- Aur-dev - lists.archlinux.org

[aur-dev] [PATCH] systemd compatibility
by Marcel Korpel 07 Dec '12

07 Dec '12

--- INSTALL | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/INSTALL b/INSTALL index afab274..1a41066 100644 --- a/INSTALL +++ b/INSTALL @@ -53,7 +53,7 @@ Setup on Arch Linux: 6) Configure MySQL - Start the MySQL service. Example: - # /etc/rc.d/mysqld start + # systemctl start mysqld - Create database # mysqladmin -p create AUR -- 1.8.0.1

2 1

[aur-dev] Some issues after installing AUR locally
by Marcel Korpel 07 Dec '12

07 Dec '12

Hi all, After following the instructions and giving Apache access to my home directory, I managed to go to the local AUR home page. However, apart from not having dummy data, I have some issues: 1) There's a message above the page saying "Notice: Undefined index: PATH_INFO in /home/mk/archdev/aur/web/html/index.php on line 7". I checked with a php_info() command and it's indeed not present. 2) http://aur/packages/, aur/register/, and aur/login/ are not available (though packages.php is). Should I set some option in my config files? 3) Now http://aur and http://localhost point to the same page (the AUR home page). Is there a method to be able to point http://localhost back to /srv/http (without losing http://aur)? Thanks in advance! Regards, Marcel

2 3

[aur-dev] [PATCH] Split package flagging and unflagging into separate functions
by canyonknight 06 Dec '12

06 Dec '12

Currently, package flagging and unflagging takes place within the pkg_flag() function. A bool is set to true or false depending on the action. Create new pkg_unflag() function with sole purpose of unflagging and keep pkg_flag() in place. This split will be useful in the overhaul of the notification system. Signed-off-by: canyonknight <canyonknight(a)gmail.com> --- web/html/packages.php | 4 +-- web/lib/pkgfuncs.inc.php | 74 ++++++++++++++++++++++++++++-------------------- 2 files changed, 45 insertions(+), 33 deletions(-) diff --git a/web/html/packages.php b/web/html/packages.php index 094c221..6182550 100644 --- a/web/html/packages.php +++ b/web/html/packages.php @@ -51,9 +51,9 @@ if (isset($_POST['IDs'])) { $output = ""; if (check_token()) { if (current_action("do_Flag")) { - $output = pkg_flag($atype, $ids, true); + $output = pkg_flag($atype, $ids); } elseif (current_action("do_UnFlag")) { - $output = pkg_flag($atype, $ids, False); + $output = pkg_unflag($atype, $ids); } elseif (current_action("do_Adopt")) { $output = pkg_adopt($atype, $ids, true); } elseif (current_action("do_Disown")) { diff --git a/web/lib/pkgfuncs.inc.php b/web/lib/pkgfuncs.inc.php index cfdd9a7..c00c33d 100644 --- a/web/lib/pkgfuncs.inc.php +++ b/web/lib/pkgfuncs.inc.php @@ -772,33 +772,24 @@ function sanitize_ids($ids) { } /** - * Flag and un-flag packages out-of-date + * Flag package(s) as out-of-date * * @global string $AUR_LOCATION The AUR's URL used for notification e-mails * @param string $atype Account type, output of account_from_sid * @param array $ids Array of package IDs to flag/unflag - * @param bool $action true flags out-of-date, false un-flags. Flags by default * * @return string Translated success or error messages */ -function pkg_flag ($atype, $ids, $action=true, $dbh=NULL) { +function pkg_flag($atype, $ids, $dbh=NULL) { global $AUR_LOCATION; if (!$atype) { - if ($action) { - return __("You must be logged in before you can flag packages."); - } else { - return __("You must be logged in before you can unflag packages."); - } + return __("You must be logged in before you can flag packages."); } $ids = sanitize_ids($ids); if (empty($ids)) { - if ($action) { - return __("You did not select any packages to flag."); - } else { - return __("You did not select any packages to unflag."); - } + return __("You did not select any packages to flag."); } if(!$dbh) { @@ -806,25 +797,13 @@ function pkg_flag ($atype, $ids, $action=true, $dbh=NULL) { } $q = "UPDATE Packages SET"; - if ($action) { - $q.= " OutOfDateTS = UNIX_TIMESTAMP()"; - } - else { - $q.= " OutOfDateTS = NULL"; - } + $q.= " OutOfDateTS = UNIX_TIMESTAMP()"; $q.= " WHERE ID IN (" . implode(",", $ids) . ")"; - - if (!$action && ($atype != "Trusted User" && $atype != "Developer")) { - $q.= "AND MaintainerUID = " . uid_from_sid($_COOKIE["AURSID"], $dbh); - } - - if ($action) { - $q.= " AND OutOfDateTS IS NULL"; - } + $q.= " AND OutOfDateTS IS NULL"; $affected_pkgs = $dbh->exec($q); - if ($action && $affected_pkgs > 0) { + if ($affected_pkgs > 0) { # Notify of flagging by email $f_name = username_from_sid($_COOKIE['AURSID'], $dbh); $f_email = email_from_sid($_COOKIE['AURSID'], $dbh); @@ -846,9 +825,42 @@ function pkg_flag ($atype, $ids, $action=true, $dbh=NULL) { } } - if ($action) { - return __("The selected packages have been flagged out-of-date."); - } else { + return __("The selected packages have been flagged out-of-date."); +} + +/** + * Unflag package(s) as out-of-date + * + * @param string $atype Account type, output of account_from_sid + * @param array $ids Array of package IDs to flag/unflag + * + * @return string Translated success or error messages + */ +function pkg_unflag($atype, $ids, $dbh=NULL) { + if (!$atype) { + return __("You must be logged in before you can unflag packages."); + } + + $ids = sanitize_ids($ids); + if (empty($ids)) { + return __("You did not select any packages to unflag."); + } + + if(!$dbh) { + $dbh = db_connect(); + } + + $q = "UPDATE Packages SET "; + $q.= "OutOfDateTS = NULL "; + $q.= "WHERE ID IN (" . implode(",", $ids) . ") "; + + if ($atype != "Trusted User" && $atype != "Developer") { + $q.= "AND MaintainerUID = " . uid_from_sid($_COOKIE["AURSID"], $dbh); + } + + $result = $dbh->exec($q); + + if ($result) { return __("The selected packages have been unflagged."); } } -- 1.8.0.1

