- Aur-dev - lists.archlinux.org

[aur-dev] [PATCH] Allow package co-maintainers to pin comments
by Lukas Fleischer 06 Nov '17

06 Nov '17

Implements FS#56255. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/lib/pkgfuncs.inc.php | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/web/lib/pkgfuncs.inc.php b/web/lib/pkgfuncs.inc.php index 5c48a8e..dbcf63e 100644 --- a/web/lib/pkgfuncs.inc.php +++ b/web/lib/pkgfuncs.inc.php @@ -85,8 +85,9 @@ function can_edit_comment_array($comment) { /** * Determine if the user can pin a specific package comment * - * Only the Package Maintainer, Trusted Users, and Developers can pin - * comments. This function is used for the backend side of comment pinning. + * Only the Package Maintainer, Package Co-maintainers, Trusted Users, and + * Developers can pin comments. This function is used for the backend side of + * comment pinning. * * @param string $comment_id The comment ID in the database * @@ -97,6 +98,11 @@ function can_pin_comment($comment_id=0) { $q = "SELECT MaintainerUID FROM PackageBases AS pb "; $q.= "LEFT JOIN PackageComments AS pc ON pb.ID = pc.PackageBaseID "; + $q.= "WHERE pc.ID = " . intval($comment_id) . " "; + $q.= "UNION "; + $q = "SELECT pcm.UsersID FROM PackageComaintainers AS pcm "; + $q.= "LEFT JOIN PackageComments AS pc "; + $q.= "ON pcm.PackageBaseID = pc.PackageBaseID "; $q.= "WHERE pc.ID = " . intval($comment_id); $result = $dbh->query($q); @@ -104,16 +110,17 @@ function can_pin_comment($comment_id=0) { return false; } - $uid = $result->fetch(PDO::FETCH_COLUMN, 0); + $uids = $result->fetchAll(PDO::FETCH_COLUMN, 0); - return has_credential(CRED_COMMENT_PIN, array($uid)); + return has_credential(CRED_COMMENT_PIN, $uids); } /** * Determine if the user can edit a specific package comment using an array * - * Only the Package Maintainer, Trusted Users, and Developers can pin - * comments. This function is used for the frontend side of comment pinning. + * Only the Package Maintainer, Package Co-maintainers, Trusted Users, and + * Developers can pin comments. This function is used for the frontend side of + * comment pinning. * * @param array $comment All database information relating a specific comment * -- 2.15.0

1 0

[aur-dev] [PATCH] login.php: Escape quotes in the referer field
by Lukas Fleischer 05 Nov '17

05 Nov '17

Replace special characters in the referer GET parameter using htmlspecialchars() before inserting it into the login form fields to prevent from XSS attacks. Fixes FS#55286. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/html/login.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/web/html/login.php b/web/html/login.php index a55ce05..df51705 100644 --- a/web/html/login.php +++ b/web/html/login.php @@ -41,7 +41,7 @@ html_header('AUR ' . __("Login")); <input type="submit" class="button" value="<?php print __("Login"); ?>" /> <a href="<?= get_uri('/passreset/') ?>">[<?= __('Forgot Password') ?>]</a> <?php if (in_request('referer') !== ""): ?> - <input id="id_referer" type="hidden" name="referer" value="<?= in_request('referer') ?>" /> + <input id="id_referer" type="hidden" name="referer" value="<?= htmlspecialchars(in_request('referer'), ENT_QUOTES) ?>" /> <?php elseif (isset($_SERVER['HTTP_REFERER'])): ?> <input id="id_referer" type="hidden" name="referer" value="<?= htmlspecialchars($_SERVER['HTTP_REFERER'], ENT_QUOTES) ?>" /> <?php endif; ?> -- 2.15.0

1 0

[aur-dev] [PATCH 1/2] Set X-Frame-Options to DENY for all pages
by Lukas Fleischer 05 Nov '17

