- Aur-dev - lists.archlinux.org

[aur-dev] [PATCH] gendummydata.py: Remove extra letter from dummy pkgrel
by canyonknight 15 Nov '12

15 Nov '12

Signed-off-by: canyonknight <canyonknight(a)gmail.com> --- support/schema/gendummydata.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/support/schema/gendummydata.py b/support/schema/gendummydata.py index 160dde5..68f58b6 100755 --- a/support/schema/gendummydata.py +++ b/support/schema/gendummydata.py @@ -76,7 +76,7 @@ def genVersion(): ver.append("%d" % random.randrange(0,20)) if random.randrange(0,2) == 0: ver.append("%d" % random.randrange(0,100)) - return ".".join(ver) + "-u%d" % random.randrange(1,11) + return ".".join(ver) + "-%d" % random.randrange(1,11) def genCategory(): return random.randrange(1,CATEGORIES_COUNT) def genUID(): -- 1.8.0

2 1

[aur-dev] [PATCH] pkgfuncs.inc.php: Rework query to avoid "Required by" duplicates
by canyonknight 15 Nov '12

15 Nov '12

Packages with multiple DepConditions are returned multiple times in the "Required by" column. Limit SQL results to distinct packages. Fixes FS#32478 Signed-off-by: canyonknight <canyonknight(a)gmail.com> --- Ignore previous duplicates fix. This works better as an SQL fix. web/lib/pkgfuncs.inc.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/web/lib/pkgfuncs.inc.php b/web/lib/pkgfuncs.inc.php index 8f84cdf..cfdd9a7 100644 --- a/web/lib/pkgfuncs.inc.php +++ b/web/lib/pkgfuncs.inc.php @@ -169,7 +169,7 @@ function package_required($name="", $dbh=NULL) { if(!$dbh) { $dbh = db_connect(); } - $q = "SELECT p.Name, PackageID FROM PackageDepends pd "; + $q = "SELECT DISTINCT p.Name, PackageID FROM PackageDepends pd "; $q.= "JOIN Packages p ON pd.PackageID = p.ID "; $q.= "WHERE DepName = " . $dbh->quote($name) . " "; $q.= "ORDER BY p.Name"; -- 1.8.0

2 1

[aur-dev] AUR 2.0.1 released
by Lukas Fleischer 07 Nov '12

07 Nov '12

Changes since 2.0.0: * Do not lowercase language selection entries (fixes FS#32453). * Add missing internationalization to a few strings (fixes FS#32449). * Remove plural from the adopt/disown button (fixes FS#32455). * Show a warning when split packages are submitted. * Avoid double slashes in notifications (fixes FS#32460). * Add proper "double slash handling" (fixes FS#32460). * Fix a potential XSS for package names and dependencies. You can check the Git log [1] for a complete list of cimmits. The official Arch Linux AUR setup [2] has already been upgraded! [1] https://projects.archlinux.org/aur.git/log/?id=v2.0.1 [2] https://aur.archlinux.org/

1 0

[aur-dev] [PATCH] pkg_details.php: Fix potential XSS for package names and dep conditions
by Lukas Fleischer 07 Nov '12

