- Aur-dev - lists.archlinux.org

[aur-dev] [PATCH] Move registration code to a separate unit
by Lukas Fleischer 25 Jun '15

25 Jun '15

Until now, we used the same unit to register and edit accounts. Split these features into separate source files for clarity. This also allows us the redirect to the home page when a logged-in user tries to access the user registration page. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/html/account.php | 18 +----------------- web/html/register.php | 36 ++++++++++++++++++++++++++++++++++++ web/lib/routing.inc.php | 2 +- 3 files changed, 38 insertions(+), 18 deletions(-) create mode 100644 web/html/register.php diff --git a/web/html/account.php b/web/html/account.php index 6ecd56e..0bb145c 100644 --- a/web/html/account.php +++ b/web/html/account.php @@ -116,23 +116,7 @@ if (isset($_COOKIE["AURSID"])) { } else { # visitor is not logged in # - if ($action == "AccountInfo") { - print __("You must log in to view user information."); - } elseif ($action == "NewAccount") { - # process the form input for creating a new account - # - process_account_form("new", "NewAccount", - in_request("U"), 1, 0, in_request("E"), - '', '', in_request("R"), in_request("L"), - in_request("I"), in_request("K"), - in_request("PK")); - - } else { - # display the account request form - # - print __("Use this form to create an account."); - display_account_form("NewAccount", "", "", "", "", "", "", "", $LANG); - } + print __("You must log in to view user information."); } echo "</div>"; diff --git a/web/html/register.php b/web/html/register.php new file mode 100644 index 0000000..014d802 --- /dev/null +++ b/web/html/register.php @@ -0,0 +1,36 @@ +<?php + +set_include_path(get_include_path() . PATH_SEPARATOR . '../lib'); + +include_once('aur.inc.php'); # access AUR common functions +include_once('acctfuncs.inc.php'); # access Account specific functions + +set_lang(); # this sets up the visitor's language +check_sid(); # see if they're still logged in + +if (isset($_COOKIE["AURSID"])) { + header('Location: /'); + exit(); +} + +html_header(__('Register')); + +echo '<div class="box">'; +echo '<h2>' . __('Register') . '</h2>'; + +if (in_request("Action") == "NewAccount") { + process_account_form("new", "NewAccount", in_request("U"), 1, 0, + in_request("E"), '', '', in_request("R"), + in_request("L"), in_request("I"), in_request("K"), + in_request("PK")); + +} else { + print __("Use this form to create an account."); + display_account_form("NewAccount", "", "", "", "", "", "", "", $LANG); +} + +echo '</div>'; + +html_footer(AURWEB_VERSION); + +?> diff --git a/web/lib/routing.inc.php b/web/lib/routing.inc.php index 74ab816..8c45c62 100644 --- a/web/lib/routing.inc.php +++ b/web/lib/routing.inc.php @@ -8,7 +8,7 @@ $ROUTES = array( '/packages' => 'packages.php', '/pkgbase' => 'pkgbase.php', '/requests' => 'pkgreq.php', - '/register' => 'account.php', + '/register' => 'register.php', '/account' => 'account.php', '/accounts' => 'account.php', '/login' => 'login.php', -- 2.4.4

1 0

[aur-dev] [PATCH v2] Redirect at previous page after a successful login
by Gordian Edenhofer 25 Jun '15

25 Jun '15

After the user was authenticated a redirect to the site which linked the user to the login page is done. This fixes FS#32481. --- Thanks for the replies. I fixed the concerning htmlspecialchars invocation and changed the formatting. Though I am a fan of short if-else statements and even think they improve readability I do not mind loosing them. Changes since v1: * Prevent setting referer again if $_REQUEST['referer'] exists already * Do not link back to the registration page web/html/login.php | 5 +++++ web/lib/acctfuncs.inc.php | 7 ++++++- 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/web/html/login.php b/web/html/login.php index f898a57..ddb1e69 100644 --- a/web/html/login.php +++ b/web/html/login.php @@ -42,6 +42,11 @@ html_header('AUR ' . __("Login")); <p> <input type="submit" class="button" value="<?php print __("Login"); ?>" /> <a href="<?= get_uri('/passreset/') ?>">[<?= __('Forgot Password') ?>]</a> + <?php if (in_request('referer') !== ""): ?> + <input id="id_referer" type="hidden" name="referer" value="<?= in_request('referer') ?>" /> + <?php elseif (isset($_SERVER['HTTP_REFERER']) && strpos(aur_location()."/register", $_SERVER['HTTP_REFERER']) !== 0): ?> + <input id="id_referer" type="hidden" name="referer" value="<?= htmlspecialchars($_SERVER['HTTP_REFERER'], ENT_QUOTES) ?>" /> + <?php endif; ?> </p> </fieldset> </form> diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index 20ac081..8f2f686 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -544,7 +544,12 @@ function try_login() { } setcookie("AURSID", $new_sid, $cookie_time, "/", null, !empty($_SERVER['HTTPS']), true); - header("Location: " . get_uri('/')); + + $referer = in_request('referer'); + if (strpos($referer, aur_location()) !== 0) { + $referer = '/'; + } + header("Location: ".get_uri( $referer )); $login_error = ""; } -- 2.4.4

