- Aur-dev - lists.archlinux.org

[aur-dev] [PATCH v3 1/3] Use username from the database if one is provided by the user
by Marcel Korpel 16 Jul '15

16 Jul '15

This fixes a bug where the new user name input by the user was invalid, causing the account deletion link and the form action to be wrong. Signed-off-by: Marcel Korpel <marcel.korpel(a)gmail.com> --- web/html/account.php | 4 ++-- web/lib/acctfuncs.inc.php | 8 +++++--- web/template/account_edit_form.php | 4 ++-- 3 files changed, 9 insertions(+), 7 deletions(-) diff --git a/web/html/account.php b/web/html/account.php index c447de3..f5e6c19 100644 --- a/web/html/account.php +++ b/web/html/account.php @@ -61,7 +61,7 @@ if (isset($_COOKIE["AURSID"])) { $row["AccountTypeID"], $row["Suspended"], $row["Email"], "", "", $row["RealName"], $row["LangPreference"], $row["IRCNick"], $row["PGPKey"], $PK, - $row["InactivityTS"] ? 1 : 0, $row["ID"]); + $row["InactivityTS"] ? 1 : 0, $row["ID"], $row["Username"]); } else { print __("You do not have permission to edit this account."); } @@ -100,7 +100,7 @@ if (isset($_COOKIE["AURSID"])) { in_request("E"), in_request("P"), in_request("C"), in_request("R"), in_request("L"), in_request("I"), in_request("K"), in_request("PK"), in_request("J"), - in_request("ID")); + in_request("ID"), $row["Username"]); } } else { if (has_credential(CRED_ACCOUNT_SEARCH)) { diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index 2b57b2d..9d6f5ee 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -56,11 +56,12 @@ function html_format_pgp_fingerprint($fingerprint) { * @param string $PK The list of SSH public keys * @param string $J The inactivity status of the displayed user * @param string $UID The user ID of the displayed user + * @param string $N The username as present in the database * * @return void */ function display_account_form($A,$U="",$T="",$S="",$E="",$P="",$C="",$R="", - $L="",$I="",$K="",$PK="",$J="", $UID=0) { + $L="",$I="",$K="",$PK="",$J="",$UID=0,$N="") { global $SUPPORTED_LANGS; include("account_edit_form.php"); @@ -86,11 +87,12 @@ function display_account_form($A,$U="",$T="",$S="",$E="",$P="",$C="",$R="", * @param string $PK The list of public SSH keys * @param string $J The inactivity status of the user * @param string $UID The user ID of the modified account + * @param string $N The username as present in the database * * @return string|void Return void if successful, otherwise return error */ function process_account_form($TYPE,$A,$U="",$T="",$S="",$E="",$P="",$C="", - $R="",$L="",$I="",$K="",$PK="",$J="",$UID=0) { + $R="",$L="",$I="",$K="",$PK="",$J="",$UID=0,$N="") { global $SUPPORTED_LANGS; $error = ''; @@ -247,7 +249,7 @@ function process_account_form($TYPE,$A,$U="",$T="",$S="",$E="",$P="",$C="", if ($error) { print "<ul class='errorlist'><li>".$error."</li></ul>\n"; display_account_form($A, $U, $T, $S, $E, "", "", - $R, $L, $I, $K, $PK, $J, $UID); + $R, $L, $I, $K, $PK, $J, $UID, $N); return; } diff --git a/web/template/account_edit_form.php b/web/template/account_edit_form.php index 56bdd45..0aadb9d 100644 --- a/web/template/account_edit_form.php +++ b/web/template/account_edit_form.php @@ -1,9 +1,9 @@ <?php if ($A == "UpdateAccount"): ?> <p> - <?= __('Click %shere%s if you want to permanently delete this account.', '<a href="' . get_user_uri($U) . 'delete/' . '">', '</a>') ?> + <?= __('Click %shere%s if you want to permanently delete this account.', '<a href="' . get_user_uri($N) . 'delete/' . '">', '</a>') ?> </p> -<form id="edit-profile-form" action="<?= get_user_uri($U) . 'update/'; ?>" method="post"> +<form id="edit-profile-form" action="<?= get_user_uri($N) . 'update/'; ?>" method="post"> <?php else: ?> <form id="edit-profile-form" action="<?= get_uri('/register/'); ?>" method="post"> <?php endif; ?> -- 2.4.5

2 3

[aur-dev] [PATCH v2 1/3] Use username from the database if one is provided by the user
by Marcel Korpel 14 Jul '15