07 Nov '12

From: canyonknight <canyonknight(a)gmail.com> Package names and dep conditions can be specially crafted for an XSS attack. Properly sanitize these variables on the package details page. In addition, avoid including dep conditions as part of a package link. Signed-off-by: canyonknight <canyonknight(a)gmail.com> Signed-off-by: Lukas Fleischer <archlinux(a)cryptocrack.de> --- web/template/pkg_details.php | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/web/template/pkg_details.php b/web/template/pkg_details.php index cdf2764..b5d8a9f 100644 --- a/web/template/pkg_details.php +++ b/web/template/pkg_details.php @@ -190,9 +190,9 @@ if ($row["MaintainerUID"]): # darr: (DepName, DepCondition, PackageID), where ID is NULL if it didn't exist if (!is_null($darr[2])): ?> - <li><a href="<?= htmlspecialchars(get_pkg_uri($darr[0]), ENT_QUOTES); ?>" title="<?= __('View packages details for').' '.$darr[0].$darr[1]?>"><?= $darr[0].$darr[1]?></a></li> + <li><a href="<?= htmlspecialchars(get_pkg_uri($darr[0]), ENT_QUOTES); ?>" title="<?= __('View packages details for').' '. htmlspecialchars($darr[0]) ?>"><?= htmlspecialchars($darr[0]) ?></a><?= htmlspecialchars($darr[1]) ?></li> <?php else: ?> - <li><a href="https://www.archlinux.org/packages/?q=<?= urlencode($darr[0])?>" title="<?= __('View packages details for').' '.$darr[0].$darr[1] ?>"><?= $darr[0].$darr[1] ?></a></li> + <li><a href="https://www.archlinux.org/packages/?q=<?= urlencode($darr[0])?>" title="<?= __('View packages details for').' ' . htmlspecialchars($darr[0]) ?>"><?= htmlspecialchars($darr[0]) ?></a><?= htmlspecialchars($darr[1]) ?></li> <?php endif; ?> <?php endwhile; ?> </ul> @@ -206,7 +206,7 @@ if ($row["MaintainerUID"]): # darr: (PackageName, PackageID) while (list($k, $darr) = each($requiredby)): ?> - <li><a href="<?= htmlspecialchars(get_pkg_uri($darr[0]), ENT_QUOTES); ?>" title="<?= __('View packages details for').' '.$darr[0]?>"><?= $darr[0] ?></a></li> + <li><a href="<?= htmlspecialchars(get_pkg_uri($darr[0]), ENT_QUOTES); ?>" title="<?= __('View packages details for').' ' . htmlspecialchars($darr[0]) ?>"><?= htmlspecialchars($darr[0]) ?></a></li> <?php endwhile; ?> </ul> <?php endif; ?> -- 1.8.0

1 0

[aur-dev] [PATCH] pkgfuncs.inc.php: Avoid printing duplicates in "Required by"
by canyonknight 05 Nov '12

05 Nov '12

Packages with multiple DepConditions are returned multiple times in the "Required by" column. Array is multi-dimensional so cannot have array_unique() run over it directly to remove duplicates. Serialize the array, remove duplicates, then unserialize the array. Fixes FS#32478 Signed-off-by: canyonknight <canyonknight(a)gmail.com> --- web/lib/pkgfuncs.inc.php | 2 ++ 1 file changed, 2 insertions(+) diff --git a/web/lib/pkgfuncs.inc.php b/web/lib/pkgfuncs.inc.php index 8f84cdf..4beaec3 100644 --- a/web/lib/pkgfuncs.inc.php +++ b/web/lib/pkgfuncs.inc.php @@ -178,6 +178,8 @@ function package_required($name="", $dbh=NULL) { while ($row = $result->fetch(PDO::FETCH_NUM)) { $deps[] = $row; } + + $deps = array_map('unserialize', array_unique(array_map('serialize', $deps))); } return $deps; } -- 1.8.0

1 0

[aur-dev] [BUG] Notification emails have broken URLs
by D. Can Celasun 05 Nov '12

05 Nov '12

Greetings, I've just received a mail like this: > Your package linux-mainline-dellxps has been flagged out of date by > *** [1]. You may view your package at: > https://aur.archlinux.org//packages/linux-mainline-dellxps/ > >[1] - https://aur.archlinux.org//account/***/ Notice the double slash after "org". Clicking the package link works fine, but making a POST request from that page (i.e commenting) redirects me to http://packages/linux-mainline-dellxps/ which obviously does not exist. Cheers, Can

2 1

[aur-dev] [PATCH 1/3] routing.inc.php: Return proper (non-virtual) URIs
by Lukas Fleischer 04 Nov '12

04 Nov '12

Make sure we always return root-relative URIs in get_pkg_uri() and in get_user_uri() and prepend a slash ("/") if the virtual URL feature is disabled. Signed-off-by: Lukas Fleischer <archlinux(a)cryptocrack.de> --- web/lib/routing.inc.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/web/lib/routing.inc.php b/web/lib/routing.inc.php index dfd6942..206886c 100644 --- a/web/lib/routing.inc.php +++ b/web/lib/routing.inc.php @@ -54,7 +54,7 @@ function get_pkg_uri($pkgname) { if ($USE_VIRTUAL_URLS) { return $PKG_PATH . '/' . urlencode($pkgname) . '/'; } else { - return get_route($PKG_PATH) . '?N=' . urlencode($pkgname); + return '/' . get_route($PKG_PATH) . '?N=' . urlencode($pkgname); } } @@ -70,6 +70,6 @@ function get_user_uri($username) { if ($USE_VIRTUAL_URLS) { return $USER_PATH . '/' . urlencode($username) . '/'; } else { - return get_route($USER_PATH) . '?U=' . urlencode($username); + return '/' . get_route($USER_PATH) . '?U=' . urlencode($username); } } -- 1.8.0

