- Aur-dev - lists.archlinux.org

[aur-dev] [PATCH 0/4] FS#45410, TUs bypassing blacklist
by Johannes Löthberg 23 Jun '15

23 Jun '15

This patch series are meant to firstly simplify somewhat, and then to implement FS#45410. First version. Johannes Löthberg (4): git: Use AUR_USER env var instead of ForceCommand argument git-auth: Set AUR_PRIVILEGED env var for TUs & devs git-serve: Drop direct AccountType checking, use AUR_PRIVILEGED git-update: Allow privileged users to bypass blacklist git-interface/git-auth.py | 29 +++++++++++++++++++++++++---- git-interface/git-serve.py | 6 +++--- git-interface/git-update.py | 3 ++- 3 files changed, 30 insertions(+), 8 deletions(-) -- 2.4.4

2 10

[aur-dev] [PATCH] Wrap all confirmation checkbox labels in label tag
by Johannes Löthberg 23 Jun '15

23 Jun '15

Without a label tag around the label it won't be clickable. Signed-off-by: Johannes Löthberg <johannes(a)kyriasis.com> --- web/html/pkgdel.php | 4 ++-- web/html/pkgdisown.php | 4 ++-- web/html/pkgmerge.php | 4 ++-- web/template/account_delete.php | 4 ++-- web/template/pkg_search_results.php | 2 +- 5 files changed, 9 insertions(+), 9 deletions(-) diff --git a/web/html/pkgdel.php b/web/html/pkgdel.php index bad1cd3..face081 100644 --- a/web/html/pkgdel.php +++ b/web/html/pkgdel.php @@ -34,8 +34,8 @@ if (has_credential(CRED_PKGBASE_DELETE)): ?> <?php if (isset($_GET['via'])): ?> <input type="hidden" name="via" value="<?= intval($_GET['via']) ?>" /> <?php endif; ?> - <p><input type="checkbox" name="confirm" value="1" /> - <?= __("Confirm package deletion") ?></p> + <p><label><input type="checkbox" name="confirm" value="1" /> + <?= __("Confirm package deletion") ?></label></p> <p><input type="submit" class="button" name="do_Delete" value="<?= __("Delete") ?>" /></p> </fieldset> </form> diff --git a/web/html/pkgdisown.php b/web/html/pkgdisown.php index 50f5c79..f7ef0f2 100644 --- a/web/html/pkgdisown.php +++ b/web/html/pkgdisown.php @@ -41,8 +41,8 @@ if (has_credential(CRED_PKGBASE_DISOWN, $maintainer_uids)): ?> <?php if (isset($_GET['via'])): ?> <input type="hidden" name="via" value="<?= intval($_GET['via']) ?>" /> <?php endif; ?> - <p><input type="checkbox" name="confirm" value="1" /> - <?= __("Confirm to disown the package") ?></p> + <p><label><input type="checkbox" name="confirm" value="1" /> + <?= __("Confirm to disown the package") ?></label</p> <p><input type="submit" class="button" name="do_Disown" value="<?= __("Disown") ?>" /></p> </fieldset> </form> diff --git a/web/html/pkgmerge.php b/web/html/pkgmerge.php index a9c8894..0742c62 100644 --- a/web/html/pkgmerge.php +++ b/web/html/pkgmerge.php @@ -55,8 +55,8 @@ if (has_credential(CRED_PKGBASE_DELETE)): ?> </script> <p><label for="merge_Into" ><?= __("Merge into:") ?></label> <input type="text" id="merge_Into" name="merge_Into" value="<?= isset($_GET['into']) ? $_GET['into'] : '' ?>" /></p> - <p><input type="checkbox" name="confirm" value="1" /> - <?= __("Confirm package merge") ?></p> + <p><label><input type="checkbox" name="confirm" value="1" /> + <?= __("Confirm package merge") ?></label></p> <p><input type="submit" class="button" name="do_Delete" value="<?= __("Merge") ?>" /></p> </fieldset> </form> diff --git a/web/template/account_delete.php b/web/template/account_delete.php index 03951fe..faa0137 100644 --- a/web/template/account_delete.php +++ b/web/template/account_delete.php @@ -12,8 +12,8 @@ <input type="hidden" name="token" value="<?= htmlspecialchars($_COOKIE['AURSID']) ?>" /> </fieldset> <fieldset> - <p><input type="checkbox" name="confirm" value="1" /> - <?= __("Confirm deletion") ?></p> + <p><label><input type="checkbox" name="confirm" value="1" /> + <?= __("Confirm deletion") ?></label></p> <p> <input type="submit" class="button" value="<?= __("Delete") ?>" /> diff --git a/web/template/pkg_search_results.php b/web/template/pkg_search_results.php index 7134f2d..e866282 100644 --- a/web/template/pkg_search_results.php +++ b/web/template/pkg_search_results.php @@ -123,7 +123,7 @@ if (!$result): ?> <label for="merge_Into"><?= __("Merge into") ?></label> <input type="text" id="merge_Into" name="merge_Into" /> <?php endif; ?> - <input type="checkbox" name="confirm" value="1" /> <?= __("Confirm") ?> + <label><input type="checkbox" name="confirm" value="1" /> <?= __("Confirm") ?></label> <input type="hidden" name="token" value="<?= htmlspecialchars($_COOKIE['AURSID']) ?>" /> <input type="submit" class="button" style="width: 80px" value="<?= __("Go") ?>" /> </p> -- 2.4.4