2 1

[aur-dev] [PATCH] Redirect at previous page after a successful login
by Gordian Edenhofer 25 Jun '15

25 Jun '15

After the user was authenticated a redirect to the site which linked the user to the login page is done. This fixes FS#32481. --- web/html/login.php | 1 + web/lib/acctfuncs.inc.php | 15 ++++++++++++++- 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/web/html/login.php b/web/html/login.php index f898a57..1b3a589 100644 --- a/web/html/login.php +++ b/web/html/login.php @@ -42,6 +42,7 @@ html_header('AUR ' . __("Login")); <p> <input type="submit" class="button" value="<?php print __("Login"); ?>" /> <a href="<?= get_uri('/passreset/') ?>">[<?= __('Forgot Password') ?>]</a> + <input id="id_referer" type="hidden" name="referer" value="<?= !empty($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : '/'; ?>" /> </p> </fieldset> </form> diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index 20ac081..127a991 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -544,7 +544,20 @@ function try_login() { } setcookie("AURSID", $new_sid, $cookie_time, "/", null, !empty($_SERVER['HTTPS']), true); - header("Location: " . get_uri('/')); + + /** + * Check whether the site itself refered here and if so refer back to its origin + * + * One major drawback is that POST request are not handled properly, the only possible + * solution I could think of is to use JavaScript to auto submit a hidden form, though + * it would slow down the page load time and would require js for a successful redirect. + * This hard dependcy is not somehtings I want to implement since this problem is too + * minor for such an agressive approach IMHO. + */ + $referer = !empty($_REQUEST['referer']) ? $_REQUEST['referer'] : '/'; + $aur_location = aur_location(); + $referer = strpos($referer, $aur_location) === 0 ? $referer : '/'; + header("Location: " . get_uri( $referer )); $login_error = ""; } -- 2.4.4

3 6

[aur-dev] [PATCH 1/2] Make confirmation label of width 'auto'
by Johannes Löthberg 25 Jun '15

