- Aur-dev - lists.archlinux.org

[aur-dev] AUR 1.8.1 released
by Lukas Fleischer 12 Mar '11

12 Mar '11

We've just released 1.8.1 [1]! :) This one's primarily a bug fix release. It improves blacklist handling and promotes full InnoDB conversion, including some database schema cleanups. IMPORTANT: It also contains a fix for a potential SQL injection vulnerability - all maintainers of AUR setups are encouraged to upgrade, soon! Thanks to Dan for pointing this out and for providing patches for this a lot more. Other changes include: * Per-user session limits (FS#12898, defaulting to 8 sessions per user). * Searching for non-out-of-date packages (fixes FS#17896). * Packages with subdirectories are rejected (fixes FS#22995). * Automatic adoption when updating an orphan package (fixes FS#22992). * ZIP bomb protection (fixes FS#22991). Check the Git log [2] for a complete list. The official Arch Linux AUR setup [3] will be upgraded soon! [1] http://projects.archlinux.org/aur.git/commit/?id=29b2f3b3 [2] http://projects.archlinux.org/aur.git/log/?id=29b2f3b3 [3] https://aur.archlinux.org/

2 1

[aur-dev] [PATCH] Notify package maintainers about deleted dependencies (FS#10372).
by Lukas Fleischer 11 Mar '11

11 Mar '11

Signed-off-by: Lukas Fleischer <archlinux(a)cryptocrack.de> --- While upgrading our database to InnoDB, I noticed that there are missing dependencies in the package details view for some packages. This happens when some dependency of a package gets deleted as we recently added an "ON DELETE CASCADE" foreign key on package IDs to the "PackageDepends" table (the problem already existed before, tho). While thinking about a proper fix, it reminded me of FS#10372 which is related and would seem to me to be kinda useful. Reviews and comments welcome! web/lib/pkgfuncs.inc | 29 +++++++++++++++++++++++++++++ 1 files changed, 29 insertions(+), 0 deletions(-) diff --git a/web/lib/pkgfuncs.inc b/web/lib/pkgfuncs.inc index d5e0771..bfa3e1f 100644 --- a/web/lib/pkgfuncs.inc +++ b/web/lib/pkgfuncs.inc @@ -709,6 +709,35 @@ function pkg_delete ($atype, $ids) { } $dbh = db_connect(); + + # Notify of deleted dependencies. + $f_name = username_from_sid($_COOKIE['AURSID']); + $f_uid = uid_from_sid($_COOKIE['AURSID']); + $q = "SELECT Users.Email, DepPkgs.ID, DepPkgs.Name, "; + $q .= "GROUP_CONCAT(Packages.Name SEPARATOR ', ') AS DepList "; + $q .= "FROM Packages "; + $q .= "LEFT JOIN PackageDepends ON PackageDepends.DepPkgId = Packages.ID "; + $q .= "LEFT JOIN Packages DepPkgs ON DepPkgs.ID = PackageDepends.PackageID "; + $q .= "LEFT JOIN Users ON Users.ID = DepPkgs.MaintainerUID "; + $q .= "WHERE Packages.ID IN (" . implode(",", $ids) . ") "; + $q .= "GROUP BY DepPkgs.ID;"; + $result = db_query($q, $dbh); + if (mysql_num_rows($result)) { + while ($row = mysql_fetch_assoc($result)) { + # construct email + $body = "The following dependencies of your package " . $row['Name'] . " [1] "; + $body .= "have been removed by " . $f_name . " [1]: " . $row['DepList'] . ".\n\n"; + $body .= "Please check if the \"depends\" array of your PKGBUILD needs to be updated "; + $body .= "(shouldn't be necessary if a package was moved to the official repos) "; + $body .= "and re-upload your package.\n\n"; + $body .= "[1] http://aur.archlinux.org/packages.php?ID=" . $row['ID'] . "\n"; + $body .= "[2] http://aur.archlinux.org/account.php?Action=AccountInfo&ID=" . $f_uid; + $body = wordwrap($body, 70); + $headers = "Reply-to: nobody@archlinux.org\nFrom:aur-notify@archlinux.org\nX-Mailer: PHP\nX-MimeOLE: Produced By AUR\n"; + @mail($row['Email'], "AUR Dependency Removal Notification for " . $row['Name'], $body, $headers); + } + } + $q = "DELETE FROM Packages WHERE ID IN (" . implode(",", $ids) . ")"; $result = db_query($q, $dbh); -- 1.7.4.1

1 0

[aur-dev] A few more patches
by Dan McGee 10 Mar '11

10 Mar '11

Mostly to Lukas, but posting it here- I have a few more patches on my working branch you might be interested in: http://code.toofishes.net/cgit/dan/aur.git/log/?h=working * Perform a second query to find total search count * Split package search query into parts * More PHP Notice undefined fixups -Dan

