- Aur-dev - lists.archlinux.org

Highlight orphaned packages in table
by Marcus Andersson 22 Sep '20

22 Sep '20

Hi! One minor feature that i personally would find helpful, is when you're scrolling thru the package list and "accidentally" find an orphaned package that you end up adopting; Unless you're specifically looking for packages to adopt, it's pretty hard to tell an orphaned package from a maintained one. Therefore I suggest a highlighting feature, making orphaned packages easier to spot as you scroll. Fore example, out of date package's version numbers is red when they are flagged like so, that behavior would be helpful for orphaned packages too. I am happy to implement this if it seems like a reasonable addition. Thanks! mackilanu

2 1

[PATCH] pkg_search_page: Limit number of results on package search
by foxboron＠archlinux.org 05 Sep '20

05 Sep '20

From: Morten Linderud <morten(a)linderud.pw> The current package search query is quite poorly optimized and becomes a resource hog when the offsets gets large enough. This DoSes the service. A quick fix is to just ensure we have some limit to the number of hits we return. The current hardcoding of 2500 is based on the following: * 250 hits pr page max * 10 pages We can maybe consider having it lower, but it seems easier to just have this a multiple of 250 in the first iteration. Signed-off-by: Morten Linderud <morten(a)linderud.pw> --- web/lib/pkgfuncs.inc.php | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/web/lib/pkgfuncs.inc.php b/web/lib/pkgfuncs.inc.php index 8c915711..948e716c 100644 --- a/web/lib/pkgfuncs.inc.php +++ b/web/lib/pkgfuncs.inc.php @@ -624,6 +624,10 @@ function pkg_search_page($params, $show_headers=true, $SID="") { $params['O'] = 0; } + if($params['O'] >= 2500){ + $params['O'] = 2500; + } + if (isset($params["PP"])) { $params["PP"] = bound(intval($params["PP"]), 50, 250); } else { @@ -772,6 +776,9 @@ function pkg_search_page($params, $show_headers=true, $SID="") { if ($result_t) { $row = $result_t->fetch(PDO::FETCH_NUM); $total = $row[0]; + if ($total >= 2500) { + $total = 2500; + } } else { $total = 0; -- 2.28.0