1 0

[aur-dev] INSTALL: Added MYUSER (needed from root)
by Marcel Korpel 05 Dec '12

05 Dec '12

--- INSTALL | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/INSTALL b/INSTALL index 1a41066..a26dce9 100644 --- a/INSTALL +++ b/INSTALL @@ -63,17 +63,17 @@ Setup on Arch Linux: - Issue the following commands to the mysql client mysql> GRANT ALL PRIVILEGES ON AUR.* to aur@localhost - > identified by 'aur'; + -> identified by 'aur'; mysql> FLUSH PRIVILEGES; mysql> quit - Load the schema file - # mysql -uaur -p AUR < ~/aur/support/schema/aur-schema.sql + # mysql -uaur -p AUR < ~MYUSER/aur/support/schema/aur-schema.sql (give password 'aur' at the prompt) - Optionally load some test data for development purposes. - # pacman -S words mysql-python - # cd ~/aur/support/schema/ + # pacman -S words fortune-mod + # cd ~MYUSER/aur/support/schema/ # python gendummydata.py dummy-data.sql # bzip2 dummy-data.sql # bzcat dummy-data.sql.bz2 | mysql -uaur -p AUR @@ -85,7 +85,7 @@ Setup on Arch Linux: mysql> UPDATE Users SET Email = RAND() * RAND(); 7) Copy the config.inc.php.proto file to config.inc.php. Modify as needed. - # cd ~/aur/web/lib/ + # cd ~MYUSER/aur/web/lib/ # cp config.inc.php.proto config.inc.php 8) Point your browser to http://aur -- 1.8.0.1

2 2

[aur-dev] Subset of database for autocomplete
by Marcel Korpel 05 Dec '12

05 Dec '12

Hi developers, I'd like to implement a typeahead menu like it appears on the main page. In order to test my PHP script that feeds package names, I need a small subset of the AUR database (only the Packages table), say 1000 records. Can someone provide me such a subset? Thanks in advance. Regards, Marcel

3 4

[aur-dev] [PATCH] Fix account privilege escalation vulnerability
by canyonknight 30 Nov '12

