- Aur-dev - lists.archlinux.org

[aur-dev] 1.9.1 string freeze
by Lukas Fleischer 01 Mar '12

01 Mar '12

I plan to release 1.9.1 around the end of next week. In addition to some minor fixes and security patches, this is supposed to bring in new and polished translations. No, this release won't bring the ever so longed for shiny layout. And no, we won't break API yet. All translators are encouraged to take a look at their translations on Transifex. It would also be great if someone could finish the translations that are 98%-99% done (German, Polish, Finish, Russian, Spanish). The deadline is 8 days from today. Cheers, Lukas

1 0

[aur-dev] [PATCH 1/2] Fix some more XSS vulnerabilities
by Lukas Fleischer 19 Feb '12

19 Feb '12

Escape strings properly using htmlspecialchars(). Seems like we missed these in former cleanups. Fixes FS#28515. Signed-off-by: Lukas Fleischer <archlinux(a)cryptocrack.de> --- Based on maint. This is applied to our production environment on sigurd. web/template/header.php | 2 +- web/template/pkg_details.php | 2 +- web/template/stats/updates_table.php | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/web/template/header.php b/web/template/header.php index 8313bb3..578fcb9 100644 --- a/web/template/header.php +++ b/web/template/header.php @@ -4,7 +4,7 @@ <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="<?php print "$LANG\" lang=\"$LANG"; ?>"> <head> - <title>AUR (<?php print $LANG; ?>)<?php if ($title != "") { print " - " . $title; } ?></title> + <title>AUR (<?php print htmlspecialchars($LANG); ?>)<?php if ($title != "") { print " - " . htmlspecialchars($title); } ?></title> <link rel='stylesheet' type='text/css' href='css/fonts.css' /> <link rel='stylesheet' type='text/css' href='css/containers.css' /> <link rel='stylesheet' type='text/css' href='css/arch.css' /> diff --git a/web/template/pkg_details.php b/web/template/pkg_details.php index 880a675..046f836 100644 --- a/web/template/pkg_details.php +++ b/web/template/pkg_details.php @@ -69,7 +69,7 @@ $out_of_date_time = ($row["OutOfDateTS"] == 0) ? $msg : gmdate("r", intval($row[ <p> <span class='f2'><?php echo htmlspecialchars($row['Name']) . ' ' . htmlspecialchars($row['Version']) ?></span><br /> - <span class='f3'><a href="<?php echo htmlspecialchars($row['URL'], ENT_QUOTES) . '">' . $row['URL'] ?></a></span><br /> + <span class='f3'><a href="<?php echo htmlspecialchars($row['URL'], ENT_QUOTES) . '">' . htmlspecialchars($row['URL']) ?></a></span><br /> <span class='f3'><?php echo htmlspecialchars($row['Description'], ENT_QUOTES); ?></span> </p> diff --git a/web/template/stats/updates_table.php b/web/template/stats/updates_table.php index a8cdf5a..8da6732 100644 --- a/web/template/stats/updates_table.php +++ b/web/template/stats/updates_table.php @@ -11,7 +11,7 @@ <td class="boxSoft"> <span class="f4"><span class="blue"> <a href="packages.php?ID=<?php print intval($row["ID"]); ?>"> -<?php print $row["Name"] . ' ' . $row["Version"]; ?> +<?php print htmlspecialchars($row["Name"]) . ' ' . htmlspecialchars($row["Version"]); ?> </a></span></span> </td> <td class="boxSoft"> -- 1.7.9.1

1 2

Re: [aur-dev] (no subject)
by Justin Davis 04 Jan '12

04 Jan '12

...Be sure! It�s really cool site! I promise! http://www.eletricapesada.com.br/new-year.link.php?ekid_friend=46q5 Happy new year! -- -Justin

1 0

[aur-dev] [PATCH 0/5] Package details view layout changes
by Lukas Fleischer 17 Dec '11

17 Dec '11

This patch set basically syncs the package details layout with what archweb uses and makes the rendered page, as well as the source code, look cleaner and more consistent. I plan to put more efforts in cleaning up our HTML and making the AUR integrate well with the rest of www.archlinux.org. We might eventually just use "archweb.css" with a few AUR-specific extensions. Any objections from the "Arch Linux/AUR segregation" front..? Dan, any objections? Lukas Fleischer (5): pkg_details.php: Use a table for package details pkg_details.php: Add link to category search pkg_details.php: Sync metadata layout with archweb pkg_details.php: Sync package actions layout with archweb pkg_details.php: Use sane format for date strings web/html/css/arch.css | 3 - web/html/css/containers.css | 81 +++++++++++++++ web/template/pkg_details.php | 226 +++++++++++++++++++++--------------------- 3 files changed, 196 insertions(+), 114 deletions(-) -- 1.7.7.2

