April 2019 - Aur-dev - lists.archlinux.org

[aur-dev][PATCH] Correctly handle package sources which do not validate as an url
by Eli Schwartz 28 Apr '19

28 Apr '19

php's parse_url does not handle proper rfc3986 URIs, specifically, it does not handle the case of an empty authority such as file:/// or local:/// and only handles the case of file by applying a special case for file itself. These URIs are deemed "malformed" and return false. When such URIs were used, we would end up always treating the package source as a filename (despite that this is incorrect, since plain files will be correctly handled by parse_url, we will correctly determine that there is no schema, and we will go to the source_file_uri). Instead, handle the case of a "malformed" URI by treating it as another example of a source with a schema, and linking it as-is. See https://lists.archlinux.org/pipermail/aur-general/2019-January/034782.html for details. Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> --- This fixes the case of local:///, but are there other cases where php would claim a malformed url where we would actually want to link to cgit? Should we just be dumb like makepkg and git/update.py, and check if it has the string literal '://'? Given the other two places where a source url might be handled don't even make a pretense of being proper rfc3986 parsers, this would at least mean we're highly consistent in our behavior. web/lib/pkgfuncs.inc.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/web/lib/pkgfuncs.inc.php b/web/lib/pkgfuncs.inc.php index ced1f8e..126b5c3 100644 --- a/web/lib/pkgfuncs.inc.php +++ b/web/lib/pkgfuncs.inc.php @@ -481,7 +481,7 @@ function pkg_source_link($url, $arch, $package) { $url = explode('::', $url); $parsed_url = parse_url($url[0]); - if (isset($parsed_url['scheme']) || isset($url[1])) { + if ($parsed_url === false || isset($parsed_url['scheme']) || isset($url[1])) { $link = '<a href="' . htmlspecialchars((isset($url[1]) ? $url[1] : $url[0]), ENT_QUOTES) . '">' . htmlspecialchars($url[0]) . '</a>'; } else { $file_url = sprintf(config_get('options', 'source_file_uri'), htmlspecialchars($url[0]), $package); -- 2.20.1

2 4

[PATCH] git-auth: deny login if no password has been set
by Lukas Fleischer 27 Apr '19

27 Apr '19

After creating a new account, users need to verify their email address and set an initial password. Without setting a password, users cannot use their account on the web interface. However, when logging in via SSH, we did not check whether the account is verified. Fix this by only allowing SSH access once a password is set. Reported-by: Pat Hogan <pathtofile(a)gmail.com> Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- aurweb/git/auth.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/aurweb/git/auth.py b/aurweb/git/auth.py index 828ed4e..3b1e485 100755 --- a/aurweb/git/auth.py +++ b/aurweb/git/auth.py @@ -39,7 +39,8 @@ def main(): cur = conn.execute("SELECT Users.Username, Users.AccountTypeID FROM Users " "INNER JOIN SSHPubKeys ON SSHPubKeys.UserID = Users.ID " - "WHERE SSHPubKeys.PubKey = ? AND Users.Suspended = 0", + "WHERE SSHPubKeys.PubKey = ? AND Users.Suspended = 0 " + "AND NOT Users.Passwd = ''", (keytype + " " + keytext,)) row = cur.fetchone() -- 2.21.0

1 0

Re: [aur-general] Spammers in AUR user comments
by Lukas Fleischer 11 Apr '19

11 Apr '19

On Thu, 11 Apr 2019 at 15:13:32, Daniel M. Capella via aur-general wrote: > On April 5, 2019 7:54:44 AM EDT, NicoHood <archlinux at nicohood.de> wrote: > >Should and how can we better protect ourselves from spam comments? > > Perhaps we should add CAPTCHA for account registrations. IIRC, we had an issue with spam bots several years ago. We tried adding a CAPTCHA back then and it did not help (which, of course, does not imply that CAPTCHAs do not work in general). The issue was eventually resolved by requiring users to confirm their email address and set an initial password from the confirmation email before using their accounts. If this no longer works and massive spamming continues to be a problem, I am open to trying other techniques again. That being said, I think we should first figure out whether spammer account creation is automated or done manually this time. Lukas

1 0