PackageID = ". $pkgid . " "; - $q.= "ORDER BY pd.DepName LIMIT " . intval($limit); - $result = $dbh->query($q); - if (!$result) { - return array(); - } - while ($row = $result->fetch(PDO::FETCH_NUM)) { - $deps[] = $row; - } + if (!$pkgid) { + return array(); } - return $deps; + $q = "SELECT pd.DepName, dt.Name, pd.DepDesc, "; + $q.= "pd.DepCondition, pd.DepArch, p.ID "; + $q.= "FROM PackageDepends pd "; + $q.= "LEFT JOIN Packages p ON pd.DepName = p.Name "; + $q.= "LEFT JOIN DependencyTypes dt ON dt.ID = pd.DepTypeID "; + $q.= "WHERE pd.PackageID = ". $pkgid . " "; + $q.= "ORDER BY pd.DepName LIMIT " . intval($limit); + return db_cache_result($q, 'dependencies:' . $name); } /** -- 2.23.0

1 2

[PATCH] aurjson: cache extended fields
by Lukas Fleischer 06 Oct '19

06 Oct '19

Cache the results of the extended fields computation if the global caching mechanism is enabled. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/lib/aurjson.class.php | 17 ++++------------- 1 file changed, 4 insertions(+), 13 deletions(-) diff --git a/web/lib/aurjson.class.php b/web/lib/aurjson.class.php index c275d21..bfb8cd1 100644 --- a/web/lib/aurjson.class.php +++ b/web/lib/aurjson.class.php @@ -292,11 +292,7 @@ class AurJSON { "FROM Licenses INNER JOIN PackageLicenses " . "ON PackageLicenses.PackageID = " . $pkgid . " " . "AND PackageLicenses.LicenseID = Licenses.ID"; - $result = $this->dbh->query($query); - - if (!$result) { - return null; - } + $rows = db_cache_result($query, 'extended-fields:' . $pkgid, PDO::FETCH_ASSOC); $type_map = array( 'depends' => 'Depends', @@ -310,7 +306,7 @@ class AurJSON { 'license' => 'License', ); $data = array(); - while ($row = $result->fetch(PDO::FETCH_ASSOC)) { + foreach ($rows as $row) { $type = $type_map[$row['Type']]; $data[$type][] = $row['Name'] . $row['Cond']; } @@ -319,13 +315,8 @@ class AurJSON { $query = "SELECT Keyword FROM PackageKeywords " . "WHERE PackageBaseID = " . intval($base_id) . " " . "ORDER BY Keyword ASC"; - $result = $this->dbh->query($query); - - if (!$result) { - return null; - } - - $data['Keywords'] = $result->fetchAll(PDO::FETCH_COLUMN, 0); + $rows = db_cache_result($query, 'keywords:' . intval($base_id)); + $data['Keywords'] = array_map(function ($x) { return $x[0]; }, $rows); } return $data; -- 2.23.0