05 Nov '17

Do not allow to render aurweb pages in a frame to protect against clickjacking. Fixes FS#56168. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/lib/aur.inc.php | 1 + 1 file changed, 1 insertion(+) diff --git a/web/lib/aur.inc.php b/web/lib/aur.inc.php index ce569ea..6cd0451 100644 --- a/web/lib/aur.inc.php +++ b/web/lib/aur.inc.php @@ -4,6 +4,7 @@ header('Content-Type: text/html; charset=utf-8'); header('Cache-Control: no-cache, must-revalidate'); header('Expires: Tue, 11 Oct 1988 22:00:00 GMT'); // quite a special day header('Pragma: no-cache'); +header('X-Frame-Options: DENY'); date_default_timezone_set('UTC'); -- 2.15.0

1 1

[aur-dev] [PATCH] Point out that the user name is public when registering
by Lukas Fleischer 05 Nov '17

05 Nov '17

Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/template/account_edit_form.php | 3 +++ 1 file changed, 3 insertions(+) diff --git a/web/template/account_edit_form.php b/web/template/account_edit_form.php index 17c9d14..833e74a 100644 --- a/web/template/account_edit_form.php +++ b/web/template/account_edit_form.php @@ -20,6 +20,9 @@ <label for="id_username"><?= __("Username") ?>:</label> <input type="text" size="30" maxlength="<?= config_get_int('options', 'username_max_len'); ?>" name="U" id="id_username" value="<?= htmlspecialchars($U,ENT_QUOTES) ?>" /> (<?= __("required") ?>) </p> + <p> + <em><?= __("Your user name is the name you will use to login. It is visible to the general public, even if your account is inactive.") ?></em> + </p> <?php # Only TUs or Devs can promote/demote/suspend a user if (has_credential(CRED_ACCOUNT_CHANGE_TYPE)): -- 2.15.0

1 0

[aur-dev] aurweb 4.6.0 release preparations
by Lukas Fleischer 03 Nov '17

03 Nov '17

Hi, Since the AUR ToS documents are still being reviewed and I do not expect any major progress within the next couple of weeks, I would like to release 4.6.0 before the documents are polished (against my original plans to synchronize the aurweb release with the ToS release). Apart from proper ToS support, the current development version includes some nice features such as Markdown support in comments as well as some bug fixes. There is one change, namely commit d9883ee (mkpkglists: Generate a list of user names, 2017-08-01), which might be a bit controversial as-is. It extends the public interface to provide a list of user names (just the account names, no real name). Some members of our team expressed their concerns with making such a change without informing all registered users. Therefore, I would like to send an automated email to all registered AUR accounts, informing them on the change and giving them the chance to opt-out of the feature by deleting their accounts (all accounts with any kind of activity already reveal their user names, so people potentially concerned about making their user name publicly visible do not need their accounts anyway). Here is a draft: Dear AUR user, The next aurweb release, which will be released on 2017-12-03, includes a public interface to obtain a list of account names of all registered users. This means that, starting on 2017-12-03, your user name (only the account name you specified when registering, not your real name) will be visible to the general public. If you do not agree to this change, please delete your account by logging into the AUR web interface, going to your account details page and clicking the account deletion link before 2017-12-03. Thanks for using the AUR! The AUR Development Team If have any objections/improvements, please let me know. Regards, Lukas

2 2

[aur-dev] [PATCH 1/3] Do not hardcode path to the Python interpreter
by Lukas Fleischer 25 Aug '17

