- Aur-dev - lists.archlinux.org

[PATCH] Add option to send reset key for a given user name
by Lukas Fleischer 30 Jan '20

30 Jan '20

In addition to supporting email addresses in the reset key form, also support user names. The reset key is then sent to the email address in the user's profile. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/html/passreset.php | 25 ++++++++++++------------- web/lib/acctfuncs.inc.php | 13 +++++++------ 2 files changed, 19 insertions(+), 19 deletions(-) diff --git a/web/html/passreset.php b/web/html/passreset.php index 9e7cee8..b3c8bd2 100644 --- a/web/html/passreset.php +++ b/web/html/passreset.php @@ -11,14 +11,14 @@ if (isset($_COOKIE["AURSID"])) { $error = ''; -if (isset($_GET['resetkey'], $_POST['email'], $_POST['password'], $_POST['confirm'])) { +if (isset($_GET['resetkey'], $_POST['user'], $_POST['password'], $_POST['confirm'])) { $resetkey = $_GET['resetkey']; - $email = $_POST['email']; + $user = $_POST['user']; $password = $_POST['password']; $confirm = $_POST['confirm']; - $uid = uid_from_email($email); + $uid = uid_from_loginname($user); - if (empty($email) || empty($password)) { + if (empty($user) || empty($password)) { $error = __('Missing a required field.'); } elseif ($password != $confirm) { $error = __('Password fields do not match.'); @@ -31,16 +31,15 @@ if (isset($_GET['resetkey'], $_POST['email'], $_POST['password'], $_POST['confir } if (empty($error)) { - $error = password_reset($password, $resetkey, $email); + $error = password_reset($password, $resetkey, $user); } -} elseif (isset($_POST['email'])) { - $email = $_POST['email']; - $username = username_from_id(uid_from_email($email)); +} elseif (isset($_POST['user'])) { + $user = $_POST['user']; - if (empty($email)) { + if (empty($user)) { $error = __('Missing a required field.'); } else { - send_resetkey($email); + send_resetkey($user); header('Location: ' . get_uri('/passreset/') . '?step=confirm'); exit(); } @@ -67,7 +66,7 @@ html_header(__("Password Reset")); <table> <tr> <td><?= __("Confirm your e-mail address:"); ?></td> - <td><input type="text" name="email" size="30" maxlength="64" /></td> + <td><input type="text" name="user" size="30" maxlength="64" /></td> </tr> <tr> <td><?= __("Enter your new password:"); ?></td> @@ -89,8 +88,8 @@ html_header(__("Password Reset")); <ul class="errorlist"><li><?= $error ?></li></ul> <?php endif; ?> <form action="" method="post"> - <p><?= __("Enter your e-mail address:"); ?> - <input type="text" name="email" size="30" maxlength="64" /></p> + <p><?= __("Enter your user name or your e-mail address:"); ?> + <input type="text" name="user" size="30" maxlength="64" /></p> <input type="submit" class="button" value="<?= __('Continue') ?>" /> </form> <?php endif; ?> diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index 345d27a..f6cda69 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -755,13 +755,13 @@ function create_resetkey($resetkey, $uid) { /** * Send a reset key to a specific e-mail address * - * @param string $email E-mail address of the user resetting their password + * @param string $user User name or email address of the user * @param bool $welcome Whether to use the welcome message * * @return void */ -function send_resetkey($email, $welcome=false) { - $uid = uid_from_email($email); +function send_resetkey($user, $welcome=false) { + $uid = uid_from_loginname($user); if ($uid == null) { return; } @@ -779,11 +779,11 @@ function send_resetkey($email, $welcome=false) { * * @param string $password The new password * @param string $resetkey Code e-mailed to a user to reset a password - * @param string $email E-mail address of the user resetting their password + * @param string $user User name or email address of the user * * @return string|void Redirect page if successful, otherwise return error message */ -function password_reset($password, $resetkey, $email) { +function password_reset($password, $resetkey, $user) { $hash = password_hash($password, PASSWORD_DEFAULT); $dbh = DB::connect(); @@ -792,7 +792,8 @@ function password_reset($password, $resetkey, $email) { $q.= "ResetKey = '' "; $q.= "WHERE ResetKey != '' "; $q.= "AND ResetKey = " . $dbh->quote($resetkey) . " "; - $q.= "AND Email = " . $dbh->quote($email); + $q.= "AND (Email = " . $dbh->quote($user) . " OR "; + $q.= "UserName = " . $dbh->quote($user) . ")"; $result = $dbh->exec($q); if (!$result) { -- 2.25.0

