- Aur-dev - lists.archlinux.org

[aur-dev] [PATCH] Document new git-serve commands
by Lukas Fleischer 22 Jul '17

22 Jul '17

Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- doc/git-interface.txt | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/doc/git-interface.txt b/doc/git-interface.txt index 475fda6..7758512 100644 --- a/doc/git-interface.txt +++ b/doc/git-interface.txt @@ -41,11 +41,15 @@ The Shell: git-serve The git-serve command, the "aurweb shell", provides different subcommands: +* The adopt/disown commands can be used to change ownership of a package base. +* The flag/unflag commands can be used to flag/unflag a package. * The help command shows a list of available commands. * The list-repos command lists all repositories of the authenticated user. +* The restore command can be used to restore a deleted package base. +* The set-comaintainers command modifies the co-maintainers of a package base. * The set-keywords command modifies the keywords assigned to a package base. * The setup-repo command can be used to create a new repository. -* The restore command can be used to restore a deleted package base. +* The vote/unvote command can be used to vote/unvote for a package base. * The git-{receive,upload}-pack commands are redirected to git-shell(1). The command is extracted from the SSH_ORIGINAL_COMMAND environment variable -- 2.13.3

1 0

[aur-dev] [PATCH v2 2/2] Require TUs to explicitly request to overwrite a pkgbase
by Eli Schwartz 21 Jul '17

21 Jul '17

AUR_PRIVILEGED allows people with privileged AUR accounts to evade the block on non-fast-forward commits. While valid in this case, we should not do so by default, since in at least one case a TU did this without realizing there was an existing package. ( https://aur.archlinux.org/packages/rtmidi/ ) Switch to using allow_overwrite to check for destructive actions. Use .ssh/config "SendEnv" on the TU's side and and sshd_config "AcceptEnv" in the AUR server to specifically request overwrite access. TUs should use: `export AUR_OVERWRITE=1; git push` Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> --- v2: only require confirmation for force-pushing history. If you want to restrict who can use this feature, it should be as simple as adding a new account_type and modifying the env_vars passthrough, which can be implemented separately. INSTALL | 1 + aurweb/git/auth.py | 1 + aurweb/git/update.py | 3 ++- 3 files changed, 4 insertions(+), 1 deletion(-) diff --git a/INSTALL b/INSTALL index 8c9c4dd..369e1e3 100644 --- a/INSTALL +++ b/INSTALL @@ -76,6 +76,7 @@ read the instructions below. PasswordAuthentication no AuthorizedKeysCommand /usr/local/bin/aurweb-git-auth "%t" "%k" AuthorizedKeysCommandUser aur + AcceptEnv AUR_OVERWRITE 9) If you want to enable smart HTTP support with nginx and fcgiwrap, you can use the following directives: diff --git a/aurweb/git/auth.py b/aurweb/git/auth.py index 022b0ff..fe018cb 100755 --- a/aurweb/git/auth.py +++ b/aurweb/git/auth.py @@ -52,6 +52,7 @@ def main(): env_vars = { 'AUR_USER': user, 'AUR_PRIVILEGED': '1' if account_type > 1 else '0', + 'AUR_OVERWRITE' : os.environ.get('AUR_OVERWRITE', '0') if account_type > 1 else '0', } key = keytype + ' ' + keytext diff --git a/aurweb/git/update.py b/aurweb/git/update.py index 3b9ff97..5419338 100755 --- a/aurweb/git/update.py +++ b/aurweb/git/update.py @@ -238,6 +238,7 @@ def main(): user = os.environ.get("AUR_USER") pkgbase = os.environ.get("AUR_PKGBASE") privileged = (os.environ.get("AUR_PRIVILEGED", '0') == '1') + allow_overwrite = (os.environ.get("AUR_OVERWRITE", '0') == '1') warn_or_die = warn if privileged else die if len(sys.argv) == 2 and sys.argv[1] == "restore": @@ -262,7 +263,7 @@ def main(): walker = repo.walk(sha1_old, pygit2.GIT_SORT_TOPOLOGICAL) walker.hide(sha1_new) if next(walker, None) is not None: - if privileged: + if allow_overwrite: warn("non-fast-forward push (are you absolutely sure you mean this?)") else: die("denying non-fast-forward (you should pull first)") -- 2.13.3

2 3

[aur-dev] [PATCH] Fix setting keywords in the SSH interface.
by Eli Schwartz 21 Jul '17

