- Aur-dev - lists.archlinux.org

[aur-dev] [PATCH] pkgsubmit: count actual subdirectories
by Dave Reisner 19 Mar '12

19 Mar '12

Rather than relying on a regex, detect directories in the uploaded tarball and count the slashes. This avoids problems with bsdtar inserting PaxHeader attributes into the archive which look something like the following to Archive_Tar: PaxHeader/xcursor-protozoa xcursor-protozoa/ xcursor-protozoa/PaxHeader/PKGBUILD xcursor-protozoa/PKGBUILD This only occurs on certain filesystems (e.g. jfs), but the tarball is by no means invalid. When extracted, it will only contain the PKGBUILD within a single subdirectory. Signed-off-by: Dave Reisner <dreisner(a)archlinux.org> --- web/html/pkgsubmit.php | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/web/html/pkgsubmit.php b/web/html/pkgsubmit.php index 75a4b69..5f5ba30 100644 --- a/web/html/pkgsubmit.php +++ b/web/html/pkgsubmit.php @@ -63,16 +63,13 @@ if ($uid): # Extract PKGBUILD into a string $pkgbuild_raw = ''; - $dircount = 0; foreach ($tar->listContent() as $tar_file) { if (preg_match('/^[^\/]+\/PKGBUILD$/', $tar_file['filename'])) { $pkgbuild_raw = $tar->extractInString($tar_file['filename']); } - elseif (preg_match('/^[^\/]+\/$/', $tar_file['filename'])) { - if (++$dircount > 1) { - $error = __("Error - source tarball may not contain more than one directory."); - break; - } + elseif ($tar_file['filetype'] == 5 && count(explode(',', $tar_file['filename'])) > 1) { + $error = __("Error - source tarball may not contain more than one directory."); + break; } elseif (preg_match('/^[^\/]+$/', $tar_file['filename'])) { $error = __("Error - source tarball may not contain files outside a directory."); -- 1.7.9.4

3 5

[aur-dev] [PATCH] [FS#28839] Query package details directly by name
by Dario Giovannetti 09 Mar '12

09 Mar '12

Currently package-detail pages are retrieved only with "packages.php?ID=#". I've attached two possible patches to bug report FS#28839 ( https://bugs.archlinux.org/task/28839 ) that could enable querying by package name: the first one just adds an elseif in packages.php, the second one rewrites an if block avoiding some duplication of code. PATCH_1: https://bugs.archlinux.org/task/28839?getfile=8371 PATCH_2: https://bugs.archlinux.org/task/28839?getfile=8372 A new GET variable is introduced, "NAME", and this way package details could be queried also with "packages.php?NAME=pkgname". If "NAME" conflicts with an existing variable, possible alternatives are "PNAME", "PKGNAME", "pkgname" and so on. Note that the patches use `urldecode($_GET['NAME'])`, so names should be obviously url-encoded in the string. This is already supported by https://wiki.archlinux.org/index.php/Template:AUR This request is the result of the discussion in https://wiki.archlinux.org/index.php/User_talk:Det#Templates%20vs%20links. Thank you, Dario

1 0

[aur-dev] AUR 1.9.1 released
by Lukas Fleischer 09 Mar '12

09 Mar '12

Important changes: * Fixes for minor SQL injection vulnerabilities * Fixes for several XSS vulnerabilities * Several minor bug fixes * Translation updates Check the Git log [1] for a complete list. The official Arch Linux AUR setup [2] has already been upgraded! [1] http://projects.archlinux.org/aur.git/log/?id=v1.9.1 [2] https://aur.archlinux.org/

1 0

[aur-dev] [PATCH] Always set the "To:" header when sending mail
by Lukas Fleischer 08 Mar '12