1 0

[PATCH] Make CAPTCHA salt invalidation more robust
by Lukas Fleischer 05 Oct '19

05 Oct '19

With the previous implementation, unlucky users could have their CAPTCHA be invalidated by a single account creation while filling out their account registration form. Make this more robust by allowing up to five account registrations before rejecting a CAPTCHA salt. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/lib/acctfuncs.inc.php | 32 +++++++++++++++++++++++--------- 1 file changed, 23 insertions(+), 9 deletions(-) diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index f9378fe..e754989 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -75,8 +75,8 @@ function display_account_form($A,$U="",$T="",$S="",$E="",$H="",$P="",$C="",$R="" $TZ = config_get("options", "default_timezone"); } - if ($captcha_salt != get_captcha_salt()) { - $captcha_salt = get_captcha_salt(); + if (!in_array($captcha_salt, get_captcha_salts())) { + $captcha_salt = get_captcha_salts()[0]; $captcha = ""; } $captcha_challenge = get_captcha_challenge($captcha_salt); @@ -283,7 +283,7 @@ function process_account_form($TYPE,$A,$U="",$T="",$S="",$E="",$H="",$P="",$C="" $error = __("The CAPTCHA is missing."); } - if (!$error && $TYPE == "new" && $captcha_salt != get_captcha_salt()) { + if (!$error && $TYPE == "new" && !in_array($captcha_salt, get_captcha_salts())) { $error = __("This CAPTCHA has expired. Please try again."); } @@ -1469,17 +1469,31 @@ function account_comments_count($uid) { } /* - * Compute the CAPTCHA salt. The salt changes based on the number of registered - * users. This ensures that new users always use a different salt. - * - * @return string The current salt. + * Compute the list of active CAPTCHA salts. The salt changes based on the + * number of registered users. This ensures that new users always use a + * different salt and protects against hardcoding the CAPTCHA response. + * + * The first CAPTCHA in the list is the most recent one and should be used for + * new CAPTCHA challenges. The other ones are slightly outdated but may still + * be valid for recent challenges that were created before the number of users + * increased. The current implementation ensures that we can still use our + * CAPTCHA salt, even if five new users registered since the CAPTCHA challenge + * was created. + * + * @return string The list of active salts, the first being the most recent + * one. */ -function get_captcha_salt() { +function get_captcha_salts() { $dbh = DB::connect(); $q = "SELECT count(*) FROM Users"; $result = $dbh->query($q); $user_count = $result->fetchColumn(); - return 'aurweb-' . floor($user_count / 3); + + $ret = array(); + for ($i = 0; $i <= 5; $i++) { + array_push($ret, 'aurweb-' . ($user_count - $i)); + } + return $ret; } /* -- 2.23.0