2 9

[aur-dev] [PATCH] Set the title in the Trusted User page
by Andrea Scarpino 17 Dec '11

17 Dec '11

--- web/html/tu.php | 5 ++++- 1 files changed, 4 insertions(+), 1 deletions(-) diff --git a/web/html/tu.php b/web/html/tu.php index 6e202c8..6e04353 100644 --- a/web/html/tu.php +++ b/web/html/tu.php @@ -5,7 +5,10 @@ set_include_path(get_include_path() . PATH_SEPARATOR . '../lib'); include_once("aur.inc.php"); set_lang(); check_sid(); -html_header(); + +$title = __("Trusted User"); + +html_header($title); # Default votes per page $pp = 10; -- 1.7.8

2 1

[aur-dev] Select All in Package Listing
by Nick Lanham 02 Dec '11

02 Dec '11

There was some talk on the aur-general list about how it would be nice to have a select all option on the package listing page. This patch adds that. Note that I just dropped the javascript into a <script> tag as, as far as i can tell, there isn't any central location for js stuff. If that's a problem, I can move it elsewhere. Regards, Nick Lanham

2 2

[aur-dev] [PATCH] Remove maxlength on password fields
by Stein Magnus Jodal 02 Dec '11

02 Dec '11

>From c5798e0914075de8eba05ba57992ff23252bd491 Mon Sep 17 00:00:00 2001 From: Stein Magnus Jodal <stein.magnus(a)jodal.no> Date: Thu, 24 Nov 2011 22:51:05 +0100 Subject: [PATCH] Remove maxlength on password fields The password field for login had a maxlength of 128 chars, while the password fields for account creation and modification, and for password resetting, had a maxlength of 32 chars. After this change, they will all behave in the same way. Users with password managers will often use passwords longer than 32 characters, which was the previous maxlength when creating an account. Because of the password length, they will copy-paste the password into the browser. Most browsers does not notify the user that the text he pasted was cut of after a limit. If the login form also cuts of the password at the same length, the user will not notice anything until the site is changed to accept longer passwords, and his full password no longer matches the password the site has stored. In AUR's case, the login form accepted passwords of 128 characters length, so users trying to use longer passwords than 32 characters will notice the problem when first trying to log in. Setting a maximum length on input fields makes sense where the input is stored directly to a database where the database field got a limited length. In the case of password fields, limiting the length make little sense as the password is hashed before being stored. The hash function's output has constant length, irrespective of the length of the input. --- web/html/passreset.php | 4 ++-- web/lib/acctfuncs.inc.php | 4 ++-- web/lib/config.inc.php.proto | 1 - web/template/login_form.php | 2 +- 4 files changed, 5 insertions(+), 6 deletions(-) diff --git a/web/html/passreset.php b/web/html/passreset.php index 82be3ef..0792f72 100644 --- a/web/html/passreset.php +++ b/web/html/passreset.php @@ -109,11 +109,11 @@ html_header(__("Password Reset")); </tr> <tr> <td><?php echo __("Enter your new password:"); ?></td> - <td><input type="password" name="password" size="30" maxlength="32" /></td> + <td><input type="password" name="password" size="30" /></td> </tr> <tr> <td><?php echo __("Confirm your new password:"); ?></td> - <td><input type="password" name="confirm" size="30" maxlength="32" /></td> + <td><input type="password" name="confirm" size="30" /></td> </tr> </table> <br /> diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index 512e66c..b724580 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -84,7 +84,7 @@ function display_account_form($UTYPE,$A,$U="",$T="",$S="", print "<tr>"; print "<td align='left'>".__("Password").":</td>"; - print "<td align='left'><input type='password' size='30' maxlength='32'"; + print "<td align='left'><input type='password' size='30'"; print " name='P' value='".$P."' />"; if ($A != "UpdateAccount") { print " (".__("required").")"; @@ -93,7 +93,7 @@ function display_account_form($UTYPE,$A,$U="",$T="",$S="", print "<tr>"; print "<td align='left'>".__("Re-type password").":</td>"; - print "<td align='left'><input type='password' size='30' maxlength='32'"; + print "<td align='left'><input type='password' size='30'"; print " name='C' value='".$C."' />"; if ($A != "UpdateAccount") { print " (".__("required").")"; diff --git a/web/lib/config.inc.php.proto b/web/lib/config.inc.php.proto index 1f19651..aef2e34 100644 --- a/web/lib/config.inc.php.proto +++ b/web/lib/config.inc.php.proto @@ -15,7 +15,6 @@ define( "URL_DIR", "/packages/" ); define( "USERNAME_MIN_LEN", 3 ); define( "USERNAME_MAX_LEN", 16 ); define( "PASSWD_MIN_LEN", 4 ); -define( "PASSWD_MAX_LEN", 128 ); # Default language for displayed messages in the web interface. define("DEFAULT_LANG", "en"); diff --git a/web/template/login_form.php b/web/template/login_form.php index 21bdaa7..194083d 100644 --- a/web/template/login_form.php +++ b/web/template/login_form.php @@ -19,7 +19,7 @@ elseif (!$DISABLE_HTTP_LOGIN || (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'])) print htmlspecialchars($_POST['user'], ENT_QUOTES); } ?>" /> <label for="passwd"><?php print __('Password') . ':'; ?></label> - <input type="password" name="passwd" id="passwd" size="30" maxlength="<?php print PASSWD_MAX_LEN; ?>" /> + <input type="password" name="passwd" id="passwd" size="30" /> <input type="checkbox" name="remember_me" id="remember_me" /> <label for="remember_me"><?php print __("Remember me"); ?></label> <input type="submit" class="button" value="<?php print __("Login"); ?>" /> -- 1.7.5.4