1 0

[PATCH] Require password when changing account information
by Lukas Fleischer 30 Jan '20

30 Jan '20

Since commits daee20c (Require current password when setting a new one, 2020-01-30) and 8fc8898 (Require password when deleting an account, 2020-01-30), changing a password and deleting an account require the current password. Extend this to all other profile changes. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/html/account.php | 5 +++-- web/html/register.php | 4 ++-- web/lib/acctfuncs.inc.php | 19 +++++++------------ web/template/account_edit_form.php | 17 +++++++++-------- 4 files changed, 21 insertions(+), 24 deletions(-) diff --git a/web/html/account.php b/web/html/account.php index 03af8d4..ff9aba5 100644 --- a/web/html/account.php +++ b/web/html/account.php @@ -34,7 +34,6 @@ if ($action == "UpdateAccount") { in_request("S"), in_request("E"), in_request("H"), - in_request("PO"), in_request("P"), in_request("C"), in_request("R"), @@ -49,7 +48,9 @@ if ($action == "UpdateAccount") { in_request("UN"), in_request("ON"), in_request("ID"), - $row["Username"]); + $row["Username"], + in_request("passwd") + ); } } diff --git a/web/html/register.php b/web/html/register.php index 8174e34..610befc 100644 --- a/web/html/register.php +++ b/web/html/register.php @@ -26,7 +26,6 @@ if (in_request("Action") == "NewAccount") { in_request("H"), '', '', - '', in_request("R"), in_request("L"), in_request("TZ"), @@ -40,6 +39,7 @@ if (in_request("Action") == "NewAccount") { in_request("ON"), 0, "", + '', in_request("captcha_salt"), in_request("captcha"), ); @@ -55,7 +55,6 @@ if (in_request("Action") == "NewAccount") { in_request("H"), '', '', - '', in_request("R"), in_request("L"), in_request("TZ"), @@ -69,6 +68,7 @@ if (in_request("Action") == "NewAccount") { in_request("ON"), 0, "", + '', in_request("captcha_salt"), in_request("captcha") ); diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index d2144c2..345d27a 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -96,7 +96,6 @@ function display_account_form($A,$U="",$T="",$S="",$E="",$H="",$P="",$C="",$R="" * @param string $S Whether or not the account is suspended * @param string $E The e-mail address for the user * @param string $H Whether or not the e-mail address should be hidden - * @param string $PO The old password of the user * @param string $P The password for the user * @param string $C The confirmed password for the user * @param string $R The real name of the user @@ -112,13 +111,14 @@ function display_account_form($A,$U="",$T="",$S="",$E="",$H="",$P="",$C="",$R="" * @param string $ON Whether to notify of ownership changes * @param string $UID The user ID of the modified account * @param string $N The username as present in the database + * @param string $passwd The password of the logged in user. * @param string $captcha_salt The salt used for the CAPTCHA. * @param string $captcha The CAPTCHA answer. * * @return array Boolean indicating success and message to be printed */ -function process_account_form($TYPE,$A,$U="",$T="",$S="",$E="",$H="",$PO="",$P="",$C="", - $R="",$L="",$TZ="",$HP="",$I="",$K="",$PK="",$J="",$CN="",$UN="",$ON="",$UID=0,$N="",$captcha_salt="",$captcha="") { +function process_account_form($TYPE,$A,$U="",$T="",$S="",$E="",$H="",$P="",$C="", + $R="",$L="",$TZ="",$HP="",$I="",$K="",$PK="",$J="",$CN="",$UN="",$ON="",$UID=0,$N="",$passwd="",$captcha_salt="",$captcha="") { global $SUPPORTED_LANGS; $error = ''; @@ -133,10 +133,11 @@ function process_account_form($TYPE,$A,$U="",$T="",$S="",$E="",$H="",$PO="",$P=" $dbh = DB::connect(); - if(isset($_COOKIE['AURSID'])) { + if (isset($_COOKIE['AURSID'])) { $uid_session = uid_from_sid($_COOKIE['AURSID']); - } else { - $uid_session = null; + if (!$error && check_passwd($uid_session, $passwd) != 1) { + $error = __("Invalid password."); + } } if (empty($E) || empty($U)) { @@ -162,15 +163,9 @@ function process_account_form($TYPE,$A,$U="",$T="",$S="",$E="",$H="",$PO="",$P=" if (!$error && $P && !$C) { $error = __("Please confirm your new password."); } - if (!$error && $P && !$PO) { - $error = __("Please enter your old password in order to set a new one."); - } if (!$error && $P && $P != $C) { $error = __("Password fields do not match."); } - if (!$error && $P && check_passwd($uid_session, $PO) != 1) { - $error = __("The old password is invalid."); - } if (!$error && $P != '' && !good_passwd($P)) { $length_min = config_get_int('options', 'passwd_min_len'); $error = __("Your password must be at least %s characters.", diff --git a/web/template/account_edit_form.php b/web/template/account_edit_form.php index 7bd233a..09d65c0 100644 --- a/web/template/account_edit_form.php +++ b/web/template/account_edit_form.php @@ -140,12 +140,7 @@ <?php if ($A == "UpdateAccount"): ?> <fieldset> - <legend><?= __("If you want to change the password, enter your current passport, the new password and confirm the new password by entering it again.") ?></legend> - <p> - <label for="id_passwd_old"><?= __("Your current password") ?>:</label> - <input type="password" size="30" name="PO" id="id_passwd_old" value="<?= $PO ?>" /> - </p> - + <legend><?= __("If you want to change the password, enter a new password and confirm the new password by entering it again.") ?></legend> <p> <label for="id_passwd1"><?= __("Password") ?>:</label> <input type="password" size="30" name="P" id="id_passwd1" value="<?= $P ?>" /> @@ -182,16 +177,22 @@ </p> </fieldset> - <?php if ($A != "UpdateAccount"): ?> <fieldset> + <?php if ($A == "UpdateAccount"): ?> + <legend><?= __("To confirm the profile changes, please enter your current password:") ?></legend> + <p> + <label for="id_passwd_current"><?= __("Your current password") ?>:</label> + <input type="password" size="30" name="passwd" id="id_passwd_current" value="" /> + </p> + <?php else: ?> <legend><?= __("To protect the AUR against automated account creation, we kindly ask you to provide the output of the following command:") ?> <code><?= htmlspecialchars($captcha_challenge) ?></code></legend> <p> <label for="id_captcha"><?= __("Answer") ?>:</label> <input type="text" size="30" maxlength="6" name="captcha" id="id_captcha" value="<?= htmlspecialchars($captcha, ENT_QUOTES) ?>" /> (<?= __("required") ?>) <input type="hidden" name="captcha_salt" value="<?= htmlspecialchars($captcha_salt) ?>" /> </p> - </fieldset> <?php endif; ?> + </fieldset> <fieldset> <p> -- 2.25.0