2 1

[PATCH] Deliver emails to Cc in smtplib code path
by Lukas Fleischer 27 Aug '20

27 Aug '20

When using the sendmail() function with smtplib.SMTP or smtplib.SMTP_SSL, the list of actual recipients for the email (to be translated to RCPT commands) has to be provided as a parameter. Update the notification script and add all Cc recipients to that parameter. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- aurweb/scripts/notify.py | 18 ++++++++++++------ test/t2500-notify.t | 16 +++++++++++++--- 2 files changed, 25 insertions(+), 9 deletions(-) diff --git a/aurweb/scripts/notify.py b/aurweb/scripts/notify.py index 79cf633..b698bd7 100755 --- a/aurweb/scripts/notify.py +++ b/aurweb/scripts/notify.py @@ -14,10 +14,6 @@ import aurweb.l10n aur_location = aurweb.config.get('options', 'aur_location') -def headers_cc(cclist): - return {'Cc': str.join(', ', cclist)} - - def headers_msgid(thread_id): return {'Message-ID': thread_id} @@ -53,6 +49,9 @@ class Notification: def get_headers(self): return {} + def get_cc(self): + return [] + def get_body_fmt(self, lang): body = '' for line in self.get_body(lang).splitlines(): @@ -80,6 +79,8 @@ class Notification: msg['From'] = sender msg['Reply-to'] = reply_to msg['To'] = to + if self.get_cc(): + msg['Cc'] = str.join(', ', self.get_cc()) msg['X-AUR-Reason'] = reason msg['Date'] = email.utils.formatdate(localtime=True) @@ -116,6 +117,7 @@ class Notification: server.login(user, passwd) server.set_debuglevel(0) + deliver_to = [to] + self.get_cc() server.sendmail(sender, to, msg.as_bytes()) server.quit() @@ -450,6 +452,9 @@ class RequestOpenNotification(Notification): def get_recipients(self): return [(self._to, 'en')] + def get_cc(self): + return self._cc + def get_subject(self, lang): return '[PRQ#%d] %s Request for %s' % \ (self._reqid, self._reqtype.title(), self._pkgbase) @@ -478,7 +483,6 @@ class RequestOpenNotification(Notification): # Use a deterministic Message-ID for the first email referencing a # request. headers = headers_msgid(thread_id) - headers.update(headers_cc(self._cc)) return headers @@ -509,6 +513,9 @@ class RequestCloseNotification(Notification): def get_recipients(self): return [(self._to, 'en')] + def get_cc(self): + return self._cc + def get_subject(self, lang): return '[PRQ#%d] %s Request for %s %s' % (self._reqid, self._reqtype.title(), @@ -538,7 +545,6 @@ class RequestCloseNotification(Notification): def get_headers(self): thread_id = '<pkg-request-' + str(self._reqid) + '@aur.archlinux.org>' headers = headers_reply(thread_id) - headers.update(headers_cc(self._cc)) return headers diff --git a/test/t2500-notify.t b/test/t2500-notify.t index 5ef64c1..713b31e 100755 --- a/test/t2500-notify.t +++ b/test/t2500-notify.t @@ -277,13 +277,18 @@ test_expect_success 'Test subject and body of merge notifications.' ' test_cmp actual expected ' -test_expect_success 'Test subject and body of request open notifications.' ' +test_expect_success 'Test Cc, subject and body of request open notifications.' ' cat <<-EOD | sqlite3 aur.db && /* Use package request IDs which can be distinguished from other IDs. */ - INSERT INTO PackageRequests (ID, PackageBaseID, PackageBaseName, UsersID, ReqTypeID, Comments, ClosureComment) VALUES (3001, 1001, "foobar", 1, 1, "This is a request test comment.", ""); + INSERT INTO PackageRequests (ID, PackageBaseID, PackageBaseName, UsersID, ReqTypeID, Comments, ClosureComment) VALUES (3001, 1001, "foobar", 2, 1, "This is a request test comment.", ""); EOD >sendmail.out && "$NOTIFY" request-open 1 3001 orphan 1001 && + grep ^Cc: sendmail.out >actual && + cat <<-EOD >expected && + Cc: user@localhost, tu@localhost + EOD + test_cmp actual expected && grep ^Subject: sendmail.out >actual && cat <<-EOD >expected && Subject: [PRQ#3001] Orphan Request for foobar @@ -324,9 +329,14 @@ test_expect_success 'Test subject and body of request open notifications for mer test_cmp actual expected ' -test_expect_success 'Test subject and body of request close notifications.' ' +test_expect_success 'Test Cc, subject and body of request close notifications.' ' >sendmail.out && "$NOTIFY" request-close 1 3001 accepted && + grep ^Cc: sendmail.out >actual && + cat <<-EOD >expected && + Cc: user@localhost, tu@localhost + EOD + test_cmp actual expected && grep ^Subject: sendmail.out >actual && cat <<-EOD >expected && Subject: [PRQ#3001] Deletion Request for foobar Accepted -- 2.28.0

1 0

[PATCH 1/4] spawn: expand AUR_CONFIG to the full path
by Filipe Laíns 14 Aug '20

14 Aug '20

This allows using a relative path for the config. PHP didn't play well with it. Signed-off-by: Filipe Laíns <lains(a)archlinux.org> --- aurweb/spawn.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/aurweb/spawn.py b/aurweb/spawn.py index 46d534d9..3c5130d7 100644 --- a/aurweb/spawn.py +++ b/aurweb/spawn.py @@ -11,6 +11,7 @@ configuration anyway. import argparse import atexit import os +import os.path import subprocess import sys import tempfile @@ -87,6 +88,9 @@ def start(): return atexit.register(stop) + if 'AUR_CONFIG' in os.environ: + os.environ['AUR_CONFIG'] = os.path.realpath(os.environ['AUR_CONFIG']) + try: terminal_width = os.get_terminal_size().columns except OSError: -- 2.28.0

2 4

[PATCH] Redirect to referer after SSO login
by Frédéric Mangano-Tarumi 02 Aug '20

