- Aur-dev - lists.archlinux.org

[aur-dev] [PATCH] Add option to hide one's email address
by Marcel Korpel 20 Sep '15

20 Sep '15

Implements FS#42343. Signed-off-by: Marcel Korpel <marcel.korpel(a)gmail.com> --- schema/aur-schema.sql | 1 + upgrading/4.1.0.txt | 7 +++++++ web/html/account.php | 19 ++++++++++--------- web/html/register.php | 6 +++--- web/lib/acctfuncs.inc.php | 11 +++++++++-- web/template/account_details.php | 12 +++++++++++- web/template/account_edit_form.php | 5 +++++ 7 files changed, 46 insertions(+), 15 deletions(-) diff --git a/schema/aur-schema.sql b/schema/aur-schema.sql index 2c45a97..53dc468 100644 --- a/schema/aur-schema.sql +++ b/schema/aur-schema.sql @@ -26,6 +26,7 @@ CREATE TABLE Users ( Suspended TINYINT UNSIGNED NOT NULL DEFAULT 0, Username VARCHAR(32) NOT NULL, Email VARCHAR(64) NOT NULL, + HideEmail TINYINT UNSIGNED NOT NULL DEFAULT 0, Passwd CHAR(32) NOT NULL, Salt CHAR(32) NOT NULL DEFAULT '', ResetKey CHAR(32) NOT NULL DEFAULT '', diff --git a/upgrading/4.1.0.txt b/upgrading/4.1.0.txt index 439562f..26f9f65 100644 --- a/upgrading/4.1.0.txt +++ b/upgrading/4.1.0.txt @@ -17,3 +17,10 @@ ALTER TABLE PackageBases ADD COLUMN FlaggerComment VARCHAR(255) NOT NULL, ADD FOREIGN KEY (FlaggerUID) REFERENCES Users(ID) ON DELETE SET NULL; ---- + +3. Add field to store the state of a user's email address: + +---- +ALTER TABLE Users + ADD COLUMN HideEmail TINYINT UNSIGNED NOT NULL DEFAULT 0; +---- diff --git a/web/html/account.php b/web/html/account.php index adc2542..b2886fc 100644 --- a/web/html/account.php +++ b/web/html/account.php @@ -32,10 +32,10 @@ if ($action == "UpdateAccount") { list($success, $update_account_message) = process_account_form( "edit", "UpdateAccount", in_request("U"), in_request("T"), in_request("S"), - in_request("E"), in_request("P"), in_request("C"), - in_request("R"), in_request("L"), in_request("I"), - in_request("K"), in_request("PK"), in_request("J"), - in_request("ID"), $row["Username"]); + in_request("E"), in_request("H"), in_request("P"), + in_request("C"), in_request("R"), in_request("L"), + in_request("I"), in_request("K"), in_request("PK"), + in_request("J"), in_request("ID"), $row["Username"]); } } @@ -79,8 +79,8 @@ if (isset($_COOKIE["AURSID"])) { if (can_edit_account($row)) { display_account_form("UpdateAccount", $row["Username"], $row["AccountTypeID"], $row["Suspended"], $row["Email"], - "", "", $row["RealName"], $row["LangPreference"], - $row["IRCNick"], $row["PGPKey"], $PK, + $row["HideEmail"], "", "", $row["RealName"], + $row["LangPreference"], $row["IRCNick"], $row["PGPKey"], $PK, $row["InactivityTS"] ? 1 : 0, $row["ID"], $row["Username"]); } else { print __("You do not have permission to edit this account."); @@ -115,9 +115,10 @@ if (isset($_COOKIE["AURSID"])) { if (!$success) { display_account_form("UpdateAccount", in_request("U"), in_request("T"), - in_request("S"), in_request("E"), in_request("P"), in_request("C"), - in_request("R"), in_request("L"), in_request("I"), in_request("K"), - in_request("PK"), in_request("J"), in_request("ID"), $row["Username"]); + in_request("S"), in_request("E"), in_request("H"), in_request("P"), + in_request("C"), in_request("R"), in_request("L"), in_request("I"), + in_request("K"), in_request("PK"), in_request("J"), in_request("ID"), + $row["Username"]); } } else { diff --git a/web/html/register.php b/web/html/register.php index 9c5c1cc..f8400a3 100644 --- a/web/html/register.php +++ b/web/html/register.php @@ -21,7 +21,7 @@ echo '<h2>' . __('Register') . '</h2>'; if (in_request("Action") == "NewAccount") { list($success, $message) = process_account_form( "new", "NewAccount", in_request("U"), 1, 0, - in_request("E"), '', '', in_request("R"), + in_request("E"), in_request("H"), '', '', in_request("R"), in_request("L"), in_request("I"), in_request("K"), in_request("PK")); @@ -29,13 +29,13 @@ if (in_request("Action") == "NewAccount") { if (!