- Aur-dev - lists.archlinux.org

[aur-dev] [PATCH] False 'File Request' buttons for unconfirmed users
by Gordian Edenhofer 27 Jun '15

27 Jun '15

Displaying flag, notify, vote and file requet buttons for users which did not authenticate themselves and letting those fake buttons link to the login page. Signed-off-by: Gordian Edenhofer <gordian.edenhofer(a)gmail.com> --- web/template/pkg_details.php | 37 +++++++++++++++++++++++++++++++++++++ web/template/pkgbase_details.php | 37 +++++++++++++++++++++++++++++++++++++ 2 files changed, 74 insertions(+) diff --git a/web/template/pkg_details.php b/web/template/pkg_details.php index c1c07ba..fdb0a6c 100644 --- a/web/template/pkg_details.php +++ b/web/template/pkg_details.php @@ -88,6 +88,7 @@ $sources = pkg_sources($row["ID"]); <li><a href="<?= $cgit_uri . $row['BaseName'] . '.git' ?>/snapshot/master.tar.gz"><?= __('Download snapshot') ?></a></li> <li><a href="https://wiki.archlinux.org/index.php/Special:Search?search=<?= urlencode($row['Name']) ?>"><?= __('Search wiki') ?></a></li> <li><span class="flagged"><?php if ($row["OutOfDateTS"] !== NULL) { echo __('Flagged out-of-date')." (${out_of_date_time})"; } ?></span></li> + <?php if ($uid): ?> <?php if ($row["OutOfDateTS"] === NULL): ?> <li> @@ -143,6 +144,42 @@ $sources = pkg_sources($row["ID"]); <li><a href="<?= get_pkgbase_uri($row['BaseName']) . 'delete/'; ?>"><?= __('Delete Package'); ?></a></li> <li><a href="<?= get_pkgbase_uri($row['BaseName']) . 'merge/'; ?>"><?= __('Merge Package'); ?></a></li> <?php endif; ?> + <?php else: ?> + <?php if ($row["OutOfDateTS"] === NULL): ?> + <li> + <?php if (config_get_bool('options', 'disable_http_login') && empty($_SERVER['HTTPS'])): ?> + <form action="<?= get_uri('/login/', true); ?>" method="post"> + <?php else: ?> + <form action="<?= get_uri('/login/'); ?>" method="post"> + <?php endif; ?> + <input type="submit" class="button text-button" name="do_Flag" value="<?= __('Flag package out-of-date') ?>" /> + </form> + </li> + <?php endif; ?> + <li> + <?php if (config_get_bool('options', 'disable_http_login') && empty($_SERVER['HTTPS'])): ?> + <form action="<?= get_uri('/login/', true); ?>" method="post"> + <?php else: ?> + <form action="<?= get_uri('/login/'); ?>" method="post"> + <?php endif; ?> + <input type="submit" class="button text-button" name="do_Vote" value="<?= __('Vote for this package') ?>" /> + </form> + </li> + <li> + <?php if (config_get_bool('options', 'disable_http_login') && empty($_SERVER['HTTPS'])): ?> + <form action="<?= get_uri('/login/', true); ?>" method="post"> + <?php else: ?> + <form action="<?= get_uri('/login/'); ?>" method="post"> + <?php endif; ?> + <input type="submit" class="button text-button" name="do_Notify" value="<?= __('Notify of new comments') ?>" /> + </form> + </li> + <li><span class="flagged"><?php if ($row["RequestCount"] > 0) { echo _n('%d pending request', '%d pending requests', $row["RequestCount"]); } ?></span></li> + <?php if (config_get_bool('options', 'disable_http_login') && empty($_SERVER['HTTPS'])): ?> + <li><a href="<?= get_uri('/login/', true); ?>"><?= __('File Request'); ?></a></li> + <?php else: ?> + <li><a href="<?= get_uri('/login/'); ?>"><?= __('File Request'); ?></a></li> + <?php endif; ?> <?php endif; ?> <?php if ($uid && $row["MaintainerUID"] === NULL): ?> diff --git a/web/template/pkgbase_details.php b/web/template/pkgbase_details.php index 98a7219..d11e0e3 100644 --- a/web/template/pkgbase_details.php +++ b/web/template/pkgbase_details.php @@ -39,6 +39,7 @@ $pkgs = pkgbase_get_pkgnames($base_id); <li><a href="<?= $cgit_uri . $row['Name'] . '.git' ?>/snapshot/master.tar.gz"><?= __('Download snapshot') ?></a></li> <li><a href="https://wiki.archlinux.org/index.php/Special:Search?search=<?= urlencode($row['Name']) ?>"><?= __('Search wiki') ?></a></li> <li><span class="flagged"><?php if ($row["OutOfDateTS"] !== NULL) { echo __('Flagged out-of-date')." (${out_of_date_time})"; } ?></span></li> + <?php if ($uid): ?> <?php if ($row["OutOfDateTS"] === NULL): ?> <li> @@ -94,6 +95,42 @@ $pkgs = pkgbase_get_pkgnames($base_id); <li><a href="<?= get_pkgbase_uri($row['Name']) . 'delete/'; ?>"><?= __('Delete Package'); ?></a></li> <li><a href="<?= get_pkgbase_uri($row['Name']) . 'merge/'; ?>"><?= __('Merge Package'); ?></a></li> <?php endif; ?> + <?php else: ?> + <?php if ($row["OutOfDateTS"] === NULL): ?> + <li> + <?php if (config_get_bool('options', 'disable_http_login') && empty($_SERVER['HTTPS'])): ?> + <form action="<?= get_uri('/login/', true); ?>" method="post"> + <?php else: ?> + <form action="<?= get_uri('/login/'); ?>" method="post"> + <?php endif; ?> + <input type="submit" class="button text-button" name="do_Flag" value="<?= __('Flag package out-of-date') ?>" /> + </form> + </li> + <?php endif; ?> + <li> + <?php if (config_get_bool('options', 'disable_http_login') && empty($_SERVER['HTTPS'])): ?> + <form action="<?= get_uri('/login/', true); ?>" method="post"> + <?php else: ?> + <form action="<?= get_uri('/login/'); ?>" method="post"> + <?php endif; ?> + <input type="submit" class="button text-button" name="do_Vote" value="<?= __('Vote for this package') ?>" /> + </form> + </li> + <li> + <?php if (config_get_bool('options', 'disable_http_login') && empty($_SERVER['HTTPS'])): ?> + <form action="<?= get_uri('/login/', true); ?>" method="post"> + <?php else: ?> + <form action="<?= get_uri('/login/'); ?>" method="post"> + <?php endif; ?> + <input type="submit" class="button text-button" name="do_Notify" value="<?= __('Notify of new comments') ?>" /> + </form> + </li> + <li><span class="flagged"><?php if ($row["RequestCount"] > 0) { echo _n('%d pending request', '%d pending requests', $row["RequestCount"]); } ?></span></li> + <?php if (config_get_bool('options', 'disable_http_login') && empty($_SERVER['HTTPS'])): ?> + <li><a href="<?= get_uri('/login/', true); ?>"><?= __('File Request'); ?></a></li> + <?php else: ?> + <li><a href="<?= get_uri('/login/'); ?>"><?= __('File Request'); ?></a></li> + <?php endif; ?> <?php endif; ?> <?php if ($uid && $row["MaintainerUID"] === NULL): ?> -- 2.4.2

3 26

[aur-dev] [PATCH v5] git: Use .format everywhere instead of %
by Johannes Löthberg 27 Jun '15

