- Aur-dev - lists.archlinux.org

[aur-dev] [PATCH 1/2] Add a new AUR_LOCATION setting
by Dan McGee 24 Oct '11

24 Oct '11

This should be set to something like 'http://localhost' for development or 'https://aur.archlinux.org' in production. It ensures all links in the site stay in the development site and there is no sudden jump from development to production environments. Signed-off-by: Dan McGee <dan(a)archlinux.org> --- Resubmit v2- tested the pages, correct syntax on variable definition, and use 'global' keyword where appropriate. web/html/passreset.php | 2 +- web/lib/aur.inc.php | 1 + web/lib/config.inc.php.proto | 3 +++ web/lib/pkgfuncs.inc.php | 6 +++++- web/template/header.php | 2 +- web/template/login_form.php | 2 +- web/template/pkg_comment_form.php | 4 ++-- 7 files changed, 14 insertions(+), 6 deletions(-) diff --git a/web/html/passreset.php b/web/html/passreset.php index 01f3204..47d649d 100644 --- a/web/html/passreset.php +++ b/web/html/passreset.php @@ -67,7 +67,7 @@ if (isset($_GET['resetkey'], $_POST['email'], $_POST['password'], $_POST['confir 'your password follow the link below, otherwise ignore '. 'this message and nothing will happen.'). "\n\n". - 'https://aur.archlinux.org/passreset.php?'. + "{$AUR_LOCATION}/passreset.php?". "resetkey={$resetkey}"; $body = wordwrap($body, 70); $headers = "To: {$email}\nReply-to: nobody@archlinux.org\nFrom:aur-notify@archlinux.org\nX-Mailer: PHP\nX-MimeOLE: Produced By AUR"; diff --git a/web/lib/aur.inc.php b/web/lib/aur.inc.php index f432697..315092c 100644 --- a/web/lib/aur.inc.php +++ b/web/lib/aur.inc.php @@ -327,6 +327,7 @@ function html_header($title="") { global $LANG; global $SUPPORTED_LANGS; global $DISABLE_HTTP_LOGIN; + global $AUR_LOCATION; if (!$DISABLE_HTTP_LOGIN || (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'])) { $login = try_login(); diff --git a/web/lib/config.inc.php.proto b/web/lib/config.inc.php.proto index fbade86..3230815 100644 --- a/web/lib/config.inc.php.proto +++ b/web/lib/config.inc.php.proto @@ -77,3 +77,6 @@ $MAX_FILESIZE_UNCOMPRESSED = 1024 * 1024 * 8; # Allow HTTPs logins only $DISABLE_HTTP_LOGIN = true; + +# Web URL used in email links and absolute redirects, no trailing slash +$AUR_LOCATION = "http://localhost"; diff --git a/web/lib/pkgfuncs.inc.php b/web/lib/pkgfuncs.inc.php index 3e89fa3..f3e9134 100644 --- a/web/lib/pkgfuncs.inc.php +++ b/web/lib/pkgfuncs.inc.php @@ -301,6 +301,8 @@ function pkgname_is_blacklisted($name, $dbh=NULL) { # display package details # function package_details($id=0, $SID="", $dbh=NULL) { + global $AUR_LOCATION; + if(!$dbh) { $dbh = db_connect(); } @@ -620,6 +622,8 @@ function sanitize_ids($ids) { * @return string Translated success or error messages */ function pkg_flag ($atype, $ids, $action=true, $dbh=NULL) { + global $AUR_LOCATION; + if (!$atype) { if ($action) { return __("You must be logged in before you can flag packages."); @@ -666,7 +670,7 @@ function pkg_flag ($atype, $ids, $action=true, $dbh=NULL) { if (mysql_num_rows($result)) { while ($row = mysql_fetch_assoc($result)) { # construct email - $body = "Your package " . $row['Name'] . " has been flagged out of date by " . $f_name . " [1]. You may view your package at:\nhttps://aur.archlinux.org/packages.php?ID=" . $row['ID'] . "\n\n[1] - https://aur.archlinux.org/account.php?Action=AccountInfo&ID=" . $f_uid; + $body = "Your package " . $row['Name'] . " has been flagged out of date by " . $f_name . " [1]. You may view your package at:\n" . $AUR_LOCATION . "/packages.php?ID=" . $row['ID'] . "\n\n[1] - " . $AUR_LOCATION . "/account.php?Action=AccountInfo&ID=" . $f_uid; $body = wordwrap($body, 70); $headers = "Reply-to: nobody@archlinux.org\nFrom:aur-notify@archlinux.org\nX-Mailer: PHP\nX-MimeOLE: Produced By AUR\n"; @mail($row['Email'], "AUR Out-of-date Notification for ".$row['Name'], $body, $headers); diff --git a/web/template/header.php b/web/template/header.php index 8313bb3..73486b4 100644 --- a/web/template/header.php +++ b/web/template/header.php @@ -23,7 +23,7 @@ <li id="anb-forums"><a href="https://bbs.archlinux.org/" title="Community forums">Forums</a></li> <li id="anb-wiki"><a href="https://wiki.archlinux.org/" title="Community documentation">Wiki</a></li> <li id="anb-bugs"><a href="https://bugs.archlinux.org/" title="Report and track bugs">Bugs</a></li> - <li id="anb-aur"><a href="https://aur.archlinux.org/" title="Arch Linux User Repository">AUR</a></li> + <li id="anb-aur"><a href="/" title="Arch Linux User Repository">AUR</a></li> <li id="anb-download"><a href="http://www.archlinux.org/download/" title="Get Arch Linux">Download</a></li> </ul> </div> diff --git a/web/template/login_form.php b/web/template/login_form.php index c27e9ba..21bdaa7 100644 --- a/web/template/login_form.php +++ b/web/template/login_form.php @@ -32,7 +32,7 @@ else { ?> <span class='error'> <?php printf(__("HTTP login is disabled. Please %sswitch to HTTPs%s if you want to login."), - '<a href="https://aur.archlinux.org' . htmlspecialchars($_SERVER['REQUEST_URI'], ENT_QUOTES) . '">', '</a>'); ?> + '<a href="' . $AUR_LOCATION . htmlspecialchars($_SERVER['REQUEST_URI'], ENT_QUOTES) . '">', '</a>'); ?> </span> <?php } ?> </div> diff --git a/web/template/pkg_comment_form.php b/web/template/pkg_comment_form.php index e52c92d..c6ed69a 100644 --- a/web/template/pkg_comment_form.php +++ b/web/template/pkg_comment_form.php @@ -35,9 +35,9 @@ if (isset($_REQUEST['comment'])) { # Simply making these strings translatable won't work, users would be # getting emails in the language that the user who posted the comment was in $body = - 'from https://aur.archlinux.org/packages.php?ID=' + 'from ' . $AUR_LOCATION . '/packages.php?ID=' . $_REQUEST['ID'] . "\n" - . username_from_sid($_COOKIE['AURSID']) . " wrote:\n\n" + . username_from_sid($_COOKIE['AURSID'], $dbh) . " wrote:\n\n" . $_POST['comment'] . "\n\n---\nIf you no longer wish to receive notifications about this package, please go the the above package page and click the UnNotify button."; $body = wordwrap($body, 70); -- 1.7.7