21 Jul '17

This was broken in commit 8914a41db938194efc021f842c89d47ff6b522c9 which refactored the argument parsing. Instead of checking for at least the set-keywords command and a pkgbase name, we were checking for *exactly* the command and pkgbase name, leaving no room for keywords... As a result, while we could clear the keywords, we could not set them. Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> --- aurweb/git/serve.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/aurweb/git/serve.py b/aurweb/git/serve.py index 3eef26a..eea0c9c 100755 --- a/aurweb/git/serve.py +++ b/aurweb/git/serve.py @@ -502,7 +502,7 @@ def serve(action, cmdargv, user, privileged, remote_addr): cmd = action + " '" + repo_path + "'" os.execl(git_shell_cmd, git_shell_cmd, '-c', cmd) elif action == 'set-keywords': - checkarg(cmdargv, 'repository name') + checkarg_atleast(cmdargv, 'repository name') pkgbase_set_keywords(cmdargv[1], cmdargv[2:]) elif action == 'list-repos': checkarg(cmdargv) -- 2.13.3

2 1

[aur-dev] [PATCH 1/2] Emit warning when TUs use their supowerpowers to overwrite a pkgbase
by Eli Schwartz 21 Jul '17

21 Jul '17

AUR_PRIVILEGED allows people with privileged AUR accounts to evade the block on non-fast-forward commits. While valid in this case, we should still provide a message saying that this happened, since in at least one case ( https://aur.archlinux.org/packages/rtmidi/ ) a TU did this without realizing there was an existing package. Signed-off-by: Eli Schwartz <eschwartz(a)archlinux.org> --- Similar to the warn_or_die function, except that doesn't take alternative messages and there is no nice universal message here. I think I prefer something that allows the TU to set whether they really mean to perform a privileged TU action, since accidentally overwriting something is kind of bad either way. The follow-up patch implements this -- instead? alongside? Either patch stands on its own, though I think I'd like to see both. aurweb/git/update.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/aurweb/git/update.py b/aurweb/git/update.py index c9a98d0..3b9ff97 100755 --- a/aurweb/git/update.py +++ b/aurweb/git/update.py @@ -258,11 +258,14 @@ def main(): conn = aurweb.db.Connection() # Detect and deny non-fast-forwards. - if sha1_old != "0" * 40 and not privileged: + if sha1_old != "0" * 40: walker = repo.walk(sha1_old, pygit2.GIT_SORT_TOPOLOGICAL) walker.hide(sha1_new) if next(walker, None) is not None: - die("denying non-fast-forward (you should pull first)") + if privileged: + warn("non-fast-forward push (are you absolutely sure you mean this?)") + else: + die("denying non-fast-forward (you should pull first)") # Prepare the walker that validates new commits. walker = repo.walk(sha1_new, pygit2.GIT_SORT_TOPOLOGICAL) -- 2.13.3

2 2

[aur-dev] [PATCH] gendummydata.py: Fixed not null constraint problems
by Mark Weiman 02 May '17

02 May '17

PackageBases.FlaggerComment and PackageComments.RenderedComment cannot be null and would cause problems in the output file for sqlite users. This patch adds empty strings ("") as values for these fields. Signed-off-by: Mark Weiman <mark.weiman(a)markzz.com> --- schema/gendummydata.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/schema/gendummydata.py b/schema/gendummydata.py index 373f82e..5ed6332 100755 --- a/schema/gendummydata.py +++ b/schema/gendummydata.py @@ -205,8 +205,8 @@ for p in list(seen_pkgs.keys()): uuid = genUID() # the submitter/user - s = ("INSERT INTO PackageBases (ID, Name, SubmittedTS, ModifiedTS, " - "SubmitterUID, MaintainerUID, PackagerUID) VALUES (%d, '%s', %d, %d, %d, %s, %s);\n") + s = ("INSERT INTO PackageBases (ID, Name, FlaggerComment, SubmittedTS, ModifiedTS, " + "SubmitterUID, MaintainerUID, PackagerUID) VALUES (%d, '%s', '', %d, %d, %d, %s, %s);\n") s = s % (seen_pkgs[p], p, NOW, NOW, uuid, muid, puid) out.write(s) @@ -223,7 +223,7 @@ for p in list(seen_pkgs.keys()): for i in range(0, num_comments): now = NOW + random.randrange(400, 86400*3) s = ("INSERT INTO PackageComments (PackageBaseID, UsersID," - " Comments, CommentTS) VALUES (%d, %d, '%s', %d);\n") + " Comments, RenderedComment, CommentTS) VALUES (%d, %d, '%s', '', %d);\n") s = s % (seen_pkgs[p], genUID(), genFortune(), now) out.write(s) -- 2.12.2

1 0

[aur-dev] [PATCH] Add support for Terms of Service documents
by Lukas Fleischer 30 Apr '17