02 Aug '20

Introduce a `redirect` query argument to SSO login endpoints so that users are redirected to the page they were originally on when they clicked the Login link. --- aurweb/routers/sso.py | 23 +++++++++++++++++------ web/html/login.php | 18 ++++++++++++------ 2 files changed, 29 insertions(+), 12 deletions(-) diff --git a/aurweb/routers/sso.py b/aurweb/routers/sso.py index 2e4fbacc..4ef31b0a 100644 --- a/aurweb/routers/sso.py +++ b/aurweb/routers/sso.py @@ -30,16 +30,21 @@ oauth.register( @router.get("/sso/login") -async def login(request: Request): +async def login(request: Request, redirect: str = None): """ Redirect the user to the SSO provider’s login page. We specify prompt=login to force the user to input their credentials even if they’re already logged on the SSO. This is less practical, but given AUR has the potential to impact many users, better safe than sorry. + + The `redirect` argument is a query parameter specifying the post-login + redirect URL. """ - redirect_uri = aurweb.config.get("options", "aur_location") + "/sso/authenticate" - return await oauth.sso.authorize_redirect(request, redirect_uri, prompt="login") + authenticate_url = aurweb.config.get("options", "aur_location") + "/sso/authenticate" + if redirect: + authenticate_url = authenticate_url + "?" + urlencode([("redirect", redirect)]) + return await oauth.sso.authorize_redirect(request, authenticate_url, prompt="login") def is_account_suspended(conn, user_id): @@ -82,8 +87,15 @@ def is_ip_banned(conn, ip): return result.fetchone() is not None +def is_aur_url(url): + aur_location = aurweb.config.get("options", "aur_location") + if not aur_location.endswith("/"): + aur_location = aur_location + "/" + return url.startswith(aur_location) + + @router.get("/sso/authenticate") -async def authenticate(request: Request, conn=Depends(aurweb.db.connect)): +async def authenticate(request: Request, redirect: str = None, conn=Depends(aurweb.db.connect)): """ Receive an OpenID Connect ID token, validate it, then process it to create an new AUR session. @@ -118,8 +130,7 @@ async def authenticate(request: Request, conn=Depends(aurweb.db.connect)): return "Sorry, we don’t seem to know you Sir " + sub elif len(aur_accounts) == 1: sid = open_session(request, conn, aur_accounts[0][Users.c.ID]) - response = RedirectResponse("/") - # TODO redirect to the referrer + response = RedirectResponse(redirect if redirect and is_aur_url(redirect) else "/") response.set_cookie(key="AURSID", value=sid, httponly=True, secure=request.url.scheme == "https") if "id_token" in token: diff --git a/web/html/login.php b/web/html/login.php index 3a146f60..3f3d66cc 100644 --- a/web/html/login.php +++ b/web/html/login.php @@ -9,6 +9,10 @@ if (!$disable_http_login || (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'])) { $login_error = $login['error']; } +$referer = in_request('referer'); +if ($referer === '') + $referer = $_SERVER['HTTP_REFERER']; + html_header('AUR ' . __("Login")); ?> <div id="dev-login" class="box"> @@ -40,13 +44,15 @@ html_header('AUR ' . __("Login")); <p> <input type="submit" class="button" value="<?php print __("Login"); ?>" /> <a href="<?= get_uri('/passreset/') ?>">[<?= __('Forgot Password') ?>]</a> - <?php if (config_get('sso', 'openid_configuration')): ?> - <a href="<?= get_uri('/sso/login') ?>">[<?= __('Login through SSO') ?>]</a> + <?php if (config_get('sso', 'openid_configuration')): + $sso_login_url = get_uri('/sso/login'); + if (isset($referer)) + $sso_login_url .= '?redirect=' . urlencode($referer); + ?> + <a href="<?= htmlspecialchars($sso_login_url, ENT_QUOTES) ?>">[<?= __('Login through SSO') ?>]</a> <?php endif; ?> - <?php if (in_request('referer') !== ""): ?> - <input id="id_referer" type="hidden" name="referer" value="<?= htmlspecialchars(in_request('referer'), ENT_QUOTES) ?>" /> - <?php elseif (isset($_SERVER['HTTP_REFERER'])): ?> - <input id="id_referer" type="hidden" name="referer" value="<?= htmlspecialchars($_SERVER['HTTP_REFERER'], ENT_QUOTES) ?>" /> + <?php if (isset($referer)): ?> + <input id="id_referer" type="hidden" name="referer" value="<?= htmlspecialchars($referer, ENT_QUOTES) ?>" /> <?php endif; ?> </p> </fieldset> -- 2.27.0