2 2

[aur-dev] [PATCH] Added license search
by Alexander Rødseth 24 Oct '11

24 Oct '11

Signed-off-by: Alexander Rødseth <rodseth(a)gmail.com> --- web/lib/pkgfuncs.inc.php | 49 ++++++++++++++++++++++++++++++++++++++ web/template/pkg_search_form.php | 21 ++++++++++++++++ 2 files changed, 70 insertions(+), 0 deletions(-) diff --git a/web/lib/pkgfuncs.inc.php b/web/lib/pkgfuncs.inc.php index 3e89fa3..9a2074e 100644 --- a/web/lib/pkgfuncs.inc.php +++ b/web/lib/pkgfuncs.inc.php @@ -92,6 +92,40 @@ function pkgCategories($dbh=NULL) { return $cats; } +# grab the current list of distinct licenses +# +# "fromdb" is boolean and decides if the list of licenses +# should be fetched from the available licenses in the database +# or from a predefined list. Set to true or false here to make +# either one the default. Set to false if the database load is too high. +# +function package_licenses($dbh=NULL, $fromdb=true) { + $lics = array(); + if ($fromdb != false) { + if(!$dbh) { + $dbh = db_connect(); + } + $q = "SELECT DISTINCT License FROM Packages WHERE License != '' "; + $q.= "ORDER BY License ASC"; + $result = db_query($q, $dbh); + if ($result) { + while ($row = mysql_fetch_row($result)) { + $lics[] = $row[0]; + } + } + } else { + // All possible licenses from + // https://wiki.archlinux.org/index.php/PKGBUILD#license + $lics = array("AGPL", "AGPL3", "APACHE", "Apache", "Artistic2.0", + "BSD", "CCPL", "CDDL", "CPL", "custom", "EPL", "FDL", + "FDL1.2", "FDL1.3", "GPL", "GPL2", "GPL3", "LGPL", + "LGPL2.1", "LGPL3", "LPPL", "MIT", "MPL", "PHP", "PSF", + "PerlArtistic", "Python", "RUBY", "ZLIB", "ZPL"); + // sort($lics); + } + return $lics; +} + # check to see if the package name exists # function pkgid_from_name($name="", $dbh=NULL) { @@ -370,6 +404,9 @@ function package_details($id=0, $SID="", $dbh=NULL) { * s - package submitter's username * do_Orphans - boolean. whether to search packages * without a maintainer + * outdated - if the package is flagged: "on" or "off" + * license - the license ID, where 0 is "Any" + * license ID may change at any time * * * These two are actually handled in packages.php. @@ -396,6 +433,8 @@ function pkg_search_page($SID="", $dbh=NULL) { $myuid = uid_from_sid($SID, $dbh); // get a list of package categories $cats = pkgCategories($dbh); //meow + // get a list of licenses + $lics = package_licenses($dbh); // :-a // sanitize paging variables // @@ -494,6 +533,16 @@ function pkg_search_page($SID="", $dbh=NULL) { $q_where .= "AND OutOfDateTS IS NULL "; } } + + if (isset($_GET['license'])) { + // List ID ($lid) starts with 0 for "Any" and then enumerates the + // licenses from 1, which explains the "-1" below + $lid = intval($_GET["license"]); + if ($lid != 0) { + // Make the query select on licenses too + $q_where .= "AND Packages.License = '".$lics[$lid-1]."' "; + } + } $order = (isset($_GET["SO"]) && $_GET["SO"] == 'd') ? 'DESC' : 'ASC'; diff --git a/web/template/pkg_search_form.php b/web/template/pkg_search_form.php index 53d34fe..8c82859 100644 --- a/web/template/pkg_search_form.php +++ b/web/template/pkg_search_form.php @@ -119,6 +119,27 @@ ?> </select> </li> + <li> + <label><?php print __("License"); ?></label> + <select name='license'> + <option value='0'><?php print __("Any"); ?></option> + <?php + $lics = package_licenses(); + for($id = 0; $id < sizeof($lics); ++$id): + $lic = $lics[$id]; + // "Any" occupies slot 0 + $lid = $id+1; + if (isset($_REQUEST['license']) && $_REQUEST['license'] == $lid): + ?> + <option value="<?php print $lid ?>" selected="selected"><?php print $lic; ?></option> + <?php else: ?> + <option value="<?php print $lid ?>"><?php print $lic; ?></option> + <?php + endif; + endfor; + ?> + </select> + </li> </ul> </div> <?php endif; ?> -- 1.7.7

2 1

[aur-dev] [PATCH 1/6] Remove a boatload of inline table styles
by Dan McGee 24 Oct '11

