- Aur-dev - lists.archlinux.org

[PATCH] Make CAPTCHA salt invalidation more robust
by Lukas Fleischer 05 Oct '19

05 Oct '19

With the previous implementation, unlucky users could have their CAPTCHA be invalidated by a single account creation while filling out their account registration form. Make this more robust by allowing up to five account registrations before rejecting a CAPTCHA salt. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/lib/acctfuncs.inc.php | 32 +++++++++++++++++++++++--------- 1 file changed, 23 insertions(+), 9 deletions(-) diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index f9378fe..e754989 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -75,8 +75,8 @@ function display_account_form($A,$U="",$T="",$S="",$E="",$H="",$P="",$C="",$R="" $TZ = config_get("options", "default_timezone"); } - if ($captcha_salt != get_captcha_salt()) { - $captcha_salt = get_captcha_salt(); + if (!in_array($captcha_salt, get_captcha_salts())) { + $captcha_salt = get_captcha_salts()[0]; $captcha = ""; } $captcha_challenge = get_captcha_challenge($captcha_salt); @@ -283,7 +283,7 @@ function process_account_form($TYPE,$A,$U="",$T="",$S="",$E="",$H="",$P="",$C="" $error = __("The CAPTCHA is missing."); } - if (!$error && $TYPE == "new" && $captcha_salt != get_captcha_salt()) { + if (!$error && $TYPE == "new" && !in_array($captcha_salt, get_captcha_salts())) { $error = __("This CAPTCHA has expired. Please try again."); } @@ -1469,17 +1469,31 @@ function account_comments_count($uid) { } /* - * Compute the CAPTCHA salt. The salt changes based on the number of registered - * users. This ensures that new users always use a different salt. - * - * @return string The current salt. + * Compute the list of active CAPTCHA salts. The salt changes based on the + * number of registered users. This ensures that new users always use a + * different salt and protects against hardcoding the CAPTCHA response. + * + * The first CAPTCHA in the list is the most recent one and should be used for + * new CAPTCHA challenges. The other ones are slightly outdated but may still + * be valid for recent challenges that were created before the number of users + * increased. The current implementation ensures that we can still use our + * CAPTCHA salt, even if five new users registered since the CAPTCHA challenge + * was created. + * + * @return string The list of active salts, the first being the most recent + * one. */ -function get_captcha_salt() { +function get_captcha_salts() { $dbh = DB::connect(); $q = "SELECT count(*) FROM Users"; $result = $dbh->query($q); $user_count = $result->fetchColumn(); - return 'aurweb-' . floor($user_count / 3); + + $ret = array(); + for ($i = 0; $i <= 5; $i++) { + array_push($ret, 'aurweb-' . ($user_count - $i)); + } + return $ret; } /* -- 2.23.0