30 Apr '17

This allows for adding Terms of Service documents to the database that registered users need to accept before using the AUR. A revision field can be used to indicate whether a document was updated. If it is increased, all users are again asked to accept the new terms. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- schema/aur-schema.sql | 20 +++++++++++++ upgrading/4.6.0.txt | 20 +++++++++++++ web/html/tos.php | 50 ++++++++++++++++++++++++++++++++ web/lib/acctfuncs.inc.php | 74 +++++++++++++++++++++++++++++++++++++++++++++++ web/lib/aur.inc.php | 23 +++++++++++++++ web/lib/routing.inc.php | 1 + 6 files changed, 188 insertions(+) create mode 100644 web/html/tos.php diff --git a/schema/aur-schema.sql b/schema/aur-schema.sql index e584165..45272bb 100644 --- a/schema/aur-schema.sql +++ b/schema/aur-schema.sql @@ -379,3 +379,23 @@ CREATE TABLE Bans ( BanTS TIMESTAMP NOT NULL, PRIMARY KEY (IPAddress) ) ENGINE = InnoDB; + +-- Terms and Conditions +-- +CREATE TABLE Terms ( + ID INTEGER UNSIGNED NOT NULL AUTO_INCREMENT, + Description VARCHAR(255) NOT NULL, + URL VARCHAR(8000) NOT NULL, + Revision INTEGER UNSIGNED NOT NULL DEFAULT 1, + PRIMARY KEY (ID) +) ENGINE = InnoDB; + +-- Terms and Conditions accepted by users +-- +CREATE TABLE AcceptedTerms ( + UsersID INTEGER UNSIGNED NOT NULL, + TermsID INTEGER UNSIGNED NOT NULL, + Revision INTEGER UNSIGNED NOT NULL DEFAULT 0, + FOREIGN KEY (UsersID) REFERENCES Users(ID) ON DELETE CASCADE, + FOREIGN KEY (TermsID) REFERENCES Terms(ID) ON DELETE CASCADE +) ENGINE = InnoDB; diff --git a/upgrading/4.6.0.txt b/upgrading/4.6.0.txt index b051bac..816409d 100644 --- a/upgrading/4.6.0.txt +++ b/upgrading/4.6.0.txt @@ -15,3 +15,23 @@ UPDATE PackageDepends --- ALTER TABLE PackageComments ADD COLUMN RenderedComment TEXT NOT NULL; --- + +3. Add Terms and AcceptedTerms tables: + +--- +CREATE TABLE Terms ( + ID INTEGER UNSIGNED NOT NULL AUTO_INCREMENT, + Description VARCHAR(255) NOT NULL, + URL VARCHAR(8000) NOT NULL, + Revision INTEGER UNSIGNED NOT NULL DEFAULT 1, + PRIMARY KEY (ID) +) ENGINE = InnoDB; + +CREATE TABLE AcceptedTerms ( + UsersID INTEGER UNSIGNED NOT NULL, + TermsID INTEGER UNSIGNED NOT NULL, + Revision INTEGER UNSIGNED NOT NULL DEFAULT 0, + FOREIGN KEY (UsersID) REFERENCES Users(ID) ON DELETE CASCADE, + FOREIGN KEY (TermsID) REFERENCES Terms(ID) ON DELETE CASCADE +) ENGINE = InnoDB; +--- diff --git a/web/html/tos.php b/web/html/tos.php new file mode 100644 index 0000000..135fa1e --- /dev/null +++ b/web/html/tos.php @@ -0,0 +1,50 @@ +<?php +set_include_path(get_include_path() . PATH_SEPARATOR . '../lib'); + +include_once("aur.inc.php"); + +$uid = uid_from_sid($_COOKIE["AURSID"]); + +if (isset($_POST["accept"]) && $_POST["accept"]) { + accept_terms($uid, $_POST["rev"]); + header("Location: " . get_uri('/')); +} + +$terms = fetch_updated_terms($uid); +if (!$terms) { + header("Location: " . get_uri('/')); +} + +html_header('AUR ' . __("Terms of Service")); +?> +<div id="dev-login" class="box"> + <h2>AUR <?= __('Terms of Service') ?></h2> + <?php if (isset($_COOKIE["AURSID"])): ?> + <form method="post" action="<?= get_uri('/tos') ?>"> + <fieldset> + <p> + <?= __("Logged-in as: %s", '<strong>' . username_from_sid($_COOKIE["AURSID"]) . '</strong>'); ?> + </p> + <p> + <?= __("The following documents have been updated. Please review them carefully:"); ?> + </p> + <ul> + <?php foreach($terms as $row): ?> + <li><a href="<?= urlencode(sprintf($row["URL"], $row["Revision"])) ?>"><?= htmlspecialchars($row["Description"]) ?></a> (<?= __('revision %d', $row["Revision"]) ?>)</li> + <?php endforeach; ?> + </ul> + <p> + <?php foreach($terms as $row): ?> + <input type="hidden" name="rev[<?= $row["ID"] ?