27 Jun '15

% formatting is deprecated, and .format should be used instead. Signed-off-by: Johannes Löthberg <johannes(a)kyriasis.com> --- Changes since v4: * commit.id is an object, so we need to wrap it in str() before passing it to .format git-interface/aurinfo.py | 18 ++++++++-------- git-interface/git-serve.py | 26 +++++++++++------------ git-interface/git-update.py | 50 ++++++++++++++++++++++----------------------- 3 files changed, 47 insertions(+), 47 deletions(-) diff --git a/git-interface/aurinfo.py b/git-interface/aurinfo.py index 86d0705..201f864 100644 --- a/git-interface/aurinfo.py +++ b/git-interface/aurinfo.py @@ -84,7 +84,7 @@ class AurInfo(object): class StderrECatcher(object): def Catch(self, lineno, error): - print('ERROR[%d]: %s' % (lineno, error), file=sys.stderr) + print('ERROR[{:d}]: {:s}'.format(lineno, error), file=sys.stderr) class CollectionECatcher(object): @@ -126,8 +126,8 @@ def ParseAurinfoFromIterable(iterable, ecatcher=None): try: key, value = map(str.strip, line.split('=', 1)) except ValueError: - ecatcher.Catch(lineno, 'unexpected header format in section=%s' % - current_package['pkgname']) + ecatcher.Catch(lineno, 'unexpected header format in section={:s}'.format( + current_package['pkgname'])) continue if key == 'pkgbase': @@ -149,7 +149,7 @@ def ParseAurinfoFromIterable(iterable, ecatcher=None): key, value = map(str.strip, line.split('=', 1)) except ValueError: ecatcher.Catch(lineno, 'unexpected attribute format in ' - 'section=%s' % current_package['pkgname']) + 'section={:s}'.format(current_package['pkgname'])) if IsMultiValued(key): if not current_package.get(key): @@ -161,8 +161,8 @@ def ParseAurinfoFromIterable(iterable, ecatcher=None): current_package[key] = value else: ecatcher.Catch(lineno, 'overwriting attribute ' - '%s: %s -> %s' % (key, current_package[key], - value)) + '{:s}: {:s} -> {:s}'.format(key, + current_package[key], value)) return aurinfo @@ -177,7 +177,7 @@ def ValidateAurinfo(filename='.AURINFO'): ParseAurinfo(filename, ecatcher) errors = ecatcher.Errors() for error in errors: - print('error on line %d: %s' % error, file=sys.stderr) + print('error on line {:d}: {:s}'.format(error), file=sys.stderr) return not errors @@ -196,13 +196,13 @@ if __name__ == '__main__': if action == 'parse': aurinfo = ParseAurinfo() for pkgname in aurinfo.GetPackageNames(): - print(">>> merged package: %s" % pkgname) + print(">>> merged package: {:s}".format(pkgname)) pp.pprint(aurinfo.GetMergedPackage(pkgname)) print() elif action == 'validate': sys.exit(not ValidateAurinfo(filename)) else: - print('unknown action: %s' % action) + print('unknown action: {:s}'.format(action)) sys.exit(1) # vim: set et ts=4 sw=4: diff --git a/git-interface/git-serve.py b/git-interface/git-serve.py index 26aa02d..02086e0 100755 --- a/git-interface/git-serve.py +++ b/git-interface/git-serve.py @@ -45,7 +45,7 @@ def list_repos(user): cur.execute("SELECT ID FROM Users WHERE Username = %s ", [user]) userid = cur.fetchone()[0] if userid == 0: - die('%s: unknown user: %s' % (action, user)) + die('{:s}: unknown user: {:s}'.format(action, user)) cur.execute("SELECT Name, PackagerUID FROM PackageBases " + "WHERE MaintainerUID = %s ", [userid]) @@ -55,9 +55,9 @@ def list_repos(user): def create_pkgbase(pkgbase, user): if not re.match(repo_regex, pkgbase): - die('%s: invalid repository name: %s' % (action, pkgbase)) + die('{:s}: invalid repository name: {:s}'.format(action, pkgbase)) if pkgbase_exists(pkgbase): - die('%s: package base already exists: %s' % (action, pkgbase)) + die('{:s}: package base already exists: {:s}'.format(action, pkgbase)) db = mysql.connector.connect(host=aur_db_host, user=aur_db_user, passwd=aur_db_pass, db=aur_db_name, @@ -67,7 +67,7 @@ def create_pkgbase(pkgbase, user): cur.execute("SELECT ID FROM Users WHERE Username = %s ", [user]) userid = cur.fetchone()[0] if userid == 0: - die('%s: unknown user: %s' % (action, user)) + die('{:s}: unknown user: {:s}'.format(action, user)) cur.execute("INSERT INTO PackageBases (Name, SubmittedTS, ModifiedTS, " + "SubmitterUID, MaintainerUID) VALUES (%s, UNIX_TIMESTAMP(), " + @@ -100,11 +100,11 @@ def check_permissions(pkgbase, user): return cur.fetchone()[0] > 0 def die(msg): - sys.stderr.write("%s\n" % (msg)) + sys.stderr.write("{:s}\n".format(msg)) exit(1) def die_with_help(msg): - die(msg + "\nTry `%s help` for a list of commands." % (ssh_cmdline)) + die(msg + "\nTry `{:s} help` for a list of commands.".format(ssh_cmdline)) user = sys.argv[1] cmd = os.environ.get("SSH_ORIGINAL_COMMAND") @@ -120,7 +120,7 @@ if enable_maintenance: if action == 'git-upload-pack' or action == 'git-receive-pack': if len(cmdargv) < 2: - die_with_help("%s: missing path" % (action)) + die_with_help("{:s}: missing path".format(action)) path = cmdargv[1].rstrip('/') if not path.startswith('/'): @@ -129,14 +129,14 @@ if action == 'git-upload-pack' or action == 'git-receive-pack': path = path + '.git' pkgbase = path[1:-4] if not re.match(repo_regex, pkgbase): - die('%s: invalid repository name: %s' % (action, pkgbase)) + die('{:s}: invalid repository name: {:s}'.format(action, pkgbase)) if not pkgbase_exists(pkgbase): create_pkgbase(pkgbase, user) if action == 'git-receive-pack': if not check_permissions(pkgbase, user): - die('%s: permission denied: %s' % (action, user)) + die('{:s}: permission denied: {:s}'.format(action, user)) os.environ["AUR_USER"] = user os.environ["AUR_PKGBASE"] = pkgbase @@ -145,13 +145,13 @@ if action == 'git-upload-pack' or action == 'git-receive-pack': os.execl(git_shell_cmd, git_shell_cmd, '-c', cmd) elif action == 'list-repos': if len(cmdargv) > 1: - die_with_help("%s: too many arguments" % (action)) + die_with_help("{:s}: too many arguments".format(action)) list_repos(user) elif action == 'setup-repo': if len(cmdargv) < 2: - die_with_help("%s: missing repository name" % (action)) + die_with_help("{:s}: missing repository name".format(action)) if len(cmdargv) > 2: - die_with_help("%s: too many arguments" % (action)) + die_with_help("{:s}: too many arguments".format(action)) create_pkgbase(cmdargv[1], user) elif action == 'help': die("Commands:\n" + @@ -161,4 +161,4 @@ elif action == 'help': " git-receive-pack Internal command used with Git.\n" + " git-upload-pack Internal command used with Git.") else: - die_with_help("invalid command: %s" % (action)) + die_with_help("invalid command: {:s}".format(action)) diff --git a/git-interface/git-update.py b/git-interface/git-update.py index 41a3474..f697eb8 100755 --- a/git-interface/git-update.py +++ b/git-interface/git-update.py @@ -72,10 +72,10 @@ def save_srcinfo(srcinfo, db, cur, user): pkginfo = srcinfo.GetMergedPackage(pkgname) if 'epoch' in pkginfo and int(pkginfo['epoch']) > 0: - ver = '%d:%s-%s' % (int(pkginfo['epoch']), pkginfo['pkgver'], - pkginfo['pkgrel']) + ver = '{:d}:{:s}-{:s}'.format(int(pkginfo['epoch']), pkginfo['pkgver'], + pkginfo['pkgrel']) else: - ver = '%s-%s' % (pkginfo['pkgver'], pkginfo['pkgrel']) + ver = '{:s}-{:s}'.format(pkginfo['pkgver'], pkginfo['pkgrel']) for field in ('pkgdesc', 'url'): if not field in pkginfo: @@ -166,14 +166,14 @@ def save_srcinfo(srcinfo, db, cur, user): db.commit() def die(msg): - sys.stderr.write("error: %s\n" % (msg)) + sys.stderr.write("error: {:s}\n".format(msg)) exit(1) def die_commit(msg, commit): sys.stderr.write("error: The following error " + "occurred when parsing commit\n") - sys.stderr.write("error: %s:\n" % (commit)) - sys.stderr.write("error: %s\n" % (msg)) + sys.stderr.write("error: {:s}:\n".format(commit)) + sys.stderr.write("error: {:s}\n".format(msg)) exit(1) if len(sys.argv) != 4: @@ -216,20 +216,20 @@ blacklist = [row[0] for row in cur.fetchall()] for commit in walker: if not '.SRCINFO' in commit.tree: - die_commit("missing .SRCINFO", commit.id) + die_commit("missing .SRCINFO", str(commit.id)) for treeobj in commit.tree: blob = repo[treeobj.id] if isinstance(blob, pygit2.Tree): die_commit("the repository must not contain subdirectories", - commit.id) + str(commit.id)) if not isinstance(blob, pygit2.Blob): - die_commit("not a blob object: %s" % (treeobj), commit.id) + die_commit("not a blob object: {:s}".format(treeobj), str(commit.id)) if blob.size > 250000: - die_commit("maximum blob size (250kB) exceeded", commit.id) + die_commit("maximum blob size (250kB) exceeded", str(commit.id)) srcinfo_raw = repo[commit.tree['.SRCINFO'].id].data.decode() srcinfo_raw = srcinfo_raw.split('\n') @@ -239,45 +239,45 @@ for commit in walker: if errors: sys.stderr.write("error: The following errors occurred " "when parsing .SRCINFO in commit\n") - sys.stderr.write("error: %s:\n" % (commit.id)) + sys.stderr.write("error: {:s}:\n".format(str(commit.id))) for error in errors: - sys.stderr.write("error: line %d: %s\n" % error) + sys.stderr.write("error: line {:d}: {:s}\n".format(error)) exit(1) srcinfo_pkgbase = srcinfo._pkgbase['pkgname'] if not re.match(repo_regex, srcinfo_pkgbase): - die_commit('invalid pkgbase: %s' % (srcinfo_pkgbase), commit.id) + die_commit('invalid pkgbase: {:s}'.format(srcinfo_pkgbase), str(commit.id)) for pkgname in srcinfo.GetPackageNames(): pkginfo = srcinfo.GetMergedPackage(pkgname) for field in ('pkgver', 'pkgrel', 'pkgname'): if not field in pkginfo: - die_commit('missing mandatory field: %s' % (field), commit.id) + die_commit('missing mandatory field: {:s}'.format(field), str(commit.id)) if 'epoch' in pkginfo and not pkginfo['epoch'].isdigit(): - die_commit('invalid epoch: %s' % (pkginfo['epoch']), commit.id) + die_commit('invalid epoch: {:s}'.format(pkginfo['epoch']), str(commit.id)) if not re.match(r'[a-z0-9][a-z0-9\.+_-]*$', pkginfo['pkgname']): - die_commit('invalid package name: %s' % (pkginfo['pkgname']), - commit.id) + die_commit('invalid package name: {:s}'.format(pkginfo['pkgname']), + str(commit.id)) for field in ('pkgname', 'pkgdesc', 'url'): if field in pkginfo and len(pkginfo[field]) > 255: - die_commit('%s field too long: %s' % (field, pkginfo[field]), - commit.id) + die_commit('{:s} field too long: {:s}'.format(field, pkginfo[field]), + str(commit.id)) for field in ('install', 'changelog'): if field in pkginfo and not pkginfo[field] in commit.tree: - die_commit('missing %s file: %s' % (field, pkginfo[field]), - commit.id) + die_commit('missing {:s} file: {:s}'.format(field, pkginfo[field]), + str(commit.id)) for field in extract_arch_fields(pkginfo, 'source'): fname = field['value'] if "://" in fname or "lp:" in fname: continue if not fname in commit.tree: - die_commit('missing source file: %s' % (fname), commit.id) + die_commit('missing source file: {:s}'.format(fname), str(commit.id)) srcinfo_raw = repo[repo[sha1_new].tree['.SRCINFO'].id].data.decode() srcinfo_raw = srcinfo_raw.split('\n') @@ -285,7 +285,7 @@ srcinfo = aurinfo.ParseAurinfoFromIterable(srcinfo_raw) srcinfo_pkgbase = srcinfo._pkgbase['pkgname'] if srcinfo_pkgbase != pkgbase: - die('invalid pkgbase: %s' % (srcinfo_pkgbase)) + die('invalid pkgbase: {:s}'.format(srcinfo_pkgbase)) pkgbase = srcinfo._pkgbase['pkgname'] cur.execute("SELECT ID FROM PackageBases WHERE Name = %s", [pkgbase]) @@ -296,12 +296,12 @@ for pkgname in srcinfo.GetPackageNames(): pkgname = pkginfo['pkgname'] if pkgname in blacklist: - die('package is blacklisted: %s' % (pkginfo['pkgname'])) + die('package is blacklisted: {:s}'.format(pkginfo['pkgname'])) cur.execute("SELECT COUNT(*) FROM Packages WHERE Name = %s AND " + "PackageBaseID <> %s", [pkgname, pkgbase_id]) if cur.fetchone()[0] > 0: - die('cannot overwrite package: %s' % (pkgname)) + die('cannot overwrite package: {:s}'.format(pkgname)) save_srcinfo(srcinfo, db, cur, user) -- 2.4.4