$success) { display_account_form("NewAccount", in_request("U"), 1, 0, - in_request("E"), '', '', in_request("R"), + in_request("E"), in_request("H"), '', '', in_request("R"), in_request("L"), in_request("I"), in_request("K"), in_request("PK")); } } else { print '<p>' . __("Use this form to create an account.") . '</p>'; - display_account_form("NewAccount", "", "", "", "", "", "", "", $LANG); + display_account_form("NewAccount", "", "", "", "", "", "", "", "", $LANG); } echo '</div>'; diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index 756c847..a200998 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -47,6 +47,7 @@ function html_format_pgp_fingerprint($fingerprint) { * @param string $T The account type of the displayed user * @param string $S Whether the displayed user has a suspended account * @param string $E The e-mail address of the displayed user + * @param string $H Whether the e-mail address of the displayed user is hidden * @param string $P The password value of the displayed user * @param string $C The confirmed password value of the displayed user * @param string $R The real name of the displayed user @@ -60,7 +61,7 @@ function html_format_pgp_fingerprint($fingerprint) { * * @return void */ -function display_account_form($A,$U="",$T="",$S="",$E="",$P="",$C="",$R="", +function display_account_form($A,$U="",$T="",$S="",$E="",$H="",$P="",$C="",$R="", $L="",$I="",$K="",$PK="",$J="",$UID=0,$N="") { global $SUPPORTED_LANGS; @@ -78,6 +79,7 @@ function display_account_form($A,$U="",$T="",$S="",$E="",$P="",$C="",$R="", * @param string $T The account type for the user * @param string $S Whether or not the account is suspended * @param string $E The e-mail address for the user + * @param string $H Whether or not the e-mail address should be hidden * @param string $P The password for the user * @param string $C The confirmed password for the user * @param string $R The real name of the user @@ -91,7 +93,7 @@ function display_account_form($A,$U="",$T="",$S="",$E="",$P="",$C="",$R="", * * @return array Boolean indicating success and message to be printed */ -function process_account_form($TYPE,$A,$U="",$T="",$S="",$E="",$P="",$C="", +function process_account_form($TYPE,$A,$U="",$T="",$S="",$E="",$H="",$P="",$C="", $R="",$L="",$I="",$K="",$PK="",$J="",$UID=0,$N="") { global $SUPPORTED_LANGS; @@ -324,6 +326,11 @@ function process_account_form($TYPE,$A,$U="",$T="",$S="",$E="",$P="",$C="", $q.= ", Suspended = 0"; } $q.= ", Email = " . $dbh->quote($E); + if ($H) { + $q.= ", HideEmail = 1"; + } else { + $q.= ", HideEmail = 0"; + } if ($P) { $salt = generate_salt(); $hash = salted_hash($P, $salt); diff --git a/web/template/account_details.php b/web/template/account_details.php index 9282b2c..59a6a63 100644 --- a/web/template/account_details.php +++ b/web/template/account_details.php @@ -25,7 +25,17 @@ </tr> <tr> <th><?= __("Email Address") . ":" ?></th> - <td><a href="mailto:<?= htmlspecialchars($row["Email"], ENT_QUOTES) ?>"><?= htmlspecialchars($row["Email"], ENT_QUOTES) ?></a></td> + <td> + <?php + if ($row["HideEmail"] == 1 && !has_credential(CRED_ACCOUNT_SEARCH)): + print "<em>" . __("hidden") . "</em>"; + else: + ?> + <a href="mailto:<?= htmlspecialchars($row["Email"], ENT_QUOTES) ?>"><?= htmlspecialchars($row["Email"], ENT_QUOTES) ?></a> + <?php + endif; + ?> + </td> </tr> <tr> <th><?= __("Real Name") . ":" ?></th> diff --git a/web/template/account_edit_form.php b/web/template/account_edit_form.php index 83aedb0..16655c0 100644 --- a/web/template/account_edit_form.php +++ b/web/template/account_edit_form.php @@ -76,6 +76,11 @@ <em><?= __("Please ensure you correctly entered your email address, otherwise you will be locked out.") ?></em> </p> + <p> + <label for="id_hide"><?= __("Hide Email Address") ?>:</label> + <input type="checkbox" name="H" id="id_hide" <?= $H ? 'checked="checked"' : '' ?> /> + </p> + <?php if ($A == "UpdateAccount"): ?> <p> <label for="id_passwd1"><?= __("Password") ?>:</label> -- 2.5.2