2 1

[aur-dev] [PATCH] Specify utf8 in database schema.
by Loui Chang 28 Feb '11

28 Feb '11

Signed-off-by: Loui Chang <louipc.ist(a)gmail.com> --- support/schema/aur-schema.sql | 8 ++++---- 1 files changed, 4 insertions(+), 4 deletions(-) diff --git a/support/schema/aur-schema.sql b/support/schema/aur-schema.sql index b713fc8..1649055 100644 --- a/support/schema/aur-schema.sql +++ b/support/schema/aur-schema.sql @@ -2,7 +2,7 @@ -- is also included such as AccountTypes, etc. -- DROP DATABASE AUR; -CREATE DATABASE AUR; +CREATE DATABASE AUR DEFAULT CHARACTER SET utf8 COLLATE utf8_general_ci; USE AUR; -- Define the Account Types for the AUR. @@ -159,7 +159,7 @@ CREATE TABLE PackageComments ( ID BIGINT UNSIGNED NOT NULL AUTO_INCREMENT, PackageID INTEGER UNSIGNED NOT NULL, UsersID INTEGER UNSIGNED NOT NULL, - Comments TEXT NOT NULl DEFAULT '', + Comments TEXT NOT NULL DEFAULT '', CommentTS BIGINT UNSIGNED NOT NULL DEFAULT 0, DelUsersID INTEGER UNSIGNED NULL DEFAULT NULL, PRIMARY KEY (ID), @@ -193,8 +193,8 @@ CREATE TABLE PackageBlacklist ( -- CREATE TABLE IF NOT EXISTS TU_VoteInfo ( ID int(10) unsigned NOT NULL auto_increment, - Agenda text collate latin1_general_ci NOT NULL, - User VARCHAR(32) collate latin1_general_ci NOT NULL, + Agenda text COLLATE utf8_general_ci NOT NULL, + User VARCHAR(32) COLLATE utf8_general_ci NOT NULL, Submitted bigint(20) unsigned NOT NULL, End bigint(20) unsigned NOT NULL, SubmitterID int(10) unsigned NOT NULL, -- 1.7.4.1

2 1

[aur-dev] Russian comments are '???'
by Joker-jar 26 Feb '11

26 Feb '11

Hi. Russian comments are like '???' now in the aur. Look: http://aur.archlinux.org/packages.php?ID=40365 I think, problem in database encoding

6 5

[aur-dev] AUR 1.8.0 released
by Lukas Fleischer 22 Feb '11

22 Feb '11

1.8.0 is finally out [1]! Please note that this release removes all the code for automatic tarball extraction. From now on, only PKGBUILDs and source tarballs will be accessible via the AUR web interface. 1.8.0 also introduces a package blacklist and a blacklist helper which can be used to avoid submission of packages from the official repos to the AUR. Other changes include: * Original submitters in package details. * Variable parser improvements. * "python2" shebang for all Python scripts. * "First" and "Last" links in search results. * Timestamps for out-of-date packages. * Clickable links in comments. * Auto redirection from confirmation screens. * RTL support. * Updated translations. * InnoDB compatibility for all tables. * Database cleanups. * Fixes for some XSS vulnerabilities. * Fixes for all bugs reported on the bug tracker [2] :) Check the Git log [3] for a complete list. The official Arch Linux AUR setup [4] will be upgraded soon! [1] http://projects.archlinux.org/aur.git/commit/?id=a7742012 [2] https://bugs.archlinux.org/index.php?project=2 [3] http://projects.archlinux.org/aur.git/log/?id=a7742012 [4] https://aur.archlinux.org/

4 3

Re: [aur-dev] aur-dev Digest, Vol 39, Issue 8
by Connor Behan 22 Feb '11

22 Feb '11

Why would you do this? I find it immensely useful to look at the patches AUR developers use so I can see what they do to packages out of curiosity. Now I will have to download the tarball to see the same thing even if it's a program I don't want to compile and use. Furthermore, I refer to several of my own patches with links to the AUR website. When I'm emailing someone saying "here is a patch you might like" I often provide a link to http://aur.archlinux.org/packages/medit-full/medit-full/bindings2.diff(which still works but for how long) instead of pasting it or attaching it. Just off the top of my head I can think of two websites and two bug reports I've made that I will have to change if these links stop working. Please reconsider. And if I've missed my chance to complain because this was voted on in the mailing lists then I'm sorry for missing it but I highly doubt that was the case. Please note that this release removes all the code for automatic tarball > extraction. From now on, only PKGBUILDs and source tarballs will be > accessible via the AUR web interface. >

2 1

Re: [aur-dev] AUR 1.8.0 released
by Connor Behan 22 Feb '11

22 Feb '11

Oops, wrong subject line in the last post.

1 0

[aur-dev] [PATCH] "logged before" -> "logged in before" in web/lib/pkgfuncs.inc
by Wieland Hoffmann 21 Feb '11

21 Feb '11

This fixes a small message telling people they had to be logged to edit package information into telling them they need to be logged _in_. --- web/lib/pkgfuncs.inc | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-)

2 1

[aur-dev] Adding the HE language.
by Netanel Shine 18 Feb '11

18 Feb '11

Hey there, i was working on translating the AUR to my language, Hebrew. I am adding to this message the gzipped patched file. btw. i know his name lame, but i think he will work just fine. THanks! -- Netanel Shine

6 40