- Aur-dev - lists.archlinux.org

[aur-dev] [PATCH] pkgsubmit.php: Fix comment parsing in arrays
by Neer Sighted 27 Feb '13

27 Feb '13

Fix the comment parsing in arrays, so that a hash in a one-line array does not get parsed as a comment. -- Neer Sighted, Hacker http://neersighted.com | neersighted(a)myopera.com {01DC2056}

1 0

[aur-dev] [PATCH] Remove aurblup configuration file parser
by Lukas Fleischer 15 Feb '13

15 Feb '13

Drop the (very bad) PHP parser and allow for passing all necessary configuration via command line parameters. Also, add a convenience wrapper written in PHP that parses the configuration file and subsequently calls aurblup with correct command line options. Signed-off-by: Lukas Fleischer <archlinux(a)cryptocrack.de> --- scripts/aurblup/aurblup-wrapper | 17 +++++++ scripts/aurblup/aurblup.c | 108 +++++++++++++++------------------------- 2 files changed, 58 insertions(+), 67 deletions(-) create mode 100755 scripts/aurblup/aurblup-wrapper diff --git a/scripts/aurblup/aurblup-wrapper b/scripts/aurblup/aurblup-wrapper new file mode 100755 index 0000000..b056030 --- /dev/null +++ b/scripts/aurblup/aurblup-wrapper @@ -0,0 +1,17 @@ +#!/usr/bin/php +<?php +$dir = $argv[1]; + +if (empty($dir)) { + echo "Please specify AUR directory.\n"; + exit; +} + +set_include_path(get_include_path() . PATH_SEPARATOR . "$dir/lib"); +include("config.inc.php"); + +exec($dir . "/../scripts/aurblup/aurblup " . + "-S /var/run/mysqld/mysqld.sock " . + "-u " . escapeshellarg(AUR_db_user) . " " . + "-p " . escapeshellarg(AUR_db_pass) . " " . + "-D " . escapeshellarg(AUR_db_name)); diff --git a/scripts/aurblup/aurblup.c b/scripts/aurblup/aurblup.c index 3236554..be398f8 100644 --- a/scripts/aurblup/aurblup.c +++ b/scripts/aurblup/aurblup.c @@ -5,6 +5,7 @@ */ #include <alpm.h> +#include <getopt.h> #include <mysql.h> #include <stdio.h> #include <string.h> @@ -22,15 +23,15 @@ static void blacklist_remove(const char *); static void blacklist_sync(alpm_list_t *, alpm_list_t *); static alpm_list_t *dblist_get_pkglist(alpm_list_t *); static alpm_list_t *dblist_create(void); -static void read_config(const char *); +static int parse_options(int, char **); static void init(void); static void cleanup(void); -static char *mysql_host = NULL; +static char *mysql_host = "localhost"; static char *mysql_socket = NULL; -static char *mysql_user = NULL; -static char *mysql_passwd = NULL; -static char *mysql_db = NULL; +static char *mysql_user = "aur"; +static char *mysql_passwd = "aur"; +static char *mysql_db = "AUR"; static MYSQL *c; @@ -208,65 +209,42 @@ dblist_create(void) return dblist; } -static void -read_config(const char *fn) +static int parse_options(int argc, char **argv) { - FILE *fp; - char line[128]; - char **t, **u, *p, *q; - - if (!(fp = fopen(fn, "r"))) - die("failed to open AUR config file (\"%s\")\n", fn); - - while (fgets(line, sizeof(line), fp)) { - u = NULL; - if (strstr(line, CONFIG_KEY_HOST)) { - t = &mysql_host; - u = &mysql_socket; - } - else if (strstr(line, CONFIG_KEY_USER)) - t = &mysql_user; - else if (strstr(line, CONFIG_KEY_PASSWD)) - t = &mysql_passwd; - else if (strstr(line, CONFIG_KEY_DB)) - t = &mysql_db; - else - t = NULL; - - if (t) { - strtok(line, "\""); - strtok(NULL, "\""); - strtok(NULL, "\""); - p = strtok(NULL, "\""); - - if (u) { - p = strtok(p, ":"); - q = strtok(NULL, ":"); - } - else q = NULL; - - if (p && !*t) { - *t = malloc(strlen(p) + 1); - strncpy(*t, p, strlen(p) + 1); - } - - if (q && !*u) { - *u = malloc(strlen(q) + 1); - strncpy(*u, q, strlen(q) + 1); - } + int opt; + + static const struct option opts[] = { + { "mysql-host", required_argument, 0, 'h' }, + { "mysql-socket", required_argument, 0, 'S' }, + { "mysql-user", required_argument, 0, 'u' }, + { "mysql-passwd", required_argument, 0, 'p' }, + { "mysql-db", required_argument, 0, 'D' }, + { 0, 0, 0, 0 } + }; + + while((opt = getopt_long(argc, argv, "h:S:u:p:D:", opts, NULL)) != -1) { + switch(opt) { + case 'h': + mysql_host = optarg; + break;; + case 'S': + mysql_socket = optarg; + break;; + case 'u': + mysql_user = optarg; + break;; + case 'p': + mysql_passwd = optarg; + break;; + case 'D': + mysql_db = optarg; + break;; + default: + return 0; } } - fclose(fp); - - if (!mysql_host) - die("MySQL host setting not found in AUR config file\n"); - if (!mysql_user) - die("MySQL user setting not found in AUR config file\n"); - if (!mysql_passwd) - die("MySQL password setting not found in AUR config file\n"); - if (!mysql_db) - die("MySQL database setting not found in AUR config file\n"); + return 1; } static void @@ -288,12 +266,6 @@ init(void) static void cleanup(void) { - free(mysql_host); - free(mysql_socket); - free(mysql_user); - free(mysql_passwd); - free(mysql_db); - alpm_release(handle); mysql_close(c); mysql_library_end(); @@ -303,7 +275,9 @@ int main(int argc, char *argv[]) { alpm_list_t *pkgs_cur, *pkgs_new; - read_config(AUR_CONFIG); + if (!parse_options(argc, argv)) + return 1; + init(); pkgs_cur = blacklist_get_pkglist(); -- 1.8.1.3