2 1

[aur-dev] [PATCH 1/2] Fix type of FlaggerUID in table PackageBases
by Marcel Korpel 20 Sep '15

20 Sep '15

Signed-off-by: Marcel Korpel <marcel.korpel(a)gmail.com> --- schema/aur-schema.sql | 2 +- upgrading/4.1.0.txt | 5 +++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/schema/aur-schema.sql b/schema/aur-schema.sql index ff137dc..2c45a97 100644 --- a/schema/aur-schema.sql +++ b/schema/aur-schema.sql @@ -85,7 +85,7 @@ CREATE TABLE PackageBases ( FlaggerComment VARCHAR(255) NOT NULL, SubmittedTS BIGINT UNSIGNED NOT NULL, ModifiedTS BIGINT UNSIGNED NOT NULL, - FlaggerUID BIGINT UNSIGNED NULL DEFAULT NULL, -- who flagged the package out-of-date? + FlaggerUID INTEGER UNSIGNED NULL DEFAULT NULL, -- who flagged the package out-of-date? SubmitterUID INTEGER UNSIGNED NULL DEFAULT NULL, -- who submitted it? MaintainerUID INTEGER UNSIGNED NULL DEFAULT NULL, -- User PackagerUID INTEGER UNSIGNED NULL DEFAULT NULL, -- Last packager diff --git a/upgrading/4.1.0.txt b/upgrading/4.1.0.txt index e9545ff..439562f 100644 --- a/upgrading/4.1.0.txt +++ b/upgrading/4.1.0.txt @@ -13,6 +13,7 @@ package out-of-date: ---- ALTER TABLE PackageBases - ADD COLUMN FlaggerUID BIGINT UNSIGNED NULL DEFAULT NULL, - ADD COLUMN FlaggerComment VARCHAR(255) NOT NULL; + ADD COLUMN FlaggerUID INTEGER UNSIGNED NULL DEFAULT NULL, + ADD COLUMN FlaggerComment VARCHAR(255) NOT NULL, + ADD FOREIGN KEY (FlaggerUID) REFERENCES Users(ID) ON DELETE SET NULL; ---- -- 2.5.2

2 5

[aur-dev] [PATCH] Rename "Age" search order to "Last modified"
by Lukas Fleischer 20 Sep '15

20 Sep '15

Use a better description for sorting by modification time, as it is not clear whether "Age" refers to the package creation date or to the modification date. The possibility to sort by "Age" is kept internally (but hidden from the user interface) such that old links to search results still work. Fixes FS#46319. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/lib/pkgfuncs.inc.php | 4 ++++ web/template/pkg_search_form.php | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/web/lib/pkgfuncs.inc.php b/web/lib/pkgfuncs.inc.php index 62bea65..600e590 100644 --- a/web/lib/pkgfuncs.inc.php +++ b/web/lib/pkgfuncs.inc.php @@ -755,7 +755,11 @@ function pkg_search_page($SID="") { case 'm': $q_sort .= "Maintainer " . $order . ", "; break; + case 'l': + $q_sort .= "ModifiedTS " . $order . ", "; + break; case 'a': + /* For compatibility with old search links. */ $q_sort .= "-ModifiedTS " . $order . ", "; break; default: diff --git a/web/template/pkg_search_form.php b/web/template/pkg_search_form.php index 404d16e..1cc5fb2 100644 --- a/web/template/pkg_search_form.php +++ b/web/template/pkg_search_form.php @@ -24,7 +24,7 @@ $sortby = array( 'w' => __('Voted'), 'o' => __('Notify'), 'm' => __('Maintainer'), - 'a' => __('Age') + 'l' => __('Last modified') ); $orderby = array( -- 2.5.2