1 0

[PATCH 1/2] Keep signature delimiters intact in notifications
by Lukas Fleischer 30 Jan '20

30 Jan '20

Since commit eeaa1c3 (Separate text from footer in notification emails, 2020-01-04), information about unsubscribing from notifications is added in a signature block. However, the code to format the email body trimmed the RFC 3676 signature delimiter, replacing "-- " by "--". Fix this by adding a special case for signature delimiters. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- aurweb/scripts/notify.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/aurweb/scripts/notify.py b/aurweb/scripts/notify.py index 6c3be22..f2767fd 100755 --- a/aurweb/scripts/notify.py +++ b/aurweb/scripts/notify.py @@ -54,6 +54,9 @@ class Notification: def get_body_fmt(self, lang): body = '' for line in self.get_body(lang).splitlines(): + if line == '-- ': + body += '-- \n' + continue body += textwrap.fill(line, break_long_words=False) + '\n' for i, ref in enumerate(self.get_refs()): body += '\n' + '[%d] %s' % (i + 1, ref) -- 2.25.0

1 1

[PATCH] Update copyright range in the cgit footer
by Lukas Fleischer 30 Jan '20

30 Jan '20

--- web/template/cgit/footer.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/web/template/cgit/footer.html b/web/template/cgit/footer.html index 1c0bf6f..14c358f 100644 --- a/web/template/cgit/footer.html +++ b/web/template/cgit/footer.html @@ -1,6 +1,6 @@ <div id="footer"> <p> - Copyright © 2004-2019 aurweb Development Team – + Copyright © 2004-2020 aurweb Development Team – <strong>AUR packages are user produced content. Any use of the provided files is at your own risk.</strong> </p> </div> -- 2.25.0