1 0

[aur-dev] [PATCH] git-update: Improve error message on invalid pkgbase
by Lukas Fleischer 27 Jun '15

27 Jun '15

When the package base does not match the repository name, we currently show an error message that only mentions the package base name: error: invalid pkgbase: yate-qt4 To the end user this sounds like the package base name is malformed itself (and we show exactly the same error message when it contains invalid characters, indeed). Clarify that there is a name mismatch by also printing the expected value: error: invalid pkgbase: yate-qt4, expected: yate4-qt Inspired by FS#45483. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- git-interface/git-update.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/git-interface/git-update.py b/git-interface/git-update.py index 59e5820..c533ece 100755 --- a/git-interface/git-update.py +++ b/git-interface/git-update.py @@ -286,7 +286,7 @@ srcinfo = aurinfo.ParseAurinfoFromIterable(srcinfo_raw) srcinfo_pkgbase = srcinfo._pkgbase['pkgname'] if srcinfo_pkgbase != pkgbase: - die('invalid pkgbase: {:s}'.format(srcinfo_pkgbase)) + die('invalid pkgbase: {:s}, expected {:s}'.format(srcinfo_pkgbase, pkgbase)) pkgbase = srcinfo._pkgbase['pkgname'] cur.execute("SELECT ID FROM PackageBases WHERE Name = %s", [pkgbase]) -- 2.4.4

1 0

[aur-dev] [PATCH] Add support for multiple SSH public keys
by Lukas Fleischer 26 Jun '15