>]" value="<?= $row["Revision"] ?>" /> + <?php endforeach; ?> + <input type="checkbox" name="accept" /> <?= __("I accept the terms and conditions above."); ?> + </p> + <p> + <input type="submit" name="submit" value="<?= __("Continue") ?>" /> + </p> + </fieldset> + </form> + <?php endif; ?> +</div> +<?php +html_footer(AURWEB_VERSION); diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index 22b3ca8..e45d735 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -1325,3 +1325,77 @@ function notify($params) { return proc_close($p); } + +/* + * Obtain a list of terms a given user has not yet accepted. + * + * @param int $uid The ID of the user to obtain terms for. + * + * @return array A list of terms the user has not yet accepted. + */ +function fetch_updated_terms($uid) { + $dbh = DB::connect(); + + $q = "SELECT ID, Terms.Revision, Description, URL "; + $q .= "FROM Terms LEFT JOIN AcceptedTerms "; + $q .= "ON AcceptedTerms.TermsID = Terms.ID "; + $q .= "AND AcceptedTerms.UsersID = " . intval($uid) . " "; + $q .= "WHERE AcceptedTerms.Revision IS NULL OR "; + $q .= "AcceptedTerms.Revision < Terms.Revision"; + + $result = $dbh->query($q); + + if ($result) { + return $result->fetchAll(); + } else { + return array(); + } +} + +/* + * Accept a list of given terms. + * + * @param int $uid The ID of the user to accept the terms. + * @param array $termrev An array mapping each term to the accepted revision. + * + * @return void + */ +function accept_terms($uid, $termrev) { + $dbh = DB::connect(); + + $q = "SELECT TermsID, Revision FROM AcceptedTerms "; + $q .= "WHERE UsersID = " . intval($uid); + + $result = $dbh->query($q); + + if (!$result) { + return; + } + + $termrev_update = array(); + while ($row = $result->fetch(PDO::FETCH_ASSOC)) { + $id = $row['TermsID']; + if (!array_key_exists($id, $termrev)) { + continue; + } + if ($row['Revision'] < $termrev[$id]) { + $termrev_update[$id] = $termrev[$id]; + } + } + $termrev_add = array_diff_key($termrev, $termrev_update); + + foreach ($termrev_add as $id => $rev) { + $q = "INSERT INTO AcceptedTerms (TermsID, UsersID, Revision) "; + $q .= "VALUES (" . intval($id) . ", " . intval($uid) . ", "; + $q .= intval($rev) . ")"; + $dbh->exec($q); + } + + foreach ($termrev_update as $id => $rev) { + $q = "UPDATE AcceptedTerms "; + $q .= "SET Revision = " . intval($rev) . " "; + $q .= "WHERE TermsID = " . intval($id) . " AND "; + $q .= "UsersID = " . intval($uid); + $dbh->exec($q); + } +} diff --git a/web/lib/aur.inc.php b/web/lib/aur.inc.php index 063de8f..ce569ea 100644 --- a/web/lib/aur.inc.php +++ b/web/lib/aur.inc.php @@ -22,6 +22,7 @@ include_once('timezone.inc.php'); set_tz(); check_sid(); +check_tos(); /** * Check if a visitor is logged in @@ -92,6 +93,28 @@ function check_sid() { } /** + * Redirect user to the Terms of Service agreement if there are updated terms. + * + * @return void + */ +function check_tos() { + if (!isset($_COOKIE["AURSID"])) { + return; + } + + $path = $_SERVER['PATH_INFO']; + $route = get_route($path); + if (!$route || $route == "tos.php") { + return; + } + + if (count(fetch_updated_terms(uid_from_sid($_COOKIE["AURSID"]))) > 0) { + header('Location: ' . get_uri('/tos')); + exit(); + } +} + +/** * Verify the supplied CSRF token matches expected token * * @return bool True if the CSRF token is the same as the cookie SID, otherwise false diff --git a/web/lib/routing.inc.php b/web/lib/routing.inc.php index 8c45c62..7d9750a 100644 --- a/web/lib/routing.inc.php +++ b/web/lib/routing.inc.php @@ -16,6 +16,7 @@ $ROUTES = array( '/passreset' => 'passreset.php', '/rpc' => 'rpc.php', '/rss' => 'rss.php', + '/tos' => 'tos.php', '/tu' => 'tu.php', '/addvote' => 'addvote.php', ); -- 2.12.2