25 Aug '17

Use `/usr/bin/env python3` instead of `/usr/bin/python3` in the shebang of Python scripts. This adds support for non-standard Python interpreter paths such as the paths used in virtualenv environments. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- aurweb/git/auth.py | 2 +- aurweb/git/serve.py | 2 +- aurweb/git/update.py | 2 +- aurweb/scripts/aurblup.py | 2 +- aurweb/scripts/mkpkglists.py | 2 +- aurweb/scripts/notify.py | 2 +- aurweb/scripts/pkgmaint.py | 2 +- aurweb/scripts/popupdate.py | 2 +- aurweb/scripts/rendercomment.py | 2 +- aurweb/scripts/tuvotereminder.py | 2 +- schema/gendummydata.py | 2 +- 11 files changed, 11 insertions(+), 11 deletions(-) diff --git a/aurweb/git/auth.py b/aurweb/git/auth.py index d02390d..b7819a9 100755 --- a/aurweb/git/auth.py +++ b/aurweb/git/auth.py @@ -1,4 +1,4 @@ -#!/usr/bin/python3 +#!/usr/bin/env python3 import os import shlex diff --git a/aurweb/git/serve.py b/aurweb/git/serve.py index dfaddd1..93ff34c 100755 --- a/aurweb/git/serve.py +++ b/aurweb/git/serve.py @@ -1,4 +1,4 @@ -#!/usr/bin/python3 +#!/usr/bin/env python3 import os import re diff --git a/aurweb/git/update.py b/aurweb/git/update.py index 16fa2b0..f681ddb 100755 --- a/aurweb/git/update.py +++ b/aurweb/git/update.py @@ -1,4 +1,4 @@ -#!/usr/bin/python3 +#!/usr/bin/env python3 import os import pygit2 diff --git a/aurweb/scripts/aurblup.py b/aurweb/scripts/aurblup.py index 1b6de2f..1433173 100755 --- a/aurweb/scripts/aurblup.py +++ b/aurweb/scripts/aurblup.py @@ -1,4 +1,4 @@ -#!/usr/bin/python3 +#!/usr/bin/env python3 import pyalpm import re diff --git a/aurweb/scripts/mkpkglists.py b/aurweb/scripts/mkpkglists.py index 686ee7d..6724141 100755 --- a/aurweb/scripts/mkpkglists.py +++ b/aurweb/scripts/mkpkglists.py @@ -1,4 +1,4 @@ -#!/usr/bin/python3 +#!/usr/bin/env python3 import datetime import gzip diff --git a/aurweb/scripts/notify.py b/aurweb/scripts/notify.py index 69164fb..2d0f757 100755 --- a/aurweb/scripts/notify.py +++ b/aurweb/scripts/notify.py @@ -1,4 +1,4 @@ -#!/usr/bin/python3 +#!/usr/bin/env python3 import email.mime.text import subprocess diff --git a/aurweb/scripts/pkgmaint.py b/aurweb/scripts/pkgmaint.py index 3ad9ed8..36da126 100755 --- a/aurweb/scripts/pkgmaint.py +++ b/aurweb/scripts/pkgmaint.py @@ -1,4 +1,4 @@ -#!/usr/bin/python3 +#!/usr/bin/env python3 import time diff --git a/aurweb/scripts/popupdate.py b/aurweb/scripts/popupdate.py index 58cd018..b64deed 100755 --- a/aurweb/scripts/popupdate.py +++ b/aurweb/scripts/popupdate.py @@ -1,4 +1,4 @@ -#!/usr/bin/python3 +#!/usr/bin/env python3 import time diff --git a/aurweb/scripts/rendercomment.py b/aurweb/scripts/rendercomment.py index 9c0aa6a..22aa856 100755 --- a/aurweb/scripts/rendercomment.py +++ b/aurweb/scripts/rendercomment.py @@ -1,4 +1,4 @@ -#!/usr/bin/python3 +#!/usr/bin/env python3 import re import pygit2 diff --git a/aurweb/scripts/tuvotereminder.py b/aurweb/scripts/tuvotereminder.py index 97b1d12..eb3874e 100755 --- a/aurweb/scripts/tuvotereminder.py +++ b/aurweb/scripts/tuvotereminder.py @@ -1,4 +1,4 @@ -#!/usr/bin/python3 +#!/usr/bin/env python3 import subprocess import time diff --git a/schema/gendummydata.py b/schema/gendummydata.py index 5ed6332..1f3d047 100755 --- a/schema/gendummydata.py +++ b/schema/gendummydata.py @@ -1,4 +1,4 @@ -#!/usr/bin/python3 +#!/usr/bin/env python3 """ usage: gendummydata.py outputfilename.sql """ -- 2.14.1