1 0

[PATCH] Add a simple CAPTCHA to the sign up form
by Lukas Fleischer 05 Oct '19

05 Oct '19

Add a CAPTCHA to protect against automated account creation. The CAPTCHA changes whenever three new accounts are registered. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- This is a first attempt to stop the recent wave of spammers. Other counter-measures will be implemented if it is not effective. web/html/register.php | 14 +++++- web/lib/acctfuncs.inc.php | 74 +++++++++++++++++++++++++++++- web/template/account_edit_form.php | 11 +++++ 3 files changed, 95 insertions(+), 4 deletions(-) diff --git a/web/html/register.php b/web/html/register.php index 368999a..a426482 100644 --- a/web/html/register.php +++ b/web/html/register.php @@ -36,7 +36,12 @@ if (in_request("Action") == "NewAccount") { 0, in_request("CN"), in_request("UN"), - in_request("ON")); + in_request("ON"), + 0, + "", + in_request("captcha_salt"), + in_request("captcha"), + ); print $message; @@ -59,7 +64,12 @@ if (in_request("Action") == "NewAccount") { 0, in_request("CN"), in_request("UN"), - in_request("ON")); + in_request("ON"), + 0, + "", + in_request("captcha_salt"), + in_request("captcha") + ); } } else { print '<p>' . __("Use this form to create an account.") . '</p>'; diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index dc44484..b0513c6 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -62,17 +62,25 @@ function html_format_pgp_fingerprint($fingerprint) { * @param string $ON Whether to notify of ownership changes * @param string $UID The user ID of the displayed user * @param string $N The username as present in the database + * @param string $captcha_salt The salt used for the CAPTCHA. + * @param string $captcha The CAPTCHA answer. * * @return void */ function display_account_form($A,$U="",$T="",$S="",$E="",$H="",$P="",$C="",$R="", - $L="",$TZ="",$HP="",$I="",$K="",$PK="",$J="",$CN="",$UN="",$ON="",$UID=0,$N="") { + $L="",$TZ="",$HP="",$I="",$K="",$PK="",$J="",$CN="",$UN="",$ON="",$UID=0,$N="",$captcha_salt="",$captcha="") { global $SUPPORTED_LANGS; if ($TZ == "") { $TZ = config_get("options", "default_timezone"); } + if ($captcha_salt != get_captcha_salt()) { + $captcha_salt = get_captcha_salt(); + $captcha = ""; + } + $captcha_challenge = get_captcha_challenge($captcha_salt); + include("account_edit_form.php"); return; } @@ -103,11 +111,13 @@ function display_account_form($A,$U="",$T="",$S="",$E="",$H="",$P="",$C="",$R="" * @param string $ON Whether to notify of ownership changes * @param string $UID The user ID of the modified account * @param string $N The username as present in the database + * @param string $captcha_salt The salt used for the CAPTCHA. + * @param string $captcha The CAPTCHA answer. * * @return array Boolean indicating success and message to be printed */ function process_account_form($TYPE,$A,$U="",$T="",$S="",$E="",$H="",$P="",$C="", - $R="",$L="",$TZ="",$HP="",$I="",$K="",$PK="",$J="",$CN="",$UN="",$ON="",$UID=0,$N="") { + $R="",$L="",$TZ="",$HP="",$I="",$K="",$PK="",$J="",$CN="",$UN="",$ON="",$UID=0,$N="",$captcha_salt="",$captcha="") { global $SUPPORTED_LANGS; $error = ''; @@ -269,6 +279,18 @@ function process_account_form($TYPE,$A,$U="",$T="",$S="",$E="",$H="",$P="",$C="" } } + if (!$error && $TYPE == "new" && empty($captcha)) { + $error = __("The CAPTCHA is missing."); + } + + if (!$error && $TYPE == "new" && $captcha_salt != get_captcha_salt()) { + $error = __("This CAPTCHA has expired. Please try again."); + } + + if (!$error && $TYPE == "new" && $captcha != get_captcha_answer($captcha_salt)) { + $error = __("The entered CAPTCHA answer is invalid."); + } + if ($error) { $message = "<ul class='errorlist'><li>".$error."</li></ul>\n"; return array(false, $message); @@ -1445,3 +1467,51 @@ function account_comments_count($uid) { $result = $dbh->query($q); return $result->fetchColumn(); } + +/* + * Compute the CAPTCHA salt. The salt changes based on the number of registered + * users. This ensures that new users always use a different salt. + * + * @return string The current salt. + */ +function get_captcha_salt() { + $dbh = DB::connect(); + $q = "SELECT count(*) FROM Users"; + $result = $dbh->query($q); + $user_count = $result->fetchColumn(); + return 'aurweb-' . floor($user_count / 3); +} + +/* + * Return the CAPTCHA challenge for a given salt. + * + * @param string $salt The salt to be used for the CAPTCHA computation. + * + * @return string The challenge as a string. + */ +function get_captcha_challenge($salt) { + $token = substr(md5($salt), 0, 3); + return "pacman -V|sed -r 's#[0-9]+#" . $token . "#g'|md5sum|cut -c1-6"; +} + +/* + * Compute CAPTCHA answer for a given salt. + * + * @param string $salt The salt to be used for the CAPTCHA computation. + * + * @return string The correct answer as a string. + */ +function get_captcha_answer($salt) { + $token = substr(md5($salt), 0, 3); + $text = <<<EOD + + .--. Pacman v$token.$token.$token - libalpm v$token.$token.$token +/ _.-' .-. .-. .-. Copyright (C) $token-$token Pacman Development Team +\ '-. '-' '-' '-' Copyright (C) $token-$token Judd Vinet + '--' + This program may be freely redistributed under + the terms of the GNU General Public License. + +EOD; + return substr(md5($text . "\n"), 0, 6); +} diff --git a/web/template/account_edit_form.php b/web/template/account_edit_form.php index 38d5274..5e84aa7 100644 --- a/web/template/account_edit_form.php +++ b/web/template/account_edit_form.php @@ -174,6 +174,17 @@ </p> </fieldset> + <?php if ($A != "UpdateAccount"): ?> + <fieldset> + <legend><?= __("To protect the AUR against automated account creation, we kindly ask you to provide the output of the following command:") ?> <code><?= htmlspecialchars($captcha_challenge) ?></code></legend> + <p> + <label for="id_captcha"><?= __("Answer") ?>:</label> + <input type="text" size="30" maxlength="6" name="captcha" id="id_captcha" value="<?= htmlspecialchars($captcha, ENT_QUOTES) ?>" /> (<?= __("required") ?>) + <input type="hidden" name="captcha_salt" value="<?= htmlspecialchars($captcha_salt) ?>" /> + </p> + </fieldset> + <?php endif; ?> + <fieldset> <p> <label></label> -- 2.23.0