08 Mar '12

Use "undisclosed-recipients: ;" when sending mass notifications (such as comment notifications and the like. Addresses FS#28229. Signed-off-by: Lukas Fleischer <archlinux(a)cryptocrack.de> --- web/html/passreset.php | 4 ++-- web/lib/pkgfuncs.inc.php | 2 +- web/template/pkg_comment_form.php | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/web/html/passreset.php b/web/html/passreset.php index 82be3ef..98aa685 100644 --- a/web/html/passreset.php +++ b/web/html/passreset.php @@ -70,8 +70,8 @@ if (isset($_GET['resetkey'], $_POST['email'], $_POST['password'], $_POST['confir "{$AUR_LOCATION}/passreset.php?". "resetkey={$resetkey}"; $body = wordwrap($body, 70); - $headers = "To: {$email}\nReply-to: nobody@archlinux.org\nFrom:aur-notify@archlinux.org\nX-Mailer: PHP\nX-MimeOLE: Produced By AUR"; - @mail(' ', 'AUR Password Reset', $body, $headers); + $headers = "Reply-to: nobody@archlinux.org\nFrom:aur-notify@archlinux.org\nX-Mailer: PHP\nX-MimeOLE: Produced By AUR"; + @mail($email, 'AUR Password Reset', $body, $headers); } header('Location: passreset.php?step=confirm'); diff --git a/web/lib/pkgfuncs.inc.php b/web/lib/pkgfuncs.inc.php index 4204019..7b71ef4 100644 --- a/web/lib/pkgfuncs.inc.php +++ b/web/lib/pkgfuncs.inc.php @@ -745,7 +745,7 @@ function pkg_delete ($atype, $ids, $mergepkgid, $dbh=NULL) { $body = wordwrap($body, 70); $bcc = implode(', ', $bcc); $headers = "Bcc: $bcc\nReply-to: nobody(a)archlinux.org\nFrom: aur-notify(a)archlinux.org\nX-Mailer: AUR\n"; - @mail(' ', "AUR Package deleted: " . $pkgname, $body, $headers); + @mail('undisclosed-recipients: ;', "AUR Package deleted: " . $pkgname, $body, $headers); } } diff --git a/web/template/pkg_comment_form.php b/web/template/pkg_comment_form.php index a2bbf71..7606ce9 100644 --- a/web/template/pkg_comment_form.php +++ b/web/template/pkg_comment_form.php @@ -43,7 +43,7 @@ if (isset($_REQUEST['comment'])) { $body = wordwrap($body, 70); $bcc = implode(', ', $bcc); $headers = "Bcc: $bcc\nReply-to: nobody(a)archlinux.org\nFrom: aur-notify(a)archlinux.org\nX-Mailer: AUR\n"; - @mail(' ', "AUR Comment for " . $row['Name'], $body, $headers); + @mail('undisclosed-recipients: ;', "AUR Comment for " . $row['Name'], $body, $headers); } } -- 1.7.9.3

1 0

[aur-dev] 1.9.1 string freeze
by Lukas Fleischer 01 Mar '12

01 Mar '12

I plan to release 1.9.1 around the end of next week. In addition to some minor fixes and security patches, this is supposed to bring in new and polished translations. No, this release won't bring the ever so longed for shiny layout. And no, we won't break API yet. All translators are encouraged to take a look at their translations on Transifex. It would also be great if someone could finish the translations that are 98%-99% done (German, Polish, Finish, Russian, Spanish). The deadline is 8 days from today. Cheers, Lukas

1 0

[aur-dev] [PATCH 1/2] Fix some more XSS vulnerabilities
by Lukas Fleischer 19 Feb '12