2 1

[aur-dev] [PATCH] Fix a warning when formatting user names
by Lukas Fleischer 20 Jun '15

20 Jun '15

Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/lib/aur.inc.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/web/lib/aur.inc.php b/web/lib/aur.inc.php index a45c9b6..7f923d7 100644 --- a/web/lib/aur.inc.php +++ b/web/lib/aur.inc.php @@ -186,7 +186,7 @@ function username_from_sid($sid="") { function html_format_username($username) { $username_fmt = $username ? htmlspecialchars($username, ENT_QUOTES) : __("None"); - if ($username && $_COOKIE["AURSID"]) { + if ($username && isset($_COOKIE["AURSID"])) { $link = '<a href="' . get_uri('/account/') . $username_fmt; $link .= '" title="' . __('View account information for %s', $username_fmt); $link .= '">' . $username_fmt . '</a>'; -- 2.4.4

1 0

[aur-dev] [PATCH] Remove can_submit_blacklisted()
by Lukas Fleischer 20 Jun '15

20 Jun '15

This function is unneeded since commit 74edb6f (Use Git repositories to store packages, 2014-06-06). Signed-off-by: Lukas Fleischer <lfleischer(a)archlinux.org> --- web/lib/credentials.inc.php | 2 -- web/lib/pkgfuncs.inc.php | 12 ------------ 2 files changed, 14 deletions(-) diff --git a/web/lib/credentials.inc.php b/web/lib/credentials.inc.php index 614f2d9..cf1fcca 100644 --- a/web/lib/credentials.inc.php +++ b/web/lib/credentials.inc.php @@ -15,7 +15,6 @@ define("CRED_PKGBASE_EDIT_COMAINTAINERS", 24); define("CRED_PKGBASE_FLAG", 11); define("CRED_PKGBASE_LIST_VOTERS", 12); define("CRED_PKGBASE_NOTIFY", 13); -define("CRED_PKGBASE_SUBMIT_BLACKLISTED", 14); define("CRED_PKGBASE_UNFLAG", 15); define("CRED_PKGBASE_VOTE", 16); define("CRED_PKGREQ_FILE", 23); @@ -65,7 +64,6 @@ function has_credential($credential, $approved_users=array()) { case CRED_PKGBASE_EDIT_COMAINTAINERS: case CRED_PKGBASE_DISOWN: case CRED_PKGBASE_LIST_VOTERS: - case CRED_PKGBASE_SUBMIT_BLACKLISTED: case CRED_PKGBASE_UNFLAG: case CRED_PKGREQ_CLOSE: case CRED_PKGREQ_LIST: diff --git a/web/lib/pkgfuncs.inc.php b/web/lib/pkgfuncs.inc.php index 35b0e4e..f03134c 100644 --- a/web/lib/pkgfuncs.inc.php +++ b/web/lib/pkgfuncs.inc.php @@ -43,18 +43,6 @@ function can_delete_comment_array($comment) { } /** - * Determine if the visitor can submit blacklisted packages. - * - * Only Trusted Users and Developers can delete blacklisted packages. Packages - * are blacklisted if they are include in the official repositories. - * - * @return bool True if the user can submit blacklisted packages, otherwise false - */ -function can_submit_blacklisted() { - return has_credential(CRED_PKGBASE_SUBMIT_BLACKLISTED); -} - -/** * Check to see if the package name already exists in the database * * @param string $name The package name to check -- 2.4.4