14 Jul '15

This fixes a bug where the new user name input by the user was invalid, causing the account deletion link and the form action to be wrong. Signed-off-by: Marcel Korpel <marcel.korpel(a)gmail.com> --- web/html/account.php | 4 ++-- web/lib/acctfuncs.inc.php | 8 +++++--- web/template/account_edit_form.php | 4 ++-- 3 files changed, 9 insertions(+), 7 deletions(-) diff --git a/web/html/account.php b/web/html/account.php index c447de3..f5e6c19 100644 --- a/web/html/account.php +++ b/web/html/account.php @@ -61,7 +61,7 @@ if (isset($_COOKIE["AURSID"])) { $row["AccountTypeID"], $row["Suspended"], $row["Email"], "", "", $row["RealName"], $row["LangPreference"], $row["IRCNick"], $row["PGPKey"], $PK, - $row["InactivityTS"] ? 1 : 0, $row["ID"]); + $row["InactivityTS"] ? 1 : 0, $row["ID"], $row["Username"]); } else { print __("You do not have permission to edit this account."); } @@ -100,7 +100,7 @@ if (isset($_COOKIE["AURSID"])) { in_request("E"), in_request("P"), in_request("C"), in_request("R"), in_request("L"), in_request("I"), in_request("K"), in_request("PK"), in_request("J"), - in_request("ID")); + in_request("ID"), $row["Username"]); } } else { if (has_credential(CRED_ACCOUNT_SEARCH)) { diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index edd38ee..b5dc51d 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -56,11 +56,12 @@ function html_format_pgp_fingerprint($fingerprint) { * @param string $PK The list of SSH public keys * @param string $J The inactivity status of the displayed user * @param string $UID The user ID of the displayed user + * @param string $N The username as present in the database * * @return void */ function display_account_form($A,$U="",$T="",$S="",$E="",$P="",$C="",$R="", - $L="",$I="",$K="",$PK="",$J="", $UID=0) { + $L="",$I="",$K="",$PK="",$J="",$UID=0,$N="") { global $SUPPORTED_LANGS; include("account_edit_form.php"); @@ -86,11 +87,12 @@ function display_account_form($A,$U="",$T="",$S="",$E="",$P="",$C="",$R="", * @param string $PK The list of public SSH keys * @param string $J The inactivity status of the user * @param string $UID The user ID of the modified account + * @param string $N The username as present in the database * * @return string|void Return void if successful, otherwise return error */ function process_account_form($TYPE,$A,$U="",$T="",$S="",$E="",$P="",$C="", - $R="",$L="",$I="",$K="",$PK="",$J="",$UID=0) { + $R="",$L="",$I="",$K="",$PK="",$J="",$UID=0,$N="") { global $SUPPORTED_LANGS; $error = ''; @@ -247,7 +249,7 @@ function process_account_form($TYPE,$A,$U="",$T="",$S="",$E="",$P="",$C="", if ($error) { print "<ul class='errorlist'><li>".$error."</li></ul>\n"; display_account_form($A, $U, $T, $S, $E, "", "", - $R, $L, $I, $K, $PK, $J, $UID); + $R, $L, $I, $K, $PK, $J, $UID, $N); return; } diff --git a/web/template/account_edit_form.php b/web/template/account_edit_form.php index 56bdd45..0aadb9d 100644 --- a/web/template/account_edit_form.php +++ b/web/template/account_edit_form.php @@ -1,9 +1,9 @@ <?php if ($A == "UpdateAccount"): ?> <p> - <?= __('Click %shere%s if you want to permanently delete this account.', '<a href="' . get_user_uri($U) . 'delete/' . '">', '</a>') ?> + <?= __('Click %shere%s if you want to permanently delete this account.', '<a href="' . get_user_uri($N) . 'delete/' . '">', '</a>') ?> </p> -<form id="edit-profile-form" action="<?= get_user_uri($U) . 'update/'; ?>" method="post"> +<form id="edit-profile-form" action="<?= get_user_uri($N) . 'update/'; ?>" method="post"> <?php else: ?> <form id="edit-profile-form" action="<?= get_uri('/register/'); ?>" method="post"> <?php endif; ?> -- 2.4.5

2 3

[aur-dev] [PATCH] stats.inc.php: Improve definition of "added"
by Lukas Fleischer 14 Jul '15