24 Oct '11

Replacing with CSS styles where appropriate. A previously unused CSS style is tweaked in the stylesheet to match most of what was done via non-CSS styling. Signed-off-by: Dan McGee <dan(a)archlinux.org> --- Things look mostly the same on all these pages. However, there are a few exceptions- for example, the removal of the needless centering of the account search form. web/html/css/arch.css | 9 +++++---- web/html/index.php | 2 +- web/html/pkgsubmit.php | 2 +- web/lib/acctfuncs.inc.php | 14 ++++---------- web/template/pkg_search_results.php | 18 +++++++++--------- web/template/search_accounts_form.php | 2 +- web/template/tu_details.php | 12 ++++++------ web/template/tu_list.php | 16 ++++++++-------- 8 files changed, 35 insertions(+), 40 deletions(-) diff --git a/web/html/css/arch.css b/web/html/css/arch.css index eec02ee..1e588f1 100644 --- a/web/html/css/arch.css +++ b/web/html/css/arch.css @@ -244,13 +244,14 @@ table.center { } table.results { padding: 0px; + width: 100%; border-collapse: collapse; } .results th { - background-color: #e1e3e6; - border-bottom: 1px solid #46494d; - border-top: 1px solid #46494d; - padding: 0px 5px 0px 0px; + text-align: center; +} +.results th, .results td { + padding: 1px; } .results th>a { text-decoration: none; diff --git a/web/html/index.php b/web/html/index.php index 138541f..0d513d3 100644 --- a/web/html/index.php +++ b/web/html/index.php @@ -50,7 +50,7 @@ echo __( <br /> <?php echo __('Some packages may be provided as binaries in [community].'); ?> </p> -<table border='0' cellpadding='0' cellspacing='3' width='90%'> +<table> <tr> <td class='boxSoft' valign='top'> <?php updates_table($dbh); ?> diff --git a/web/html/pkgsubmit.php b/web/html/pkgsubmit.php index a5cc0c0..54c4b3e 100644 --- a/web/html/pkgsubmit.php +++ b/web/html/pkgsubmit.php @@ -437,7 +437,7 @@ html_header("Submit"); <form action='pkgsubmit.php' method='post' enctype='multipart/form-data'> <div> <input type='hidden' name='pkgsubmit' value='1' /> </div> - <table border='0' cellspacing='5'> + <table> <tr> <td class='f4' align='right'><?php print __("Package Category"); ?>:</td> <td class='f4' align='left'> diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index 59fa730..4c6da9f 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -35,7 +35,7 @@ function display_account_form($UTYPE,$A,$U="",$T="",$S="", print "<input type='hidden' name='ID' value='".$UID."' />\n"; } print "</fieldset>"; - print "<table border='0' cellpadding='0' cellspacing='0' width='80%' style=\"margin:0 auto;\">\n"; + print "<table>\n"; print "<tr><td colspan='2'> </td></tr>\n"; print "<tr>"; @@ -415,13 +415,7 @@ function search_results_page($UTYPE,$O=0,$SB="",$U="",$T="", } else { $num_rows = mysql_num_rows($result); if ($num_rows) { - print "<table border='0' cellpadding='0'"; - print " cellspacing='0' width='90%'"; - print " style=\"margin:0 auto\">\n"; - print "<tr>"; - print "<td colspan='2'>"; - print "<table border='0' cellpadding='0'"; - print " cellspacing='0' width='100%'>\n"; + print "<table class='results'>\n"; print "<tr>"; print "<th class='header'>"; print "<span class='f2'>".__("Username")."</span></th>"; @@ -483,8 +477,8 @@ function search_results_page($UTYPE,$O=0,$SB="",$U="",$T="", $i++; } print "</table>\n"; - print "</td></tr>\n"; + print "<table class='results'>\n"; print "<tr>"; print "<td align='left'>"; print "<form action='account.php' method='post'>\n"; @@ -540,7 +534,7 @@ function display_account_info($U="", $T="", $E="", $R="", $I="") { global $SUPPORTED_LANGS; - print "<table border='0' cellpadding='0' cellspacing='0' width='33%' style=\"margin:0 auto;\">\n"; + print "<table>\n"; print " <tr>\n"; print " <td colspan='2'> </td>\n"; print " </tr>\n"; diff --git a/web/template/pkg_search_results.php b/web/template/pkg_search_results.php index e576e6e..8ef352b 100644 --- a/web/template/pkg_search_results.php +++ b/web/template/pkg_search_results.php @@ -12,32 +12,32 @@ -<table width='100%' cellspacing='0' cellpadding='2'> +<table class='results'> <tr> <?php if ($SID): ?> - <th style='border-bottom: #666 1px solid; vertical-align: bottom'> </th> + <th class='header'> </th> <?php endif; ?> - <th style='border-bottom: #666 1px solid; vertical-align: bottom'><span class='f2'> + <th class='header'><span class='f2'> <a href='?<?php print mkurl('SB=c&SO=' . $SO_next) ?>'><?php print __("Category") ?></a> </span></th> - <th style='border-bottom: #666 1px solid; vertical-align: bottom; text-align: center;'><span class='f2'> + <th class='header'><span class='f2'> <a href='?<?php print mkurl('SB=n&SO=' . $SO_next) ?>'><?php print __("Name") ?></a> </span></th> - <th style='border-bottom: #666 1px solid; vertical-align: bottom'><span class='f2'> + <th class='header'><span class='f2'> <a href='?<?php print mkurl('SB=v&SO=' . $SO_next) ?>'><?php print __("Votes") ?></a> </span></th> <?php if ($SID): ?> - <th style='border-bottom: #666 1px solid; vertical-align: bottom'><span class='f2'> + <th class='header'><span class='f2'> <a href='?<?php print mkurl('SB=w&SO=' . $SO_next) ?>'><?php print __("Voted") ?></a> </span></th> - <th style='border-bottom: #666 1px solid; vertical-align: bottom'><span class='f2'> + <th class='header'><span class='f2'> <a href='?<?php print mkurl('SB=o&SO=' . $SO_next) ?>'><?php print __("Notify") ?></a> </span></th> <?php endif; ?> - <th style='border-bottom: #666 1px solid; vertical-align: bottom; text-align: center;'><span class='f2'><?php print __("Description") ?></span></th> - <th style='border-bottom: #666 1px solid; vertical-align: bottom'><span class='f2'> + <th class='header'><span class='f2'><?php print __("Description") ?></span></th> + <th class='header'><span class='f2'> <a href='?<?php print mkurl('SB=m&SO=' . $SO_next) ?>'><?php print __("Maintainer") ?></a> </span></th> </tr> diff --git a/web/template/search_accounts_form.php b/web/template/search_accounts_form.php index 9d6c40d..9b0d8e2 100644 --- a/web/template/search_accounts_form.php +++ b/web/template/search_accounts_form.php @@ -1,6 +1,6 @@ <br /> <form action='account.php' method='post'> - <table border='0' cellpadding='0' cellspacing='0' width='80%' style="margin:0 auto;"> + <table> <tr> <td align='left'><?php print __("Username"); ?>:</td> diff --git a/web/template/tu_details.php b/web/template/tu_details.php index 7d6c305..c48f603 100644 --- a/web/template/tu_details.php +++ b/web/template/tu_details.php @@ -24,13 +24,13 @@ N/A <?php print str_replace("\n", "<br />\n", htmlspecialchars($row['Agenda'])) ?> </p> -<table class="boxSoft" width='100%' cellspacing='0' cellpadding='2'> +<table class="boxSoft"> <tr> -<th style='border-bottom: #666 1px solid; vertical-align: bottom'><span class='f2'><?php print __("Yes") ?></span></th> -<th style='border-bottom: #666 1px solid; vertical-align: bottom'><span class='f2'><?php print __("No") ?></span></th> -<th style='border-bottom: #666 1px solid; vertical-align: bottom'><span class='f2'><?php print __("Abstain") ?></span></th> -<th style='border-bottom: #666 1px solid; vertical-align: bottom'><span class='f2'><?php print __("Total") ?></span></th> -<th style='border-bottom: #666 1px solid; vertical-align: bottom'><span class='f2'><?php print __('Voted') ?></span></th> +<th class='boxSoftTitle'><span class='f2'><?php print __("Yes") ?></span></th> +<th class='boxSoftTitle'><span class='f2'><?php print __("No") ?></span></th> +<th class='boxSoftTitle'><span class='f2'><?php print __("Abstain") ?></span></th> +<th class='boxSoftTitle'><span class='f2'><?php print __("Total") ?></span></th> +<th class='boxSoftTitle'><span class='f2'><?php print __('Voted') ?></span></th> </tr> <tr> <td class='data1'><span class='f5'><span class='blue'><?php print $row['Yes'] ?></span></span></td> diff --git a/web/template/tu_list.php b/web/template/tu_list.php index 75d9414..0966a4c 100644 --- a/web/template/tu_list.php +++ b/web/template/tu_list.php @@ -2,17 +2,17 @@ <div class="pgboxtitle" style="text-align:right;"> <span class='f3'><?php print $type ?></span> </div> - <table width='100%' cellspacing='0' cellpadding='2'> + <table class='results'> <tr> - <th style='border-bottom: #666 1px solid; vertical-align: bottom'><span class='f2'><?php print __("Proposal") ?></span></th> - <th style='border-bottom: #666 1px solid; vertical-align: bottom'><span class='f2'> + <th class='header'><span class='f2'><?php print __("Proposal") ?></span></th> + <th class='header'><span class='f2'> <a href='?off=<?php print $off ?>&by=<?php print $by_next ?>'><?php print __("Start") ?></a> </span></th> - <th style='border-bottom: #666 1px solid; vertical-align: bottom'><span class='f2'><?php print __("End") ?></span></th> - <th style='border-bottom: #666 1px solid; vertical-align: bottom'><span class='f2'><?php print __("User") ?></span></th> - <th style='border-bottom: #666 1px solid; vertical-align: bottom'><span class='f2'><?php print __("Yes") ?></span></th> - <th style='border-bottom: #666 1px solid; vertical-align: bottom'><span class='f2'><?php print __("No") ?></span></th> - <th style='border-bottom: #666 1px solid; vertical-align: bottom'><span class='f2'><?php print __('Voted') ?></span></th> + <th class='header'><span class='f2'><?php print __("End") ?></span></th> + <th class='header'><span class='f2'><?php print __("User") ?></span></th> + <th class='header'><span class='f2'><?php print __("Yes") ?></span></th> + <th class='header'><span class='f2'><?php print __("No") ?></span></th> + <th class='header'><span class='f2'><?php print __('Voted') ?></span></th> </tr> <?php if (mysql_num_rows($result) == 0) { ?> <tr><td align='center' colspan='0'><?php print __("No results found.") ?></td></tr> -- 1.7.6

3 10

[aur-dev] [PATCH 1/6] Move web/README to README
by Dan McGee 21 Oct '11

21 Oct '11

The existing README file at the root level is not at all helpful to the end user of this repository as it is an old document describing the origins of the AUR, rather than a helpful "how to get this running" text file. Move web/README to README so it is obvious where to find said instructions. Signed-off-by: Dan McGee <dan(a)archlinux.org> --- This is a resubmit of all the patches I have queued that had no feedback last time I submitted them (or haven't been submitted but seem pretty low-impact, like this one). Nothing messing with db_connect() on the package details page, index, etc. is included here as those need changes, but should not be holding up merging of this stuff if there are no other problems. For this patch: I used `-M -B -C` options to generate this patch, thus the lack of diff, but it does exactly what the commit message says. web/README => README | 0 1 files changed, 0 insertions(+), 0 deletions(-) rename web/README => README (100%) diff --git a/web/README b/README similarity index 100% rename from web/README rename to README -- 1.7.7

1 5

[aur-dev] [PATCH 1/2] aurblup: remove use of alpm_list_getdata()
by Dan McGee 21 Oct '11