1 0

[PATCH] rendercomment: respectful linkification of Git commits
by Lukas Fleischer 30 Jan '20

30 Jan '20

From: Frédéric Mangano-Tarumi <fmang(a)mg0.fr> Turn the git-commits markdown processor into an inline processor, which is smart enough not to convert Git hashes contained in code blocks or links. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- aurweb/scripts/rendercomment.py | 36 ++++++++++++++++++--------------- 1 file changed, 20 insertions(+), 16 deletions(-) diff --git a/aurweb/scripts/rendercomment.py b/aurweb/scripts/rendercomment.py index 5e18fd5..5c59748 100755 --- a/aurweb/scripts/rendercomment.py +++ b/aurweb/scripts/rendercomment.py @@ -40,19 +40,26 @@ class FlysprayLinksExtension(markdown.extensions.Extension): md.preprocessors.add('flyspray-links', preprocessor, '_end') -class GitCommitsPreprocessor(markdown.preprocessors.Preprocessor): - _oidre = re.compile(r'(\b)([0-9a-f]{7,40})(\b)') +class GitCommitsInlineProcessor(markdown.inlinepatterns.InlineProcessor): + """ + Turn Git hashes like f7f5152be5ab into links to AUR's cgit. + + Only commit references that do exist are linkified. Hashes are shortened to + shorter non-ambiguous prefixes. Only hashes with at least 7 digits are + considered. + """ + _repo = pygit2.Repository(repo_path) - _head = None def __init__(self, md, head): self._head = head - super(markdown.preprocessors.Preprocessor, self).__init__(md) + super().__init__(r'\b([0-9a-f]{7,40})\b', md) - def handleMatch(self, m): - oid = m.group(2) + def handleMatch(self, m, data): + oid = m.group(1) if oid not in self._repo: - return oid + # Unkwown OID; preserve the orginal text. + return None, None, None prefixlen = 12 while prefixlen < 40: @@ -60,13 +67,10 @@ class GitCommitsPreprocessor(markdown.preprocessors.Preprocessor): break prefixlen += 1 - html = '[`' + oid[:prefixlen] + '`]' - html += '(' + commit_uri % (self._head, oid[:prefixlen]) + ')' - - return html - - def run(self, lines): - return [self._oidre.sub(self.handleMatch, line) for line in lines] + el = markdown.util.etree.Element('a') + el.set('href', commit_uri % (self._head, oid[:prefixlen])) + el.text = markdown.util.AtomicString(oid[:prefixlen]) + return el, m.start(0), m.end(0) class GitCommitsExtension(markdown.extensions.Extension): @@ -77,8 +81,8 @@ class GitCommitsExtension(markdown.extensions.Extension): super(markdown.extensions.Extension, self).__init__() def extendMarkdown(self, md, md_globals): - preprocessor = GitCommitsPreprocessor(md, self._head) - md.preprocessors.add('git-commits', preprocessor, '_end') + processor = GitCommitsInlineProcessor(md, self._head) + md.inlinePatterns.add('git-commits', processor, '_end') class HeadingTreeprocessor(markdown.treeprocessors.Treeprocessor): -- 2.25.0