1 1

[aur-dev] [PATCH] Call check_sid() from a central location
by Lukas Fleischer 27 Apr '17

27 Apr '17

Instead of calling check_sid() from every single PHP script representing a web page, add the call to aur.inc.php which is sourced by all of them. Also, remove set_lang() calls from the scripts since these are also already included in aur.inc.php. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/html/account.php | 3 --- web/html/addvote.php | 2 -- web/html/comaintainers.php | 3 --- web/html/commentedit.php | 3 --- web/html/home.php | 3 --- web/html/login.php | 2 -- web/html/logout.php | 1 - web/html/packages.php | 2 -- web/html/passreset.php | 3 --- web/html/pkgbase.php | 2 -- web/html/pkgdel.php | 3 --- web/html/pkgdisown.php | 3 --- web/html/pkgflag.php | 3 --- web/html/pkgflagcomment.php | 3 --- web/html/pkgmerge.php | 3 --- web/html/pkgreq.php | 3 --- web/html/register.php | 3 --- web/html/tu.php | 2 -- web/lib/aur.inc.php | 2 ++ 19 files changed, 2 insertions(+), 47 deletions(-) diff --git a/web/html/account.php b/web/html/account.php index 549f852..c30a89a 100644 --- a/web/html/account.php +++ b/web/html/account.php @@ -5,9 +5,6 @@ set_include_path(get_include_path() . PATH_SEPARATOR . '../lib'); include_once('aur.inc.php'); # access AUR common functions include_once('acctfuncs.inc.php'); # access Account specific functions -set_lang(); # this sets up the visitor's language -check_sid(); # see if they're still logged in - $action = in_request("Action"); $need_userinfo = array( diff --git a/web/html/addvote.php b/web/html/addvote.php index d152941..3672c03 100644 --- a/web/html/addvote.php +++ b/web/html/addvote.php @@ -3,8 +3,6 @@ set_include_path(get_include_path() . PATH_SEPARATOR . '../lib'); include_once("aur.inc.php"); -set_lang(); -check_sid(); $title = __("Add Proposal"); diff --git a/web/html/comaintainers.php b/web/html/comaintainers.php index 23d8d19..9733558 100644 --- a/web/html/comaintainers.php +++ b/web/html/comaintainers.php @@ -5,9 +5,6 @@ set_include_path(get_include_path() . PATH_SEPARATOR . '../lib'); include_once("aur.inc.php"); include_once("pkgbasefuncs.inc.php"); -set_lang(); -check_sid(); - if (!isset($base_id) || !has_credential(CRED_PKGBASE_EDIT_COMAINTAINERS, array(pkgbase_maintainer_uid($base_id)))) { header('Location: /'); exit(); diff --git a/web/html/commentedit.php b/web/html/commentedit.php index 2a0628e..53ec289 100644 --- a/web/html/commentedit.php +++ b/web/html/commentedit.php @@ -5,9 +5,6 @@ set_include_path(get_include_path() . PATH_SEPARATOR . '../lib'); include_once("aur.inc.php"); include_once("pkgbasefuncs.inc.php"); -set_lang(); -check_sid(); - $comment_id = intval($_REQUEST['comment_id']); list($user_id, $comment) = comment_by_id($comment_id); diff --git a/web/html/home.php b/web/html/home.php index 2675491..0ce89f4 100644 --- a/web/html/home.php +++ b/web/html/home.php @@ -3,9 +3,6 @@ set_include_path(get_include_path() . PATH_SEPARATOR . '../lib'); include_once("aur.inc.php"); -set_lang(); -check_sid(); - include_once('stats.inc.php'); if (isset($_COOKIE["AURSID"])) { diff --git a/web/html/login.php b/web/html/login.php index 7345439..a55ce05 100644 --- a/web/html/login.php +++ b/web/html/login.php @@ -2,8 +2,6 @@ set_include_path(get_include_path() . PATH_SEPARATOR . '../lib'); include_once("aur.inc.php"); -set_lang(); -check_sid(); $disable_http_login = config_get_bool('options', 'disable_http_login'); if (!$disable_http_login || (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'])) { diff --git a/web/html/logout.php b/web/html/logout.php index 5e8e8f4..1402200 100644 --- a/web/html/logout.php +++ b/web/html/logout.php @@ -5,7 +5,6 @@ set_include_path(get_include_path() . PATH_SEPARATOR . '../lib'); include_once("aur.inc.php"); # access AUR common functions include_once("acctfuncs.inc.php"); # access AUR common functions - # if they've got a cookie, log them out - need to do this before # sending any HTML output. # diff --git a/web/html/packages.php b/web/html/packages.php index 7d5b207..db9606d 100644 --- a/web/html/packages.php +++ b/web/html/packages.php @@ -3,9 +3,7 @@ set_include_path(get_include_path() . PATH_SEPARATOR . '../lib'); include_once("aur.inc.php"); # access AUR common functions -set_lang(); # this sets up the visitor's language include_once('pkgfuncs.inc.php'); # package specific functions -check_sid(); # see if they're still logged in # Retrieve package ID and name, unless initialized