14 Jul '15

Until now, a package is listed under "Packages added in the past 7 days" if it was added at most one week ago and if the last modification time matches the submission time stamp. A package is considered "updated" if it was modified at most one week ago and the modification time stamp differs from the submission time stamp. Since we are using Git to store packages now, there always is a delay between package creation (which is handled in git-serve) and last modification (which is handled by git-update). Thus, by the above definitions, almost every package is considered "updated". Since there is no reason for excluding packages that were both added and updated within the past seven days from the "Packages added in the past 7 days" counter, we can drop the check whether the last modification time matches the submission time stamp. Also, to identify packages that were actually updated, we now only count packages that were modified at least one hour after the initial submission. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/lib/stats.inc.php | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/web/lib/stats.inc.php b/web/lib/stats.inc.php index 52637be..203be0a 100644 --- a/web/lib/stats.inc.php +++ b/web/lib/stats.inc.php @@ -77,25 +77,29 @@ function general_stats_table() { $yearstamp = intval(strtotime("-1 year")); $q = "SELECT COUNT(*) FROM PackageBases "; - $q.= "WHERE ModifiedTS >= $targstamp "; - $q.= "AND ModifiedTS = SubmittedTS "; + $q.= "WHERE SubmittedTS >= $targstamp "; $q.= "AND PackagerUID IS NOT NULL"; $add_count = db_cache_value($q, 'add_count'); + /* + * A package whose last modification time differs less than an hour + * from the initial submission time is considered new. + */ + $q = "SELECT COUNT(*) FROM PackageBases "; $q.= "WHERE ModifiedTS >= $targstamp "; - $q.= "AND ModifiedTS != SubmittedTS "; + $q.= "AND ModifiedTS - SubmittedTS >= 3600 "; $q.= "AND PackagerUID IS NOT NULL"; $update_count = db_cache_value($q, 'update_count'); $q = "SELECT COUNT(*) FROM PackageBases "; $q.= "WHERE ModifiedTS >= $yearstamp "; - $q.= "AND ModifiedTS != SubmittedTS "; + $q.= "AND ModifiedTS - SubmittedTS >= 3600 "; $q.= "AND PackagerUID IS NOT NULL"; $update_year_count = db_cache_value($q, 'update_year_count'); $q = "SELECT COUNT(*) FROM PackageBases "; - $q.= "WHERE ModifiedTS = SubmittedTS "; + $q.= "WHERE ModifiedTS - SubmittedTS < 3600 "; $q.= "AND PackagerUID IS NOT NULL"; $never_update_count = db_cache_value($q, 'never_update_count'); -- 2.4.5

1 0

[aur-dev] [PATCH 1/3] Use username from the database if one is provided by the user
by Marcel Korpel 13 Jul '15