2 3

[aur-dev] [PATCH 0/5] Database connection overhaul
by canyonknight 05 Feb '13

05 Feb '13

Hello all, I recently noticed in my SQL logs that multiple database connections will be started over the course of a page loading. Past commits have relied on passing the handle as an argument to avoid that. The problem is many functions don't get a handle passed to them and there is a large amount of boilerplate code. This patch series will basically fully implement the same functionality as passing DB handles as arguments but with a lot less code and not mucking up function args. Due to the fact that some of these patches are quite large they may get eaten by the list, so as always they will be available on my "working" branch. canyonknight (5): Add database wrapper class and new connection method Remove unnecessary database connection parameter from all functions Remove documentation references to database parameter Remove checks before calling connection method Remove unneeded database connection calls web/html/account.php | 1 - web/html/home.php | 8 +- web/html/logout.php | 7 +- web/html/pkgsubmit.php | 23 ++-- web/lib/DB.class.php | 28 +++++ web/lib/acctfuncs.inc.php | 179 +++++++++-------------------- web/lib/aur.inc.php | 131 ++++++--------------- web/lib/aurjson.class.php | 2 +- web/lib/cachefuncs.inc.php | 3 +- web/lib/pkgfuncs.inc.php | 276 +++++++++++++++------------------------------ web/lib/stats.inc.php | 33 +++--- web/lib/translator.inc.php | 6 +- 12 files changed, 239 insertions(+), 458 deletions(-) create mode 100644 web/lib/DB.class.php -- 1.8.1.2

2 7

[aur-dev] [PATCH] Add CDATA markers
by Marcel Korpel 04 Feb '13

04 Feb '13

--- web/html/home.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/web/html/home.php b/web/html/home.php index 0b51d55..e857b8d 100644 --- a/web/html/home.php +++ b/web/html/home.php @@ -109,7 +109,7 @@ $dbh = db_connect(); </div> <script type="text/javascript" src="https://ajax.googleapis.com/ajax/libs/jquery/1.8.2/jquery.min.js"></script> <script type="text/javascript" src="/js/bootstrap-typeahead.js"></script> -<script type="text/javascript"> +<script type="text/javascript">//<![CDATA[ $(document).ready(function() { $('#pkgsearch-field').typeahead({ source: function(query, callback) { @@ -123,6 +123,6 @@ $(document).ready(function() { items: 20 }).attr('autocomplete', 'off'); }); -</script> +//]]></script> <?php html_footer(AUR_VERSION); -- 1.8.1.1

3 4

[aur-dev] Missing translations for AUR 2.0.1
by rafael ff1 30 Jan '13

30 Jan '13

Hi all. In the transition 2.0.0 to 2.0.1, a few non-translated strings in AUR webui were found and fixed in source code, however the PO files were not updated. In consequence, the translators didn't made the webui 100% translated (e.g. "Package Search" in pt_BR in main screen is in english). While this is not a big issue, it is always nice to have the interface all translated. Having that said, *if there is no plan for soon releasing next version*, please consider uploading translations to Transifex, giving a time frame for translation and releasing the translatings. Thanks in advance, Rafael Ferreira

3 2

[aur-dev] [PATCH 4/4] acctfuncs.inc.php: Change wording of account editing message
by canyonknight 22 Jan '13

22 Jan '13

An error message is printed when the number of affected rows is 0 for an edited account. A count of 0 doesn't imply an error, only that no changes were made in the database. Signed-off-by: canyonknight <canyonknight(a)gmail.com> --- web/lib/acctfuncs.inc.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index b2bf03b..96fd9f6 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -248,7 +248,7 @@ function process_account_form($UTYPE,$TYPE,$A,$U="",$T="",$S="",$E="", $q.= " WHERE ID = ".intval($UID); $result = $dbh->exec($q); if (!$result) { - print __("Error trying to modify account, %s%s%s.", + print __("No changes were made to the account, %s%s%s.", "<strong>", htmlspecialchars($U,ENT_QUOTES), "</strong>"); } else { print __("The account, %s%s%s, has been successfully modified.", -- 1.8.1.1