2 2

trivia: size of packages.gz shrinks when sorted
by Greg Minshall 02 Oct '19

02 Oct '19

1 0

[PATCH] notify.py: Use a/an correctly when sending request notifications
by Lars Rustand 19 Aug '19

19 Aug '19

Will no longer send notifications about "a orphan request", but determine whether to use a/an based on the first character of the request type. Signed-off-by: Lars Rustand <rustand.lars(a)gmail.com> --- aurweb/scripts/notify.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/aurweb/scripts/notify.py b/aurweb/scripts/notify.py index d975086..ace6614 100755 --- a/aurweb/scripts/notify.py +++ b/aurweb/scripts/notify.py @@ -414,8 +414,9 @@ class RequestOpenNotification(Notification): (self._user, self._pkgbase, self._merge_into) body += '\n\n' + self._text else: - body = '%s [1] filed a %s request for %s [2]:' % \ - (self._user, self._reqtype, self._pkgbase) + an = ["a","an"][self._reqtype[0] in "aeiou"] + body = '%s [1] filed %s %s request for %s [2]:' % \ + (self._user, an, self._reqtype, self._pkgbase) body += '\n\n' + self._text return body -- 2.22.0

3 3

[aur-dev][PATCH] Move permission for LIST_COMMENTS to dev/tu block
by Eli Schwartz 18 Aug '19

18 Aug '19

In commit 3578e77ad4e9258495eed7e786b7dc3aebcf1b63 we implemented listing of comments from the account details page , but this was intended to only be available to TUs and Devs. As the comment says: "display the comment list if they're a TU/dev" The credential checking code, however, set this credential for all users, contrary to the intention of the commit. Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> --- web/lib/credentials.inc.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/web/lib/credentials.inc.php b/web/lib/credentials.inc.php index c125119..96c7233 100644 --- a/web/lib/credentials.inc.php +++ b/web/lib/credentials.inc.php @@ -49,7 +49,6 @@ function has_credential($credential, $approved_users=array()) { $atype = account_from_sid($_COOKIE['AURSID']); switch ($credential) { - case CRED_ACCOUNT_LIST_COMMENTS: case CRED_PKGBASE_FLAG: case CRED_PKGBASE_NOTIFY: case CRED_PKGBASE_VOTE: @@ -60,6 +59,7 @@ function has_credential($credential, $approved_users=array()) { case CRED_ACCOUNT_CHANGE_TYPE: case CRED_ACCOUNT_EDIT: case CRED_ACCOUNT_LAST_LOGIN: + case CRED_ACCOUNT_LIST_COMMENTS: case CRED_ACCOUNT_SEARCH: case CRED_COMMENT_DELETE: case CRED_COMMENT_UNDELETE: -- 2.23.0

2 4

kodi-devel-bin
by Паша 09 Aug '19

09 Aug '19

Hey guys! Am I wrong or package kodi-devel-bin really breaks guidelines? It looks like it compiles kodi from scratch every time Pasha

2 1

Re: [PATCH] notify.py: Use a/an correctly when sending request notifications
by Eli Schwartz 09 Aug '19

09 Aug '19

On 8/9/19 2:08 PM, Lars Rustand wrote: > Argh, gmail replies to the wrong address. > > On Fri, Aug 9, 2019, 20:06 Lars Rustand <rustand.lars(a)gmail.com> wrote: > >> Thank you for the feedback, I totally agree with your remarks. I might be >> a little too fond of codegolfing, that's where I got the idea to use True >> as an index. >> I posted an updated patch where I added your changes. No problem. ;) Thanks. As an aside, I have now seen int(True)-indexed lists used "in the wild"! A clever fox saw what I wrote and PM'ed me a Fizzbuzz implementation which relied on that. -- Eli Schwartz Bug Wrangler and Trusted User

2 1

[PATCH] pkgreqfuncs: Don't leave out non-default ClosureComment column
by Johannes Löthberg 30 Jul '19