21 Oct '11

This is not strictly necessry as listitem->data is public. Signed-off-by: Dan McGee <dan(a)archlinux.org> --- scripts/aurblup/aurblup.c | 14 +++++++------- 1 files changed, 7 insertions(+), 7 deletions(-) diff --git a/scripts/aurblup/aurblup.c b/scripts/aurblup/aurblup.c index 2180860..4fc5951 100644 --- a/scripts/aurblup/aurblup.c +++ b/scripts/aurblup/aurblup.c @@ -130,10 +130,10 @@ blacklist_sync(alpm_list_t *pkgs_cur, alpm_list_t *pkgs_new) mysql_die("failed to start MySQL transaction: %s\n"); for (p = pkgs_add; p; p = alpm_list_next(p)) - blacklist_add(alpm_list_getdata(p)); + blacklist_add(p->data); for (p = pkgs_rem; p; p = alpm_list_next(p)) - blacklist_remove(alpm_list_getdata(p)); + blacklist_remove(p->data); if (mysql_query(c, "COMMIT")) mysql_die("failed to commit MySQL transaction: %s\n"); @@ -149,7 +149,7 @@ dblist_get_pkglist(alpm_list_t *dblist) alpm_list_t *pkglist = NULL; for (d = dblist; d; d = alpm_list_next(d)) { - pmdb_t *db = alpm_list_getdata(d); + pmdb_t *db = d->data; if (alpm_trans_init(0, NULL, NULL, NULL)) alpm_die("failed to initialize ALPM transaction: %s\n"); @@ -159,15 +159,15 @@ dblist_get_pkglist(alpm_list_t *dblist) alpm_die("failed to release ALPM transaction: %s\n"); for (p = alpm_db_get_pkgcache(db); p; p = alpm_list_next(p)) { - pmpkg_t *pkg = alpm_list_getdata(p); + pmpkg_t *pkg = p->data; pkglist = pkglist_append(pkglist, alpm_pkg_get_name(pkg)); for (q = alpm_pkg_get_provides(pkg); q; q = alpm_list_next(q)) - pkglist = pkglist_append(pkglist, alpm_list_getdata(q)); + pkglist = pkglist_append(pkglist, q->data); for (q = alpm_pkg_get_replaces(pkg); q; q = alpm_list_next(q)) - pkglist = pkglist_append(pkglist, alpm_list_getdata(q)); + pkglist = pkglist_append(pkglist, q->data); } } @@ -190,7 +190,7 @@ dblist_create(void) alpm_die("failed to get sync DBs: %s\n"); for (d = dblist; d; d = alpm_list_next(d)) { - pmdb_t *db = alpm_list_getdata(d); + pmdb_t *db = d->data; char server[1024]; snprintf(server, 1024, ALPM_MIRROR, alpm_db_get_name(db)); -- 1.7.7

1 1

[aur-dev] [PATCH 1/2] aurblup: remove ';' from queries
by Dan McGee 21 Oct '11

21 Oct '11

The semicolons are not necessary when performing queries via the MySQL API, so remove them. Signed-off-by: Dan McGee <dan(a)archlinux.org> --- scripts/aurblup/aurblup.c | 10 +++++----- 1 files changed, 5 insertions(+), 5 deletions(-) diff --git a/scripts/aurblup/aurblup.c b/scripts/aurblup/aurblup.c index 6a67d68..e01f053 100644 --- a/scripts/aurblup/aurblup.c +++ b/scripts/aurblup/aurblup.c @@ -74,7 +74,7 @@ blacklist_get_pkglist() MYSQL_ROW row; alpm_list_t *pkglist = NULL; - if (mysql_query(c, "SELECT Name FROM PackageBlacklist;")) + if (mysql_query(c, "SELECT Name FROM PackageBlacklist")) mysql_die("failed to read blacklist from MySQL database: %s\n"); if (!(res = mysql_store_result(c))) @@ -96,7 +96,7 @@ blacklist_add(const char *name) mysql_real_escape_string(c, esc, name, strlen(name)); snprintf(query, 1024, "INSERT INTO PackageBlacklist (Name) " - "VALUES ('%s');", esc); + "VALUES ('%s')", esc); free(esc); if (mysql_query(c, query)) @@ -110,7 +110,7 @@ blacklist_remove(const char *name) char query[1024]; mysql_real_escape_string(c, esc, name, strlen(name)); - snprintf(query, 1024, "DELETE FROM PackageBlacklist WHERE Name = '%s';", esc); + snprintf(query, 1024, "DELETE FROM PackageBlacklist WHERE Name = '%s'", esc); free(esc); if (mysql_query(c, query)) @@ -125,7 +125,7 @@ blacklist_sync(alpm_list_t *pkgs_cur, alpm_list_t *pkgs_new) pkgs_add = alpm_list_diff(pkgs_new, pkgs_cur, (alpm_list_fn_cmp)strcmp); pkgs_rem = alpm_list_diff(pkgs_cur, pkgs_new, (alpm_list_fn_cmp)strcmp); - if (mysql_query(c, "START TRANSACTION;")) + if (mysql_query(c, "START TRANSACTION")) mysql_die("failed to start MySQL transaction: %s\n"); for (p = pkgs_add; p; p = alpm_list_next(p)) @@ -134,7 +134,7 @@ blacklist_sync(alpm_list_t *pkgs_cur, alpm_list_t *pkgs_new) for (p = pkgs_rem; p; p = alpm_list_next(p)) blacklist_remove(alpm_list_getdata(p)); - if (mysql_query(c, "COMMIT;")) + if (mysql_query(c, "COMMIT")) mysql_die("failed to commit MySQL transaction: %s\n"); alpm_list_free(pkgs_add); -- 1.7.7

1 1

[aur-dev] [PATCH] Move SUPPORTED_LANGS out of config.inc.php
by Dan McGee 20 Oct '11

20 Oct '11

This has no real business being here, and is a pain to update when new languages are shipped. Move it to aur.inc.php instead so it doesn't overwhelm the user-configurable settings file with static stuff. Signed-off-by: Dan McGee <dan(a)archlinux.org> --- web/lib/aur.inc.php | 28 ++++++++++++++++++++++++++++ web/lib/config.inc.php.proto | 28 ---------------------------- 2 files changed, 28 insertions(+), 28 deletions(-) diff --git a/web/lib/aur.inc.php b/web/lib/aur.inc.php index f432697..e784794 100644 --- a/web/lib/aur.inc.php +++ b/web/lib/aur.inc.php @@ -15,6 +15,34 @@ include_once("version.inc.php"); include_once("acctfuncs.inc.php"); include_once("cachefuncs.inc.php"); +# Languages we have translations for +$SUPPORTED_LANGS = array( + "ca" => "Català", + "cs" => "česky", + "da" => "Dansk", + "de" => "Deutsch", + "en" => "English", + "el" => "Ελληνικά", + "es" => "Español", + "fi" => "Finnish", + "fr" => "Français", + "he" => "עברית", + "hr" => "Hrvatski", + "hu" => "Magyar", + "it" => "Italiano", + "nb_NO" => "Norsk", + "nl" => "Dutch", + "pl" => "Polski", + "pt" => "Português", + "pt_BR" => "Português (Brasil)", + "ro" => "Română", + "ru" => "Русский", + "sr" => "Srpski", + "tr" => "Türkçe", + "uk" => "Українська", + "zh_CN" => "简体中文" +); + # see if the visitor is already logged in # function check_sid($dbh=NULL) { diff --git a/web/lib/config.inc.php.proto b/web/lib/config.inc.php.proto index 61c37f0..ef5918d 100644 --- a/web/lib/config.inc.php.proto +++ b/web/lib/config.inc.php.proto @@ -33,34 +33,6 @@ define("SQL_DEBUG", 0); # to '127.0.0.1:11211'. #define("MEMCACHE_SERVERS", '127.0.0.1:11211'); -# Languages we have translations for -$SUPPORTED_LANGS = array( - "ca" => "Català", - "cs" => "česky", - "da" => "Dansk", - "de" => "Deutsch", - "en" => "English", - "el" => "Ελληνικά", - "es" => "Español", - "fi" => "Finnish", - "fr" => "Français", - "he" => "עברית", - "hr" => "Hrvatski", - "hu" => "Magyar", - "it" => "Italiano", - "nb_NO" => "Norsk", - "nl" => "Dutch", - "pl" => "Polski", - "pt" => "Português", - "pt_BR" => "Português (Brasil)", - "ro" => "Română", - "ru" => "Русский", - "sr" => "Srpski", - "tr" => "Türkçe", - "uk" => "Українська", - "zh_CN" => "简体中文" -); - # Session limit per user $MAX_SESSIONS_PER_USER = 8; -- 1.7.7