1 0

[PATCH] Add a simple CAPTCHA to the sign up form
by Lukas Fleischer 05 Oct '19

05 Oct '19

Add a CAPTCHA to protect against automated account creation. The CAPTCHA changes whenever three new accounts are registered. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- This is a first attempt to stop the recent wave of spammers. Other counter-measures will be implemented if it is not effective. web/html/register.php | 14 +++++- web/lib/acctfuncs.inc.php | 74 +++++++++++++++++++++++++++++- web/template/account_edit_form.php | 11 +++++ 3 files changed, 95 insertions(+), 4 deletions(-) diff --git a/web/html/register.php b/web/html/register.php index 368999a..a426482 100644 --- a/web/html/register.php +++ b/web/html/register.php @@ -36,7 +36,12 @@ if (in_request("Action") == "NewAccount") { 0, in_request("CN"), in_request("UN"), - in_request("ON")); + in_request("ON"), + 0, + "", + in_request("captcha_salt"), + in_request("captcha"), + ); print $message; @@ -59,7 +64,12 @@ if (in_request("Action") == "NewAccount") { 0, in_request("CN"), in_request("UN"), - in_request("ON")); + in_request("ON"), + 0, + "", + in_request("captcha_salt"), + in_request("captcha") + ); } } else { print '<p>' . __("Use this form to create an account.") . '</p>'; diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index dc44484..b0513c6 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -62,17 +62,25 @@ function html_format_pgp_fingerprint($fingerprint) { * @param string $ON Whether to notify of ownership changes * @param string $UID The user ID of the displayed user * @param string $N The username as present in the database + * @param string $captcha_salt The salt used for the CAPTCHA. + * @param string $captcha The CAPTCHA answer. * * @return void */ function display_account_form($A,$U="",$T="",$S="",$E="",$H="",$P="",$C="",$R="", - $L="",$TZ="",$HP="",$I="",$K="",$PK="",$J="",$CN="",$UN="",$ON="",$UID=0,$N="") { + $L="",$TZ="",$HP="",$I="",$K="",$PK="",$J="",$CN="",$UN="",$ON="",$UID=0,$N="",$captcha_salt="",$captcha="") { global $SUPPORTED_LANGS; if ($TZ == "") { $TZ = config_get("options", "default_timezone"); } + if ($captcha_salt != get_captcha_salt()) { + $captcha_salt = get_captcha_salt(); + $captcha = ""; + } + $captcha_challenge = get_captcha_challenge($captcha_salt); + include("account_edit_form.php"); return; } @@ -103,11 +111,13 @@ function display_account_form($A,$U="",$T="",$S="",$E="",$H="",$P="",$C="",$R="" * @param string $ON Whether to notify of ownership changes * @param string $UID The user ID of the modified account * @param string $N The username as present in the database + * @param string $captcha_salt The salt used for the CAPTCHA. + * @param string $captcha The CAPTCHA answer. * * @return array Boolean indicating success and message to be printed */ function process_account_form($TYPE,$A,$U="",$T="",$S="",$E="",$H="",$P="",$C="", - $R="",$L="",$TZ="",$HP="",$I="",$K="",$PK="",$J="",$CN="",$UN="",$ON="",$UID=0,$N="") { + $R="",$L="",$TZ="",$HP="",$I="",$K="",$PK="",$J="",$CN="",$UN="",$ON="",$UID=0,$N="",$captcha_salt="",$captcha="") { global $SUPPORTED_LANGS; $error = ''; @@ -269,6 +279,18 @@ function process_account_form($TYPE,$A,$U="",$T="",$S="",$E="",$H="",$P="",$C="" } } + if (!$error && $TYPE == "new" && empty($captcha)) { + $error = __("The CAPTCHA is missing."); + } + + if (!$error && $TYPE == "new" && $captcha_salt != get_captcha_salt()) { + $error = __("This CAPTCHA has expired. Please try again."); + } + + if (!$error && $TYPE == "new" && $captcha != get_captcha_answer($captcha_salt)) { + $error = __("The entered CAPTCHA answer is invalid."); + } + if ($error) { $message = "<ul class='errorlist'><li>".$error."</li></ul>\n"; return array(false, $message); @@ -1445,3 +1467,51 @@ function account_comments_count($uid) { $result = $dbh->query($q); return $result->fetchColumn(); } + +/* + * Compute the CAPTCHA salt. The salt changes based on the number of registered + * users. This ensures that new users always use a different salt. + * + * @return string The current salt. + */ +function get_captcha_salt() { + $dbh = DB::connect(); + $q = "SELECT count(*) FROM Users"; + $result = $dbh->query($q); + $user_count = $result->fetchColumn(); + return 'aurweb-' . floor($user_count / 3); +} + +/* + * Return the CAPTCHA challenge for a given salt. + * + * @param string $salt The salt to be used for the CAPTCHA computation. + * + * @return string The challenge as a string. + */ +function get_captcha_challenge($salt) { + $token = substr(md5($salt), 0, 3); + return "pacman -V|sed -r 's#[0-9]+#" . $token . "#g'|md5sum|cut -c1-6"; +} + +/* + * Compute CAPTCHA answer for a given salt. + * + * @param string $salt The salt to be used for the CAPTCHA computation. + * + * @return string The correct answer as a string. + */ +function get_captcha_answer($salt) { + $token = substr(md5($salt), 0, 3); + $text = <<<EOD + + .--. Pacman v$token.$token.$token - libalpm v$token.$token.$token +/ _.-' .-. .-. .-. Copyright (C) $token-$token Pacman Development Team +\ '-. '-' '-' '-' Copyright (C) $token-$token Judd Vinet + '--' + This program may be freely redistributed under + the terms of the GNU General Public License. + +EOD; + return substr(md5($text . "\n"), 0, 6); +} diff --git a/web/template/account_edit_form.php b/web/template/account_edit_form.php index 38d5274..5e84aa7 100644 --- a/web/template/account_edit_form.php +++ b/web/template/account_edit_form.php @@ -174,6 +174,17 @@ </p> </fieldset> + <?php if ($A != "UpdateAccount"): ?> + <fieldset> + <legend><?= __("To protect the AUR against automated account creation, we kindly ask you to provide the output of the following command:") ?> <code><?= htmlspecialchars($captcha_challenge) ?></code></legend> + <p> + <label for="id_captcha"><?= __("Answer") ?>:</label> + <input type="text" size="30" maxlength="6" name="captcha" id="id_captcha" value="<?= htmlspecialchars($captcha, ENT_QUOTES) ?>" /> (<?= __("required") ?>) + <input type="hidden" name="captcha_salt" value="<?= htmlspecialchars($captcha_salt) ?>" /> + </p> + </fieldset> + <?php endif; ?> + <fieldset> <p> <label></label> -- 2.23.0

2 2