1 0

[aur-dev] [PATCH 1/2] Remove legacy code
by Lukas Fleischer 19 Sep '15

19 Sep '15

In 74edb6f (Use Git repositories to store packages, 2014-06-06), package creation was moved to the Python backend. Remove several PHP functions that are no longer needed. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/lib/pkgfuncs.inc.php | 189 ----------------------------------------------- 1 file changed, 189 deletions(-) diff --git a/web/lib/pkgfuncs.inc.php b/web/lib/pkgfuncs.inc.php index b00b22d..d3cad12 100644 --- a/web/lib/pkgfuncs.inc.php +++ b/web/lib/pkgfuncs.inc.php @@ -516,23 +516,6 @@ function pkg_name_from_id($pkgids) { } /** - * Determine if a package name is on the database blacklist - * - * @param string $name The package name to check - * - * @return bool True if the name is blacklisted, otherwise false - */ -function pkg_name_is_blacklisted($name) { - $dbh = DB::connect(); - $q = "SELECT COUNT(*) FROM PackageBlacklist "; - $q.= "WHERE Name = " . $dbh->quote($name); - $result = $dbh->query($q); - - if (!$result) return false; - return ($result->fetchColumn() > 0); -} - -/** * Get the package details * * @param string $id The package ID to get description for @@ -913,178 +896,6 @@ function sanitize_ids($ids) { } /** - * Add package information to the database for a specific package - * - * @param int $base_id ID of the package base - * @param string $pkgname Name of the new package - * @param string $pkgver Version of the new package - * @param string $pkgdesc Description of the new package - * @param string $pkgurl Upstream URL for the new package - * - * @return int ID of the new package - */ -function pkg_create($base_id, $pkgname, $pkgver, $pkgdesc, $pkgurl) { - $dbh = DB::connect(); - $q = sprintf("INSERT INTO Packages (PackageBaseID, Name, Version, " . - "Description, URL) VALUES (%d, %s, %s, %s, %s)", - $base_id, $dbh->quote($pkgname), $dbh->quote($pkgver), - $dbh->quote($pkgdesc), $dbh->quote($pkgurl)); - $dbh->exec($q); - return $dbh->lastInsertId(); -} - -/** - * Add a dependency for a specific package to the database - * - * @param int $pkgid The package ID to add the dependency for - * @param string $type The type of dependency to add - * @param string $depname The name of the dependency to add - * @param string $depcondition The type of dependency for the package - * @param string $deparch The architecture of the dependency to add - * - * @return void - */ -function pkg_add_dep($pkgid, $type, $depname, $depcondition, $deparch) { - $dbh = DB::connect(); - $q = sprintf("INSERT INTO PackageDepends (PackageID, DepTypeID, DepName, DepCondition, DepArch) VALUES (%d, %d, %s, %s, %s)", - $pkgid, - pkg_dependency_type_id_from_name($type), - $dbh->quote($depname), - $dbh->quote($depcondition), - $deparch ? $dbh->quote($deparch) : 'NULL' - ); - $dbh->exec($q); -} - -/** - * Add a relation for a specific package to the database - * - * @param int $pkgid The package ID to add the relation for - * @param string $type The type of relation to add - * @param string $relname The name of the relation to add - * @param string $relcondition The version requirement of the relation - * @param string $relarch The architecture of the relation to