July 2020 - Aur-dev - lists.archlinux.org

[PATCH 2/3] SSO: Port account suspension
by Frédéric Mangano-Tarumi 20 Jul '20

20 Jul '20

--- aurweb/routers/sso.py | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/aurweb/routers/sso.py b/aurweb/routers/sso.py index efd4462c..3e3b743d 100644 --- a/aurweb/routers/sso.py +++ b/aurweb/routers/sso.py @@ -41,11 +41,20 @@ async def login(request: Request): return await oauth.sso.authorize_redirect(request, redirect_uri, prompt="login") +def is_account_suspended(conn, user_id): + row = conn.execute(select([Users.c.Suspended]).where(Users.c.ID == user_id)).fetchone() + return row is not None and bool(row[0]) + + def open_session(conn, user_id): """ Create a new user session into the database. Return its SID. """ - # TODO check for account suspension + # TODO Handle translations. + if is_account_suspended(conn, user_id): + raise HTTPException(status_code=403, detail='Account suspended') + # TODO This is a terrible message because it could imply the attempt at + # logging in just caused the suspension. # TODO apply [options] max_sessions_per_user sid = uuid.uuid4().hex conn.execute(Sessions.insert().values( -- 2.27.0

1 0

[PATCH 1/4] SSO: Explain the rationale behind prompt=login
by Frédéric Mangano-Tarumi 14 Jul '20

14 Jul '20

We might reconsider it in the future. --- aurweb/routers/sso.py | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/aurweb/routers/sso.py b/aurweb/routers/sso.py index d0802c34..e1ec7efe 100644 --- a/aurweb/routers/sso.py +++ b/aurweb/routers/sso.py @@ -28,6 +28,13 @@ oauth.register( @router.get("/sso/login") async def login(request: Request): + """ + Redirect the user to the SSO provider’s login page. + + We specify prompt=login to force the user to input their credentials even + if they’re already logged on the SSO. This is less practical, but given AUR + has the potential to impact many users, better safe than sorry. + """ redirect_uri = aurweb.config.get("options", "aur_location") + "/sso/authenticate" return await oauth.sso.authorize_redirect(request, redirect_uri, prompt="login") -- 2.27.0

2 1

[PATCH] Fix typos in CONTRIBUTING.md
by Frédéric Mangano-Tarumi 14 Jul '20

14 Jul '20

--- CONTRIBUTING.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index a37d980a..7b9ff466 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -2,9 +2,9 @@ Patches should be sent to the [aur-dev(a)archlinux.org][1] mailing list. -Before sending patched you are recomended to run the `flake8` and `isort`. +Before sending patches, you are recommended to run `flake8` and `isort`. -You can add git hook to do this by installing `python-pre-install` and running -`pre-install install`. +You can add a git hook to do this by installing `python-pre-commit` and running +`pre-commit install`. [1] https://lists.archlinux.org/listinfo/aur-dev -- 2.27.0

2 1

[PATCH 4/4] Save id_token for the SSO logout
by Frédéric Mangano-Tarumi 14 Jul '20