25 Jun '15

Signed-off-by: Johannes Löthberg <johannes(a)kyriasis.com> --- web/html/css/aurweb.css | 4 ++++ web/html/pkgdel.php | 2 +- web/html/pkgdisown.php | 2 +- web/html/pkgmerge.php | 2 +- web/template/account_delete.php | 2 +- web/template/pkg_search_results.php | 2 +- 6 files changed, 9 insertions(+), 5 deletions(-) diff --git a/web/html/css/aurweb.css b/web/html/css/aurweb.css index 620e0fa..6f2a1e5 100644 --- a/web/html/css/aurweb.css +++ b/web/html/css/aurweb.css @@ -108,3 +108,7 @@ span.hover-help { border-bottom: 1px dotted black; cursor:help; } + +label.confirmation { + width: auto; +} diff --git a/web/html/pkgdel.php b/web/html/pkgdel.php index face081..eb20967 100644 --- a/web/html/pkgdel.php +++ b/web/html/pkgdel.php @@ -34,7 +34,7 @@ if (has_credential(CRED_PKGBASE_DELETE)): ?> <?php if (isset($_GET['via'])): ?> <input type="hidden" name="via" value="<?= intval($_GET['via']) ?>" /> <?php endif; ?> - <p><label><input type="checkbox" name="confirm" value="1" /> + <p><label class="confirmation"><input type="checkbox" name="confirm" value="1" /> <?= __("Confirm package deletion") ?></label></p> <p><input type="submit" class="button" name="do_Delete" value="<?= __("Delete") ?>" /></p> </fieldset> diff --git a/web/html/pkgdisown.php b/web/html/pkgdisown.php index f7ef0f2..4842939 100644 --- a/web/html/pkgdisown.php +++ b/web/html/pkgdisown.php @@ -41,7 +41,7 @@ if (has_credential(CRED_PKGBASE_DISOWN, $maintainer_uids)): ?> <?php if (isset($_GET['via'])): ?> <input type="hidden" name="via" value="<?= intval($_GET['via']) ?>" /> <?php endif; ?> - <p><label><input type="checkbox" name="confirm" value="1" /> + <p><label class="confirmation"><input type="checkbox" name="confirm" value="1" /> <?= __("Confirm to disown the package") ?></label</p> <p><input type="submit" class="button" name="do_Disown" value="<?= __("Disown") ?>" /></p> </fieldset> diff --git a/web/html/pkgmerge.php b/web/html/pkgmerge.php index 0742c62..c651ce9 100644 --- a/web/html/pkgmerge.php +++ b/web/html/pkgmerge.php @@ -55,7 +55,7 @@ if (has_credential(CRED_PKGBASE_DELETE)): ?> </script> <p><label for="merge_Into" ><?= __("Merge into:") ?></label> <input type="text" id="merge_Into" name="merge_Into" value="<?= isset($_GET['into']) ? $_GET['into'] : '' ?>" /></p> - <p><label><input type="checkbox" name="confirm" value="1" /> + <p><label class="confirmation"><input type="checkbox" name="confirm" value="1" /> <?= __("Confirm package merge") ?></label></p> <p><input type="submit" class="button" name="do_Delete" value="<?= __("Merge") ?>" /></p> </fieldset> diff --git a/web/template/account_delete.php b/web/template/account_delete.php index faa0137..74f386d 100644 --- a/web/template/account_delete.php +++ b/web/template/account_delete.php @@ -12,7 +12,7 @@ <input type="hidden" name="token" value="<?= htmlspecialchars($_COOKIE['AURSID']) ?>" /> </fieldset> <fieldset> - <p><label><input type="checkbox" name="confirm" value="1" /> + <p><label class="confirmation"><input type="checkbox" name="confirm" value="1" /> <?= __("Confirm deletion") ?></label></p> <p> diff --git a/web/template/pkg_search_results.php b/web/template/pkg_search_results.php index e866282..cce533c 100644 --- a/web/template/pkg_search_results.php +++ b/web/template/pkg_search_results.php @@ -123,7 +123,7 @@ if (!$result): ?> <label for="merge_Into"><?= __("Merge into") ?></label> <input type="text" id="merge_Into" name="merge_Into" /> <?php endif; ?> - <label><input type="checkbox" name="confirm" value="1" /> <?= __("Confirm") ?></label> + <label class="confirmation"><input type="checkbox" name="confirm" value="1" /> <?= __("Confirm") ?></label> <input type="hidden" name="token" value="<?= htmlspecialchars($_COOKIE['AURSID']) ?>" /> <input type="submit" class="button" style="width: 80px" value="<?= __("Go") ?>" /> </p> -- 2.4.4

2 2

[aur-dev] [PATCH] Add the popularity field to the RPC interface
by Lukas Fleischer 25 Jun '15

25 Jun '15

Implements FS#45422. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/lib/aurjson.class.php | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/web/lib/aurjson.class.php b/web/lib/aurjson.class.php index c896b04..7b77da4 100644 --- a/web/lib/aurjson.class.php +++ b/web/lib/aurjson.class.php @@ -33,6 +33,14 @@ class AurJSON { 'Users.UserName AS Maintainer', 'SubmittedTS AS FirstSubmitted', 'ModifiedTS AS LastModified' ); + private static $fields_v4 = array( + 'Packages.ID', 'Packages.Name', + 'PackageBases.ID AS PackageBaseID', + 'PackageBases.Name AS PackageBase', 'Version', + 'Description', 'URL', 'NumVotes', 'Popularity', + 'OutOfDateTS AS OutOfDate', 'Users.UserName AS Maintainer', + 'SubmittedTS AS FirstSubmitted', 'ModifiedTS AS LastModified' + ); private static $numeric_fields = array( 'ID', 'PackageBaseID', 'NumVotes', 'OutOfDate', 'FirstSubmitted', 'LastModified' @@ -211,7 +219,11 @@ class AurJSON { "GROUP BY Packages.ID " . "LIMIT $max_results"; } elseif ($this->version >= 2) { - $fields = implode(',', self::$fields_v2); + if ($this->version == 2 || $this->version == 3) { + $fields = implode(',', self::$fields_v2); + } else if ($this->version == 4) { + $fields = implode(',', self::$fields_v4); + } $query = "SELECT {$fields} " . "FROM Packages LEFT JOIN PackageBases " . "ON PackageBases.ID = Packages.PackageBaseID " . -- 2.4.4