1 1

[PATCH] Require password when deleting an account
by Lukas Fleischer 30 Jan '20

30 Jan '20

Further reduce the attack surface in case of a stolen session ID. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/html/account.php | 17 +++++++++++++---- web/template/account_delete.php | 11 +++++++++-- 2 files changed, 22 insertions(+), 6 deletions(-) diff --git a/web/html/account.php b/web/html/account.php index 7c6c424..03af8d4 100644 --- a/web/html/account.php +++ b/web/html/account.php @@ -120,12 +120,21 @@ if (isset($_COOKIE["AURSID"])) { } elseif ($action == "DeleteAccount") { /* Details for account being deleted. */ if (can_edit_account($row)) { - $UID = $row['ID']; + $uid_removal = $row['ID']; + $uid_session = uid_from_sid($_COOKIE['AURSID']); + $username = $row['Username']; + if (in_request('confirm') && check_token()) { - user_delete($UID); - header('Location: /'); + if (check_passwd($uid_session, $_REQUEST['passwd']) == 1) { + user_delete($uid_removal); + header('Location: /'); + } else { + echo "<ul class='errorlist'><li>"; + echo __("Invalid password."); + echo "</li></ul>"; + include("account_delete.php"); + } } else { - $username = $row['Username']; include("account_delete.php"); } } else { diff --git a/web/template/account_delete.php b/web/template/account_delete.php index 718b172..d0c6e74 100644 --- a/web/template/account_delete.php +++ b/web/template/account_delete.php @@ -12,8 +12,15 @@ <input type="hidden" name="token" value="<?= htmlspecialchars($_COOKIE['AURSID']) ?>" /> </fieldset> <fieldset> - <p><label class="confirmation"><input type="checkbox" name="confirm" value="1" /> - <?= __("Confirm deletion") ?></label></p> + <p> + <label for="id_passwd"><?= __("Password") ?>:</label> + <input type="password" size="30" name="passwd" id="id_passwd" value="" /> + </p> + + <p> + <label class="confirmation"><input type="checkbox" name="confirm" value="1" /> + <?= __("Confirm deletion") ?></label> + </p> <p> <input type="submit" class="button" value="<?= __("Delete") ?>" /> -- 2.25.0

1 0

[PATCH] Verify current password against logged in user
by Lukas Fleischer 30 Jan '20

30 Jan '20

When changing the password of an account, instead of asking for the old password of the account, ask for the password of the currently logged in user. This allows privileged users to edit other accounts without knowing their passwords. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/lib/acctfuncs.inc.php | 9 ++++----- web/template/account_edit_form.php | 4 ++-- 2 files changed, 6 insertions(+), 7 deletions(-) diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index 601d4ce..d2144c2 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -134,10 +134,9 @@ function process_account_form($TYPE,$A,$U="",$T="",$S="",$E="",$H="",$PO="",$P=" $dbh = DB::connect(); if(isset($_COOKIE['AURSID'])) { - $editor_user = uid_from_sid($_COOKIE['AURSID']); - } - else { - $editor_user = null; + $uid_session = uid_from_sid($_COOKIE['AURSID']); + } else { + $uid_session = null; } if (empty($E) || empty($U)) { @@ -169,7 +168,7 @@ function process_account_form($TYPE,$A,$U="",$T="",$S="",$E="",$H="",$PO="",$P=" if (!$error && $P && $P != $C) { $error = __("Password fields do not match."); } - if (!$error && $P && check_passwd($UID, $PO) != 1) { + if (!$error && $P && check_passwd($uid_session, $PO) != 1) { $error = __("The old password is invalid."); } if (!$error && $P != '' && !good_passwd($P)) { diff --git a/web/template/account_edit_form.php b/web/template/account_edit_form.php index 25e9185..7bd233a 100644 --- a/web/template/account_edit_form.php +++ b/web/template/account_edit_form.php @@ -140,9 +140,9 @@ <?php if ($A == "UpdateAccount"): ?> <fieldset> - <legend><?= __("If you want to change your password, enter your current passport, your new password and confirm the new password by entering it again.") ?></legend> + <legend><?= __("If you want to change the password, enter your current passport, the new password and confirm the new password by entering it again.") ?></legend> <p> - <label for="id_passwd_old"><?= __("Old password") ?>:</label> + <label for="id_passwd_old"><?= __("Your current password") ?>:</label> <input type="password" size="30" name="PO" id="id_passwd_old" value="<?= $PO ?>" /> </p> -- 2.25.0

1 0

[PATCH] Undo accidental code addition
by Lukas Fleischer 30 Jan '20

30 Jan '20

Rollback an accidental change that sneaked into commit daee20c (Require current password when setting a new one, 2020-01-30). Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/lib/acctfuncs.inc.php | 1 - 1 file changed, 1 deletion(-) diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index 1de49b0..601d4ce 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -135,7 +135,6 @@ function process_account_form($TYPE,$A,$U="",$T="",$S="",$E="",$H="",$PO="",$P=" if(isset($_COOKIE['AURSID'])) { $editor_user = uid_from_sid($_COOKIE['AURSID']); - $row = account_details(in_request("ID"), in_request("U")); } else { $editor_user = null; -- 2.25.0

1 0

[PATCH] Require current password when setting a new one
by Lukas Fleischer 30 Jan '20