2 1

[PATCH] Remove the per-user session limit
by Frédéric Mangano-Tarumi 02 Aug '20

02 Aug '20

This feature was originally introduced by f961ffd9c7f2d3d51d3e3b060990a4fef9e56c1b as a fix for FS#12898 <https://bugs.archlinux.org/task/12898>. As of today, it is broken because of the `q.SessionID IS NULL` condition in the WHERE clause, which can’t be true because SessionID is not nullable. As a consequence, the session limit was not applied. The fact the absence of the session limit hasn’t caused any issue so far, and hadn’t even been noticed, suggests the feature is unneeded. --- aurweb/routers/sso.py | 2 +- conf/config.defaults | 1 - web/lib/acctfuncs.inc.php | 17 ----------------- 3 files changed, 1 insertion(+), 19 deletions(-) diff --git a/aurweb/routers/sso.py b/aurweb/routers/sso.py index 2e4fbacc..73c884a4 100644 --- a/aurweb/routers/sso.py +++ b/aurweb/routers/sso.py @@ -56,7 +56,7 @@ def open_session(request, conn, user_id): raise HTTPException(status_code=403, detail=_('Account suspended')) # TODO This is a terrible message because it could imply the attempt at # logging in just caused the suspension. - # TODO apply [options] max_sessions_per_user + sid = uuid.uuid4().hex conn.execute(Sessions.insert().values( UsersID=user_id, diff --git a/conf/config.defaults b/conf/config.defaults index 49259754..98e033b7 100644 --- a/conf/config.defaults +++ b/conf/config.defaults @@ -13,7 +13,6 @@ passwd_min_len = 8 default_lang = en default_timezone = UTC sql_debug = 0 -max_sessions_per_user = 8 login_timeout = 7200 persistent_cookie_timeout = 2592000 max_filesize_uncompressed = 8388608 diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index ebabb840..bc603d3b 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -596,23 +596,6 @@ function try_login() { /* Generate a session ID and store it. */ while (!$logged_in && $num_tries < 5) { - $session_limit = config_get_int('options', 'max_sessions_per_user'); - if ($session_limit) { - /* - * Delete all user sessions except the - * last ($session_limit - 1). - */ - $q = "DELETE s.* FROM Sessions s "; - $q.= "LEFT JOIN (SELECT SessionID FROM Sessions "; - $q.= "WHERE UsersId = " . $userID . " "; - $q.= "ORDER BY LastUpdateTS DESC "; - $q.= "LIMIT " . ($session_limit - 1) . ") q "; - $q.= "ON s.SessionID = q.SessionID "; - $q.= "WHERE s.UsersId = " . $userID . " "; - $q.= "AND q.SessionID IS NULL;"; - $dbh->query($q); - } - $new_sid = new_sid(); $q = "INSERT INTO Sessions (UsersID, SessionID, LastUpdateTS)" ." VALUES (" . $userID . ", '" . $new_sid . "', " . strval(time()) . ")"; -- 2.27.0

2 1

[PATCH 1/3] Update last login information on SSO login
by Frédéric Mangano-Tarumi 29 Jul '20

29 Jul '20

--- aurweb/routers/sso.py | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/aurweb/routers/sso.py b/aurweb/routers/sso.py index 7b9c67c8..817adadb 100644 --- a/aurweb/routers/sso.py +++ b/aurweb/routers/sso.py @@ -63,7 +63,13 @@ def open_session(request, conn, user_id): SessionID=sid, LastUpdateTS=time.time(), )) - # TODO update Users.LastLogin and Users.LastLoginIPAddress + + # Update user’s last login information. + conn.execute(Users.update() + .where(Users.c.ID == user_id) + .values(LastLogin=int(time.time()), + LastLoginIPAddress=request.client.host)) + return sid -- 2.27.0

2 1

[PATCH 3/3] Guard OAuth exceptions to provide better messages
by Frédéric Mangano-Tarumi 28 Jul '20