1 0

[aur-dev] [PATCH 1/2] git-update: Remove regex matching of URL
by Johannes Löthberg 20 Jun '15

20 Jun '15

The regex check that a URL is either http or ftp doesn't really have any use, and it forces you to leave proper URLs for eg projects hosted on gopher empty. Signed-off-by: Johannes Löthberg <johannes(a)kyriasis.com> --- git-interface/git-update.py | 3 --- 1 file changed, 3 deletions(-) diff --git a/git-interface/git-update.py b/git-interface/git-update.py index ebed491..6610019 100755 --- a/git-interface/git-update.py +++ b/git-interface/git-update.py @@ -258,9 +258,6 @@ for commit in walker: die_commit('invalid package name: %s' % (pkginfo['pkgname']), commit.id) - if not re.match(r'(?:http|ftp)s?://.*', pkginfo['url']): - die_commit('invalid URL: %s' % (pkginfo['url']), commit.id) - for field in ('pkgname', 'pkgdesc', 'url'): if len(pkginfo[field]) > 255: die_commit('%s field too long: %s' % (field, pkginfo[field]), -- 2.4.4

1 1

[aur-dev] [PATCH 1/4] Add functions for getting arrays of maintainer and co-maintainer UIDs
by Johannes Löthberg 20 Jun '15

20 Jun '15

Signed-off-by: Johannes Löthberg <johannes(a)kyriasis.com> --- web/lib/pkgbasefuncs.inc.php | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) diff --git a/web/lib/pkgbasefuncs.inc.php b/web/lib/pkgbasefuncs.inc.php index c8c99eb..d12a228 100644 --- a/web/lib/pkgbasefuncs.inc.php +++ b/web/lib/pkgbasefuncs.inc.php @@ -318,6 +318,19 @@ function pkgbase_maintainer_uid($base_id) { return $result->fetch(PDO::FETCH_COLUMN, 0); } +/** + * Retrieve the maintainers of an array of package bases given by their ID + * + * @param int $base_ids The array of IDs of the package bases to query + * + * @return int The user ID of the current package maintainer + */ +function pkgbase_maintainer_uids($base_ids) { + $dbh = DB::connect(); + $q = "SELECT MaintainerUID FROM PackageBases WHERE ID IN (" . implode(",", $base_ids) . ")"; + $result = $dbh->query($q); + return $result->fetchAll(PDO::FETCH_COLUMN, 0); +} /** * Flag package(s) as out-of-date @@ -993,6 +1006,28 @@ function pkgbase_get_comaintainers($base_id) { } /** + * Get a list of package base co-maintainer IDs + * + * @param int $base_id The package base ID to retrieve the co-maintainers for + * + * @return array An array of co-maintainer user UDs + */ +function pkgbase_get_comaintainer_uids($base_ids) { + $dbh = DB::connect(); + $q = "SELECT UsersID FROM PackageComaintainers "; + $q .= "INNER JOIN Users ON Users.ID = PackageComaintainers.UsersID "; + $q .= "WHERE PackageComaintainers.PackageBaseID IN (" . implode(",", $base_ids) . ") "; + $q .= "ORDER BY Priority ASC"; + $result = $dbh->query($q); + + if ($result) { + return $result->fetchAll(PDO::FETCH_COLUMN, 0); + } else { + return array(); + } +} + +/** * Update the list of co-maintainers of a package base * * @param int $base_id The package base ID to update the co-maintainers of -- 2.4.4

1 3

[aur-dev] [PATCH v2 1/2] git-update: Remove regex matching of URL
by Johannes Löthberg 19 Jun '15