by the routing framework if (!isset($pkgid) || !isset($pkgname)) { diff --git a/web/html/passreset.php b/web/html/passreset.php index e89967d..9e7cee8 100644 --- a/web/html/passreset.php +++ b/web/html/passreset.php @@ -4,9 +4,6 @@ set_include_path(get_include_path() . PATH_SEPARATOR . '../lib'); include_once("aur.inc.php"); # access AUR common functions -set_lang(); # this sets up the visitor's language -check_sid(); # see if they're still logged in - if (isset($_COOKIE["AURSID"])) { header('Location: /'); exit(); diff --git a/web/html/pkgbase.php b/web/html/pkgbase.php index a593af1..03b0eee 100644 --- a/web/html/pkgbase.php +++ b/web/html/pkgbase.php @@ -3,9 +3,7 @@ set_include_path(get_include_path() . PATH_SEPARATOR . '../lib'); include_once("aur.inc.php"); -set_lang(); include_once('pkgfuncs.inc.php'); -check_sid(); /* * Retrieve package base ID and name, unless initialized by the routing diff --git a/web/html/pkgdel.php b/web/html/pkgdel.php index 591ccce..4620beb 100644 --- a/web/html/pkgdel.php +++ b/web/html/pkgdel.php @@ -5,9 +5,6 @@ set_include_path(get_include_path() . PATH_SEPARATOR . '../lib'); include_once("aur.inc.php"); include_once("pkgfuncs.inc.php"); -set_lang(); -check_sid(); - html_header(__("Package Deletion")); if (has_credential(CRED_PKGBASE_DELETE)): ?> diff --git a/web/html/pkgdisown.php b/web/html/pkgdisown.php index 036fe6d..4b04e85 100644 --- a/web/html/pkgdisown.php +++ b/web/html/pkgdisown.php @@ -5,9 +5,6 @@ set_include_path(get_include_path() . PATH_SEPARATOR . '../lib'); include_once("aur.inc.php"); include_once("pkgfuncs.inc.php"); -set_lang(); -check_sid(); - html_header(__("Disown Package")); $maintainer_uids = array(pkgbase_maintainer_uid($base_id)); diff --git a/web/html/pkgflag.php b/web/html/pkgflag.php index 25c8ccb..61346b9 100644 --- a/web/html/pkgflag.php +++ b/web/html/pkgflag.php @@ -5,9 +5,6 @@ set_include_path(get_include_path() . PATH_SEPARATOR . '../lib'); include_once("aur.inc.php"); include_once("pkgfuncs.inc.php"); -set_lang(); -check_sid(); - /* Grab the list of package base IDs to be operated on. */ $ids = array(); if (isset($_POST['IDs'])) { diff --git a/web/html/pkgflagcomment.php b/web/html/pkgflagcomment.php index 98680ef..c0363c8 100644 --- a/web/html/pkgflagcomment.php +++ b/web/html/pkgflagcomment.php @@ -5,9 +5,6 @@ set_include_path(get_include_path() . PATH_SEPARATOR . '../lib'); include_once("aur.inc.php"); include_once("pkgbasefuncs.inc.php"); -set_lang(); -check_sid(); - if (!isset($base_id)) { header('Location: /'); exit(); diff --git a/web/html/pkgmerge.php b/web/html/pkgmerge.php index e8e7ca9..6ee7423 100644 --- a/web/html/pkgmerge.php +++ b/web/html/pkgmerge.php @@ -5,9 +5,6 @@ set_include_path(get_include_path() . PATH_SEPARATOR . '../lib'); include_once("aur.inc.php"); include_once("pkgfuncs.inc.php"); -set_lang(); -check_sid(); - html_header(__("Package Merging")); if (has_credential(CRED_PKGBASE_DELETE)): ?> diff --git a/web/html/pkgreq.php b/web/html/pkgreq.php index f981c25..d2f9461 100644 --- a/web/html/pkgreq.php +++ b/web/html/pkgreq.php @@ -5,9 +5,6 @@ set_include_path(get_include_path() . PATH_SEPARATOR . '../lib'); include_once("aur.inc.php"); include_once("pkgfuncs.inc.php"); -set_lang(); -check_sid(); - if (isset($base_id)) { if (!has_credential(CRED_PKGREQ_FILE)) { header('Location: /'); diff --git a/web/html/register.php b/web/html/register.php index 843fea9..368999a 100644 --- a/web/html/register.php +++ b/web/html/register.php @@ -5,9 +5,6 @@ set_include_path(get_include_path() . PATH_SEPARATOR . '../lib'); include_once('aur.inc.php'); # access AUR common functions include_once('acctfuncs.inc.php'); # access Account specific functions -set_lang(); # this sets up the visitor's language -check_sid(); # see if they're still logged in - if (isset($_COOKIE["AURSID"])) { header('Location: /'); exit(); diff --git a/web/html/tu.php b/web/html/tu.php index cc77d62..34e64ea 100644 --- a/web/html/tu.php +++ b/web/html/tu.php @@ -3,8 +3,6 @@ set_include_path(get_include_path() . PATH_SEPARATOR . '../lib'); include_once("aur.inc.php"); -set_lang(); -check_sid(); $title = __("Trusted User"); diff --git a/web/lib/aur.inc.php b/web/lib/aur.inc.php index d58df40..063de8f 100644 --- a/web/lib/aur.inc.php +++ b/web/lib/aur.inc.php @@ -21,6 +21,8 @@ include_once("credentials.inc.php"); include_once('timezone.inc.php'); set_tz(); +check_sid(); + /** * Check if a visitor is logged in * -- 2.12.2