26 Jun '15

Attaching more than one SSH public key to the same account is useful, e.g. if one uses different machines to access the AUR SSH interface. Multiple keys can now be specified by adding multiple lines to the text area on the account edit form. Implements FS#45469. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- git-interface/git-auth.py | 6 +- schema/aur-schema.sql | 12 +++- upgrading/4.0.0.txt | 10 ++- web/html/account.php | 3 +- web/lib/acctfuncs.inc.php | 166 +++++++++++++++++++++++++++++++++++++++------- 5 files changed, 166 insertions(+), 31 deletions(-) diff --git a/git-interface/git-auth.py b/git-interface/git-auth.py index b67d9de..c7de777 100755 --- a/git-interface/git-auth.py +++ b/git-interface/git-auth.py @@ -47,8 +47,10 @@ db = mysql.connector.connect(host=aur_db_host, user=aur_db_user, unix_socket=aur_db_socket, buffered=True) cur = db.cursor() -cur.execute("SELECT Username, AccountTypeID FROM Users WHERE SSHPubKey = %s " + - "AND Suspended = 0", (keytype + " " + keytext,)) +cur.execute("SELECT Users.Username, Users.AccountTypeID FROM Users " + + "INNER JOIN SSHPubKeys ON SSHPubKeys.UserID = Users.ID " + "WHERE SSHPubKeys.PubKey = %s AND Users.Suspended = 0", + (keytype + " " + keytext,)) if cur.rowcount != 1: exit(1) diff --git a/schema/aur-schema.sql b/schema/aur-schema.sql index 5a2e5c5..594a804 100644 --- a/schema/aur-schema.sql +++ b/schema/aur-schema.sql @@ -33,7 +33,6 @@ CREATE TABLE Users ( LangPreference VARCHAR(5) NOT NULL DEFAULT 'en', IRCNick VARCHAR(32) NOT NULL DEFAULT '', PGPKey VARCHAR(40) NULL DEFAULT NULL, - SSHPubKey VARCHAR(4096) NULL DEFAULT NULL, LastLogin BIGINT UNSIGNED NOT NULL DEFAULT 0, LastLoginIPAddress INTEGER UNSIGNED NOT NULL DEFAULT 0, InactivityTS BIGINT UNSIGNED NOT NULL DEFAULT 0, @@ -53,6 +52,17 @@ INSERT INTO Users (ID, AccountTypeID, Username, Email, Passwd) VALUES ( 3, 1, 'user', 'user@localhost', MD5('user')); +-- SSH public keys used for the aurweb SSH/Git interface. +-- +CREATE TABLE SSHPubKeys ( + UserID INTEGER UNSIGNED NOT NULL, + Fingerprint VARCHAR(44) NOT NULL, + PubKey VARCHAR(4096) NOT NULL, + PRIMARY KEY (Fingerprint), + FOREIGN KEY (UserID) REFERENCES Users(ID) ON DELETE CASCADE +) ENGINE = InnoDB; + + -- Track Users logging in/out of AUR web site. -- CREATE TABLE Sessions ( diff --git a/upgrading/4.0.0.txt b/upgrading/4.0.0.txt index 637c4b9..74e167b 100644 --- a/upgrading/4.0.0.txt +++ b/upgrading/4.0.0.txt @@ -3,10 +3,16 @@ want to keep the package contents, please create a backup before starting the upgrade process and import the source tarballs into the Git repositories afterwards. -1. Add a field for the SSH public key to the Users table: +1. Add a table to store SSH public keys: ---- -ALTER TABLE Users ADD COLUMN SSHPubKey VARCHAR(4096) NULL DEFAULT NULL; +CREATE TABLE SSHPubKeys ( + UserID INTEGER UNSIGNED NOT NULL, + Fingerprint VARCHAR(44) NOT NULL, + PubKey VARCHAR(4096) NOT NULL, + PRIMARY KEY (Fingerprint), + FOREIGN KEY (UserID) REFERENCES Users(ID) ON DELETE CASCADE +) ENGINE = InnoDB; ---- 2. Create a new user and configure Git/SSH as described in INSTALL. diff --git a/web/html/account.php b/web/html/account.php index 0bb145c..c447de3 100644 --- a/web/html/account.php +++ b/web/html/account.php @@ -16,6 +16,7 @@ $need_userinfo = array( if (in_array($action, $need_userinfo)) { $row = account_details(in_request("ID"), in_request("U")); + $PK = implode("\n", account_get_ssh_keys($row["ID"])); } if ($action == "AccountInfo") { @@ -59,7 +60,7 @@ if (isset($_COOKIE["AURSID"])) { display_account_form("UpdateAccount", $row["Username"], $row["AccountTypeID"], $row["Suspended"], $row["Email"], "", "", $row["RealName"], $row["LangPreference"], - $row["IRCNick"], $row["PGPKey"], $row["SSHPubKey"], + $row["IRCNick"], $row["PGPKey"], $PK, $row["InactivityTS"] ? 1 : 0, $row["ID"]); } else { print __("You do not have permission to edit this account."); diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index 6b7d227..70541e1 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -53,7 +53,7 @@ function html_format_pgp_fingerprint($fingerprint) { * @param string $L The language preference of the displayed user * @param string $I The IRC nickname of the displayed user * @param string $K The PGP key fingerprint of the displayed user - * @param string $PK The SSH public key of the displayed user + * @param string $PK The list of SSH public keys * @param string $J The inactivity status of the displayed user * @param string $UID The user ID of the displayed user * @@ -83,7 +83,7 @@ function display_account_form($A,$U="",$T="",$S="",$E="",$P="",$C="",$R="", * @param string $L The language preference of the user * @param string $I The IRC nickname of the user * @param string $K The PGP fingerprint of the user - * @param string $PK The SSH public key of the user + * @param string $PK The list of public SSH keys * @param string $J The inactivity status of the user * @param string $UID The user ID of the modified account * @@ -149,12 +149,32 @@ function process_account_form($TYPE,$A,$U="",$T="",$S="",$E="",$P="",$C="", } if (!$error && !empty($PK)) { - if (valid_ssh_pubkey($PK)) { - $tokens = explode(" ", $PK); - $PK = $tokens[0] . " " . $tokens[1]; - } else { - $error = __("The SSH public key is invalid."); + $ssh_keys = array_filter(explode("\n", $PK)); + $ssh_fingerprints = array(); + + foreach ($ssh_keys as &$ssh_key) { + if (!valid_ssh_pubkey($ssh_key)) { + $error = __("The SSH public key is invalid."); + break; + } + + $ssh_fingerprint = ssh_key_fingerprint($ssh_key); + if (!$ssh_fingerprint) { + $error = __("The SSH public key is invalid."); + break; + } + + $tokens = explode(" ", $ssh_key); + $ssh_key = $tokens[0] . " " . $tokens[1]; + + $ssh_fingerprints[] = $ssh_fingerprint; } + + /* + * Destroy last reference to prevent accidentally overwriting + * an array element. + */ + unset($ssh_key); } if (isset($_COOKIE['AURSID'])) { @@ -203,22 +223,25 @@ function process_account_form($TYPE,$A,$U="",$T="",$S="",$E="",$P="",$C="", "<strong>", htmlspecialchars($E,ENT_QUOTES), "</strong>"); } } - if (!$error && !empty($PK)) { + if (!$error && count($ssh_keys) > 0) { /* - * Check whether the SSH public key is available. + * Check whether any of the SSH public keys is already in use. * TODO: Fix race condition. */ - $q = "SELECT COUNT(*) FROM Users "; - $q.= "WHERE SSHPubKey = " . $dbh->quote($PK); - if ($TYPE == "edit") { - $q.= " AND ID != " . intval($UID); - } - $result = $dbh->query($q); - $row = $result->fetch(PDO::FETCH_NUM); - - if ($row[0]) { - $error = __("The SSH public key, %s%s%s, is already in use.", - "<strong>", htmlspecialchars($PK, ENT_QUOTES), "</strong>"); + foreach ($ssh_keys as $ssh_key) { + $q = "SELECT COUNT(*) FROM SSHPubKeys "; + $q.= "WHERE PubKey = " . $dbh->quote($ssh_key); + if ($TYPE == "edit") { + $q.= " AND UserID != " . intval($UID); + } + $result = $dbh->query($q); + $row = $result->fetch(PDO::FETCH_NUM); + + if ($row[0]) { + $error = __("The SSH public key, %s%s%s, is already in use.", + "<strong>", htmlspecialchars($PK, ENT_QUOTES), "</strong>"); + break; + } } } @@ -247,13 +270,11 @@ function process_account_form($TYPE,$A,$U="",$T="",$S="",$E="",$P="",$C="", $L = $dbh->quote($L); $I = $dbh->quote($I); $K = $dbh->quote(str_replace(" ", "", $K)); - $PK = empty($PK) ? "NULL" : $dbh->quote($PK); $q = "INSERT INTO Users (AccountTypeID, Suspended, "; $q.= "InactivityTS, Username, Email, Passwd, Salt, "; - $q.= "RealName, LangPreference, IRCNick, PGPKey, "; - $q.= "SSHPubKey) "; + $q.= "RealName, LangPreference, IRCNick, PGPKey) "; $q.= "VALUES (1, 0, 0, $U, $E, $P, $salt, $R, $L, "; - $q.= "$I, $K, $PK)"; + $q.= "$I, $K)"; $result = $dbh->exec($q); if (!$result) { print __("Error trying to create account, %s%s%s.", @@ -261,6 +282,9 @@ function process_account_form($TYPE,$A,$U="",$T="",$S="",$E="",$P="",$C="", return; } + $uid = $dbh->lastInsertId(); + account_set_ssh_keys($uid, $ssh_keys, $ssh_fingerprints); + print __("The account, %s%s%s, has been successfully created.", "<strong>", htmlspecialchars($U,ENT_QUOTES), "</strong>"); print "<p>\n"; @@ -321,10 +345,12 @@ function process_account_form($TYPE,$A,$U="",$T="",$S="",$E="",$P="",$C="", $q.= ", LangPreference = " . $dbh->quote($L); $q.= ", IRCNick = " . $dbh->quote($I); $q.= ", PGPKey = " . $dbh->quote(str_replace(" ", "", $K)); - $q.= ", SSHPubKey = " . $dbh->quote($PK); $q.= ", InactivityTS = " . $inactivity_ts; $q.= " WHERE ID = ".intval($UID); $result = $dbh->exec($q); + + account_set_ssh_keys($UID, $ssh_keys, $ssh_fingerprints); + if (!$result) { print __("No changes were made to the account, %s%s%s.", "<strong>", htmlspecialchars($U,ENT_QUOTES), "</strong>"); @@ -1194,3 +1220,93 @@ function can_edit_account($acctinfo) { $uid = $acctinfo['ID']; return has_credential(CRED_ACCOUNT_EDIT, array($uid)); } + +/* + * Compute the fingerprint of an SSH key. + * + * @param string $ssh_key The SSH public key to retrieve the fingerprint for + * + * @return string The SSH key fingerprint + */ +function ssh_key_fingerprint($ssh_key) { + $tmpfile = tempnam(sys_get_temp_dir(), "aurweb"); + file_put_contents($tmpfile, $ssh_key); + + /* + * The -l option of ssh-keygen can be used to show the fingerprint of + * the specified public key file. Expected output format: + * + * 2048 SHA256:uBBTXmCNjI2CnLfkuz9sG8F+e9/T4C+qQQwLZWIODBY user@host (RSA) + * + * ... where 2048 is the key length, the second token is the actual + * fingerprint, followed by the key comment and the key type. + */ + + $cmd = "/usr/bin/ssh-keygen -l -f " . escapeshellarg($tmpfile); + exec($cmd, $out, $ret); + if ($ret !== 0 || count($out) !== 1) { + return false; + } + + unlink($tmpfile); + + $tokens = explode(' ', $out[0]); + if (count($tokens) != 4) { + return false; + } + + $tokens = explode(':', $tokens[1]); + if (count($tokens) != 2 || $tokens[0] != 'SHA256') { + return false; + } + + return $tokens[1]; +} + +/* + * Get the SSH public keys associated with an account. + * + * @param int $uid The user ID of the account to retrieve the keys for. + * + * @return array An array representing the keys + */ +function account_get_ssh_keys($uid) { + $dbh = DB::connect(); + $q = "SELECT PubKey FROM SSHPubKeys WHERE UserID = " . intval($uid); + $result = $dbh->query($q); + + if ($result) { + return $result->fetchAll(PDO::FETCH_COLUMN, 0); + } else { + return array(); + } +} + +/* + * Set the SSH public keys associated with an account. + * + * @param int $uid The user ID of the account to assign the keys to. + * @param array $ssh_keys The SSH public keys. + * @param array $ssh_fingerprints The corresponding SSH key fingerprints. + * + * @return bool Boolean flag indicating success or failure. + */ +function account_set_ssh_keys($uid, $ssh_keys, $ssh_fingerprints) { + $dbh = DB::connect(); + + $q = sprintf("DELETE FROM SSHPubKeys WHERE UserID = %d", $uid); + $dbh->exec($q); + + $ssh_fingerprint = reset($ssh_fingerprints); + foreach ($ssh_keys as $ssh_key) { + $q = sprintf( + "INSERT INTO SSHPubKeys (UserID, Fingerprint, PubKey) " . + "VALUES (%d, %s, %s)", $uid, + $dbh->quote($ssh_fingerprint), $dbh->quote($ssh_key) + ); + $dbh->exec($q); + $ssh_fingerprint = next($ssh_fingerprints); + } + + return true; +} -- 2.4.4