1 0

[aur-dev] [PATCH] Clear a user's active sessions following account suspension
by canyonknight 22 Jan '13

22 Jan '13

A suspended user can stay in active sessions. Introduce new function delete_user_sessions to remove all open sessions for a specific user. Allows suspensions to take effect immediately. Signed-off-by: canyonknight <canyonknight(a)gmail.com> --- web/lib/acctfuncs.inc.php | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index cdf4af6..b2bf03b 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -229,6 +229,8 @@ function process_account_form($UTYPE,$TYPE,$A,$U="",$T="",$S="",$E="", $q.= ", AccountTypeID = ".intval($T); } if ($S) { + /* Ensure suspended users can't keep an active session */ + delete_user_sessions($UID, $dbh); $q.= ", Suspended = 1"; } else { $q.= ", Suspended = 0"; @@ -797,6 +799,23 @@ function delete_session_id($sid, $dbh=NULL) { } /** + * Remove all sessions belonging to a particular user + * + * @param int $uid ID of user to remove all sessions for + * @param \PDO $dbh An already established database connection + * + * @return void + */ +function delete_user_sessions($uid, $dbh=NULL) { + if (!$dbh) { + $dbh = db_connect(); + } + + $q = "DELETE FROM Sessions WHERE UsersID = " . intval($uid); + $dbh->exec($q); +} + +/** * Remove sessions from the database that have exceed the timeout * * @global int $LOGIN_TIMEOUT Time until session expires -- 1.8.1.1

1 0

[aur-dev] [PATCH] Replace permission check code with can_edit_account()
by canyonknight 22 Jan '13

22 Jan '13

Signed-off-by: canyonknight <canyonknight(a)gmail.com> --- web/html/account.php | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/web/html/account.php b/web/html/account.php index cccdd76..2133734 100644 --- a/web/html/account.php +++ b/web/html/account.php @@ -48,11 +48,8 @@ if (isset($_COOKIE["AURSID"])) { if (empty($row)) { print __("Could not retrieve information for the specified user."); } else { - # double check to make sure logged in user can edit this account - # - if ($atype == "Developer" || ($atype == "Trusted User" && - $row["AccountType"] != "Developer") || - ($row["ID"] == uid_from_sid($_COOKIE["AURSID"]))) { + /* Verify user has permission to edit the account */ + if (can_edit_account($atype, $row, uid_from_sid($_COOKIE["AURSID"]))) { display_account_form($atype, "UpdateAccount", $row["Username"], $row["AccountType"], $row["Suspended"], $row["Email"], "", "", $row["RealName"], $row["LangPreference"], -- 1.8.1.1

1 0

[aur-dev] [PATCH] acctfuncs.inc.php: Change return type of valid_username function
by canyonknight 22 Jan '13

22 Jan '13

The function is only determining whether a username is valid, so it makes more sense to simply return a boolean value. Signed-off-by: canyonknight <canyonknight(a)gmail.com> --- web/lib/acctfuncs.inc.php | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index a41659e..cdf4af6 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -480,12 +480,12 @@ function try_login($dbh=NULL) { * * The username must be longer or equal to USERNAME_MIN_LEN. It must be shorter * or equal to USERNAME_MAX_LEN. It must start and end with either a letter or - * a number. It can contain one period, hypen, or underscore. Returns username - * if it meets all of those rules. + * a number. It can contain one period, hypen, or underscore. Returns boolean + * of whether name is valid. * * @param string $user Username to validate * - * @return string|void Return username if it meets criteria, otherwise void + * @return bool True if username meets criteria, otherwise false */ function valid_username($user) { if (!empty($user)) { @@ -500,13 +500,12 @@ function valid_username($user) { # contain only letters and numbers, # and at most has one dash, period, or underscore if ( preg_match("/^[a-z0-9]+[.\-_]?[a-z0-9]+$/", $user) ) { - #All is good return the username - return $user; + return true; } } } - return; + return false; } /** -- 1.8.1.1

1 0

[aur-dev] [PATCH] aur.inc.php: Fix PHP undefined index notice for AURSID
by canyonknight 21 Jan '13

21 Jan '13

Occurs in the rare situation where a logged out user tries to POST a CSRF token. Signed-off-by: canyonknight <canyonknight(a)gmail.com> --- web/lib/aur.inc.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/web/lib/aur.inc.php b/web/lib/aur.inc.php index 387d81d..e02c835 100644 --- a/web/lib/aur.inc.php +++ b/web/lib/aur.inc.php @@ -94,7 +94,7 @@ function check_sid($dbh=NULL) { * @return bool True if the CSRF token is the same as the cookie SID, otherwise false */ function check_token() { - if (isset($_POST['token'])) { + if (isset($_POST['token']) && isset($_COOKIE['AURSID'])) { return ($_POST['token'] == $_COOKIE['AURSID']); } else { return false; -- 1.8.1.1

1 0