13 Jul '15

This fixes a bug where the new user name input by the user was invalid, causing the account deletion link and the form action to be wrong. Signed-off-by: Marcel Korpel <marcel.korpel(a)gmail.com> --- web/html/account.php | 2 +- web/lib/acctfuncs.inc.php | 29 ++++++++++++++++++++++++++--- web/template/account_edit_form.php | 4 ++-- 3 files changed, 29 insertions(+), 6 deletions(-) diff --git a/web/html/account.php b/web/html/account.php index c447de3..8545478 100644 --- a/web/html/account.php +++ b/web/html/account.php @@ -100,7 +100,7 @@ if (isset($_COOKIE["AURSID"])) { in_request("E"), in_request("P"), in_request("C"), in_request("R"), in_request("L"), in_request("I"), in_request("K"), in_request("PK"), in_request("J"), - in_request("ID")); + in_request("ID"), $row["Username"]); } } else { if (has_credential(CRED_ACCOUNT_SEARCH)) { diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index edd38ee..ad907df 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -39,6 +39,25 @@ function html_format_pgp_fingerprint($fingerprint) { } /** + * If a user name from the database is provided, use that one, as the other + * one might be tampered by the end user + * + * @param string $U The username, possibly provided by the user + * @param string $N The username as present in the database + * + * @return string A username that's always safe to use in URLs + */ +function create_safe_url_username($U, $N) { + // if a display username is provided but not one extracted + // from the database, use the former + if (!empty($U) && empty($N)) { + $N = $U; + } + + return $N; +} + +/** * Loads the account editing form, with any values that are already saved * * @global array $SUPPORTED_LANGS Languages that are supported by the AUR @@ -56,13 +75,15 @@ function html_format_pgp_fingerprint($fingerprint) { * @param string $PK The list of SSH public keys * @param string $J The inactivity status of the displayed user * @param string $UID The user ID of the displayed user + * @param string $N The username as present in the database * * @return void */ function display_account_form($A,$U="",$T="",$S="",$E="",$P="",$C="",$R="", - $L="",$I="",$K="",$PK="",$J="", $UID=0) { + $L="",$I="",$K="",$PK="",$J="",$UID=0,$N="") { global $SUPPORTED_LANGS; + $N = create_safe_url_username($U, $N); include("account_edit_form.php"); return; } @@ -86,13 +107,15 @@ function display_account_form($A,$U="",$T="",$S="",$E="",$P="",$C="",$R="", * @param string $PK The list of public SSH keys * @param string $J The inactivity status of the user * @param string $UID The user ID of the modified account + * @param string $N The username as present in the database * * @return string|void Return void if successful, otherwise return error */ function process_account_form($TYPE,$A,$U="",$T="",$S="",$E="",$P="",$C="", - $R="",$L="",$I="",$K="",$PK="",$J="",$UID=0) { + $R="",$L="",$I="",$K="",$PK="",$J="",$UID=0,$N="") { global $SUPPORTED_LANGS; + $N = create_safe_url_username($U, $N); $error = ''; if (is_ipbanned()) { @@ -247,7 +270,7 @@ function process_account_form($TYPE,$A,$U="",$T="",$S="",$E="",$P="",$C="", if ($error) { print "<ul class='errorlist'><li>".$error."</li></ul>\n"; display_account_form($A, $U, $T, $S, $E, "", "", - $R, $L, $I, $K, $PK, $J, $UID); + $R, $L, $I, $K, $PK, $J, $UID, $N); return; } diff --git a/web/template/account_edit_form.php b/web/template/account_edit_form.php index 56bdd45..0aadb9d 100644 --- a/web/template/account_edit_form.php +++ b/web/template/account_edit_form.php @@ -1,9 +1,9 @@ <?php if ($A == "UpdateAccount"): ?> <p> - <?= __('Click %shere%s if you want to permanently delete this account.', '<a href="' . get_user_uri($U) . 'delete/' . '">', '</a>') ?> + <?= __('Click %shere%s if you want to permanently delete this account.', '<a href="' . get_user_uri($N) . 'delete/' . '">', '</a>') ?> </p> -<form id="edit-profile-form" action="<?= get_user_uri($U) . 'update/'; ?>" method="post"> +<form id="edit-profile-form" action="<?= get_user_uri($N) . 'update/'; ?>" method="post"> <?php else: ?> <form id="edit-profile-form" action="<?= get_uri('/register/'); ?>" method="post"> <?php endif; ?> -- 2.4.5

2 7

[aur-dev] [PATCH 1/1] disable autocorrection for package search input field
by Christian Hesse 13 Jul '15

13 Jul '15

From: Christian Hesse <mail(a)eworm.de> Searching for packages with mobile devices can be quite... adventurous. Most package names are not contained in dictionaries, so let's disable autocorrection. Signed-off-by: Christian Hesse <mail(a)eworm.de> --- web/html/home.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/web/html/home.php b/web/html/home.php index 3252876..23c6286 100644 --- a/web/html/home.php +++ b/web/html/home.php @@ -130,7 +130,7 @@ html_header( __("Home") ); <fieldset> <label for="pkgsearch-field"><?= __('Package Search') ?>:</label> <input type="hidden" name="O" value="0" /> - <input id="pkgsearch-field" type="text" name="K" size="30" value="<?php if (isset($_REQUEST["K"])) { print stripslashes(trim(htmlspecialchars($_REQUEST["K"], ENT_QUOTES))); } ?>" maxlength="35" /> + <input id="pkgsearch-field" type="text" name="K" size="30" value="<?php if (isset($_REQUEST["K"])) { print stripslashes(trim(htmlspecialchars($_REQUEST["K"], ENT_QUOTES))); } ?>" maxlength="35" autocorrect="off" /> </fieldset> </form> </div> -- 2.4.5

1 0

[aur-dev] [PATCH] Don't change tables manually before deleting a user
by Marcel Korpel 12 Jul '15