2 3

[aur-dev] [PATCH 1/2] Split out code to generate action links
by Lukas Fleischer 26 Jun '15

26 Jun '15

Add (and use) two new helper functions html_account_link() and html_account_form() to generate the links in the package actions box. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/lib/aur.inc.php | 37 ++++++++++++++++++ web/template/pkg_details.php | 74 ++++++++++-------------------------- web/template/pkgbase_details.php | 82 ++++++++++++++-------------------------- 3 files changed, 86 insertions(+), 107 deletions(-) diff --git a/web/lib/aur.inc.php b/web/lib/aur.inc.php index 7f923d7..95f72ce 100644 --- a/web/lib/aur.inc.php +++ b/web/lib/aur.inc.php @@ -222,6 +222,43 @@ function html_format_maintainers($maintainer, $comaintainers) { } /** + * Format a link in the package actions box + * + * @param string $uri The link target + * @param string $desc The link label + * + * @return string The generated HTML code for the action link + */ +function html_action_link($uri, $desc) { + $code = '<a href="' . htmlspecialchars($uri, ENT_QUOTES) . '">'; + $code .= htmlspecialchars($desc) . '</a>'; + + return $code; +} + +/** + * Format a form in the package actions box + * + * @param string $uri The link target + * @param string $action The action name (passed as HTTP POST parameter) + * @param string $desc The link label + * + * @return string The generated HTML code for the action link + */ +function html_action_form($uri, $action, $desc) { + $code = '<form action="' . htmlspecialchars($uri, ENT_QUOTES) . '" '; + $code .= 'method="post">'; + $code .= '<input type="hidden" name="token" value="'; + $code .= htmlspecialchars($_COOKIE['AURSID'], ENT_QUOTES) . '" />'; + $code .= '<input type="submit" class="button text-button" name="'; + $code .= htmlspecialchars($action, ENT_QUOTES) . '" '; + $code .= 'value="' . htmlspecialchars($desc, ENT_QUOTES) . '" />'; + $code .= '</form>'; + + return $code; +} + +/** * Determine the user's e-mail address in the database using a session ID * * @param string $sid User's session ID diff --git a/web/template/pkg_details.php b/web/template/pkg_details.php index 6864431..e894c07 100644 --- a/web/template/pkg_details.php +++ b/web/template/pkg_details.php @@ -83,6 +83,9 @@ foreach ($rels as $rel) { # $sources[0] = 'src'; $sources = pkg_sources($row["ID"]); + +$base_uri = get_pkgbase_uri($row['BaseName']); + ?> <div id="pkgdetails" class="box"> <h2><?= __('Package Details') . ': ' . htmlspecialchars($row['Name']) . ' ' . htmlspecialchars($row['Version']) ?></h2> @@ -99,75 +102,40 @@ $sources = pkg_sources($row["ID"]); <li><span class="flagged"><?php if ($row["OutOfDateTS"] !== NULL) { echo __('Flagged out-of-date')." (${out_of_date_time})"; } ?></span></li> <?php if ($uid): ?> <?php if ($row["OutOfDateTS"] === NULL): ?> - <li> - <form action="<?= get_pkgbase_uri($row['BaseName']) . 'flag/'; ?>" method="post"> - <input type="hidden" name="token" value="<?= htmlspecialchars($_COOKIE['AURSID']) ?>" /> - <input type="submit" class="button text-button" name="do_Flag" value="<?= __('Flag package out-of-date') ?>" /> - </form> - </li> + <li><?= html_action_form($base_uri . 'flag/', "do_Flag", __('Flag package out-of-date')) ?></li> <?php elseif (($row["OutOfDateTS"] !== NULL) && has_credential(CRED_PKGBASE_UNFLAG, $maintainers)): ?> - <li> - <form action="<?= get_pkgbase_uri($row['BaseName']) . 'unflag/'; ?>" method="post"> - <input type="hidden" name="token" value="<?= htmlspecialchars($_COOKIE['AURSID']) ?>" /> - <input type="submit" class="button text-button" name="do_UnFlag" value="<?= __('Unflag package') ?>" /> - </form> - </li> + <li><?= html_action_form($base_uri . 'unflag/', "do_UnFlag", __('Unflag package')) ?></li> <?php endif; ?> + <?php if (pkgbase_user_voted($uid, $base_id)): ?> - <li> - <form action="<?= get_pkgbase_uri($row['BaseName']) . 'unvote/'; ?>" method="post"> - <input type="hidden" name="token" value="<?= htmlspecialchars($_COOKIE['AURSID']) ?>" /> - <input type="submit" class="button text-button" name="do_UnVote" value="<?= __('Remove vote') ?>" /> - </form> - </li> + <li><?= html_action_form($base_uri . 'unvote/', "do_UnVote", __('Remove vote')) ?></li> <?php else: ?> - <li> - <form action="<?= get_pkgbase_uri($row['BaseName']) . 'vote/'; ?>" method="post"> - <input type="hidden" name="token" value="<?= htmlspecialchars($_COOKIE['AURSID']) ?>" /> - <input type="submit" class="button text-button" name="do_Vote" value="<?= __('Vote for this package') ?>" /> - </form> - </li> + <li><?= html_action_form($base_uri . 'vote/', "do_Vote", __('Vote for this package')) ?></li> <?php endif; ?> + <?php if (pkgbase_user_notify($uid, $base_id)): ?> - <li> - <form action="<?= get_pkgbase_uri($row['BaseName']) . 'unnotify/'; ?>" method="post"> - <input type="hidden" name="token" value="<?= htmlspecialchars($_COOKIE['AURSID']) ?>" /> - <input type="submit" class="button text-button" name="do_UnNotify" value="<?= __('Disable notifications') ?>" /> - </form> - </li> + <li><?= html_action_form($base_uri . 'unnotify/', "do_UnNotify", __('Disable notifications')) ?></li> <?php else: ?> - <li> - <form action="<?= get_pkgbase_uri($row['BaseName']) . 'notify/'; ?>" method="post"> - <input type="hidden" name="token" value="<?= htmlspecialchars($_COOKIE['AURSID']) ?>" /> - <input type="submit" class="button text-button" name="do_Notify" value="<?= __('Notify of new comments') ?>" /> - </form> - </li> + <li><?= html_action_form($base_uri . 'notify/', "do_Notify", __('Notify of new comments')) ?></li> <?php endif; ?> + <?php if (has_credential(CRED_PKGBASE_EDIT_COMAINTAINERS, array($row["MaintainerUID"]))): ?> - <li><a href="<?= get_pkgbase_uri($row['BaseName']) . 'comaintainers/'; ?>"><?= __('Manage Co-Maintainers'); ?></a></li> + <li><?= html_action_link($base_uri . 'comaintainers/', __('Manage Co-Maintainers')) ?></a></li> <?php endif; ?> + <li><span class="flagged"><?php if ($row["RequestCount"] > 0) { echo _n('%d pending request', '%d pending requests', $row["RequestCount"]); } ?></span></li> - <li><a href="<?= get_pkgbase_uri($row['BaseName']) . 'request/'; ?>"><?= __('File Request'); ?></a></li> + <li><?= html_action_link($base_uri . 'request/', __('File Request')) ?></a></li> + <?php if (has_credential(CRED_PKGBASE_DELETE)): ?> - <li><a href="<?= get_pkgbase_uri($row['BaseName']) . 'delete/'; ?>"><?= __('Delete Package'); ?></a></li> - <li><a href="<?= get_pkgbase_uri($row['BaseName']) . 'merge/'; ?>"><?= __('Merge Package'); ?></a></li> - <?php endif; ?> + <li><?= html_action_link($base_uri . 'delete/', __('Delete Package')) ?></a></li> + <li><?= html_action_link($base_uri . 'merge/', __('Merge Package')) ?></a></li> <?php endif; ?> <?php if ($uid && $row["MaintainerUID"] === NULL): ?> - <li> - <form action="<?= get_pkgbase_uri($row['BaseName']) . 'adopt/'; ?>" method="post"> - <input type="hidden" name="token" value="<?= htmlspecialchars($_COOKIE['AURSID']) ?>" /> - <input type="submit" class="button text-button" name="do_Adopt" value="<?