30 Nov '12

A check is only done to verify a Trusted User isn't promoting their account. An attacker can send tampered account type POST data to change their "User" level account to a "Developer" account. Add check so that all users cannot increase their own account permissions. Signed-off-by: canyonknight <canyonknight(a)gmail.com> Signed-off-by: Lukas Fleischer <archlinux(a)cryptocrack.de> --- Already applied to maint branch and aur.archlinux.org setup. Anyone using a custom AUR setup should apply this patch. web/lib/acctfuncs.inc.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index 81e06b6..a41659e 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -145,8 +145,8 @@ function process_account_form($UTYPE,$TYPE,$A,$U="",$T="",$S="",$E="", $error = __("The PGP key fingerprint is invalid."); } - if ($UTYPE == "Trusted User" && $T == 3) { - $error = __("A Trusted User cannot assign Developer status."); + if (($UTYPE == "User" && $T > 1) || ($UTYPE == "Trusted User" && $T > 2)) { + $error = __("Cannot increase account permissions."); } if (!$error && !array_key_exists($L, $SUPPORTED_LANGS)) { $error = __("Language is not currently supported."); -- 1.8.0.1

1 0

[aur-dev] [PATCH] Fix account editing and hijacking vulnerability
by canyonknight 30 Nov '12

30 Nov '12

Checks are in place to avoid users getting account editing forms they shouldn't have access to. The appropriate checks before editing the account in the backend are not in place. This vulnerability allows a user to craft malicious POST data to edit other user accounts, thereby allowing account hijacking. Add a new flexible function can_edit_account() to determine if a user has appropriate permissions. Run the permission check before processing any account information in the backend. Signed-off-by: canyonknight <canyonknight(a)gmail.com> Signed-off-by: Lukas Fleischer <archlinux(a)cryptocrack.de> --- Already applied to maint branch and aur.archlinux.org setup. Anyone using a custom AUR setup should apply this patch. web/html/account.php | 11 ++++++++--- web/lib/acctfuncs.inc.php | 29 +++++++++++++++++++++++++++++ 2 files changed, 37 insertions(+), 3 deletions(-) diff --git a/web/html/account.php b/web/html/account.php index 786ae02..cccdd76 100644 --- a/web/html/account.php +++ b/web/html/account.php @@ -73,9 +73,14 @@ if (isset($_COOKIE["AURSID"])) { } } elseif ($action == "UpdateAccount") { - # user is submitting their modifications to an existing account - # - if (check_token()) { + $uid = uid_from_sid($_COOKIE['AURSID']); + + /* Details for account being updated */ + $acctinfo = account_details(in_request('ID'), in_request('U')); + + /* Verify user permissions and that the request is a valid POST */ + if (can_edit_account($atype, $acctinfo, $uid) && check_token()) { + /* Update the details for the existing account */ process_account_form($atype, "edit", "UpdateAccount", in_request("U"), in_request("T"), in_request("S"), in_request("E"), in_request("P"), in_request("C"), diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index 3fd23ae..81e06b6 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -1015,3 +1015,32 @@ function cast_proposal_vote($voteid, $uid, $vote, $newtotal, $dbh=NULL) { $q = "INSERT INTO TU_Votes (VoteID, UserID) VALUES (" . intval($voteid) . ", " . intval($uid) . ")"; $result = $dbh->exec($q); } + +/** + * Verify a user has the proper permissions to edit an account + * + * @param string $atype Account type of the editing user + * @param array $acctinfo User account information for edited account + * @param int $uid User ID of the editing user + * + * @return bool True if permission to edit the account, otherwise false + */ +function can_edit_account($atype, $acctinfo, $uid) { + /* Developers can edit any account */ + if ($atype == 'Developer') { + return true; + } + + /* Trusted Users can edit all accounts except Developer accounts */ + if ($atype == 'Trusted User' && + $acctinfo['AccountType'] != 'Developer') { + return true; + } + + /* Users can edit only their own account */ + if ($acctinfo['ID'] == $uid) { + return true; + } + + return false; +} -- 1.8.0.1

1 0

[aur-dev] [PATCH] login.php: Properly link to logout page when already logged in
by canyonknight 21 Nov '12