30 Jul '19

Since 09cb61a (schema: Remove invalid default values for TEXT columns, 2017-04-15) the PackageRequests.ClosureComment field no longer has a default value. Signed-off-by: Johannes Löthberg <johannes(a)kyriasis.com> --- web/lib/pkgreqfuncs.inc.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/web/lib/pkgreqfuncs.inc.php b/web/lib/pkgreqfuncs.inc.php index b8be7e5..079df38 100644 --- a/web/lib/pkgreqfuncs.inc.php +++ b/web/lib/pkgreqfuncs.inc.php @@ -165,10 +165,10 @@ function pkgreq_file($ids, $type, $merge_into, $comments) { $q = "INSERT INTO PackageRequests "; $q.= "(ReqTypeID, PackageBaseID, PackageBaseName, MergeBaseName, "; - $q.= "UsersID, Comments, RequestTS) VALUES (" . $type_id . ", "; + $q.= "UsersID, Comments, ClosureComment, RequestTS) VALUES (" . $type_id . ", "; $q.= $base_id . ", " . $dbh->quote($pkgbase_name) . ", "; $q.= $dbh->quote($merge_into) . ", " . $uid . ", "; - $q.= $dbh->quote($comments) . ", " . strval(time()) . ")"; + $q.= $dbh->quote($comments) . ", '', " . strval(time()) . ")"; $dbh->exec($q); $request_id = $dbh->lastInsertId(); -- 2.22.0

2 1

[PATCH v2] Implement spamming mitigations for comments
by Jelle van der Waa 30 Jun '19

30 Jun '19

From: Jelle van der Waa <jelle(a)vdwaa.nl> Add a hidden input text field named 'website' which is hidden by CSS to not show up for normal users. Automated bots try to fill in all text fields, especially 'required' fields such as a 'website' when spamming a webform. When a comment is posted with the 'website' field filled in ignore it, so it seems that the submission is succesful. Signed-off-by: Jelle van der Waa <jelle(a)vdwaa.nl> --- web/html/css/aurweb.css | 4 ++++ web/html/pkgbase.php | 3 ++- web/template/pkg_comment_form.php | 1 + 3 files changed, 7 insertions(+), 1 deletion(-) diff --git a/web/html/css/aurweb.css b/web/html/css/aurweb.css index 81bf9ab..aa0a7b0 100644 --- a/web/html/css/aurweb.css +++ b/web/html/css/aurweb.css @@ -199,3 +199,7 @@ label.confirmation, .error { color: red; } + +#id_website { + display: none; +} diff --git a/web/html/pkgbase.php b/web/html/pkgbase.php index b716644..0241ae3 100644 --- a/web/html/pkgbase.php +++ b/web/html/pkgbase.php @@ -117,7 +117,8 @@ if (check_token()) { list($ret, $output) = pkgreq_close($_POST['reqid'], $_POST['reason'], $_POST['comments']); } elseif (current_action("do_EditComaintainers")) { list($ret, $output) = pkgbase_set_comaintainers($base_id, explode("\n", $_POST['users'])); - } elseif (current_action("do_AddComment")) { + } elseif (current_action("do_AddComment") && $_REQUEST['website'] === "") { + // website is a hidden field used to detect if a bot filled in all form elements $uid = uid_from_sid($_COOKIE["AURSID"]); list($ret, $output) = pkgbase_add_comment($base_id, $uid, $_REQUEST['comment']); if ($ret && isset($_REQUEST['enable_notifications'])) { diff --git a/web/template/pkg_comment_form.php b/web/template/pkg_comment_form.php index 3feee8f..23322a7 100644 --- a/web/template/pkg_comment_form.php +++ b/web/template/pkg_comment_form.php @@ -11,6 +11,7 @@ <p> <textarea id="id_comment" name="comment" cols="80" rows="10"><?= (isset($comment_id)) ? htmlspecialchars($comment) : "" ?></textarea> </p> + <input id="id_website" type="text" name="website"/> <p> <input type="submit" value="<?= (isset($comment_id)) ? __("Save") : __("Add Comment") ?>" /> <?php if (!isset($comment_id) && !pkgbase_user_notify($uid, $base_id)): ?> -- 2.22.0

2 1

[PATCH] Update copyright year in the cgit footer template
by Michael Straube 30 Jun '19

30 Jun '19

Signed-off-by: Michael Straube <michael.straube(a)posteo.de> --- web/template/cgit/footer.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/web/template/cgit/footer.html b/web/template/cgit/footer.html index 6ceec28..1c0bf6f 100644 --- a/web/template/cgit/footer.html +++ b/web/template/cgit/footer.html @@ -1,6 +1,6 @@ <div id="footer"> <p> - Copyright © 2004-2018 aurweb Development Team – + Copyright © 2004-2019 aurweb Development Team – <strong>AUR packages are user produced content. Any use of the provided files is at your own risk.</strong> </p> </div> -- 2.22.0

2 1