add - * - * @return void - */ -function pkg_add_rel($pkgid, $type, $relname, $relcondition, $relarch) { - $dbh = DB::connect(); - $q = sprintf("INSERT INTO PackageRelations (PackageID, RelTypeID, RelName, RelCondition, RelArch) VALUES (%d, %d, %s, %s, %s)", - $pkgid, - pkg_relation_type_id_from_name($type), - $dbh->quote($relname), - $dbh->quote($relcondition), - $relarch ? $dbh->quote($relarch) : 'NULL' - ); - $dbh->exec($q); -} - -/** - * Add a source for a specific package to the database - * - * @param int $pkgid The package ID to add the source for - * @param string $pkgsrc The package source to add to the database - * @param string $srcarch The architecture of the source to add - * - * @return void - */ -function pkg_add_src($pkgid, $pkgsrc, $srcarch) { - $dbh = DB::connect(); - $q = sprintf("INSERT INTO PackageSources (PackageID, Source, SourceArch) VALUES (%d, %s, %s)", - $pkgid, - $dbh->quote($pkgsrc), - $srcarch ? $dbh->quote($srcarch) : 'NULL' - ); - $dbh->exec($q); -} - -/** - * Creates a new group and returns its ID - * - * If the groups already exists, the ID of the already existing group is - * returned. - * - * @param string $name The name of the group to create - * - * @return int The ID of the group - */ -function pkg_create_group($name) { - $dbh = DB::connect(); - $q = sprintf("SELECT ID FROM Groups WHERE Name = %s", $dbh->quote($name)); - $result = $dbh->query($q); - if ($result) { - $grpid = $result->fetch(PDO::FETCH_COLUMN, 0); - if ($grpid > 0) { - return $grpid; - } - } - - $q = sprintf("INSERT INTO Groups (Name) VALUES (%s)", $dbh->quote($name)); - $dbh->exec($q); - return $dbh->lastInsertId(); -} - -/** - * Add a package to a group - * - * @param int $pkgid The package ID of the package to add - * @param int $grpid The group ID of the group to add the package to - * - * @return void - */ -function pkg_add_grp($pkgid, $grpid) { - $dbh = DB::connect(); - $q = sprintf("INSERT INTO PackageGroups (PackageID, GroupID) VALUES (%d, %d)", - $pkgid, - $grpid - ); - $dbh->exec($q); -} - -/** - * Creates a new license and returns its ID - * - * If the license already exists, the ID of the already existing license is - * returned. - * - * @param string $name The name of the license to create - * - * @return int The ID of the license - */ -function pkg_create_license($name) { - $dbh = DB::connect(); - $q = sprintf("SELECT ID FROM Licenses WHERE Name = %s", $dbh->quote($name)); - $result = $dbh->query($q); - if ($result) { - $licid = $result->fetch(PDO::FETCH_COLUMN, 0); - if ($licid > 0) { - return $licid; - } - } - - $q = sprintf("INSERT INTO Licenses (Name) VALUES (%s)", $dbh->quote($name)); - $dbh->exec($q); - return $dbh->lastInsertId(); -} - -/** - * Add a license to a package - * - * @param int $pkgid The package ID of the package - * @param int $grpid The ID of the license to add - * - * @return void - */ -function pkg_add_lic($pkgid, $licid) { - $dbh = DB::connect(); - $q = sprintf("INSERT INTO PackageLicenses (PackageID, LicenseID) VALUES (%d, %d)", - $pkgid, - $licid - ); - $dbh->exec($q); -} - -/** * Determine package information for latest package * * @param int $numpkgs Number of packages to get information on -- 2.5.2