19 Feb '12

Escape strings properly using htmlspecialchars(). Seems like we missed these in former cleanups. Fixes FS#28515. Signed-off-by: Lukas Fleischer <archlinux(a)cryptocrack.de> --- Based on maint. This is applied to our production environment on sigurd. web/template/header.php | 2 +- web/template/pkg_details.php | 2 +- web/template/stats/updates_table.php | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/web/template/header.php b/web/template/header.php index 8313bb3..578fcb9 100644 --- a/web/template/header.php +++ b/web/template/header.php @@ -4,7 +4,7 @@ <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="<?php print "$LANG\" lang=\"$LANG"; ?>"> <head> - <title>AUR (<?php print $LANG; ?>)<?php if ($title != "") { print " - " . $title; } ?></title> + <title>AUR (<?php print htmlspecialchars($LANG); ?>)<?php if ($title != "") { print " - " . htmlspecialchars($title); } ?></title> <link rel='stylesheet' type='text/css' href='css/fonts.css' /> <link rel='stylesheet' type='text/css' href='css/containers.css' /> <link rel='stylesheet' type='text/css' href='css/arch.css' /> diff --git a/web/template/pkg_details.php b/web/template/pkg_details.php index 880a675..046f836 100644 --- a/web/template/pkg_details.php +++ b/web/template/pkg_details.php @@ -69,7 +69,7 @@ $out_of_date_time = ($row["OutOfDateTS"] == 0) ? $msg : gmdate("r", intval($row[ <?php echo htmlspecialchars($row['Name']) . ' ' . htmlspecialchars($row['Version']) ?> - <a href="<?php echo htmlspecialchars($row['URL'], ENT_QUOTES) . '">' . $row['URL'] ?></a> + <a href="<?php echo htmlspecialchars($row['URL'], ENT_QUOTES) . '">' . htmlspecialchars($row['URL']) ?></a> <?php echo htmlspecialchars($row['Description'], ENT_QUOTES); ?> diff --git a/web/template/stats/updates_table.php b/web/template/stats/updates_table.php index a8cdf5a..8da6732 100644 --- a/web/template/stats/updates_table.php +++ b/web/template/stats/updates_table.php @@ -11,7 +11,7 @@ <td class="boxSoft"> <a href="packages.php?ID=<?php print intval($row["ID"]); ?>"> -<?php print $row["Name"] . ' ' . $row["Version"]; ?> +<?php print htmlspecialchars($row["Name"]) . ' ' . htmlspecialchars($row["Version"]); ?> </a> </td> <td class="boxSoft"> -- 1.7.9.1

1 2

Re: [aur-dev] (no subject)
by Justin Davis 04 Jan '12

04 Jan '12

...Be sure! It�s really cool site! I promise! http://www.eletricapesada.com.br/new-year.link.php?ekid_friend=46q5 Happy new year! -- -Justin

1 0

[aur-dev] [PATCH 0/5] Package details view layout changes
by Lukas Fleischer 17 Dec '11

17 Dec '11

This patch set basically syncs the package details layout with what archweb uses and makes the rendered page, as well as the source code, look cleaner and more consistent. I plan to put more efforts in cleaning up our HTML and making the AUR integrate well with the rest of www.archlinux.org. We might eventually just use "archweb.css" with a few AUR-specific extensions. Any objections from the "Arch Linux/AUR segregation" front..? Dan, any objections? Lukas Fleischer (5): pkg_details.php: Use a table for package details pkg_details.php: Add link to category search pkg_details.php: Sync metadata layout with archweb pkg_details.php: Sync package actions layout with archweb pkg_details.php: Use sane format for date strings web/html/css/arch.css | 3 - web/html/css/containers.css | 81 +++++++++++++++ web/template/pkg_details.php | 226 +++++++++++++++++++++--------------------- 3 files changed, 196 insertions(+), 114 deletions(-) -- 1.7.7.2

2 9

[aur-dev] [PATCH] Set the title in the Trusted User page
by Andrea Scarpino 17 Dec '11

17 Dec '11

--- web/html/tu.php | 5 ++++- 1 files changed, 4 insertions(+), 1 deletions(-) diff --git a/web/html/tu.php b/web/html/tu.php index 6e202c8..6e04353 100644 --- a/web/html/tu.php +++ b/web/html/tu.php @@ -5,7 +5,10 @@ set_include_path(get_include_path() . PATH_SEPARATOR . '../lib'); include_once("aur.inc.php"); set_lang(); check_sid(); -html_header(); + +$title = __("Trusted User"); + +html_header($title); # Default votes per page $pp = 10; -- 1.7.8

2 1

[aur-dev] Select All in Package Listing
by Nick Lanham 02 Dec '11

02 Dec '11

There was some talk on the aur-general list about how it would be nice to have a select all option on the package listing page. This patch adds that. Note that I just dropped the javascript into a <script> tag as, as far as i can tell, there isn't any central location for js stuff. If that's a problem, I can move it elsewhere. Regards, Nick Lanham

2 2