1 2

[aur-dev] [PATCH] pkgsubmit.php: Show a warning for split packages
by Lukas Fleischer 04 Nov '12

04 Nov '12

Display a special error message if the package is identified as split package. Currently, the AUR displays a very vague error message when a split package is submitted ("Invalid name: only lowercase letters are allowed"). This often caused confusion among package submitters, see FS#22834 and FS#32450. Signed-off-by: Lukas Fleischer <archlinux(a)cryptocrack.de> --- web/html/pkgsubmit.php | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/web/html/pkgsubmit.php b/web/html/pkgsubmit.php index 885c44f..5dd58af 100644 --- a/web/html/pkgsubmit.php +++ b/web/html/pkgsubmit.php @@ -269,6 +269,10 @@ if ($uid): } # Now we've parsed the pkgbuild, let's move it to where it belongs + if (!$error && $pkg_name[0] == '(') { + $error = __("Error - The AUR does not support split packages!"); + } + if (!$error) { $pkg_name = str_replace("'", "", $new_pkgbuild['pkgname']); $pkg_name = escapeshellarg($pkg_name); -- 1.8.0

1 0

[aur-dev] [PATCH 1/3] header.php: Do not lowercase language selection entries
by Lukas Fleischer 04 Nov '12

04 Nov '12

Commit 091c2b5f5523773604699b914c19e6b02ce290bc introduced lower casing to the language drop-down list. Revert this and use htmlspecialchars() to escape language entries instead. Addresses FS#32453. Signed-off-by: Lukas Fleischer <archlinux(a)cryptocrack.de> --- web/template/header.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/web/template/header.php b/web/template/header.php index a60174b..92cb2ff 100644 --- a/web/template/header.php +++ b/web/template/header.php @@ -37,9 +37,9 @@ reset($SUPPORTED_LANGS); foreach ($SUPPORTED_LANGS as $lang => $lang_name) { - print '<option value="' . strtolower($lang) . '"' . + print '<option value="' . htmlspecialchars($lang, ENT_QUOTES) . '"' . ($lang == $LANG ? ' selected="selected"' : '') . - '>' . strtolower($lang) . "</option>\n"; + '>' . htmlspecialchars($lang) . "</option>\n"; } ?> </select> -- 1.8.0

1 2

[aur-dev] [PATCH] UPGRADING: Remove reference to Archive_Tar
by Lukas Fleischer 04 Nov '12

04 Nov '12

The Archive_Tar PEAR module is no longer needed as of commit acdf9a85a0ff320f55d6eebb2ba7550fea61a5bb. Remove the associated upgrading instruction. Signed-off-by: Lukas Fleischer <archlinux(a)cryptocrack.de> --- UPGRADING | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/UPGRADING b/UPGRADING index dcf9169..bf486a7 100644 --- a/UPGRADING +++ b/UPGRADING @@ -13,13 +13,11 @@ ALTER TABLE Users ADD COLUMN PGPKey VARCHAR(40) NULL DEFAULT NULL; 2. Merge "web/lib/config.inc.php.proto" with "web/lib/config.inc.php". -3. Update Archive_Tar to version greater than 1.3.7. +3. Enable the PDO MySQL extension (pdo_mysql.so) in "php.ini". -4. Enable the PDO MySQL extension (pdo_mysql.so) in "php.ini". +4. Upgrade to PHP>=5.4.0 or enable "short_open_tag" in "php.ini". -5. Upgrade to PHP>=5.4.0 or enable "short_open_tag" in "php.ini". - -6. Install translations by running `make install` in "po/". +5. Install translations by running `make install` in "po/". From 1.9.0 to 1.9.1 ------------------- -- 1.8.0

1 0