14 Jul '20

As far as I can see, Keycloak ignores it entirely. I can login in as SSO user A, then disconnect from the SSO directly and reconnect as user B, but when I disconnect user A from AUR, Keycloak disconnects B even though AUR passed it an ID token for A. --- aurweb/routers/sso.py | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) diff --git a/aurweb/routers/sso.py b/aurweb/routers/sso.py index a8d4b141..04ecdca6 100644 --- a/aurweb/routers/sso.py +++ b/aurweb/routers/sso.py @@ -80,6 +80,11 @@ async def authenticate(request: Request, conn=Depends(aurweb.db.connect)): # TODO redirect to the referrer response.set_cookie(key="AURSID", value=sid, httponly=True, secure=request.url.scheme == "https") + if "id_token" in token: + # We save the id_token for the SSO logout. It’s not too important + # though, so if we can’t find it, we can live without it. + response.set_cookie(key="SSO_ID_TOKEN", value=token["id_token"], path="/sso/", + httponly=True, secure=request.url.scheme == "https") return response else: # We’ve got a severe integrity violation. @@ -87,7 +92,7 @@ async def authenticate(request: Request, conn=Depends(aurweb.db.connect)): @router.get("/sso/logout") -async def logout(): +async def logout(request: Request): """ Disconnect the user from the SSO provider, potentially affecting every other Arch service. AUR logout is performed by `/logout`, before it @@ -96,7 +101,13 @@ async def logout(): Based on the OpenID Connect Session Management specification: https://openid.net/specs/openid-connect-session-1_0.html#RPLogout """ + id_token = request.cookies.get("SSO_ID_TOKEN") + if not id_token: + return RedirectResponse("/") + metadata = await oauth.sso.load_server_metadata() - # TODO Supply id_token_hint to the end session endpoint. - query = urlencode({'post_logout_redirect_uri': aurweb.config.get('options', 'aur_location')}) - return RedirectResponse(metadata["end_session_endpoint"] + '?' + query) + query = urlencode({'post_logout_redirect_uri': aurweb.config.get('options', 'aur_location'), + 'id_token_hint': id_token}) + response = RedirectResponse(metadata["end_session_endpoint"] + '?' + query) + response.delete_cookie("SSO_ID_TOKEN", path="/sso/") + return response -- 2.27.0

1 0

[PATCH 3/4] Implement SSO logout
by Frédéric Mangano-Tarumi 14 Jul '20

14 Jul '20

--- aurweb/routers/sso.py | 18 ++++++++++++++++++ web/html/logout.php | 14 +++++++++++++- 2 files changed, 31 insertions(+), 1 deletion(-) diff --git a/aurweb/routers/sso.py b/aurweb/routers/sso.py index e1ec7efe..a8d4b141 100644 --- a/aurweb/routers/sso.py +++ b/aurweb/routers/sso.py @@ -1,6 +1,8 @@ import time import uuid +from urllib.parse import urlencode + import fastapi from authlib.integrations.starlette_client import OAuth @@ -82,3 +84,19 @@ async def authenticate(request: Request, conn=Depends(aurweb.db.connect)): else: # We’ve got a severe integrity violation. raise Exception("Multiple accounts found for SSO account " + sub) + + +(a)router.get("/sso/logout") +async def logout(): + """ + Disconnect the user from the SSO provider, potentially affecting every + other Arch service. AUR logout is performed by `/logout`, before it + redirects to `/sso/logout`. + + Based on the OpenID Connect Session Management specification: + https://openid.net/specs/openid-connect-session-1_0.html#RPLogout + """ + metadata = await oauth.sso.load_server_metadata() + # TODO Supply id_token_hint to the end session endpoint. + query = urlencode({'post_logout_redirect_uri': aurweb.config.get('options', 'aur_location')}) + return RedirectResponse(metadata["end_session_endpoint"] + '?' + query) diff --git a/web/html/logout.php b/web/html/logout.php index 14022001..9fd63943 100644 --- a/web/html/logout.php +++ b/web/html/logout.php @@ -5,16 +5,28 @@ set_include_path(get_include_path() . PATH_SEPARATOR . '../lib'); include_once("aur.inc.php"); # access AUR common functions include_once("acctfuncs.inc.php"); # access AUR common functions +$redirect_uri = '/'; + # if they've got a cookie, log them out - need to do this before # sending any HTML output. # if (isset($_COOKIE["AURSID"])) { + $uid = uid_from_sid($_COOKIE['AURSID']); delete_session_id($_COOKIE["AURSID"]); # setting expiration to 1 means '1 second after midnight January 1, 1970' setcookie("AURSID", "", 1, "/", null, !empty($_SERVER['HTTPS']), true); unset($_COOKIE['AURSID']); clear_expired_sessions(); + + # If the account is linked to an SSO account, disconnect the user from the SSO too. + if (isset($uid)) { + $dbh = DB::connect(); + $sso_account_id = $dbh->query("SELECT SSOAccountID FROM Users WHERE ID = " . $dbh->quote($uid)) + ->fetchColumn(); + if ($sso_account_id) + $redirect_uri = '/sso/logout'; + } } -header('Location: /'); +header("Location: $redirect_uri"); -- 2.27.0