= __('Adopt Package') ?>" /> - </form> - </li> + <li><?= html_action_form($base_uri . 'adopt/', "do_Adopt", __('Adopt Package')) ?></li> <?php elseif (has_credential(CRED_PKGBASE_DISOWN, array($row["MaintainerUID"]))): ?> - <li> - <form action="<?= get_pkgbase_uri($row['BaseName']) . 'disown/'; ?>" method="post"> - <input type="hidden" name="token" value="<?= htmlspecialchars($_COOKIE['AURSID']) ?>" /> - <input type="submit" class="button text-button" name="do_Disown" value="<?= __('Disown Package') ?>" /> - </form> - </li> + <li><?= html_action_form($base_uri . 'disown/', "do_Disown", __('Disown Package')) ?></li> + <?php endif; ?> <?php endif; ?> </ul> </div> diff --git a/web/template/pkgbase_details.php b/web/template/pkgbase_details.php index dc30e48..f6d8071 100644 --- a/web/template/pkgbase_details.php +++ b/web/template/pkgbase_details.php @@ -17,6 +17,12 @@ $maintainer = username_from_id($row["MaintainerUID"]); $comaintainers = pkgbase_get_comaintainers($base_id); $packager = username_from_id($row["PackagerUID"]); +if ($row["MaintainerUID"] !== NULL) { + $maintainers = array_merge(array($row["MaintainerUID"]), pkgbase_get_comaintainer_uids(array($base_id))); +} else { + $maintainers = NULL; +} + $votes = $row['NumVotes']; # In case of wanting to put a custom message @@ -28,6 +34,9 @@ $submitted_time = ($row["SubmittedTS"] == 0) ? $msg : gmdate("Y-m-d H:i", intval $out_of_date_time = ($row["OutOfDateTS"] == 0) ? $msg : gmdate("Y-m-d", intval($row["OutOfDateTS"])); $pkgs = pkgbase_get_pkgnames($base_id); + +$base_uri = get_pkgbase_uri($row['Name']); + ?> <div id="pkgdetails" class="box"> <h2><?= __('Package Base Details') . ': ' . htmlspecialchars($row['Name']) ?></h2> @@ -44,75 +53,40 @@ $pkgs = pkgbase_get_pkgnames($base_id); <li><span class="flagged"><?php if ($row["OutOfDateTS"] !== NULL) { echo __('Flagged out-of-date')." (${out_of_date_time})"; } ?></span></li> <?php if ($uid): ?> <?php if ($row["OutOfDateTS"] === NULL): ?> - <li> - <form action="<?= get_pkgbase_uri($row['Name']) . 'flag/'; ?>" method="post"> - <input type="hidden" name="token" value="<?= htmlspecialchars($_COOKIE['AURSID']) ?>" /> - <input type="submit" class="button text-button" name="do_Flag" value="<?= __('Flag package out-of-date') ?>" /> - </form> - </li> - <?php elseif (($row["OutOfDateTS"] !== NULL) && has_credential(CRED_PKGBASE_UNFLAG, array($row["MaintainerUID"]))): ?> - <li> - <form action="<?= get_pkgbase_uri($row['Name']) . 'unflag/'; ?>" method="post"> - <input type="hidden" name="token" value="<?= htmlspecialchars($_COOKIE['AURSID']) ?>" /> - <input type="submit" class="button text-button" name="do_UnFlag" value="<?= __('Unflag package') ?>" /> - </form> - </li> + <li><?= html_action_form($base_uri . 'flag/', "do_Flag", __('Flag package out-of-date')) ?></li> + <?php elseif (($row["OutOfDateTS"] !== NULL) && has_credential(CRED_PKGBASE_UNFLAG, $maintainers)): ?> + <li><?= html_action_form($base_uri . 'unflag/', "do_UnFlag", __('Unflag package')) ?></li> <?php endif; ?> + <?php if (pkgbase_user_voted($uid, $base_id)): ?> - <li> - <form action="<?= get_pkgbase_uri($row['Name']) . 'unvote/'; ?>" method="post"> - <input type="hidden" name="token" value="<?= htmlspecialchars($_COOKIE['AURSID']) ?>" /> - <input type="submit" class="button text-button" name="do_UnVote" value="<?= __('Remove vote') ?>" /> - </form> - </li> + <li><?= html_action_form($base_uri . 'unvote/', "do_UnVote", __('Remove vote')) ?></li> <?php else: ?> - <li> - <form action="<?= get_pkgbase_uri($row['Name']) . 'vote/'; ?>" method="post"> - <input type="hidden" name="token" value="<?= htmlspecialchars($_COOKIE['AURSID']) ?>" /> - <input type="submit" class="button text-button" name="do_Vote" value="<?= __('Vote for this package') ?>" /> - </form> - </li> + <li><?= html_action_form($base_uri . 'vote/', "do_Vote", __('Vote for this package')) ?></li> <?php endif; ?> + <?php if (pkgbase_user_notify($uid, $base_id)): ?> - <li> - <form action="<?= get_pkgbase_uri($row['Name']) . 'unnotify/'; ?>" method="post"> - <input type="hidden" name="token" value="<?= htmlspecialchars($_COOKIE['AURSID']) ?>" /> - <input type="submit" class="button text-button" name="do_UnNotify" value="<?= __('Disable notifications') ?>" /> - </form> - </li> + <li><?= html_action_form($base_uri . 'unnotify/', "do_UnNotify", __('Disable notifications')) ?></li> <?php else: ?> - <li> - <form action="<?= get_pkgbase_uri($row['Name']) . 'notify/'; ?>" method="post"> - <input type="hidden" name="token" value="<?= htmlspecialchars($_COOKIE['AURSID']) ?>" /> - <input type="submit" class="button text-button" name="do_Notify" value="<?= __('Notify of new comments') ?>" /> - </form> - </li> + <li><?= html_action_form($base_uri . 'notify/', "do_Notify", __('Notify of new comments')) ?></li> <?php endif; ?> + <?php if (has_credential(CRED_PKGBASE_EDIT_COMAINTAINERS, array($row["MaintainerUID"]))): ?> - <li><a href="<?= get_pkgbase_uri($row['Name']) . 'comaintainers/'; ?>"><?= __('Manage Co-Maintainers'); ?></a></li> + <li><?= html_action_link($base_uri . 'comaintainers/', __('Manage Co-Maintainers')) ?></a></li> <?php endif; ?> + <li><span class="flagged"><?php if ($row["RequestCount"] > 0) { echo _n('%d pending request', '%d pending requests', $row["RequestCount"]); } ?></span></li> - <li><a href="<?= get_pkgbase_uri($row['Name']) . 'request/'; ?>"><?= __('File Request'); ?></a></li> + <li><?= html_action_link($base_uri . 'request/', __('File Request')) ?></a></li> + <?php if (has_credential(CRED_PKGBASE_DELETE)): ?> - <li><a href="<?= get_pkgbase_uri($row['Name']) . 'delete/'; ?>"><?= __('Delete Package'); ?></a></li> - <li><a href="<?= get_pkgbase_uri($row['Name']) . 'merge/'; ?>"><?= __('Merge Package'); ?></a></li> - <?php endif; ?> + <li><?= html_action_link($base_uri . 'delete/', __('Delete Package')) ?></a></li> + <li><?= html_action_link($base_uri . 'merge/', __('Merge Package')) ?></a></li> <?php endif; ?> <?php if ($uid && $row["MaintainerUID"] === NULL): ?> - <li> - <form action="<?= get_pkgbase_uri($row['Name']) . 'adopt/'; ?>" method="post"> - <input type="hidden" name="token" value="<?= htmlspecialchars($_COOKIE['AURSID']) ?>" /> - <input type="submit" class="button text-button" name="do_Adopt" value="<?= __('Adopt Package') ?>" /> - </form> - </li> + <li><?= html_action_form($base_uri . 'adopt/', "do_Adopt", __('Adopt Package')) ?></li> <?php elseif (has_credential(CRED_PKGBASE_DISOWN, array($row["MaintainerUID"]))): ?> - <li> - <form action="<?= get_pkgbase_uri($row['Name']) . 'disown/'; ?>" method="post"> - <input type="hidden" name="token" value="<?= htmlspecialchars($_COOKIE['AURSID']) ?>" /> - <input type="submit" class="button text-button" name="do_Disown" value="<?= __('Disown Package') ?>" /> - </form> - </li> + <li><?= html_action_form($base_uri . 'disown/', "do_Disown", __('Disown Package')) ?></li> + <?php endif; ?> <?php endif; ?> </ul> </div> -- 2.4.4