28 Jul '20

--- aurweb/routers/sso.py | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/aurweb/routers/sso.py b/aurweb/routers/sso.py index 817adadb..2e4fbacc 100644 --- a/aurweb/routers/sso.py +++ b/aurweb/routers/sso.py @@ -5,7 +5,7 @@ from urllib.parse import urlencode import fastapi -from authlib.integrations.starlette_client import OAuth +from authlib.integrations.starlette_client import OAuth, OAuthError from fastapi import Depends, HTTPException from fastapi.responses import RedirectResponse from sqlalchemy.sql import select @@ -95,8 +95,18 @@ async def authenticate(request: Request, conn=Depends(aurweb.db.connect)): detail=_('The login form is currently disabled for your IP address, ' 'probably due to sustained spam attacks. Sorry for the ' 'inconvenience.')) - token = await oauth.sso.authorize_access_token(request) - user = await oauth.sso.parse_id_token(request, token) + + try: + token = await oauth.sso.authorize_access_token(request) + user = await oauth.sso.parse_id_token(request, token) + except OAuthError: + # Here, most OAuth errors should be caused by forged or expired tokens. + # Let’s give attackers as little information as possible. + _ = get_translator_for_request(request) + raise HTTPException( + status_code=400, + detail=_('Bad OAuth token. Please retry logging in from the start.')) + sub = user.get("sub") # this is the SSO account ID in JWT terminology if not sub: _ = get_translator_for_request(request) -- 2.27.0

1 0

[PATCH 2/3] HTML error pages for FastAPI
by Frédéric Mangano-Tarumi 28 Jul '20

28 Jul '20

--- aurweb/asgi.py | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/aurweb/asgi.py b/aurweb/asgi.py index 60c7ade7..9293ed77 100644 --- a/aurweb/asgi.py +++ b/aurweb/asgi.py @@ -1,4 +1,7 @@ -from fastapi import FastAPI +import http + +from fastapi import FastAPI, HTTPException +from fastapi.responses import HTMLResponse from starlette.middleware.sessions import SessionMiddleware import aurweb.config @@ -14,3 +17,14 @@ if not session_secret: app.add_middleware(SessionMiddleware, secret_key=session_secret) app.include_router(sso.router) + + +(a)app.exception_handler(HTTPException) +async def http_exception_handler(request, exc): + """ + Dirty HTML error page to replace the default JSON error responses. + In the future this should use a proper Arch-themed HTML template. + """ + phrase = http.HTTPStatus(exc.status_code).phrase + return HTMLResponse(f"<h1>{exc.status_code} {phrase}</h1><p>{exc.detail}</p>", + status_code=exc.status_code) -- 2.27.0

1 0

[PATCH 2/2] Stop redirecting stderr with proc_open
by Frédéric Mangano-Tarumi 27 Jul '20

27 Jul '20

Error outputs were piped to a temporary buffer that wasn’t read by anyone, making debugging hard because errors were completely silenced. By not explicitly redirecting stderr on proc_open, the subprocess inherits its parent stderr. --- web/lib/acctfuncs.inc.php | 2 -- web/lib/pkgbasefuncs.inc.php | 2 -- 2 files changed, 4 deletions(-) diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index d238c0e0..ebabb840 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -1349,7 +1349,6 @@ function notify($params) { $descspec = array( 0 => array('pipe', 'r'), 1 => array('pipe', 'w'), - 2 => array('pipe', 'w') ); $p = proc_open($cmd, $descspec, $pipes); @@ -1360,7 +1359,6 @@ function notify($params) { fclose($pipes[0]); fclose($pipes[1]); - fclose($pipes[2]); return proc_close($p); } diff --git a/web/lib/pkgbasefuncs.inc.php b/web/lib/pkgbasefuncs.inc.php index a4925891..22b882b4 100644 --- a/web/lib/pkgbasefuncs.inc.php +++ b/web/lib/pkgbasefuncs.inc.php @@ -96,7 +96,6 @@ function render_comment($id) { $descspec = array( 0 => array('pipe', 'r'), 1 => array('pipe', 'w'), - 2 => array('pipe', 'w') ); $p = proc_open($cmd, $descspec, $pipes); @@ -107,7 +106,6 @@ function render_comment($id) { fclose($pipes[0]); fclose($pipes[1]); - fclose($pipes[2]); return proc_close($p); } -- 2.27.0

2 1