1 0

[aur-dev] [PATCH] Support headings in package comments
by Lukas Fleischer 26 Apr '17

26 Apr '17

Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- aurweb/scripts/rendercomment.py | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/aurweb/scripts/rendercomment.py b/aurweb/scripts/rendercomment.py index f32c827..9c0aa6a 100755 --- a/aurweb/scripts/rendercomment.py +++ b/aurweb/scripts/rendercomment.py @@ -67,6 +67,20 @@ class GitCommitsExtension(markdown.extensions.Extension): md.preprocessors.add('git-commits', preprocessor, '_end') +class HeadingTreeprocessor(markdown.treeprocessors.Treeprocessor): + def run(self, doc): + for elem in doc: + if elem.tag == 'h1': + elem.tag = 'h5' + elif elem.tag in ['h2', 'h3', 'h4', 'h5']: + elem.tag = 'h6' + + +class HeadingExtension(markdown.extensions.Extension): + def extendMarkdown(self, md, md_globals): + md.treeprocessors.add('heading', HeadingTreeprocessor(md), '_end') + + def get_comment(conn, commentid): cur = conn.execute('SELECT PackageComments.Comments, PackageBases.Name ' 'FROM PackageComments INNER JOIN PackageBases ' @@ -88,8 +102,10 @@ def main(): text, pkgbase = get_comment(conn, commentid) html = markdown.markdown(text, extensions=['fenced_code', LinkifyExtension(), - GitCommitsExtension(pkgbase)]) - allowed_tags = bleach.sanitizer.ALLOWED_TAGS + ['p', 'pre'] + GitCommitsExtension(pkgbase), + HeadingExtension()]) + allowed_tags = bleach.sanitizer.ALLOWED_TAGS + \ + ['p', 'pre', 'h4', 'h5', 'h6'] html = bleach.clean(html, tags=allowed_tags) save_rendered_comment(conn, commentid, html) -- 2.12.2

1 0

[aur-dev] [PATCH 1/3] t1300: Factor out package dumping
by Lukas Fleischer 25 Apr '17