1 0

[PATCH 2/4] SSO: Add an SSO option in the login page
by Frédéric Mangano-Tarumi 14 Jul '20

14 Jul '20

We’ll probably change the whole login page in the future, but this makes development easier. --- web/html/login.php | 3 +++ 1 file changed, 3 insertions(+) diff --git a/web/html/login.php b/web/html/login.php index 01454414..3a146f60 100644 --- a/web/html/login.php +++ b/web/html/login.php @@ -40,6 +40,9 @@ html_header('AUR ' . __("Login")); <p> <input type="submit" class="button" value="<?php print __("Login"); ?>" /> <a href="<?= get_uri('/passreset/') ?>">[<?= __('Forgot Password') ?>]</a> + <?php if (config_get('sso', 'openid_configuration')): ?> + <a href="<?= get_uri('/sso/login') ?>">[<?= __('Login through SSO') ?>]</a> + <?php endif; ?> <?php if (in_request('referer') !== ""): ?> <input id="id_referer" type="hidden" name="referer" value="<?= htmlspecialchars(in_request('referer'), ENT_QUOTES) ?>" /> <?php elseif (isset($_SERVER['HTTP_REFERER'])): ?> -- 2.27.0

1 0

[PATCH] Update the aurweb Git URLs to GitLab
by Frédéric Mangano-Tarumi 13 Jul '20

13 Jul '20

--- INSTALL | 2 +- README.md | 4 ++-- TESTING | 2 +- doc/i18n.txt | 2 +- web/lib/version.inc.php | 1 + web/template/footer.php | 2 +- 6 files changed, 7 insertions(+), 6 deletions(-) diff --git a/INSTALL b/INSTALL index 7087aca2..1db69a9c 100644 --- a/INSTALL +++ b/INSTALL @@ -12,7 +12,7 @@ read the instructions below. 1) Clone the aurweb project: $ cd /srv/http/ - $ git clone git://git.archlinux.org/aurweb.git + $ git clone https://gitlab.archlinux.org/archlinux/aurweb.git 2) Setup a web server with PHP and MySQL. Configure the web server to redirect all URLs to /index.php/foo/bar/. The following block can be used with nginx: diff --git a/README.md b/README.md index f7285a51..3105889a 100644 --- a/README.md +++ b/README.md @@ -29,8 +29,8 @@ Directory Layout Links ----- -* The repository is hosted at git://git.archlinux.org/aurweb.git -- see - doc/CodingGuidelines for information on the patch submission process. +* The repository is hosted at <https://gitlab.archlinux.org/archlinux/aurweb.git>. + See doc/CodingGuidelines for information on the patch submission process. * Bugs can (and should) be submitted to the aurweb bug tracker: https://bugs.archlinux.org/index.php?project=2 diff --git a/TESTING b/TESTING index d7df3672..9a211877 100644 --- a/TESTING +++ b/TESTING @@ -7,7 +7,7 @@ INSTALL. 1) Clone the aurweb project: - $ git clone git://git.archlinux.org/aurweb.git + $ git clone https://gitlab.archlinux.org/archlinux/aurweb.git 2) Install the necessary packages: diff --git a/doc/i18n.txt b/doc/i18n.txt index 8216c084..44fb0f1f 100644 --- a/doc/i18n.txt +++ b/doc/i18n.txt @@ -21,7 +21,7 @@ strings for the translation to be usable, and it may have to be disabled. 1. Check out the aurweb source using git: -$ git clone git://git.archlinux.org/aurweb.git aurweb-git +$ git clone https://gitlab.archlinux.org/archlinux/aurweb.git aurweb-git 2. Go into the "po/" directory in the aurweb source and run msginit(1) to create a initial translation file from our translation catalog: diff --git a/web/lib/version.inc.php b/web/lib/version.inc.php index 27eef718..d96ce590 100644 --- a/web/lib/version.inc.php +++ b/web/lib/version.inc.php @@ -1,3 +1,4 @@ <?php +// The HTML footer expects AURWEB_VERSION to refer to a Git tag. define("AURWEB_VERSION", "v5.0.0"); diff --git a/web/template/footer.php b/web/template/footer.php index 572dbb26..59a97642 100644 --- a/web/template/footer.php +++ b/web/template/footer.php @@ -3,7 +3,7 @@ <div id="footer"> <?php if ($ver): ?> - <p>aurweb <a href="https://git.archlinux.org/aurweb.git/log/?h=<?= htmlspecialchars($ver, ENT_QUOTES) ?>"><?= htmlspecialchars($ver) ?></a></p> + <p>aurweb <a href="https://gitlab.archlinux.org/archlinux/aurweb/-/tags/<?= htmlspecialchars($ver, ENT_QUOTES) ?>"><?= htmlspecialchars($ver) ?></a></p> <?php endif; ?> <p><?= __('Copyright %s 2004-%d aurweb Development Team.', '©', date('Y')) ?></p> <p><?= __('AUR packages are user produced content. Any use of the provided files is at your own risk.') ?></p> -- 2.27.0