1 2

[aur-dev] [PATCH] t1100: Test AUR_OVERWRITE
by Lukas Fleischer 10 Aug '17

10 Aug '17

Since c5302d3 (Require TUs to explicitly request to overwrite a pkgbase, 2017-07-24), non-fast-forward pushes require setting the AUR_OVERWRITE environment variable. Make sure that git-auth passes this variable to git-serve when it should (and does not pass it if it shouldn't). Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- test/t1100-git-auth.sh | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/test/t1100-git-auth.sh b/test/t1100-git-auth.sh index 71d526f..dd20bea 100755 --- a/test/t1100-git-auth.sh +++ b/test/t1100-git-auth.sh @@ -25,4 +25,21 @@ test_expect_success 'Test authentication with a wrong key.' ' test_must_be_empty out ' +test_expect_success 'Test AUR_OVERWRITE passthrough.' ' + AUR_OVERWRITE=1 \ + "$GIT_AUTH" "$AUTH_KEYTYPE_TU" "$AUTH_KEYTEXT_TU" >out && + grep -q AUR_OVERWRITE=1 out +' + +test_expect_success 'Make sure that AUR_OVERWRITE is unset by default.' ' + "$GIT_AUTH" "$AUTH_KEYTYPE_TU" "$AUTH_KEYTEXT_TU" >out && + grep -q AUR_OVERWRITE=0 out +' + +test_expect_success 'Make sure regular users cannot set AUR_OVERWRITE.' ' + AUR_OVERWRITE=1 \ + "$GIT_AUTH" "$AUTH_KEYTYPE_USER" "$AUTH_KEYTEXT_USER" >out && + grep -q AUR_OVERWRITE=0 out +' + test_done -- 2.14.0

1 0

[aur-dev] [PATCH] git-serve: Fix broken SQL statement
by Lukas Fleischer 08 Aug '17

08 Aug '17

Add a missing space to the SQL statement performing the disown operation. Fixes FS#55068. Note that the broken query was not discovered by the test suite since SQLite parses "?AND" inside prepared statements gracefully while MySQL does not. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- aurweb/git/serve.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/aurweb/git/serve.py b/aurweb/git/serve.py index eea0c9c..dfaddd1 100755 --- a/aurweb/git/serve.py +++ b/aurweb/git/serve.py @@ -192,7 +192,7 @@ def pkgreq_by_pkgbase(pkgbase_id, reqtype): "INNER JOIN RequestTypes ON " + "RequestTypes.ID = PackageRequests.ReqTypeID " + "WHERE PackageRequests.Status = 0 " + - "AND PackageRequests.PackageBaseID = ?" + + "AND PackageRequests.PackageBaseID = ? " + "AND RequestTypes.Name = ?", [pkgbase_id, reqtype]) return [row[0] for row in cur.fetchall()] -- 2.14.0

1 0

[aur-dev] [PATCH] t1300: Fix test cases for non-fast-forward pushes
by Lukas Fleischer 08 Aug '17

08 Aug '17

Since commit c5302d3 (Require TUs to explicitly request to overwrite a pkgbase, 2017-07-24), non-fast-forward pushes are denied even for Trusted Users, unless the AUR_OVERWRITE environment variable is set. Mark the test case performing a non-fast-forward push from a TU account as test_must_fail and add another test case performing the same operation with AUR_OVERWRITE=1. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- test/t1300-git-update.sh | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/test/t1300-git-update.sh b/test/t1300-git-update.sh index f16e2ad..109351a 100755 --- a/test/t1300-git-update.sh +++ b/test/t1300-git-update.sh @@ -125,7 +125,18 @@ test_expect_success 'Performing a non-fast-forward ref update.' ' test_expect_success 'Performing a non-fast-forward ref update as Trusted User.' ' old=$(git -C aur.git rev-parse HEAD) && new=$(git -C aur.git rev-parse HEAD^) && + cat >expected <<-EOD && + error: denying non-fast-forward (you should pull first) + EOD AUR_USER=tu AUR_PKGBASE=foobar AUR_PRIVILEGED=1 \ + test_must_fail "$GIT_UPDATE" refs/heads/master "$old" "$new" 2>&1 && + test_cmp expected actual +' + +test_expect_success 'Performing a non-fast-forward ref update with AUR_OVERWRITE=1.' ' + old=$(git -C aur.git rev-parse HEAD) && + new=$(git -C aur.git rev-parse HEAD^) && + AUR_USER=tu AUR_PKGBASE=foobar AUR_PRIVILEGED=1 AUR_OVERWRITE=1 \ "$GIT_UPDATE" refs/heads/master "$old" "$new" 2>&1 ' -- 2.14.0

1 0

[aur-dev] Fixed translation
by Daniel Milde 03 Aug '17

03 Aug '17

Hi all, I fixed one annoying wrong translation in submenu for czech language. Patch in attachement. Thanks Daniel

2 2