3 3

[aur-dev] [PATCH] Add a new AUR_LOCATION setting
by Dan McGee 20 Oct '11

20 Oct '11

This should be set to something like 'http://localhost' for development or 'https://aur.archlinux.org' in production. It ensures all links in the site stay in the development site and there is no sudden jump from development to production environments. Signed-off-by: Dan McGee <dan(a)archlinux.org> --- web/html/passreset.php | 2 +- web/lib/config.inc.php.proto | 3 +++ web/lib/pkgfuncs.inc.php | 2 +- web/template/header.php | 2 +- web/template/login_form.php | 2 +- web/template/pkg_comment_form.php | 4 ++-- 6 files changed, 9 insertions(+), 6 deletions(-) diff --git a/web/html/passreset.php b/web/html/passreset.php index 01f3204..47d649d 100644 --- a/web/html/passreset.php +++ b/web/html/passreset.php @@ -67,7 +67,7 @@ if (isset($_GET['resetkey'], $_POST['email'], $_POST['password'], $_POST['confir 'your password follow the link below, otherwise ignore '. 'this message and nothing will happen.'). "\n\n". - 'https://aur.archlinux.org/passreset.php?'. + "{$AUR_LOCATION}/passreset.php?". "resetkey={$resetkey}"; $body = wordwrap($body, 70); $headers = "To: {$email}\nReply-to: nobody@archlinux.org\nFrom:aur-notify@archlinux.org\nX-Mailer: PHP\nX-MimeOLE: Produced By AUR"; diff --git a/web/lib/config.inc.php.proto b/web/lib/config.inc.php.proto index fbade86..61c37f0 100644 --- a/web/lib/config.inc.php.proto +++ b/web/lib/config.inc.php.proto @@ -77,3 +77,6 @@ $MAX_FILESIZE_UNCOMPRESSED = 1024 * 1024 * 8; # Allow HTTPs logins only $DISABLE_HTTP_LOGIN = true; + +# Web URL used in email links and absolute redirects, no trailing slash +AUR_LOCATION = "http://localhost" diff --git a/web/lib/pkgfuncs.inc.php b/web/lib/pkgfuncs.inc.php index 3e89fa3..6c990ea 100644 --- a/web/lib/pkgfuncs.inc.php +++ b/web/lib/pkgfuncs.inc.php @@ -666,7 +666,7 @@ function pkg_flag ($atype, $ids, $action=true, $dbh=NULL) { if (mysql_num_rows($result)) { while ($row = mysql_fetch_assoc($result)) { # construct email - $body = "Your package " . $row['Name'] . " has been flagged out of date by " . $f_name . " [1]. You may view your package at:\nhttps://aur.archlinux.org/packages.php?ID=" . $row['ID'] . "\n\n[1] - https://aur.archlinux.org/account.php?Action=AccountInfo&ID=" . $f_uid; + $body = "Your package " . $row['Name'] . " has been flagged out of date by " . $f_name . " [1]. You may view your package at:\n" . $AUR_LOCATION . "/packages.php?ID=" . $row['ID'] . "\n\n[1] - " . $AUR_LOCATION . "/account.php?Action=AccountInfo&ID=" . $f_uid; $body = wordwrap($body, 70); $headers = "Reply-to: nobody@archlinux.org\nFrom:aur-notify@archlinux.org\nX-Mailer: PHP\nX-MimeOLE: Produced By AUR\n"; @mail($row['Email'], "AUR Out-of-date Notification for ".$row['Name'], $body, $headers); diff --git a/web/template/header.php b/web/template/header.php index 8313bb3..73486b4 100644 --- a/web/template/header.php +++ b/web/template/header.php @@ -23,7 +23,7 @@ <li id="anb-forums"><a href="https://bbs.archlinux.org/" title="Community forums">Forums</a></li> <li id="anb-wiki"><a href="https://wiki.archlinux.org/" title="Community documentation">Wiki</a></li> <li id="anb-bugs"><a href="https://bugs.archlinux.org/" title="Report and track bugs">Bugs</a></li> - <li id="anb-aur"><a href="https://aur.archlinux.org/" title="Arch Linux User Repository">AUR</a></li> + <li id="anb-aur"><a href="/" title="Arch Linux User Repository">AUR</a></li> <li id="anb-download"><a href="http://www.archlinux.org/download/" title="Get Arch Linux">Download</a></li> </ul> </div> diff --git a/web/template/login_form.php b/web/template/login_form.php index c27e9ba..21bdaa7 100644 --- a/web/template/login_form.php +++ b/web/template/login_form.php @@ -32,7 +32,7 @@ else { ?> <span class='error'> <?php printf(__("HTTP login is disabled. Please %sswitch to HTTPs%s if you want to login."), - '<a href="https://aur.archlinux.org' . htmlspecialchars($_SERVER['REQUEST_URI'], ENT_QUOTES) . '">', '</a>'); ?> + '<a href="' . $AUR_LOCATION . htmlspecialchars($_SERVER['REQUEST_URI'], ENT_QUOTES) . '">', '</a>'); ?> </span> <?php } ?> </div> diff --git a/web/template/pkg_comment_form.php b/web/template/pkg_comment_form.php index e52c92d..c6ed69a 100644 --- a/web/template/pkg_comment_form.php +++ b/web/template/pkg_comment_form.php @@ -35,9 +35,9 @@ if (isset($_REQUEST['comment'])) { # Simply making these strings translatable won't work, users would be # getting emails in the language that the user who posted the comment was in $body = - 'from https://aur.archlinux.org/packages.php?ID=' + 'from ' . $AUR_LOCATION . '/packages.php?ID=' . $_REQUEST['ID'] . "\n" - . username_from_sid($_COOKIE['AURSID']) . " wrote:\n\n" + . username_from_sid($_COOKIE['AURSID'], $dbh) . " wrote:\n\n" . $_POST['comment'] . "\n\n---\nIf you no longer wish to receive notifications about this package, please go the the above package page and click the UnNotify button."; $body = wordwrap($body, 70); -- 1.7.7

2 2

[aur-dev] [PATCH] Remove explicit utf8 declarations in table creation
by Dan McGee 20 Oct '11

20 Oct '11

The create database statement sets the default character set of the database to UTF-8, so no need to do it down below. Signed-off-by: Dan McGee <dan(a)archlinux.org> --- support/schema/aur-schema.sql | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/support/schema/aur-schema.sql b/support/schema/aur-schema.sql index 88d074e..544ed94 100644 --- a/support/schema/aur-schema.sql +++ b/support/schema/aur-schema.sql @@ -190,8 +190,8 @@ CREATE TABLE PackageBlacklist ( -- CREATE TABLE IF NOT EXISTS TU_VoteInfo ( ID int(10) unsigned NOT NULL auto_increment, - Agenda text COLLATE utf8_general_ci NOT NULL, - User VARCHAR(32) COLLATE utf8_general_ci NOT NULL, + Agenda text NOT NULL, + User VARCHAR(32) NOT NULL, Submitted bigint(20) unsigned NOT NULL, End bigint(20) unsigned NOT NULL, SubmitterID int(10) unsigned NOT NULL, -- 1.7.6

1 1

[aur-dev] [PATCH 1/2] Wrap mysql_real_escape_string() in a function
by Lukas Fleischer 20 Oct '11