30 Jan '20

Prevent from easily taking over an account by changing the password with a stolen session ID. Fixes FS#65325. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/html/account.php | 1 + web/html/register.php | 2 ++ web/lib/acctfuncs.inc.php | 15 ++++++++++++-- web/template/account_edit_form.php | 32 +++++++++++++++++++----------- 4 files changed, 36 insertions(+), 14 deletions(-) diff --git a/web/html/account.php b/web/html/account.php index 1d59e9c..7c6c424 100644 --- a/web/html/account.php +++ b/web/html/account.php @@ -34,6 +34,7 @@ if ($action == "UpdateAccount") { in_request("S"), in_request("E"), in_request("H"), + in_request("PO"), in_request("P"), in_request("C"), in_request("R"), diff --git a/web/html/register.php b/web/html/register.php index a426482..8174e34 100644 --- a/web/html/register.php +++ b/web/html/register.php @@ -26,6 +26,7 @@ if (in_request("Action") == "NewAccount") { in_request("H"), '', '', + '', in_request("R"), in_request("L"), in_request("TZ"), @@ -54,6 +55,7 @@ if (in_request("Action") == "NewAccount") { in_request("H"), '', '', + '', in_request("R"), in_request("L"), in_request("TZ"), diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index e754989..1de49b0 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -96,6 +96,7 @@ function display_account_form($A,$U="",$T="",$S="",$E="",$H="",$P="",$C="",$R="" * @param string $S Whether or not the account is suspended * @param string $E The e-mail address for the user * @param string $H Whether or not the e-mail address should be hidden + * @param string $PO The old password of the user * @param string $P The password for the user * @param string $C The confirmed password for the user * @param string $R The real name of the user @@ -116,7 +117,7 @@ function display_account_form($A,$U="",$T="",$S="",$E="",$H="",$P="",$C="",$R="" * * @return array Boolean indicating success and message to be printed */ -function process_account_form($TYPE,$A,$U="",$T="",$S="",$E="",$H="",$P="",$C="", +function process_account_form($TYPE,$A,$U="",$T="",$S="",$E="",$H="",$PO="",$P="",$C="", $R="",$L="",$TZ="",$HP="",$I="",$K="",$PK="",$J="",$CN="",$UN="",$ON="",$UID=0,$N="",$captcha_salt="",$captcha="") { global $SUPPORTED_LANGS; @@ -134,6 +135,7 @@ function process_account_form($TYPE,$A,$U="",$T="",$S="",$E="",$H="",$P="",$C="" if(isset($_COOKIE['AURSID'])) { $editor_user = uid_from_sid($_COOKIE['AURSID']); + $row = account_details(in_request("ID"), in_request("U")); } else { $editor_user = null; @@ -159,9 +161,18 @@ function process_account_form($TYPE,$A,$U="",$T="",$S="",$E="",$H="",$P="",$C="" . "</li>\n</ul>"; } - if (!$error && $P && $C && ($P != $C)) { + if (!$error && $P && !$C) { + $error = __("Please confirm your new password."); + } + if (!$error && $P && !$PO) { + $error = __("Please enter your old password in order to set a new one."); + } + if (!$error && $P && $P != $C) { $error = __("Password fields do not match."); } + if (!$error && $P && check_passwd($UID, $PO) != 1) { + $error = __("The old password is invalid."); + } if (!$error && $P != '' && !good_passwd($P)) { $length_min = config_get_int('options', 'passwd_min_len'); $error = __("Your password must be at least %s characters.", diff --git a/web/template/account_edit_form.php b/web/template/account_edit_form.php index 5e84aa7..25e9185 100644 --- a/web/template/account_edit_form.php +++ b/web/template/account_edit_form.php @@ -86,18 +86,6 @@ <input type="checkbox" name="H" id="id_hide" <?= $H ? 'checked="checked"' : '' ?> /> </p> - <?php if ($A == "UpdateAccount"): ?> - <p> - <label for="id_passwd1"><?= __("Password") ?>:</label> - <input type="password" size="30" name="P" id="id_passwd1" value="<?= $P ?>" /> - </p> - - <p> - <label for="id_passwd2"><?= __("Re-type password") ?>:</label> - <input type="password" size="30" name="C" id="id_passwd2" value="<?= $C ?>" /> - </p> - <?php endif; ?> - <p> <label for="id_realname"><?= __("Real Name") ?>:</label> <input type="text" size="30" maxlength="32" name="R" id="id_realname" value="<?= htmlspecialchars($R,ENT_QUOTES) ?>" /> @@ -150,6 +138,26 @@ </p> </fieldset> + <?php if ($A == "UpdateAccount"): ?> + <fieldset> + <legend><?= __("If you want to change your password, enter your current passport, your new password and confirm the new password by entering it again.") ?></legend> + <p> + <label for="id_passwd_old"><?= __("Old password") ?>:</label> + <input type="password" size="30" name="PO" id="id_passwd_old" value="<?= $PO ?>" /> + </p> + + <p> + <label for="id_passwd1"><?= __("Password") ?>:</label> + <input type="password" size="30" name="P" id="id_passwd1" value="<?= $P ?>" /> + </p> + + <p> + <label for="id_passwd2"><?= __("Re-type password") ?>:</label> + <input type="password" size="30" name="C" id="id_passwd2" value="<?= $C ?>" /> + </p> + </fieldset> + <?php endif; ?> + <fieldset> <legend><?= __("The following information is only required if you want to submit packages to the Arch User Repository.") ?></legend> <p> -- 2.25.0