1 1

[aur-dev] [PATCH 1/2] Use a separate function for "Required by" links
by Lukas Fleischer 17 Sep '15

17 Sep '15

Do not use the same function for generating dependency and inverse dependency links. Instead, factor out common code and create two separate functions for those (rather different) functionalities. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/lib/pkgfuncs.inc.php | 92 +++++++++++++++++++++++++++++++------------- web/template/pkg_details.php | 2 +- 2 files changed, 66 insertions(+), 28 deletions(-) diff --git a/web/lib/pkgfuncs.inc.php b/web/lib/pkgfuncs.inc.php index d83a01f..2939c25 100644 --- a/web/lib/pkgfuncs.inc.php +++ b/web/lib/pkgfuncs.inc.php @@ -239,6 +239,48 @@ function pkg_relations($pkgid) { } /** + * Get the HTML code to display a package dependency link annotation + * (dependency type, architecture, ...) + * + * @param string $type The name of the dependency type + * @param string $arch The package dependency architecture + * @param string $desc An optdepends description + * + * @return string The HTML code of the label to display + */ +function pkg_deplink_annotation($type, $arch, $desc=false) { + if ($type == 'depends' && !$arch) { + return ''; + } + + $link = ' <em>('; + + if ($type == 'makedepends') { + $link .= 'make'; + } elseif ($type == 'checkdepends') { + $link .= 'check'; + } elseif ($type == 'optdepends') { + $link .= 'optional'; + } + + if ($type != 'depends' && $arch) { + $link .= ', '; + } + + if ($arch) { + $link .= htmlspecialchars($arch); + } + + $link .= ')'; + if ($type == 'optdepends' && $desc) { + $link .= ' – ' . htmlspecialchars($desc) . ' </em>'; + } + $link .= '</em>'; + + return $link; +} + +/** * Get the HTML code to display a package dependency link * * @param string $name The name of the dependency @@ -246,11 +288,10 @@ function pkg_relations($pkgid) { * @param string $cond The package dependency condition string * @param string $arch The package dependency architecture * @param int $pkg_id The package of the package to display the dependency for - * @param bool $show_desc Whether the description of optdepends is shown * * @return string The HTML code of the label to display */ -function pkg_depend_link($name, $type, $cond, $arch, $pkg_id, $show_desc=true) { +function pkg_depend_link($name, $type, $cond, $arch, $pkg_id) { if ($type == 'optdepends' && strpos($name, ':') !== false) { $tokens = explode(':', $name, 2); $name = $tokens[0]; @@ -295,33 +336,30 @@ function pkg_depend_link($name, $type, $cond, $arch, $pkg_id, $show_desc=true) { $link .= htmlspecialchars($cond); } - if ($type != 'depends' || $arch) { - $link .= ' <em>('; - - if ($type == 'makedepends') { - $link .= 'make'; - } elseif ($type == 'checkdepends') { - $link .= 'check'; - } elseif ($type == 'optdepends') { - $link .= 'optional'; - } - - if ($type != 'depends' && $arch) { - $link .= ', '; - } - - if ($arch) { - $link .= htmlspecialchars($arch); - } + return $link . pkg_deplink_annotation($type, $arch, $desc); +} - $link .= ')'; - if ($show_desc && $type == 'optdepends') { - $link .= ' – ' . htmlspecialchars($desc) . ' </em>'; - } - $link .= '</em>'; +/** + * Get the HTML code to display a package requirement link + * + * @param string $name The name of the requirement + * @param string $type The name of the dependency type + * @param string $arch The package dependency architecture + * + * @return string The HTML code of the link to display + */ +function pkg_requiredby_link($name, $type, $arch) { + if ($type == 'optdepends' && strpos($name, ':') !== false) { + $tokens = explode(':', $name, 2); + $name = $tokens[0]; } - return $link; + $link = '<a href="'; + $link .= htmlspecialchars(get_pkg_uri($name), ENT_QUOTES); + $link .= '" title="' . __('View packages details for') .' ' . htmlspecialchars($name) . '">'; + $link .= htmlspecialchars($name) . '</a>'; + + return $link . pkg_deplink_annotation($type, $arch); } /** @@ -379,7 +417,7 @@ function pkg_required($name="") { $deps = array(); if ($name != "") { $dbh = DB::connect(); - $q = "SELECT p.Name, dt.Name, '' AS DepCondition, pd.DepArch, p.ID FROM PackageDepends pd "; + $q = "SELECT p.Name, dt.Name, pd.DepArch FROM PackageDepends pd "; $q.= "LEFT JOIN Packages p ON p.ID = pd.PackageID "; $q.= "LEFT JOIN DependencyTypes dt ON dt.ID = pd.DepTypeID "; $q.= "WHERE pd.DepName = " . $dbh->quote($name) . " "; diff --git a/web/template/pkg_details.php b/web/template/pkg_details.php index 5ba3607..0a2d90e 100644 --- a/web/template/pkg_details.php +++ b/web/template/pkg_details.php @@ -285,7 +285,7 @@ endif; <?php if (count($requiredby) > 0): ?> <ul id="pkgreqslist"> <?php while (list($k, $darr) = each($requiredby)): ?> - <li><?= pkg_depend_link($darr[0], $darr[1], $darr[2], $darr[3], $darr[4], false); ?></li> + <li><?= pkg_requiredby_link($darr[0], $darr[1], $darr[2]); ?></li> <?php endwhile; ?> </ul> <?php endif; ?> -- 2.5.2

1 1

[aur-dev] [PATCH] git-update: Use proper stop value for slice
by Lukas Fleischer 16 Sep '15

16 Sep '15

Fixes a regression introduced in 4112e57 (Add a restore command to the SSH interface, 2015-08-14). Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- git-interface/git-update.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/git-interface/git-update.py b/git-interface/git-update.py index 5ff8b28..4698382 100755 --- a/git-interface/git-update.py +++ b/git-interface/git-update.py @@ -188,7 +188,7 @@ if len(sys.argv) == 2 and sys.argv[1] == "restore": refname = "refs/heads/master" sha1_old = sha1_new = repo.lookup_reference('refs/heads/' + pkgbase).target elif len(sys.argv) == 4: - refname, sha1_old, sha1_new = sys.argv[1:3] + refname, sha1_old, sha1_new = sys.argv[1:4] else: die("invalid arguments") -- 2.5.2

1 0

[aur-dev] [PATCH] Transfer notifications when merging packages
by Lukas Fleischer 16 Sep '15