19 Jun '15

The regex check that a URL is either http or ftp doesn't really have any use, and it forces you leave proper URLs like projects hosted on gopher still empty. Signed-off-by: Johannes Löthberg <johannes(a)kyriasis.com> --- git-interface/git-update.py | 3 --- 1 file changed, 3 deletions(-) diff --git a/git-interface/git-update.py b/git-interface/git-update.py index ebed491..6610019 100755 --- a/git-interface/git-update.py +++ b/git-interface/git-update.py @@ -258,9 +258,6 @@ for commit in walker: die_commit('invalid package name: %s' % (pkginfo['pkgname']), commit.id) - if not re.match(r'(?:http|ftp)s?://.*', pkginfo['url']): - die_commit('invalid URL: %s' % (pkginfo['url']), commit.id) - for field in ('pkgname', 'pkgdesc', 'url'): if len(pkginfo[field]) > 255: die_commit('%s field too long: %s' % (field, pkginfo[field]), -- 2.4.3

1 2

[aur-dev] [PATCH] git-update: Remove regex matching of URL
by Johannes Löthberg 19 Jun '15

19 Jun '15

The regex check that a URL is either http or ftp doesn't really have any use, and it forces you leave proper URLs like projects hosted on gopher still empty. Signed-off-by: Johannes Löthberg <johannes(a)kyriasis.com> --- git-interface/git-update.py | 3 --- 1 file changed, 3 deletions(-) diff --git a/git-interface/git-update.py b/git-interface/git-update.py index 34fabcf..f40511e 100755 --- a/git-interface/git-update.py +++ b/git-interface/git-update.py @@ -261,9 +261,6 @@ for commit in walker: die_commit('invalid package name: %s' % (pkginfo['pkgname']), commit.id) - if 'url' in pkginfo and not re.match(r'(?:http|ftp)s?://.*', pkginfo['url']): - die_commit('invalid URL: %s' % (pkginfo['url']), commit.id) - for field in ('pkgname', 'pkgdesc', 'url'): if field in pkginfo and len(pkginfo[field]) > 255: die_commit('%s field too long: %s' % (field, pkginfo[field]), -- 2.4.3

1 0

[aur-dev] [PATCH] git-update: Make url field optional
by Johannes Löthberg 19 Jun '15

19 Jun '15

The url PKGBUILD variable is optional, so should be in the AUR as well. Signed-off-by: Johannes Löthberg <johannes(a)kyriasis.com> --- pkgdesc should be optional as well though, but I was unsure what Lukas would think, so sending this first. Comments? git-interface/git-update.py | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/git-interface/git-update.py b/git-interface/git-update.py index ebed491..34fabcf 100755 --- a/git-interface/git-update.py +++ b/git-interface/git-update.py @@ -247,10 +247,13 @@ for commit in walker: for pkgname in srcinfo.GetPackageNames(): pkginfo = srcinfo.GetMergedPackage(pkgname) - for field in ('pkgver', 'pkgrel', 'pkgname', 'pkgdesc', 'url'): + for field in ('pkgver', 'pkgrel', 'pkgname', 'pkgdesc'): if not field in pkginfo: die_commit('missing mandatory field: %s' % (field), commit.id) + if not 'url' in pkginfo: + pkginfo['url'] = 'None' + if 'epoch' in pkginfo and not pkginfo['epoch'].isdigit(): die_commit('invalid epoch: %s' % (pkginfo['epoch']), commit.id) @@ -258,11 +261,11 @@ for commit in walker: die_commit('invalid package name: %s' % (pkginfo['pkgname']), commit.id) - if not re.match(r'(?:http|ftp)s?://.*', pkginfo['url']): + if 'url' in pkginfo and not re.match(r'(?:http|ftp)s?://.*', pkginfo['url']): die_commit('invalid URL: %s' % (pkginfo['url']), commit.id) for field in ('pkgname', 'pkgdesc', 'url'): - if len(pkginfo[field]) > 255: + if field in pkginfo and len(pkginfo[field]) > 255: die_commit('%s field too long: %s' % (field, pkginfo[field]), commit.id) -- 2.4.3

1 0

[aur-dev] [PATCH v8] pkgbase_details.php/pkg_details.php: Show keywords
by Marcel Korpel 19 Jun '15