1 0

[aur-dev] [PATCH] Display (reverse) optional dependencies as "Required by"
by Lukas Fleischer 25 Jun '15

25 Jun '15

Also, change pkg_required() such that the returned array has the same structure as the result of pkg_dependencies(). Fixes FS#45452. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/lib/pkgfuncs.inc.php | 13 ++++++++----- web/template/pkg_details.php | 9 +++------ 2 files changed, 11 insertions(+), 11 deletions(-) diff --git a/web/lib/pkgfuncs.inc.php b/web/lib/pkgfuncs.inc.php index f03134c..110290b 100644 --- a/web/lib/pkgfuncs.inc.php +++ b/web/lib/pkgfuncs.inc.php @@ -179,10 +179,11 @@ function pkg_relations($pkgid) { * @param string $cond The package dependency condition string * @param string $arch The package dependency architecture * @param int $pkg_id The package of the package to display the dependency for + * @param bool $show_desc Whether the description of optdepends is shown * * @return string The HTML code of the label to display */ -function pkg_depend_link($name, $type, $cond, $arch, $pkg_id) { +function pkg_depend_link($name, $type, $cond, $arch, $pkg_id, $show_desc=true) { if ($type == 'optdepends' && strpos($name, ':') !== false) { $tokens = explode(':', $name, 2); $name = $tokens[0]; @@ -221,7 +222,7 @@ function pkg_depend_link($name, $type, $cond, $arch, $pkg_id) { } $link .= ')'; - if ($type == 'optdepends') { + if ($show_desc && $type == 'optdepends') { $link .= ' – ' . htmlspecialchars($desc) . ' </em>'; } $link .= '</em>'; @@ -285,9 +286,11 @@ function pkg_required($name="") { $deps = array(); if ($name != "") { $dbh = DB::connect(); - $q = "SELECT DISTINCT p.Name, PackageID FROM PackageDepends pd "; - $q.= "JOIN Packages p ON pd.PackageID = p.ID "; - $q.= "WHERE DepName = " . $dbh->quote($name) . " "; + $q = "SELECT p.Name, dt.Name, '' AS DepCondition, pd.DepArch, p.ID FROM PackageDepends pd "; + $q.= "LEFT JOIN Packages p ON p.ID = pd.PackageID "; + $q.= "LEFT JOIN DependencyTypes dt ON dt.ID = pd.DepTypeID "; + $q.= "WHERE pd.DepName = " . $dbh->quote($name) . " "; + $q.= "OR SUBSTRING(pd.DepName FROM 1 FOR POSITION(': ' IN pd.DepName) - 1) = " . $dbh->quote($name) . " "; $q.= "ORDER BY p.Name"; $result = $dbh->query($q); if (!$result) {return array();} diff --git a/web/template/pkg_details.php b/web/template/pkg_details.php index 1e2b9a5..6864431 100644 --- a/web/template/pkg_details.php +++ b/web/template/pkg_details.php @@ -359,12 +359,9 @@ endif; <h3><?= __('Required by') . " (" . count($requiredby) . ")"?></h3> <?php if (count($requiredby) > 0): ?> <ul id="pkgreqslist"> -<?php - # darr: (PackageName, PackageID) - while (list($k, $darr) = each($requiredby)): -?> - <li><a href="<?= htmlspecialchars(get_pkg_uri($darr[0]), ENT_QUOTES); ?>" title="<?= __('View packages details for').' ' . htmlspecialchars($darr[0]) ?>"><?= htmlspecialchars($darr[0]) ?></a></li> - <?php endwhile; ?> + <?php while (list($k, $darr) = each($requiredby)): ?> + <li><?= pkg_depend_link($darr[0], $darr[1], $darr[2], $darr[3], $darr[4], false); ?></li> + <?php endwhile; ?> </ul> <?php endif; ?> </div> -- 2.4.4