1 0

[PATCH] Copy Git repository URL on click
by Lukas Fleischer 11 Dec '19

11 Dec '19

The Git repository URLs are not meant to be visited using a web browser. Copy the link to the clipboard instead. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/template/pkg_details.php | 17 +++++++++++++++-- web/template/pkgbase_details.php | 17 +++++++++++++++-- 2 files changed, 30 insertions(+), 4 deletions(-) diff --git a/web/template/pkg_details.php b/web/template/pkg_details.php index 93b5f1e..c6bb32d 100644 --- a/web/template/pkg_details.php +++ b/web/template/pkg_details.php @@ -100,9 +100,9 @@ $base_uri = get_pkgbase_uri($row['BaseName']); <tr> <th><?= __('Git Clone URL') . ': ' ?></th> <td> - <a href="<?= $git_clone_uri_anon ?>"><?= $git_clone_uri_anon ?></a> (<?= __('read-only') ?>) + <a class="copy" href="<?= $git_clone_uri_anon ?>"><?= $git_clone_uri_anon ?></a> (<?= __('read-only') ?>, <?= __('click to copy') ?>) <?php if (in_array($uid, $maintainers)): ?> - <br /> <a href="<?= $git_clone_uri_priv ?>"><?= $git_clone_uri_priv ?></a> + <br /> <a class="copy" href="<?= $git_clone_uri_priv ?>"><?= $git_clone_uri_priv ?></a> (<?= __('click to copy') ?>) <?php endif; ?> </td> </tr> @@ -306,3 +306,16 @@ endif; <?php endif; ?> </div> </div> + +<script> +$(document).ready(function() { + $('.copy').click(function(e) { + var tmp = $("<input>"); + $("body").append(tmp); + tmp.val($(this).text()).select(); + document.execCommand("copy"); + tmp.remove(); + e.preventDefault(); + }); +}); +</script> diff --git a/web/template/pkgbase_details.php b/web/template/pkgbase_details.php index b2ce8cb..a6857c4 100644 --- a/web/template/pkgbase_details.php +++ b/web/template/pkgbase_details.php @@ -49,9 +49,9 @@ $base_uri = get_pkgbase_uri($row['Name']); <tr> <th><?= __('Git Clone URL') . ': ' ?></th> <td> - <a href="<?= $git_clone_uri_anon ?>"><?= $git_clone_uri_anon ?></a> (<?= __('read-only') ?>) + <a class="copy" href="<?= $git_clone_uri_anon ?>"><?= $git_clone_uri_anon ?></a> (<?= __('read-only') ?>, <?= __('click to copy') ?>) <?php if (in_array($uid, $maintainers)): ?> - <br /> <a href="<?= $git_clone_uri_priv ?>"><?= $git_clone_uri_priv ?></a> + <br /> <a class="copy" href="<?= $git_clone_uri_priv ?>"><?= $git_clone_uri_priv ?></a> (<?= __('click to copy') ?>) <?php endif; ?> </td> </tr> @@ -135,3 +135,16 @@ endif; </div> </div> </div> + +<script> +$(document).ready(function() { + $('.copy').click(function(e) { + var tmp = $("<input>"); + $("body").append(tmp); + tmp.val($(this).text()).select(); + document.execCommand("copy"); + tmp.remove(); + e.preventDefault(); + }); +}); +</script> -- 2.24.0

1 0