16 Sep '15

When a package base is merged into another one, followers of the old package base usually want to be notified about comments the new package base as well. Fixes FS#27687. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- scripts/notify.py | 7 +++---- web/lib/pkgbasefuncs.inc.php | 14 ++++++++++++++ 2 files changed, 17 insertions(+), 4 deletions(-) diff --git a/scripts/notify.py b/scripts/notify.py index 55b2911..f6bf6ff 100755 --- a/scripts/notify.py +++ b/scripts/notify.py @@ -167,10 +167,9 @@ def delete(cur, uid, old_pkgbase_id, new_pkgbase_id=None): if new_pkgbase_id: new_pkgbase_uri = aur_location + '/pkgbase/' + new_pkgbase + '/' body = '%s [1] merged %s [2] into %s [3].\n\n' \ - 'You will no longer receive notifications about this ' \ - 'package, please go to [3] and click "%s" if you wish to ' \ - 'receive them again.' % \ - (user, old_pkgbase, new_pkgbase, 'Notify of new comments') + 'If you no longer wish receive notifications about the new ' \ + 'package, please go to [3] and click "%s".' %\ + (user, old_pkgbase, new_pkgbase, 'Disable notifications') body += '\n\n' body += '[1] ' + user_uri + '\n' body += '[2] ' + pkgbase_uri + '\n' diff --git a/web/lib/pkgbasefuncs.inc.php b/web/lib/pkgbasefuncs.inc.php index 799f1da..cb756f6 100644 --- a/web/lib/pkgbasefuncs.inc.php +++ b/web/lib/pkgbasefuncs.inc.php @@ -448,6 +448,20 @@ function pkgbase_delete ($base_ids, $merge_base_id, $via, $grant=false) { $q.= "WHERE PackageBaseID IN (" . implode(",", $base_ids) . ")"; $dbh->exec($q); + /* Merge notifications */ + $q = "SELECT DISTINCT UserID FROM CommentNotify cn "; + $q.= "WHERE PackageBaseID IN (" . implode(",", $base_ids) . ") "; + $q.= "AND NOT EXISTS (SELECT * FROM CommentNotify cn2 "; + $q.= "WHERE cn2.PackageBaseID = " . intval($merge_base_id) . " "; + $q.= "AND cn2.UserID = cn.UserID)"; + $result = $dbh->query($q); + + while ($notify_uid = $result->fetch(PDO::FETCH_COLUMN, 0)) { + $q = "INSERT INTO CommentNotify (UserID, PackageBaseID) "; + $q.= "VALUES (" . intval($notify_uid) . ", " . intval($merge_base_id) . ")"; + $dbh->exec($q); + } + /* Merge votes */ foreach ($base_ids as $base_id) { $q = "UPDATE PackageVotes "; -- 2.5.2

1 0

[aur-dev] [PATCH] Show providers in dependencies
by Lukas Fleischer 16 Sep '15

16 Sep '15

For all "virtual provisions" in package dependencies, show links to the actual packages providing the dependency. This partly implements FS#14125. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/lib/pkgfuncs.inc.php | 65 +++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 59 insertions(+), 6 deletions(-) diff --git a/web/lib/pkgfuncs.inc.php b/web/lib/pkgfuncs.inc.php index d760429..d83a01f 100644 --- a/web/lib/pkgfuncs.inc.php +++ b/web/lib/pkgfuncs.inc.php @@ -155,6 +155,33 @@ function pkg_groups($pkgid) { } /** + * Get providers for a specific package + * + * @param string $name The name of the "package" to get providers for + * + * @return array The IDs and names of all providers of the package + */ +function pkg_providers($name) { + $dbh = DB::connect(); + $q = "SELECT p.ID, p.Name FROM Packages p "; + $q.= "INNER JOIN PackageRelations pr ON pr.PackageID = p.ID "; + $q.= "INNER JOIN RelationTypes rt ON rt.ID = pr.RelTypeID "; + $q.= "WHERE rt.Name = 'provides' "; + $q.= "AND pr.RelName = " . $dbh->quote($name); + $result = $dbh->query($q); + + if (!$result) { + return array(); + } + + $providers = array(); + while ($row = $result->fetch(PDO::FETCH_NUM)) { + $providers[] = $row; + } + return $providers; +} + +/** * Get package dependencies for a specific package * * @param int $pkgid The package to get dependencies for @@ -232,15 +259,41 @@ function pkg_depend_link($name, $type, $cond, $arch, $pkg_id, $show_desc=true) { $desc = '(unknown)'; } - $link = '<a href="'; + $providers = array(); if (is_null($pkg_id)) { - $link .= 'https://www.archlinux.org/packages/?q=' . urlencode($name); + /* + * TODO: We currently perform one SQL query per nonexistent + * package dependency. It would be much better if we could + * annotate dependency data with providers so that we already + * know whether a dependency is a "provision name" or a package + * from the official repositories at this point. + */ + $providers = pkg_providers($name); + } + + if (count($providers) > 0) { + $link = htmlspecialchars($name) . ' '; + $link .= '<span class="virtual-dep">('; + foreach ($providers as $provider) { + $name = $provider[1]; + $link .= '<a href="'; + $link .= htmlspecialchars(get_pkg_uri($name), ENT_QUOTES); + $link .= '" title="' . __('View packages details for') .' ' . htmlspecialchars($name) . '">'; + $link .= htmlspecialchars($name) . '</a>, '; + } + $link = substr($link, 0, -2); + $link .= ')</span>'; } else { - $link .= htmlspecialchars(get_pkg_uri($name), ENT_QUOTES); + $link = '<a href="'; + if (is_null($pkg_id)) { + $link .= 'https://www.archlinux.org/packages/?q=' . urlencode($name); + } else { + $link .= htmlspecialchars(get_pkg_uri($name), ENT_QUOTES); + } + $link .= '" title="' . __('View packages details for') .' ' . htmlspecialchars($name) . '">'; + $link .= htmlspecialchars($name) . '</a>'; + $link .= htmlspecialchars($cond); } - $link .= '" title="' . __('View packages details for') .' ' . htmlspecialchars($name) . '">'; - $link .= htmlspecialchars($name) . '</a>'; - $link .= htmlspecialchars($cond); if ($type != 'depends' || $arch) { $link .= ' <em>('; -- 2.5.2