25 Apr '17

Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- test/t1300-git-update.sh | 36 ++++++++++++------------------------ 1 file changed, 12 insertions(+), 24 deletions(-) diff --git a/test/t1300-git-update.sh b/test/t1300-git-update.sh index a65ca3a..dbe6029 100755 --- a/test/t1300-git-update.sh +++ b/test/t1300-git-update.sh @@ -4,6 +4,14 @@ test_description='git-update tests' . ./setup.sh +dump_package_info() { + for t in Packages Licenses PackageLicenses Groups PackageGroups \ + PackageDepends PackageRelations PackageSources \ + PackageNotifications; do + echo "SELECT * FROM $t;" | sqlite3 aur.db + done +} + test_expect_success 'Test update hook on a fresh repository.' ' old=0000000000000000000000000000000000000000 && new=$(git -C aur.git rev-parse HEAD^) && @@ -16,12 +24,7 @@ test_expect_success 'Test update hook on a fresh repository.' ' 1|1|python-pygit2|| 1|1 EOF - >actual && - for t in Packages Licenses PackageLicenses Groups PackageGroups \ - PackageDepends PackageRelations PackageSources \ - PackageNotifications; do - echo "SELECT * FROM $t;" | sqlite3 aur.db >>actual - done && + dump_package_info >actual && test_cmp expected actual ' @@ -44,12 +47,7 @@ test_expect_success 'Test update hook on another fresh repository.' ' 1|1 2|1 EOF - >actual && - for t in Packages Licenses PackageLicenses Groups PackageGroups \ - PackageDepends PackageRelations PackageSources \ - PackageNotifications; do - echo "SELECT * FROM $t;" | sqlite3 aur.db >>actual - done && + dump_package_info >actual && test_cmp expected actual ' @@ -70,12 +68,7 @@ test_expect_success 'Test update hook on an updated repository.' ' 1|1 2|1 EOF - >actual && - for t in Packages Licenses PackageLicenses Groups PackageGroups \ - PackageDepends PackageRelations PackageSources \ - PackageNotifications; do - echo "SELECT * FROM $t;" | sqlite3 aur.db >>actual - done && + dump_package_info >actual && test_cmp expected actual ' @@ -94,12 +87,7 @@ test_expect_success 'Test restore mode.' ' 1|1 2|1 EOF - >actual && - for t in Packages Licenses PackageLicenses Groups PackageGroups \ - PackageDepends PackageRelations PackageSources \ - PackageNotifications; do - echo "SELECT * FROM $t;" | sqlite3 aur.db >>actual - done && + dump_package_info >actual && test_cmp expected actual ' -- 2.12.2

1 2

[aur-dev] [PATCH] Fix the comment collapse feature
by Lukas Fleischer 24 Apr '17

24 Apr '17

In commit 4abde89 (Use JavaScript to collapse long comments, 2017-04-19), support for collapsing/expanding long comments was added. This was broken by the recent Markdown support since comments no longer live inside a single HTML paragraph. Fix this by wrapping each comment in another div container. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/html/packages.php | 23 ++++++++++++----------- web/template/pkg_comments.php | 16 +++++++++------- 2 files changed, 21 insertions(+), 18 deletions(-) diff --git a/web/html/packages.php b/web/html/packages.php index 8d76c76..7d5b207 100644 --- a/web/html/packages.php +++ b/web/html/packages.php @@ -74,32 +74,33 @@ function collapseDependsList(list) { function collapseComment(div) { var linkid = div.attr('id') + 'link', - par = div.find('p'), - height = par.height(), + inner = div.find('div'), + height = inner.height(), maxheight = 200; if (height <= maxheight) return; - par.css({ 'overflow': 'hidden', 'height': maxheight + 'px' }); - par.addClass('collapsed'); - par.after('<p><a id="' + linkid + '" href="#">Show More…</a></p>'); + inner.css({ 'overflow': 'hidden', 'height': maxheight + 'px' }); + inner.addClass('collapsed'); + inner.after('<p><a id="' + linkid + '" href="#">Show More…</a></p>'); $('#' + linkid).click(function(event) { + var inner = $(this).parent().parent().find('div'); var newheight; - if (par.hasClass('collapsed')) { - par.css({ 'height': 'auto' }); - newheight = par.height(); - par.css({ 'height': maxheight }); + if (inner.hasClass('collapsed')) { + inner.css({ 'height': 'auto' }); + newheight = inner.height(); + inner.css({ 'height': maxheight }); $(this).text('Collapse'); } else { newheight = maxheight; $(this).text('Show More…'); } - par.animate({ 'height': newheight }); - par.toggleClass('collapsed'); + inner.animate({ 'height': newheight }); + inner.toggleClass('collapsed'); event.preventDefault(); }); } diff --git a/web/template/pkg_comments.php b/web/template/pkg_comments.php index f973b74..7d9bedc 100644 --- a/web/template/pkg_comments.php +++ b/web/template/pkg_comments.php @@ -103,13 +103,15 @@ if (!isset($count)) { <?php endif; ?> </h4> <div id="<?= isset($pinned) ? "pinned-" : "comment-" ?><?= $row['ID'] ?>-content" class="article-content<?php if ($is_deleted): ?> comment-deleted<?php endif; ?>"> - <?php if (!empty($row['RenderedComment'])): ?> - <?= $row['RenderedComment'] ?> - <?php else: ?> - <p> - <?= parse_comment($row['Comments']) ?> - </p> - <?php endif; ?> + <div> + <?php if (!empty($row['RenderedComment'])): ?> + <?= $row['RenderedComment'] ?> + <?php else: ?> + <p> + <?= parse_comment($row['Comments']) ?> + </p> + <?php endif; ?> + </div> </div> <?php endwhile; ?> -- 2.12.2

1 0