1 0

[PATCH] Add search_type url parameter
by Kevin Morris 06 Jul '20

06 Jul '20

This commit introduces new functionality: When `search_type` is `web`, search behavior matches aurweb's HTML search page. New parameters: `search_type` Valid search_type values: `rpc` (default), `web` The `rpc` search type uses the existing legacy search method. The `web` search type clones the web-based aurweb search page's behavior as closely as possible (see note at the bottom of this message). The following example searches for packages that contain `blah` AND `abc`: https://aur.archlinux.org/rpc/?v=5&type=search&search_type=web&arg=blah%20a… The legacy method still searches for packages that contain 'blah abc': https://aur.archlinux.org/rpc/?v=5&type=search&arg=blah%20abc https://aur.archlinux.org/rpc/?v=5&type=search&search_type=rpc&arg=blah%20a… An invalid `search_type` returns a json error message about it being unsupported. Additionally, `search_type` is only parsed and considered during a search of type `name` or `name-desc`. Note: This change was written as a solution to https://bugs.archlinux.org/task/49133. PS: + Some spacing issues fixed in comments. Signed-off-by: Kevin Morris <kevr.gtalk(a)gmail.com> --- doc/rpc.txt | 7 ++++ web/lib/aurjson.class.php | 75 +++++++++++++++++++++++++++++++++++---- 2 files changed, 76 insertions(+), 6 deletions(-) diff --git a/doc/rpc.txt b/doc/rpc.txt index 3148ebea..eb97547d 100644 --- a/doc/rpc.txt +++ b/doc/rpc.txt @@ -21,6 +21,11 @@ The _by_ parameter can be skipped and defaults to `name-desc`. If a maintainer search is performed and the search argument is left empty, a list of orphan packages is returned. +The _search_type_ parameter can be skipped and defaults to `rpc`. + +_search_type_ is only ever used during a `name` or `name-desc` search and +supports the following values: `rpc`, `web`. + Package Details --------------- @@ -39,6 +44,8 @@ Examples `/rpc/?v=5&type=search&by=makedepends&arg=boost` `search` with callback:: `/rpc/?v=5&type=search&arg=foobar&callback=jsonp1192244621103` +`search` with `web` _search_type_ for packages containing `cookie` AND `milk`:: + `/rpc/?v=5&type=search&search_type=web&arg=cookie%20milk` `info`:: `/rpc/?v=5&type=info&arg[]=foobar` `info` with multiple packages:: diff --git a/web/lib/aurjson.class.php b/web/lib/aurjson.class.php index 0ac586fe..0e94b578 100644 --- a/web/lib/aurjson.class.php +++ b/web/lib/aurjson.class.php @@ -23,6 +23,9 @@ class AurJSON { private static $exposed_depfields = array( 'depends', 'makedepends', 'checkdepends', 'optdepends' ); + private static $exposed_search_types = array( + 'rpc', 'web' + ); private static $fields_v1 = array( 'Packages.ID', 'Packages.Name', 'PackageBases.ID AS PackageBaseID', @@ -140,7 +143,7 @@ class AurJSON { } /* - * Check if an IP needs to be rate limited. + * Check if an IP needs to be rate limited. * * @param $ip IP of the current request * @@ -192,7 +195,7 @@ class AurJSON { $value = get_cache_value('ratelimit-ws:' . $ip, $status); if (!