20 Oct '11

Wrap mysql_real_escape_string() in a wrapper function db_escape_string() to ease porting to other databases, and as another step to pulling more of the database code into a central location. This is a rebased version of a patch by elij submitted about half a year ago. Thanks-to: elij <elij.mx(a)gmail.com> Signed-off-by: Lukas Fleischer <archlinux(a)cryptocrack.de> --- web/html/account.php | 2 +- web/html/addvote.php | 10 +++++----- web/html/logout.php | 2 +- web/html/passreset.php | 4 ++-- web/html/pkgsubmit.php | 28 ++++++++++++++-------------- web/html/voters.php | 2 +- web/lib/acctfuncs.inc.php | 26 +++++++++++++------------- web/lib/aur.inc.php | 30 ++++++++++++++++++------------ web/lib/aurjson.class.php | 8 ++++---- web/lib/pkgfuncs.inc.php | 12 ++++++------ web/lib/stats.inc.php | 2 +- web/template/pkg_comment_form.php | 2 +- 12 files changed, 67 insertions(+), 61 deletions(-) diff --git a/web/html/account.php b/web/html/account.php index ca05d1a..387fd93 100644 --- a/web/html/account.php +++ b/web/html/account.php @@ -111,7 +111,7 @@ if (isset($_COOKIE["AURSID"])) { $q.= "WHERE AccountTypes.ID = Users.AccountTypeID "; $q.= "AND Users.ID = Sessions.UsersID "; $q.= "AND Sessions.SessionID = '"; - $q.= mysql_real_escape_string($_COOKIE["AURSID"])."'"; + $q.= db_escape_string($_COOKIE["AURSID"])."'"; $result = db_query($q, $dbh); if (!mysql_num_rows($result)) { print __("Could not retrieve information for the specified user."); diff --git a/web/html/addvote.php b/web/html/addvote.php index fe3037d..f0e7d31 100644 --- a/web/html/addvote.php +++ b/web/html/addvote.php @@ -20,7 +20,7 @@ if ($atype == "Trusted User" OR $atype == "Developer") { $error = ""; if (!empty($_POST['user'])) { - $qcheck = "SELECT * FROM Users WHERE Username = '" . mysql_real_escape_string($_POST['user']) . "'"; + $qcheck = "SELECT * FROM Users WHERE Username = '" . db_escape_string($_POST['user']) . "'"; $result = db_query($qcheck, $dbh); if ($result) { $check = mysql_num_rows($result); @@ -32,7 +32,7 @@ if ($atype == "Trusted User" OR $atype == "Developer") { if ($check == 0) { $error.= __("Username does not exist."); } else { - $qcheck = "SELECT * FROM TU_VoteInfo WHERE User = '" . mysql_real_escape_string($_POST['user']) . "'"; + $qcheck = "SELECT * FROM TU_VoteInfo WHERE User = '" . db_escape_string($_POST['user']) . "'"; $qcheck.= " AND End > UNIX_TIMESTAMP()"; $result = db_query($qcheck, $dbh); if ($result) { @@ -67,9 +67,9 @@ if ($atype == "Trusted User" OR $atype == "Developer") { if (!empty($_POST['addVote']) && empty($error)) { $q = "INSERT INTO TU_VoteInfo (Agenda, User, Submitted, End, SubmitterID) VALUES "; - $q.= "('" . mysql_real_escape_string($_POST['agenda']) . "', "; - $q.= "'" . mysql_real_escape_string($_POST['user']) . "', "; - $q.= "UNIX_TIMESTAMP(), UNIX_TIMESTAMP() + " . mysql_real_escape_string($len); + $q.= "('" . db_escape_string($_POST['agenda']) . "', "; + $q.= "'" . db_escape_string($_POST['user']) . "', "; + $q.= "UNIX_TIMESTAMP(), UNIX_TIMESTAMP() + " . db_escape_string($len); $q.= ", " . uid_from_sid($_COOKIE["AURSID"]) . ")"; db_query($q, $dbh); diff --git a/web/html/logout.php b/web/html/logout.php index 1cdf453..45ab564 100644 --- a/web/html/logout.php +++ b/web/html/logout.php @@ -12,7 +12,7 @@ include_once("acctfuncs.inc.php"); # access AUR common functions if (isset($_COOKIE["AURSID"])) { $dbh = db_connect(); $q = "DELETE FROM Sessions WHERE SessionID = '"; - $q.= mysql_real_escape_string($_COOKIE["AURSID"]) . "'"; + $q.= db_escape_string($_COOKIE["AURSID"]) . "'"; db_query($q, $dbh); # setting expiration to 1 means '1 second after midnight January 1, 1970' setcookie("AURSID", "", 1, "/", null, !empty($_SERVER['HTTPS']), true); diff --git a/web/html/passreset.php b/web/html/passreset.php index 01f3204..87be1b2 100644 --- a/web/html/passreset.php +++ b/web/html/passreset.php @@ -40,8 +40,8 @@ if (isset($_GET['resetkey'], $_POST['email'], $_POST['password'], $_POST['confir Salt = '$salt', ResetKey = '' WHERE ResetKey != '' - AND ResetKey = '".mysql_real_escape_string($resetkey)."' - AND Email = '".mysql_real_escape_string($email)."'"; + AND ResetKey = '".db_escape_string($resetkey)."' + AND Email = '".db_escape_string($email)."'"; $result = db_query($q, $dbh); if (!mysql_affected_rows($dbh)) { $error = __('Invalid e-mail and reset key combination.'); diff --git a/web/html/pkgsubmit.php b/web/html/pkgsubmit.php index 36f74bf..b6b1405 100644 --- a/web/html/pkgsubmit.php +++ b/web/html/pkgsubmit.php @@ -301,7 +301,7 @@ if ($uid): $dbh = db_connect(); db_query("BEGIN", $dbh); - $q = "SELECT * FROM Packages WHERE Name = '" . mysql_real_escape_string($new_pkgbuild['pkgname']) . "'"; + $q = "SELECT * FROM Packages WHERE Name = '" . db_escape_string($new_pkgbuild['pkgname']) . "'"; $result = db_query($q, $dbh); $pdata = mysql_fetch_assoc($result); @@ -346,11 +346,11 @@ if ($uid): # Update package data $q = sprintf("UPDATE Packages SET ModifiedTS = UNIX_TIMESTAMP(), Name = '%s', Version = '%s', License = '%s', Description = '%s', URL = '%s', OutOfDateTS = NULL, MaintainerUID = %d WHERE ID = %d", - mysql_real_escape_string($new_pkgbuild['pkgname']), - mysql_real_escape_string($pkg_version), - mysql_real_escape_string($new_pkgbuild['license']), - mysql_real_escape_string($new_pkgbuild['pkgdesc']), - mysql_real_escape_string($new_pkgbuild['url']), + db_escape_string($new_pkgbuild['pkgname']), + db_escape_string($pkg_version), + db_escape_string($new_pkgbuild['license']), + db_escape_string($new_pkgbuild['pkgdesc']), + db_escape_string($new_pkgbuild['url']), $uid, $packageID); @@ -359,12 +359,12 @@ if ($uid): } else { # This is a brand new package $q = sprintf("INSERT INTO Packages (Name, License, Version, CategoryID, Description, URL, SubmittedTS, ModifiedTS, SubmitterUID, MaintainerUID) VALUES ('%s', '%s', '%s', %d, '%s', '%s', UNIX_TIMESTAMP(), UNIX_TIMESTAMP(), %d, %d)", - mysql_real_escape_string($new_pkgbuild['pkgname']), - mysql_real_escape_string($new_pkgbuild['license']), - mysql_real_escape_string($pkg_version), + db_escape_string($new_pkgbuild['pkgname']), + db_escape_string($new_pkgbuild['license']), + db_escape_string($pkg_version), $category_id, - mysql_real_escape_string($new_pkgbuild['pkgdesc']), - mysql_real_escape_string($new_pkgbuild['url']), + db_escape_string($new_pkgbuild['pkgdesc']), + db_escape_string($new_pkgbuild['url']), $uid, $uid); @@ -389,8 +389,8 @@ if ($uid): $q = sprintf("INSERT INTO PackageDepends (PackageID, DepName, DepCondition) VALUES (%d, '%s', '%s')", $packageID, - mysql_real_escape_string($deppkgname), - mysql_real_escape_string($depcondition)); + db_escape_string($deppkgname), + db_escape_string($depcondition)); db_query($q, $dbh); } @@ -401,7 +401,7 @@ if ($uid): foreach ($sources as $src) { if ($src != "" ) { $q = "INSERT INTO PackageSources (PackageID, Source) VALUES ("; - $q .