1 0

[aur-dev] [PATCH] Mitigate JSONP callback vulnerabilities
by Lukas Fleischer 12 Sep '15

12 Sep '15

The callback parameter of the RPC interface currently allows for specifying a prefix of arbitrary length of the returned result. This can be exploited by certain attacks. As a countermeasure, this patch restricts the allowed character set for the callback name to letters, digits, underscores, parenthesis and dots. It also limits the length of the name to 128 characters. Furthermore, the reflected callback name is now always prepended with "/**/", which is a common workaround to protect against attacks such as Rosetta Flash. Fixes FS#46259. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/lib/aurjson.class.php | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/web/lib/aurjson.class.php b/web/lib/aurjson.class.php index e102fed..e646c63 100644 --- a/web/lib/aurjson.class.php +++ b/web/lib/aurjson.class.php @@ -110,9 +110,13 @@ class AurJSON { return; } - if (isset($http_data['callback'])) { + $callback = $http_data['callback']; + if (isset($callback)) { + if (!preg_match('/^[a-zA-Z0-9().]{1,128}$/D', $callback)) { + return $this->json_error('Invalid callback name.'); + } header('content-type: text/javascript'); - return $http_data['callback'] . "({$json})"; + return '/**/' . $callback . '(' . $json . ')'; } else { header('content-type: application/json'); return $json; -- 2.5.1

1 0

[aur-dev] [PATCH 1/2] Remove superfluous function valid_user()
by Lukas Fleischer 11 Sep '15

11 Sep '15

This helper function was almost 100% identical to uid_from_username(). Switch to using uid_from_username(), which has a much better name and implementation, everywhere. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/html/addvote.php | 2 +- web/lib/acctfuncs.inc.php | 27 +-------------------------- 2 files changed, 2 insertions(+), 27 deletions(-) diff --git a/web/html/addvote.php b/web/html/addvote.php index 0372518..d152941 100644 --- a/web/html/addvote.php +++ b/web/html/addvote.php @@ -24,7 +24,7 @@ if (has_credential(CRED_TU_ADD_VOTE)) { $error = ""; if (!empty($_POST['user'])) { - if (!valid_user($_POST['user'])) { + if (!uid_from_username($_POST['user'])) { $error.= __("Username does not exist."); } else { diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index f718a77..ee8f0e3 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -479,7 +479,7 @@ function try_login() { } $dbh = DB::connect(); - $userID = valid_user($_REQUEST['user']); + $userID = uid_from_username($_REQUEST['user']); if (user_suspended($userID)) { $login_error = __('Account suspended'); @@ -609,31 +609,6 @@ function valid_username($user) { } /** - * Determine if a username exists in the database - * - * @param string $user Username to check in the database - * - * @return string|void Return user ID if in database, otherwise void - */ -function valid_user($user) { - if (!$user) { - return false; - } - - $dbh = DB::connect(); - - $q = "SELECT ID FROM Users WHERE "; - $q.= "Username = " . $dbh->quote($user); - $result = $dbh->query($q); - if (!$result) { - return null; - } - - $row = $result->fetch(PDO::FETCH_NUM); - return $row[0]; -} - -/** * Determine if a user already has a proposal open about themselves * * @param string $user Username to checkout for open proposal -- 2.5.1

1 1