$status || ($status && $value < $deletion_time)) { if (set_cache_value('ratelimit-ws:' . $ip, $time, $window_length) && - set_cache_value('ratelimit:' . $ip, 1, $window_length)) { + set_cache_value('ratelimit:' . $ip, 1, $window_length)) { return; } } else { @@ -472,6 +475,33 @@ class AurJSON { return array('ids' => $id_args, 'names' => $name_args); } + /* + * Prepare a WHERE statement for each keyword: append $func($keyword) + * separated by $delim. Each keyword is sanitized as wildcards before + * it's passed to $func. + * + * @param $delim Delimiter to use in the middle of two keywords. + * @param $keywords Array of keywords to prepare. + * @param $func A function that returns a string. This value is concatenated. + * + * @return A WHERE condition statement of keywords separated by $delim. + */ + private function join_where($delim, $keywords, $func) { + // Applied to each item to concatenate our entire statement. + $reduce_func = function($carry, $item) use(&$func) { + array_push($carry, $func($item)); + return $carry; + }; + + // Manual array_reduce with a local lambda. + $acc = array(); // Initial + foreach ($keywords as &$keyword) { + $acc += $reduce_func($acc, $keyword); + } + + return join(" $delim ", $acc); + } + /* * Performs a fulltext mysql search of the package database. * @@ -480,6 +510,7 @@ class AurJSON { * @return mixed Returns an array of package matches. */ private function search($http_data) { + $keyword_string = $http_data['arg']; if (isset($http_data['by'])) { @@ -488,17 +519,49 @@ class AurJSON { $search_by = 'name-desc'; } + if (isset($http_data['search_type'])) { + $search_type = $http_data['search_type']; + } else { + // Default search_type: rpc + $search_type = 'rpc'; + } + + if (!in_array($search_type, self::$exposed_search_types)) { + return $this->json_error('Unsupported search type.'); + } + if ($search_by === 'name' || $search_by === 'name-desc') { if (strlen($keyword_string) < 2) { return $this->json_error('Query arg too small.'); } - $keyword_string = $this->dbh->quote("%" . addcslashes($keyword_string, '%_') . "%"); if ($search_by === 'name') { - $where_condition = "(Packages.Name LIKE $keyword_string)"; + if ($search_type === 'rpc') { + $keyword_string = $this->dbh->quote( + "%" . addcslashes($keyword_string, '%_') . "%"); + $where_condition = "(Packages.Name LIKE $keyword_string)"; + } else { + $keywords = explode(' ', $keyword_string); + $func = function($keyword) { + $str = $this->dbh->quote("%" . addcslashes($keyword, '%_') . "%"); + return "(Packages.Name LIKE $str)"; + }; + $where_condition = $this->join_where("AND", $keywords, $func); + } } else if ($search_by === 'name-desc') { - $where_condition = "(Packages.Name LIKE $keyword_string OR "; - $where_condition .= "Description LIKE $keyword_string)"; + if ($search_type === 'rpc') { + $keyword_string = $this->dbh->quote( + "%" . addcslashes($keyword_string, '%_') . "%"); + $where_condition = "(Packages.Name LIKE $keyword_string "; + $where_condition .= "OR Description LIKE $keyword_string)"; + } else { + $keywords = explode(' ', $keyword_string); + $func = function($keyword) { + $str = $this->dbh->quote("%" . addcslashes($keyword, '%_') . "%"); + return "(Packages.Name LIKE $str OR Description LIKE $str)"; + }; + $where_condition = $this->join_where("AND", $keywords, $func); + } } } else if ($search_by === 'maintainer') { if (empty($keyword_string)) { -- 2.20.1