1 1

[aur-dev] [PATCH v3] Redirect at previous page after a successful login
by Gordian Edenhofer 25 Jun '15

25 Jun '15

After the user was authenticated a redirect to the site which linked the user to the login page is done. This fixes FS#32481. --- Here you go. Changes since v2: * Formatting * Usual redirect to register page if it is the referer web/html/login.php | 5 +++++ web/lib/acctfuncs.inc.php | 7 ++++++- 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/web/html/login.php b/web/html/login.php index f898a57..ab7bac9 100644 --- a/web/html/login.php +++ b/web/html/login.php @@ -42,6 +42,11 @@ html_header('AUR ' . __("Login")); <p> <input type="submit" class="button" value="<?php print __("Login"); ?>" /> <a href="<?= get_uri('/passreset/') ?>">[<?= __('Forgot Password') ?>]</a> + <?php if (in_request('referer') !== ""): ?> + <input id="id_referer" type="hidden" name="referer" value="<?= in_request('referer') ?>" /> + <?php elseif (isset($_SERVER['HTTP_REFERER'])): ?> + <input id="id_referer" type="hidden" name="referer" value="<?= htmlspecialchars($_SERVER['HTTP_REFERER'], ENT_QUOTES) ?>" /> + <?php endif; ?> </p> </fieldset> </form> diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index 20ac081..5d62e4e 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -544,7 +544,12 @@ function try_login() { } setcookie("AURSID", $new_sid, $cookie_time, "/", null, !empty($_SERVER['HTTPS']), true); - header("Location: " . get_uri('/')); + + $referer = in_request('referer'); + if (strpos($referer, aur_location()) !== 0) { + $referer = '/'; + } + header("Location: " . get_uri($referer)); $login_error = ""; } -- 2.4.4

2 1

[aur-dev] [PATCH] Move registration code to a separate unit
by Lukas Fleischer 25 Jun '15

25 Jun '15

Until now, we used the same unit to register and edit accounts. Split these features into separate source files for clarity. This also allows us the redirect to the home page when a logged-in user tries to access the user registration page. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/html/account.php | 18 +----------------- web/html/register.php | 36 ++++++++++++++++++++++++++++++++++++ web/lib/routing.inc.php | 2 +- 3 files changed, 38 insertions(+), 18 deletions(-) create mode 100644 web/html/register.php diff --git a/web/html/account.php b/web/html/account.php index 6ecd56e..0bb145c 100644 --- a/web/html/account.php +++ b/web/html/account.php @@ -116,23 +116,7 @@ if (isset($_COOKIE["AURSID"])) { } else { # visitor is not logged in # - if ($action == "AccountInfo") { - print __("You must log in to view user information."); - } elseif ($action == "NewAccount") { - # process the form input for creating a new account - # - process_account_form("new", "NewAccount", - in_request("U"), 1, 0, in_request("E"), - '', '', in_request("R"), in_request("L"), - in_request("I"), in_request("K"), - in_request("PK")); - - } else { - # display the account request form - # - print __("Use this form to create an account."); - display_account_form("NewAccount", "", "", "", "", "", "", "", $LANG); - } + print __("You must log in to view user information."); } echo "</div>"; diff --git a/web/html/register.php b/web/html/register.php new file mode 100644 index 0000000..014d802 --- /dev/null +++ b/web/html/register.php @@ -0,0 +1,36 @@ +<?php + +set_include_path(get_include_path() . PATH_SEPARATOR . '../lib'); + +include_once('aur.inc.php'); # access AUR common functions +include_once('acctfuncs.inc.php'); # access Account specific functions + +set_lang(); # this sets up the visitor's language +check_sid(); # see if they're still logged in + +if (isset($_COOKIE["AURSID"])) { + header('Location: /'); + exit(); +} + +html_header(__('Register')); + +echo '<div class="box">'; +echo '<h2>' . __('Register') . '</h2>'; + +if (in_request("Action") == "NewAccount") { + process_account_form("new", "NewAccount", in_request("U"), 1, 0, + in_request("E"), '', '', in_request("R"), + in_request("L"), in_request("I"), in_request("K"), + in_request("PK")); + +} else { + print __("Use this form to create an account."); + display_account_form("NewAccount", "", "", "", "", "", "", "", $LANG); +} + +echo '</div>'; + +html_footer(AURWEB_VERSION); + +?> diff --git a/web/lib/routing.inc.php b/web/lib/routing.inc.php index 74ab816..8c45c62 100644 --- a/web/lib/routing.inc.php +++ b/web/lib/routing.inc.php @@ -8,7 +8,7 @@ $ROUTES = array( '/packages' => 'packages.php', '/pkgbase' => 'pkgbase.php', '/requests' => 'pkgreq.php', - '/register' => 'account.php', + '/register' => 'register.php', '/account' => 'account.php', '/accounts' => 'account.php', '/login' => 'login.php', -- 2.4.4

1 0

[aur-dev] [PATCH v2] Redirect at previous page after a successful login
by Gordian Edenhofer 25 Jun '15