= $packageID . ", '" . mysql_real_escape_string($src) . "')"; + $q .= $packageID . ", '" . db_escape_string($src) . "')"; db_query($q, $dbh); } } diff --git a/web/html/voters.php b/web/html/voters.php index aa2aa50..02abe29 100644 --- a/web/html/voters.php +++ b/web/html/voters.php @@ -5,7 +5,7 @@ include('pkgfuncs.inc.php'); function getvotes($pkgid) { $dbh = db_connect(); - $pkgid = mysql_real_escape_string($pkgid); + $pkgid = db_escape_string($pkgid); $result = db_query("SELECT UsersID,Username FROM PackageVotes LEFT JOIN Users on (UsersID = ID) WHERE PackageID = $pkgid ORDER BY Username", $dbh); return $result; diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index 59fa730..692dd19 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -225,7 +225,7 @@ function process_account_form($UTYPE,$TYPE,$A,$U="",$T="",$S="",$E="", # NOTE: a race condition exists here if we care... # $q = "SELECT COUNT(*) AS CNT FROM Users "; - $q.= "WHERE Username = '".mysql_real_escape_string($U)."'"; + $q.= "WHERE Username = '".db_escape_string($U)."'"; if ($TYPE == "edit") { $q.= " AND ID != ".intval($UID); } @@ -243,7 +243,7 @@ function process_account_form($UTYPE,$TYPE,$A,$U="",$T="",$S="",$E="", # NOTE: a race condition exists here if we care... # $q = "SELECT COUNT(*) AS CNT FROM Users "; - $q.= "WHERE Email = '".mysql_real_escape_string($E)."'"; + $q.= "WHERE Email = '".db_escape_string($E)."'"; if ($TYPE == "edit") { $q.= " AND ID != ".intval($UID); } @@ -265,7 +265,7 @@ function process_account_form($UTYPE,$TYPE,$A,$U="",$T="",$S="",$E="", # no errors, go ahead and create the unprivileged user $salt = generate_salt(); $P = salted_hash($P, $salt); - $escaped = array_map('mysql_real_escape_string', + $escaped = array_map('db_escape_string', array($U, $E, $P, $salt, $R, $L, $I)); $q = "INSERT INTO Users (" . "AccountTypeID, Suspended, Username, Email, Passwd, Salt" . @@ -289,7 +289,7 @@ function process_account_form($UTYPE,$TYPE,$A,$U="",$T="",$S="",$E="", # no errors, go ahead and modify the user account $q = "UPDATE Users SET "; - $q.= "Username = '".mysql_real_escape_string($U)."'"; + $q.= "Username = '".db_escape_string($U)."'"; if ($T) { $q.= ", AccountTypeID = ".intval($T); } @@ -298,15 +298,15 @@ function process_account_form($UTYPE,$TYPE,$A,$U="",$T="",$S="",$E="", } else { $q.= ", Suspended = 0"; } - $q.= ", Email = '".mysql_real_escape_string($E)."'"; + $q.= ", Email = '".db_escape_string($E)."'"; if ($P) { $salt = generate_salt(); $hash = salted_hash($P, $salt); $q .= ", Passwd = '$hash', Salt = '$salt'"; } - $q.= ", RealName = '".mysql_real_escape_string($R)."'"; - $q.= ", LangPreference = '".mysql_real_escape_string($L)."'"; - $q.= ", IRCNick = '".mysql_real_escape_string($I)."'"; + $q.= ", RealName = '".db_escape_string($R)."'"; + $q.= ", LangPreference = '".db_escape_string($L)."'"; + $q.= ", IRCNick = '".db_escape_string($I)."'"; $q.= " WHERE ID = ".intval($UID); $result = db_query($q, $dbh); if (!$result) { @@ -372,19 +372,19 @@ function search_results_page($UTYPE,$O=0,$SB="",$U="",$T="", $search_vars[] = "S"; } if ($U) { - $q.= "AND Username LIKE '%".mysql_real_escape_string($U)."%' "; + $q.= "AND Username LIKE '%".db_escape_string($U)."%' "; $search_vars[] = "U"; } if ($E) { - $q.= "AND Email LIKE '%".mysql_real_escape_string($E)."%' "; + $q.= "AND Email LIKE '%".db_escape_string($E)."%' "; $search_vars[] = "E"; } if ($R) { - $q.= "AND RealName LIKE '%".mysql_real_escape_string($R)."%' "; + $q.= "AND RealName LIKE '%".db_escape_string($R)."%' "; $search_vars[] = "R"; } if ($I) { - $q.= "AND IRCNick LIKE '%".mysql_real_escape_string($I)."%' "; + $q.= "AND IRCNick LIKE '%".db_escape_string($I)."%' "; $search_vars[] = "I"; } switch ($SB) { @@ -716,7 +716,7 @@ function valid_user( $user ) if ( $user ) { $dbh = db_connect(); $q = "SELECT ID FROM Users WHERE Username = '" - . mysql_real_escape_string($user). "'"; + . db_escape_string($user). "'"; $result = db_query($q, $dbh); # Is the username in the database? diff --git a/web/lib/aur.inc.php b/web/lib/aur.inc.php index f432697..51c1eff 100644 --- a/web/lib/aur.inc.php +++ b/web/lib/aur.inc.php @@ -29,7 +29,7 @@ function check_sid($dbh=NULL) { $dbh = db_connect(); } $q = "SELECT LastUpdateTS, UNIX_TIMESTAMP() FROM Sessions "; - $q.= "WHERE SessionID = '" . mysql_real_escape_string($_COOKIE["AURSID"]) . "'"; + $q.= "WHERE SessionID = '" . db_escape_string($_COOKIE["AURSID"]) . "'"; $result = db_query($q, $dbh); if (mysql_num_rows($result) == 0) { # Invalid SessionID - hacker alert! @@ -53,7 +53,7 @@ function check_sid($dbh=NULL) { # session id timeout was reached and they must login again. # $q = "DELETE FROM Sessions WHERE SessionID = '"; - $q.= mysql_real_escape_string($_COOKIE["AURSID"]) . "'"; + $q.= db_escape_string($_COOKIE["AURSID"]) . "'"; db_query($q, $dbh); setcookie("AURSID", "", 1, "/", null, !empty($_SERVER['HTTPS']), true); @@ -69,7 +69,7 @@ function check_sid($dbh=NULL) { # overwritten. if ($last_update < time() + $LOGIN_TIMEOUT) { $q = "UPDATE Sessions SET LastUpdateTS = UNIX_TIMESTAMP() "; - $q.= "WHERE SessionID = '".mysql_real_escape_string($_COOKIE["AURSID"])."'"; + $q.= "WHERE SessionID = '".db_escape_string($_COOKIE["AURSID"])."'"; db_query($q, $dbh); } } @@ -106,7 +106,7 @@ function username_from_id($id="", $dbh=NULL) { if(!$dbh) { $dbh = db_connect(); } - $q = "SELECT Username FROM Users WHERE ID = " . mysql_real_escape_string($id); + $q = "SELECT Username FROM Users WHERE ID = " . db_escape_string($id); $result = db_query($q, $dbh); if (!$result) { return "None"; @@ -129,7 +129,7 @@ function username_from_sid($sid="", $dbh=NULL) { $q = "SELECT Username "; $q.= "FROM Users, Sessions "; $q.= "WHERE Users.ID = Sessions.UsersID "; - $q.= "AND Sessions.SessionID = '" . mysql_real_escape_string($sid) . "'"; + $q.= "AND Sessions.SessionID = '" . db_escape_string($sid) . "'"; $result = db_query($q, $dbh); if (!$result) { return ""; @@ -151,7 +151,7 @@ function email_from_sid($sid="", $dbh=NULL) { $q = "SELECT Email "; $q.= "FROM Users, Sessions "; $q.= "WHERE Users.ID = Sessions.UsersID "; - $q.= "AND Sessions.SessionID = '" . mysql_real_escape_string($sid) . "'"; + $q.= "AND Sessions.SessionID = '" . db_escape_string($sid) . "'"; $result = db_query($q, $dbh); if (!$result) { return ""; @@ -175,7 +175,7 @@ function account_from_sid($sid="", $dbh=NULL) { $q.= "FROM Users, AccountTypes, Sessions "; $q.= "WHERE Users.ID = Sessions.UsersID "; $q.= "AND AccountTypes.ID = Users.AccountTypeID "; - $q.= "AND Sessions.SessionID = '" . mysql_real_escape_string($sid) . "'"; + $q.= "AND Sessions.SessionID = '" . db_escape_string($sid) . "'"; $result = db_query($q, $dbh); if (!$result) { return ""; @@ -197,7 +197,7 @@ function uid_from_sid($sid="", $dbh=NULL) { $q = "SELECT Users.ID "; $q.