2 26

[PATCH] Add POST support for RPC API
by Kevin Morris 03 Jul '20

03 Jul '20

When we received a POST method from a client, deduce our `$data` by determining which `Content-Type` is used. Supported `Content-Type`s ========================= * `application/json` * `multipart/form-data` `application/json` POST Example, searching for 'test': ``` curl -X POST -H 'Content-Type: application/data' \ --data '{"v": "5", "type": "search", "arg": "test"}' \ https://aur.archlinux.org/rpc/ ``` `multipart/form-data` POST Example, search for 'test': ``` curl -X POST -H 'Content-Type: multipart/form-data' \ -F v=5 -F type=search -F arg=test \ https://aur.archlinux.org/rpc/ ``` This change was written as a solution to https://bugs.archlinux.org/task/49089. NOTE: This commit is not final; would like a review and a bit more consideration on `multipart/form-data` and ensuring that we're handling everything we need to. Signed-off-by: Kevin Morris <kevr.gtalk(a)gmail.com> --- web/html/rpc.php | 37 ++++++++++++++++++++++++++++++++++--- 1 file changed, 34 insertions(+), 3 deletions(-) diff --git a/web/html/rpc.php b/web/html/rpc.php index 64c95622..41762aa3 100644 --- a/web/html/rpc.php +++ b/web/html/rpc.php @@ -2,16 +2,47 @@ set_include_path(get_include_path() . PATH_SEPARATOR . '../lib'); include_once("aurjson.class.php"); -if ( $_SERVER['REQUEST_METHOD'] != 'GET' ) { +$exposed_methods = array('GET', 'POST'); +$request_method = strtoupper($_SERVER['REQUEST_METHOD']); + +if ( !in_array($request_method, $exposed_methods) ) { header('HTTP/1.1 405 Method Not Allowed'); exit(); } -if ( isset($_GET['type']) ) { +if ( $request_method === 'GET' ) { + $data = $_GET; +} else { + // Otherwise, we were given a POST method, and we'll do some more + // work to deduce our data input. + + // Extract Content-Type; remove any trailing arguments from the string. + $content_type = $_SERVER['CONTENT_TYPE']; + if ( strpos($content_type, ';') ) { + // Example: `multipart/form-data; boundary blahblah` is extracted as + // `multipart/form-data`. + $content_type = explode(';', $content_type)[0]; + } + $content_type = rtrim(trim($content_type)); + + if ($content_type === 'application/json') { + $json = file_get_contents('php://input'); + $data = json_decode($json, true); + } elseif ($content_type === 'multipart/form-data') { + $data = $_POST; + } else { + header('HTTP/1.1 400 Bad Request'); + echo "Error: Unsupported Content-Type header.\n"; + exit(); + } +} + +if ( isset($data['type']) ) { $rpc_o = new AurJSON(); - echo $rpc_o->handle($_GET); + echo $rpc_o->handle($data); } else { echo file_get_contents('../../doc/rpc.html'); } + ?> -- 2.20.1

1 1

aurweb tests and ci
by Kevin Morris 02 Jul '20

02 Jul '20

Hello aur-dev, Working on some things in aurweb at the moment, and I noticed that on master tests are failing on my system, and .travis.yml doesn't seem to properly setup the environment needed to run tests (sqlalchemy is not installed, db tables missing) on travis. Just a few questions 1. What's the state of testing aurweb currently? 2. What are any test barriers to committing code and submitting patches? 2a. What are the testing goals? 3. Is there a thread on this mailing list about this topic? Thank you very much for your time. Regards, Kevin -- Kevin Morris Software Developer Personal Inquiries: kevr.gtalk(a)gmail.com Personal Phone: (415) 583-9687 Technologies: C, C++, Python, Django, Ruby, Rails, ReactJS, jQuery, Javascript, SQL, Redux

2 1