25 Jun '15

After the user was authenticated a redirect to the site which linked the user to the login page is done. This fixes FS#32481. --- Thanks for the replies. I fixed the concerning htmlspecialchars invocation and changed the formatting. Though I am a fan of short if-else statements and even think they improve readability I do not mind loosing them. Changes since v1: * Prevent setting referer again if $_REQUEST['referer'] exists already * Do not link back to the registration page web/html/login.php | 5 +++++ web/lib/acctfuncs.inc.php | 7 ++++++- 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/web/html/login.php b/web/html/login.php index f898a57..ddb1e69 100644 --- a/web/html/login.php +++ b/web/html/login.php @@ -42,6 +42,11 @@ html_header('AUR ' . __("Login")); <p> <input type="submit" class="button" value="<?php print __("Login"); ?>" /> <a href="<?= get_uri('/passreset/') ?>">[<?= __('Forgot Password') ?>]</a> + <?php if (in_request('referer') !== ""): ?> + <input id="id_referer" type="hidden" name="referer" value="<?= in_request('referer') ?>" /> + <?php elseif (isset($_SERVER['HTTP_REFERER']) && strpos(aur_location()."/register", $_SERVER['HTTP_REFERER']) !== 0): ?> + <input id="id_referer" type="hidden" name="referer" value="<?= htmlspecialchars($_SERVER['HTTP_REFERER'], ENT_QUOTES) ?>" /> + <?php endif; ?> </p> </fieldset> </form> diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index 20ac081..8f2f686 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -544,7 +544,12 @@ function try_login() { } setcookie("AURSID", $new_sid, $cookie_time, "/", null, !empty($_SERVER['HTTPS']), true); - header("Location: " . get_uri('/')); + + $referer = in_request('referer'); + if (strpos($referer, aur_location()) !== 0) { + $referer = '/'; + } + header("Location: ".get_uri( $referer )); $login_error = ""; } -- 2.4.4

2 1

[aur-dev] [PATCH] Redirect at previous page after a successful login
by Gordian Edenhofer 25 Jun '15

25 Jun '15

After the user was authenticated a redirect to the site which linked the user to the login page is done. This fixes FS#32481. --- web/html/login.php | 1 + web/lib/acctfuncs.inc.php | 15 ++++++++++++++- 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/web/html/login.php b/web/html/login.php index f898a57..1b3a589 100644 --- a/web/html/login.php +++ b/web/html/login.php @@ -42,6 +42,7 @@ html_header('AUR ' . __("Login")); <p> <input type="submit" class="button" value="<?php print __("Login"); ?>" /> <a href="<?= get_uri('/passreset/') ?>">[<?= __('Forgot Password') ?>]</a> + <input id="id_referer" type="hidden" name="referer" value="<?= !empty($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : '/'; ?>" /> </p> </fieldset> </form> diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index 20ac081..127a991 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -544,7 +544,20 @@ function try_login() { } setcookie("AURSID", $new_sid, $cookie_time, "/", null, !empty($_SERVER['HTTPS']), true); - header("Location: " . get_uri('/')); + + /** + * Check whether the site itself refered here and if so refer back to its origin + * + * One major drawback is that POST request are not handled properly, the only possible + * solution I could think of is to use JavaScript to auto submit a hidden form, though + * it would slow down the page load time and would require js for a successful redirect. + * This hard dependcy is not somehtings I want to implement since this problem is too + * minor for such an agressive approach IMHO. + */ + $referer = !empty($_REQUEST['referer']) ? $_REQUEST['referer'] : '/'; + $aur_location = aur_location(); + $referer = strpos($referer, $aur_location) === 0 ? $referer : '/'; + header("Location: " . get_uri( $referer )); $login_error = ""; } -- 2.4.4

3 6

[aur-dev] [PATCH 1/2] Make confirmation label of width 'auto'
by Johannes Löthberg 25 Jun '15

25 Jun '15

Signed-off-by: Johannes Löthberg <johannes(a)kyriasis.com> --- web/html/css/aurweb.css | 4 ++++ web/html/pkgdel.php | 2 +- web/html/pkgdisown.php | 2 +- web/html/pkgmerge.php | 2 +- web/template/account_delete.php | 2 +- web/template/pkg_search_results.php | 2 +- 6 files changed, 9 insertions(+), 5 deletions(-) diff --git a/web/html/css/aurweb.css b/web/html/css/aurweb.css index 620e0fa..6f2a1e5 100644 --- a/web/html/css/aurweb.css +++ b/web/html/css/aurweb.css @@ -108,3 +108,7 @@ span.hover-help { border-bottom: 1px dotted black; cursor:help; } + +label.confirmation { + width: auto; +} diff --git a/web/html/pkgdel.php b/web/html/pkgdel.php index face081..eb20967 100644 --- a/web/html/pkgdel.php +++ b/web/html/pkgdel.php @@ -34,7 +34,7 @@ if (has_credential(CRED_PKGBASE_DELETE)): ?> <?php if (isset($_GET['via'])): ?> <input type="hidden" name="via" value="<?= intval($_GET['via']) ?>" /> <?php endif; ?> - <p><label><input type="checkbox" name="confirm" value="1" /> + <p><label class="confirmation"><input type="checkbox" name="confirm" value="1" /> <?= __("Confirm package deletion") ?></label></p> <p><input type="submit" class="button" name="do_Delete" value="<?= __("Delete") ?>" /></p> </fieldset> diff --git a/web/html/pkgdisown.php b/web/html/pkgdisown.php index f7ef0f2..4842939 100644 --- a/web/html/pkgdisown.php +++ b/web/html/pkgdisown.php @@ -41,7 +41,7 @@ if (has_credential(CRED_PKGBASE_DISOWN, $maintainer_uids)): ?> <?php if (isset($_GET['via'])): ?> <input type="hidden" name="via" value="<?= intval($_GET['via']) ?>" /> <?php endif; ?> - <p><label><input type="checkbox" name="confirm" value="1" /> + <p><label class="confirmation"><input type="checkbox" name="confirm" value="1" /> <?= __("Confirm to disown the package") ?></label</p> <p><input type="submit" class="button" name="do_Disown" value="<?= __("Disown") ?>" /></p> </fieldset> diff --git a/web/html/pkgmerge.php b/web/html/pkgmerge.php index 0742c62..c651ce9 100644 --- a/web/html/pkgmerge.php +++ b/web/html/pkgmerge.php @@ -55,7 +55,7 @@ if (has_credential(CRED_PKGBASE_DELETE)): ?> </script> <p><label for="merge_Into" ><?= __("Merge into:") ?></label> <input type="text" id="merge_Into" name="merge_Into" value="<?= isset($_GET['into']) ? $_GET['into'] : '' ?>" /></p> - <p><label><input type="checkbox" name="confirm" value="1" /> + <p><label class="confirmation"><input type="checkbox" name="confirm" value="1" /> <?= __("Confirm package merge") ?></label></p> <p><input type="submit" class="button" name="do_Delete" value="<?= __("Merge") ?>" /></p> </fieldset> diff --git a/web/template/account_delete.php b/web/template/account_delete.php index faa0137..74f386d 100644 --- a/web/template/account_delete.php +++ b/web/template/account_delete.php @@ -12,7 +12,7 @@ <input type="hidden" name="token" value="<?= htmlspecialchars($_COOKIE['AURSID']) ?>" /> </fieldset> <fieldset> - <p><label><input type="checkbox" name="confirm" value="1" /> + <p><label class="confirmation"><input type="checkbox" name="confirm" value="1" /> <?= __("Confirm deletion") ?></label></p> <p> diff --git a/web/template/pkg_search_results.php b/web/template/pkg_search_results.php index e866282..cce533c 100644 --- a/web/template/pkg_search_results.php +++ b/web/template/pkg_search_results.php @@ -123,7 +123,7 @@ if (!$result): ?> <label for="merge_Into"><?= __("Merge into") ?></label> <input type="text" id="merge_Into" name="merge_Into" /> <?php endif; ?> - <label><input type="checkbox" name="confirm" value="1" /> <?= __("Confirm") ?></label> + <label class="confirmation"><input type="checkbox" name="confirm" value="1" /> <?= __("Confirm") ?></label> <input type="hidden" name="token" value="<?= htmlspecialchars($_COOKIE['AURSID']) ?>" /> <input type="submit" class="button" style="width: 80px" value="<?= __("Go") ?>" /> </p> -- 2.4.4

2 2