12 Jul '15

All this is correctly taken care of by the database. This fixes several bugs where records should be deleted instead of NULLified. For example, when a comment deleter's account was deleted, DelUsersID of the comment was (re)set to NULL, causing the comment to appear again. Signed-off-by: Marcel Korpel <marcel.korpel(a)gmail.com> --- web/lib/acctfuncs.inc.php | 33 --------------------------------- 1 file changed, 33 deletions(-) diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index edd38ee..e3cba37 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -927,39 +927,6 @@ function user_delete($id) { $dbh = DB::connect(); $id = intval($id); - /* - * These are normally already taken care of by propagation constraints - * but it is better to be explicit here. - */ - $fields_delete = array( - array("Sessions", "UsersID"), - array("PackageVotes", "UsersID"), - array("CommentNotify", "UsersID") - ); - - $fields_set_null = array( - array("PackageBases", "SubmitterUID"), - array("PackageBases", "MaintainerUID"), - array("PackageBases", "SubmitterUID"), - array("PackageComments", "UsersID"), - array("PackageComments", "DelUsersID"), - array("PackageRequests", "UsersID"), - array("TU_VoteInfo", "SubmitterID"), - array("TU_Votes", "UserID") - ); - - foreach($fields_delete as list($table, $field)) { - $q = "DELETE FROM " . $table . " "; - $q.= "WHERE " . $field . " = " . $id; - $dbh->query($q); - } - - foreach($fields_set_null as list($table, $field)) { - $q = "UPDATE " . $table . " SET " . $field . " = NULL "; - $q.= "WHERE " . $field . " = " . $id; - $dbh->query($q); - } - $q = "DELETE FROM Users WHERE ID = " . $id; $dbh->query($q); return; -- 2.4.5

1 0

[aur-dev] [PATCH] use rel="nofollow" for links in comments
by Daniel Micay 12 Jul '15

12 Jul '15

This removes the incentive for spammers to post links by asking search engines to ignore them. Signed-off-by: Daniel Micay <danielmicay(a)gmail.com> --- web/lib/aur.inc.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/web/lib/aur.inc.php b/web/lib/aur.inc.php index 7a455c6..b410db5 100644 --- a/web/lib/aur.inc.php +++ b/web/lib/aur.inc.php @@ -595,7 +595,7 @@ function parse_comment($comment) { if ($i % 2) { # convert links $html .= '<a href="' . htmlspecialchars($matches[$i]) . - '">' . htmlspecialchars($matches[$i]) . '</a>'; + '" rel="nofollow">' . htmlspecialchars($matches[$i]) . '</a>'; } else { # convert everything else -- 2.4.5

2 1

[aur-dev] [PATCH v2 0/3] Add support for markdown code blocks and inline code
by Marcel Korpel 11 Jul '15

11 Jul '15

Only a subset of markdown is support, i.e.: ``` code blocks ``` and `inline code`. Marcel Korpel (3): Add horizontal scrollbar to code blocks when necessary Use a normal font size for code blocks Convert markdown codeblocks and inline code to HTML web/html/css/aurweb.css | 5 ++++ web/lib/aur.inc.php | 74 +++++++++++++++++++++++++++++++++++++++---------- 2 files changed, 65 insertions(+), 14 deletions(-) -- 2.4.5

1 5

[aur-dev] [PATCH 0/4] Add support for markdown code blocks and inline code
by Marcel Korpel 11 Jul '15

11 Jul '15

Only a subset of markdown is support, i.e.: ``` code blocks ``` and `inline code`. Marcel Korpel (4): Convert markdown codeblocks to HTML code blocks Add support for markdown inline code Add horizontal scrollbar to code blocks when necessary Use a normal font size for code blocks web/html/css/aurweb.css | 5 ++++ web/lib/aur.inc.php | 78 ++++++++++++++++++++++++++++++++++++++++++------- 2 files changed, 73 insertions(+), 10 deletions(-) -- 2.4.5

2 7

[aur-dev] [PATCH 1/2] Create missing foreign key for comments
by Marcel Korpel 10 Jul '15

10 Jul '15

Signed-off-by: Marcel Korpel <marcel.korpel(a)gmail.com> --- schema/aur-schema.sql | 1 + 1 file changed, 1 insertion(+) diff --git a/schema/aur-schema.sql b/schema/aur-schema.sql index 3aef7a3..444cb5e 100644 --- a/schema/aur-schema.sql +++ b/schema/aur-schema.sql @@ -261,6 +261,7 @@ CREATE TABLE PackageComments ( INDEX (UsersID), INDEX (PackageBaseID), FOREIGN KEY (UsersID) REFERENCES Users(ID) ON DELETE SET NULL, + FOREIGN KEY (EditedUsersID) REFERENCES Users(ID) ON DELETE SET NULL, FOREIGN KEY (DelUsersID) REFERENCES Users(ID) ON DELETE CASCADE, FOREIGN KEY (PackageBaseID) REFERENCES PackageBases(ID) ON DELETE CASCADE ) ENGINE = InnoDB; -- 2.4.5

1 2