1 0

[aur-dev] [PATCH] po/Makefile: Add more context to strings in the catalog
by Lukas Fleischer 25 Jun '15

25 Jun '15

Pass the --add-location=file parameter to xgettext(1) when building the message catalog, such that each string is annotated with the file it originates from. Fixes FS#45401. Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- po/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/po/Makefile b/po/Makefile index cebe6f3..d0ed741 100644 --- a/po/Makefile +++ b/po/Makefile @@ -55,7 +55,7 @@ update-pot: POTFILES pkgname=AUR; \ pkgver=`sed -n 's/.*"AURWEB_VERSION", "$.*$".*/\1/p' ../web/lib/version.inc.php`; \ xgettext --default-domain=aur -L php --keyword=__ --keyword=_n:1,2 \ - --no-location --add-comments=TRANSLATORS: \ + --add-location=file --add-comments=TRANSLATORS: \ --package-name="$$pkgname" --package-version="$$pkgver" \ --msgid-bugs-address='${MSGID_BUGS_ADDRESS}' \ --directory ../web --files-from POTFILES -o aur.pot -- 2.4.4

1 0

[aur-dev] [PATCH v4 0/5] FS#45410, TUs bypassing blacklist
by Johannes Löthberg 23 Jun '15

23 Jun '15

This patch series are meant to firstly simplify somewhat, and then to implement FS#45410. Changes since v3: * Fix incorrect commit message and comment * Chane key var to ssh_key * Drop && chain * Use 0/1 for True/False. Not really necessary but I want Lukas to be happy. ;) Johannes Löthberg (5): git: Use .format everywhere instead of % git: Use AUR_USER env var instead of ForceCommand argument git-auth: Set AUR_PRIVILEGED env var for TUs & devs git-serve: Drop direct AccountType checking, use AUR_PRIVILEGED git-update: Allow privileged users to bypass blacklist git-interface/aurinfo.py | 18 +++++++++--------- git-interface/git-auth.py | 31 +++++++++++++++++++++++++++---- git-interface/git-serve.py | 31 +++++++++++++++---------------- git-interface/git-update.py | 41 +++++++++++++++++++++-------------------- 4 files changed, 72 insertions(+), 49 deletions(-) -- 2.4.4

2 6

[aur-dev] [PATCH v3 0/5] FS#45410, TUs bypassing blacklist
by Johannes Löthberg 23 Jun '15

23 Jun '15

This patch series are meant to firstly simplify somewhat, and then to implement FS#45410. Changes since v2: * OpenSSH replaces `\"` in the command part of the AuthorizedKeyCommand output with `"`, so manually replace it with `\\"` instead so that we get what we'd expect Johannes Löthberg (5): git: Use .format everywhere instead of % git: Use AUR_USER env var instead of ForceCommand argument git-auth: Set AUR_PRIVILEGED env var for TUs & devs git-serve: Drop direct AccountType checking, use AUR_PRIVILEGED git-update: Allow privileged users to bypass blacklist git-interface/aurinfo.py | 18 +++++++++--------- git-interface/git-auth.py | 35 +++++++++++++++++++++++++++++++---- git-interface/git-serve.py | 31 +++++++++++++++---------------- git-interface/git-update.py | 41 +++++++++++++++++++++-------------------- 4 files changed, 76 insertions(+), 49 deletions(-) -- 2.4.4

2 7

[aur-dev] [PATCH v2 0/5] FS#45410, TUs bypassing blacklist
by Johannes Löthberg 23 Jun '15

23 Jun '15

This patch series are meant to firstly simplify somewhat, and then to implement FS#45410. Changes since v1: * Replace all uses of % with .format for consistency * Quote envvar variables with shlex.quote * Simplify if statement in git-serve Johannes Löthberg (5): git: Use .format everywhere instead of % git: Use AUR_USER env var instead of ForceCommand argument git-auth: Set AUR_PRIVILEGED env var for TUs & devs git-serve: Drop direct AccountType checking, use AUR_PRIVILEGED git-update: Allow privileged users to bypass blacklist git-interface/aurinfo.py | 18 +++++++++--------- git-interface/git-auth.py | 30 ++++++++++++++++++++++++++---- git-interface/git-serve.py | 31 +++++++++++++++---------------- git-interface/git-update.py | 41 +++++++++++++++++++++-------------------- 4 files changed, 71 insertions(+), 49 deletions(-) -- 2.4.4

1 5