21 Nov '12

Signed-off-by: canyonknight <canyonknight(a)gmail.com> --- web/html/login.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/web/html/login.php b/web/html/login.php index 9b3715b..e458fec 100644 --- a/web/html/login.php +++ b/web/html/login.php @@ -17,7 +17,7 @@ html_header('AUR ' . __("Login")); <?php if (isset($_COOKIE["AURSID"])): ?> <p> <?= __("Logged-in as: %s", '<strong>' . username_from_sid($_COOKIE["AURSID"]) . '</strong>'); ?> - <a href="<?php get_uri('/logout/'); ?>">[<?= __("Logout"); ?>]</a> + <a href="<?= get_uri('/logout/'); ?>">[<?= __("Logout"); ?>]</a> </p> <?php elseif (!$DISABLE_HTTP_LOGIN || (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'])): ?> <form method="post" action="<?= get_uri('/login') ?>"> -- 1.8.0

1 0

[aur-dev] [PATCH] index.php: Move voter page token check to switch control structure
by canyonknight 21 Nov '12

21 Nov '12

Voter page token check takes place in the same way as other existing token checks. Move the check for consistency. Signed-off-by: canyonknight <canyonknight(a)gmail.com> --- web/html/index.php | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/web/html/index.php b/web/html/index.php index 3b46ab9..a197d0b 100644 --- a/web/html/index.php +++ b/web/html/index.php @@ -22,12 +22,6 @@ if (!empty($tokens[1]) && '/' . $tokens[1] == get_pkg_route()) { } if (!empty($tokens[3])) { - if ($tokens[3] == 'voters') { - $_GET['ID'] = pkgid_from_name($tokens[2]); - include('voters.php'); - return; - } - /* TODO: Remove support for legacy URIs and move these * actions to separate modules. */ switch ($tokens[3]) { @@ -55,6 +49,10 @@ if (!empty($tokens[1]) && '/' . $tokens[1] == get_pkg_route()) { case "merge": include('pkgmerge.php'); return; + case "voters": + $_GET['ID'] = pkgid_from_name($tokens[2]); + include('voters.php'); + return; default: header("HTTP/1.0 404 Not Found"); include "./404.php"; -- 1.8.0

1 0

[aur-dev] [PATCH] Fix default selection in the account edit page
by Lukas Fleischer 18 Nov '12

18 Nov '12

We used a mixture of account type IDs and account type descriptions in the account edit page. This resulted in the account type field always defaulting to "Normal user" after an invalid form had been submitted. Consistently use account type IDs to avoid this. Signed-off-by: Lukas Fleischer <archlinux(a)cryptocrack.de> --- web/html/account.php | 2 +- web/template/account_edit_form.php | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/web/html/account.php b/web/html/account.php index 786ae02..1192da6 100644 --- a/web/html/account.php +++ b/web/html/account.php @@ -54,7 +54,7 @@ if (isset($_COOKIE["AURSID"])) { $row["AccountType"] != "Developer") || ($row["ID"] == uid_from_sid($_COOKIE["AURSID"]))) { display_account_form($atype, "UpdateAccount", $row["Username"], - $row["AccountType"], $row["Suspended"], $row["Email"], + $row["AccountTypeID"], $row["Suspended"], $row["Email"], "", "", $row["RealName"], $row["LangPreference"], $row["IRCNick"], $row["PGPKey"], $row["ID"]); } else { diff --git a/web/template/account_edit_form.php b/web/template/account_edit_form.php index 6c39d53..a41b34c 100644 --- a/web/template/account_edit_form.php +++ b/web/template/account_edit_form.php @@ -22,12 +22,12 @@ <p> <label for="id_type"><?= __("Account Type") ?>:</label> <select name="T" id="id_type"> - <?php if ($T == "User"): ?> + <?php if ($T == 1): ?> <option value="1" selected="selected"><?= __("Normal user") ?></option> <?php else: ?> <option value="1"><?= __("Normal user") ?></option> <?php endif; ?> - <?php if ($T == "Trusted User"): ?> + <?php if ($T == 2): ?> <option value="2" selected="selected"><?= __("Trusted user") ?></option> <?php else: ?> <option value="2"><?= __("Trusted user") ?></option> @@ -37,7 +37,7 @@ if ($UTYPE == "Developer"): ?> <option value="3" - <?php $T == "Developer" ? print " selected=\"selected\">" : print ">"; + <?php $T == 3 ? print " selected=\"selected\">" : print ">"; print __("Developer")."\n"; ?> </option> <?php endif; ?> -- 1.8.0

1 0