= "FROM Users, Sessions "; $q.= "WHERE Users.ID = Sessions.UsersID "; - $q.= "AND Sessions.SessionID = '" . mysql_real_escape_string($sid) . "'"; + $q.= "AND Sessions.SessionID = '" . db_escape_string($sid) . "'"; $result = db_query($q, $dbh); if (!$result) { return 0; @@ -223,6 +223,12 @@ function db_connect() { return $handle; } +# Escape strings for SQL query usage. +# Wraps the database driver's provided method (for convenience and porting). +function db_escape_string($string) { + return mysql_real_escape_string($string); +} + # disconnect from the database # this won't normally be needed as PHP/reference counting will take care of # closing the connection once it is no longer referenced @@ -290,7 +296,7 @@ function set_lang($dbh=NULL) { $q = "SELECT LangPreference FROM Users, Sessions "; $q.= "WHERE Users.ID = Sessions.UsersID "; $q.= "AND Sessions.SessionID = '"; - $q.= mysql_real_escape_string($_COOKIE["AURSID"])."'"; + $q.= db_escape_string($_COOKIE["AURSID"])."'"; $result = db_query($q, $dbh); if ($result) { @@ -355,7 +361,7 @@ function can_submit_pkg($name="", $sid="", $dbh=NULL) { $dbh = db_connect(); } $q = "SELECT MaintainerUID "; - $q.= "FROM Packages WHERE Name = '".mysql_real_escape_string($name)."'"; + $q.= "FROM Packages WHERE Name = '".db_escape_string($name)."'"; $result = db_query($q, $dbh); if (mysql_num_rows($result) == 0) {return 1;} $row = mysql_fetch_row($result); @@ -428,7 +434,7 @@ function uid_from_username($username="", $dbh=NULL) if(!$dbh) { $dbh = db_connect(); } - $q = "SELECT ID FROM Users WHERE Username = '".mysql_real_escape_string($username) + $q = "SELECT ID FROM Users WHERE Username = '".db_escape_string($username) ."'"; $result = db_query($q, $dbh); if (!$result) { @@ -449,7 +455,7 @@ function uid_from_email($email="", $dbh=NULL) if(!$dbh) { $dbh = db_connect(); } - $q = "SELECT ID FROM Users WHERE Email = '".mysql_real_escape_string($email) + $q = "SELECT ID FROM Users WHERE Email = '".db_escape_string($email) ."'"; $result = db_query($q, $dbh); if (!$result) { diff --git a/web/lib/aurjson.class.php b/web/lib/aurjson.class.php index 3a8e830..e6e62f4 100644 --- a/web/lib/aurjson.class.php +++ b/web/lib/aurjson.class.php @@ -177,7 +177,7 @@ class AurJSON { if (is_numeric($arg)) { $id_args[] = intval($arg); } else { - $escaped = mysql_real_escape_string($arg, $this->dbh); + $escaped = db_escape_string($arg, $this->dbh); $name_args[] = "'" . $escaped . "'"; } } @@ -195,7 +195,7 @@ class AurJSON { return $this->json_error('Query arg too small'); } - $keyword_string = mysql_real_escape_string($keyword_string, $this->dbh); + $keyword_string = db_escape_string($keyword_string, $this->dbh); $keyword_string = addcslashes($keyword_string, '%_'); $where_condition = "( Name LIKE '%{$keyword_string}%' OR " . @@ -218,7 +218,7 @@ class AurJSON { } else { $where_condition = sprintf("Name=\"%s\"", - mysql_real_escape_string($pqdata, $this->dbh)); + db_escape_string($pqdata, $this->dbh)); } return $this->process_query('info', $where_condition); } @@ -260,7 +260,7 @@ class AurJSON { * @return mixed Returns an array of value data containing the package data **/ private function msearch($maintainer) { - $maintainer = mysql_real_escape_string($maintainer, $this->dbh); + $maintainer = db_escape_string($maintainer, $this->dbh); $where_condition = "Users.Username = '{$maintainer}'"; diff --git a/web/lib/pkgfuncs.inc.php b/web/lib/pkgfuncs.inc.php index 3e89fa3..b078c48 100644 --- a/web/lib/pkgfuncs.inc.php +++ b/web/lib/pkgfuncs.inc.php @@ -100,7 +100,7 @@ function pkgid_from_name($name="", $dbh=NULL) { $dbh = db_connect(); } $q = "SELECT ID FROM Packages "; - $q.= "WHERE Name = '".mysql_real_escape_string($name)."' "; + $q.= "WHERE Name = '".db_escape_string($name)."' "; $result = db_query($q, $dbh); if (!$result) {return NULL;} $row = mysql_fetch_row($result); @@ -137,7 +137,7 @@ function package_required($name="", $dbh=NULL) { } $q = "SELECT p.Name, PackageID FROM PackageDepends pd "; $q.= "JOIN Packages p ON pd.PackageID = p.ID "; - $q.= "WHERE DepName = '".mysql_real_escape_string($name)."' "; + $q.= "WHERE DepName = '".db_escape_string($name)."' "; $q.= "ORDER BY p.Name"; $result = db_query($q, $dbh); if (!$result) {return array();} @@ -234,7 +234,7 @@ function pkgvotes_from_sid($sid="", $dbh=NULL) { $q.= "FROM PackageVotes, Users, Sessions "; $q.= "WHERE Users.ID = Sessions.UsersID "; $q.= "AND Users.ID = PackageVotes.UsersID "; - $q.= "AND Sessions.SessionID = '".mysql_real_escape_string($sid)."'"; + $q.= "AND Sessions.SessionID = '".db_escape_string($sid)."'"; $result = db_query($q, $dbh); if ($result) { while ($row = mysql_fetch_row($result)) { @@ -257,7 +257,7 @@ function pkgnotify_from_sid($sid="", $dbh=NULL) { $q.= "FROM CommentNotify, Users, Sessions "; $q.= "WHERE Users.ID = Sessions.UsersID "; $q.= "AND Users.ID = CommentNotify.UserID "; - $q.= "AND Sessions.SessionID = '".mysql_real_escape_string($sid)."'"; + $q.= "AND Sessions.SessionID = '".db_escape_string($sid)."'"; $result = db_query($q, $dbh); if ($result) { while ($row = mysql_fetch_row($result)) { @@ -291,7 +291,7 @@ function pkgname_is_blacklisted($name, $dbh=NULL) { if(!$dbh) { $dbh = db_connect(); } - $q = "SELECT COUNT(*) FROM PackageBlacklist WHERE Name = '" . mysql_real_escape_string($name) . "'"; + $q = "SELECT COUNT(*) FROM PackageBlacklist WHERE Name = '" . db_escape_string($name) . "'"; $result = db_query($q, $dbh); if (!$result) return false; @@ -457,7 +457,7 @@ function pkg_search_page($SID="", $dbh=NULL) { } if (isset($_GET['K'])) { - $_GET['K'] = mysql_real_escape_string(trim($_GET['K'])); + $_GET['K'] = db_escape_string(trim($_GET['K'])); # Search by maintainer if (isset($_GET["SeB"]) && $_GET["SeB"] == "m") { diff --git a/web/lib/stats.inc.php b/web/lib/stats.inc.php index 2690a5c..8f0f770 100644 --- a/web/lib/stats.inc.php +++ b/web/lib/stats.inc.php @@ -20,7 +20,7 @@ function updates_table($dbh) function user_table($user, $dbh) { - $escuser = mysql_real_escape_string($user); + $escuser = db_escape_string($user); $base_q = "SELECT count(*) FROM Packages,Users WHERE Packages.MaintainerUID = Users.ID AND Users.Username='" . $escuser . "'"; $maintainer_unsupported_count = db_cache_value($base_q, $dbh, diff --git a/web/template/pkg_comment_form.php b/web/template/pkg_comment_form.php index e52c92d..d3b602c 100644 --- a/web/template/pkg_comment_form.php +++ b/web/template/pkg_comment_form.php @@ -7,7 +7,7 @@ if (isset($_REQUEST['comment'])) { $q = 'INSERT INTO PackageComments '; $q.= '(PackageID, UsersID, Comments, CommentTS) VALUES ('; $q.= intval($_REQUEST['ID']) . ', ' . uid_from_sid($_COOKIE['AURSID']) . ', '; - $q.= "'" . mysql_real_escape_string($_REQUEST['comment']) . "', "; + $q.= "'" . db_escape_string($_REQUEST['comment']) . "', "; $q.= 'UNIX_TIMESTAMP())'; db_query($q, $dbh); -- 1.7.7

2 2