3 7

Re: [aur-dev] replace categories with tags (was: New user, introduction and proposal)
by Connor Behan 18 Nov '11

18 Nov '11

I would standardize the list of tags in a combo box in the AUR and not just the wiki. Don't let random users create their own tags at all unless they ask on a mailing list. -- Sent from my Macbook Wheel <http://www.theonion.com/video/apple-introduces-revolutionary-new-laptop-wit…>

1 0

[aur-dev] Removed two of my dated packages & picking up an abandoned one.
by Jason 17 Nov '11

17 Nov '11

First time sending to this list, so apologies in advance for any mistakes/breaches in etiquette :) I posted some questions on the AUR section of the BBS and was informed I should send an email here: 1. I have two old packages I'd like to get removed from the AUR: gwclient32 & gwclient64. They were my first attempt at doing stuff in the AUR and I later made a single dual architecture PKGBUILD, which I'm still maintaining (gwclient). 2. I'd like to become the maintainer for citrix-client, and remove bin32-citrix-client entirely. I needed this for work and made a single PKDBUILD for both architectures, which I've attached here as a tarball (Though I haven't tested the 32 bit version, in fairness). Cheers, -- ~Jason

2 2

[aur-dev] New user introduction and proposal
by Joaquín Ignacio Aramendía 17 Nov '11

17 Nov '11

Hi there! I'd like to introduce myself first then add a request/proposal with a patch attached. I'm Joaquín from Argentina, I'm relatively new to Arch but in this time I've been reading and reading and really I like this community, I feel I'm learning every day. I don't think I could ever move away from Arch or any other Arch-based distribution, and I've been testing a few now. My proposal is not really big or even important (that why I'm submitting a one-line patch) but for me is a way to sort some things out. I've noticed in the AUR that there are a bunch of categories, not random or bad ones but kind of misleading in some ways. I don't even know if people actually uses those categories when searching for packages, but when someone submits a package of any sort, a category is required. That's great actually, I like to tag things because they are way easier to sort out and I could see some logic (please correct me if I'm wrong) on those categories related with the package purpose: There are categories related with some utilities, some related to system, libraries, even with individual desktops environments, games. But when it comes to art, there is only one category 'multimedia'. As that's maybe related to some artistic data, is more related to utilities to access or reproduce that data. Then when it comes to artistic "viewable" data, and I mean icon sets, wallpapers, splash-screens, there is no category that fits. For example: some icon theme is related to X11 but is not really an added functionality to it, maybe related to multimedia but is not an utility to reproduce videos, audio or pictures; it also could be attached to gnome, kde or lxde but is not as desktop specific. Same things happen to splash screens and wallpapers. They are Eyecandy for our beloved distribution. So I was thinking about editing the categories list to add 'eyecandy' as a way to enclose all icon-sets, splash-screens themes, {gtk,metacity,shell,whatever}-themes, wallpapers and so on. I hope I don't bother too much with this. So behold... the one line patch. -- Joaquín Ignacio Aramendía <samsagax(a)gmail.com>

2 2