19 Jun '15

Keywords are hyperlinked so a user can search for other packages with the same name and/or keyword. Signed-off-by: Marcel Korpel <marcel.korpel(a)gmail.com> --- Making the colours of the keyword tags a bit darker and applying all the changes also to pkgbase_details.php. web/html/css/aurweb.css | 18 ++++++++++++++++++ web/template/pkg_details.php | 14 +++++++++++++- web/template/pkgbase_details.php | 14 +++++++++++++- 3 files changed, 44 insertions(+), 2 deletions(-) diff --git a/web/html/css/aurweb.css b/web/html/css/aurweb.css index a3f43bd..ca53fa1 100644 --- a/web/html/css/aurweb.css +++ b/web/html/css/aurweb.css @@ -53,6 +53,24 @@ text-align:right; } +.keyword:link, .keyword:visited { + float: left; + margin: 1px .5ex 1px 0; + padding: 0 1em; + color: white; + background-color: #36a; + border: 1px solid transparent; + border-radius: 2px; +} + +.keyword:hover { + cursor: pointer; +} + +.keyword:focus { + border: 1px dotted #000; +} + .text-button { background: transparent; border: none !important; diff --git a/web/template/pkg_details.php b/web/template/pkg_details.php index ae49e24..d2d3fe6 100644 --- a/web/template/pkg_details.php +++ b/web/template/pkg_details.php @@ -190,11 +190,14 @@ $sources = pkg_sources($row["ID"]); <td><a href="<?= htmlspecialchars($row['URL'], ENT_QUOTES) ?>" title="<?= __('Visit the website for') . ' ' . htmlspecialchars( $row['Name'])?>"><?= htmlspecialchars($row['URL'], ENT_QUOTES) ?></a></td> </tr> <?php -if (has_credential(CRED_PKGBASE_SET_KEYWORDS, array($row["MaintainerUID"]))): +if (has_credential(CRED_PKGBASE_SET_KEYWORDS, array($row["MaintainerUID"])) || count($keywords) > 0): ?> <tr> <th><?= __('Keywords') . ': ' ?></th> <td> +<?php +if (has_credential(CRED_PKGBASE_SET_KEYWORDS, array($row["MaintainerUID"]))): +?> <form method="post" action="<?= htmlspecialchars(get_pkgbase_uri($row['BaseName']), ENT_QUOTES); ?>"> <div> <input type="hidden" name="action" value="do_SetKeywords" /> @@ -205,6 +208,15 @@ if (has_credential(CRED_PKGBASE_SET_KEYWORDS, array($row["MaintainerUID"]))): <input type="submit" value="<?= __('Update') ?>"/> </div> </form> +<?php +else: + foreach ($keywords as $kw) { + echo '<a class="keyword" href="'; + echo get_uri('/packages/') . '?K=' . urlencode($kw) . '&SB=p'; + echo '">' . htmlspecialchars($kw) . "</a>\n"; + } +endif; +?> </td> </tr> <?php endif; ?> diff --git a/web/template/pkgbase_details.php b/web/template/pkgbase_details.php index fa24e12..61e167b 100644 --- a/web/template/pkgbase_details.php +++ b/web/template/pkgbase_details.php @@ -129,11 +129,14 @@ $pkgs = pkgbase_get_pkgnames($base_id); </td> </tr> <?php -if (has_credential(CRED_PKGBASE_SET_KEYWORDS, array($row["MaintainerUID"]))): +if (has_credential(CRED_PKGBASE_SET_KEYWORDS, array($row["MaintainerUID"])) || count($keywords) > 0): ?> <tr> <th><?= __('Keywords') . ': ' ?></th> <td> +<?php +if (has_credential(CRED_PKGBASE_SET_KEYWORDS, array($row["MaintainerUID"]))): +?> <form method="post" action="<?= htmlspecialchars(get_pkgbase_uri($row['Name']), ENT_QUOTES); ?>"> <div> <input type="hidden" name="action" value="do_SetKeywords" /> @@ -144,6 +147,15 @@ if (has_credential(CRED_PKGBASE_SET_KEYWORDS, array($row["MaintainerUID"]))): <input type="submit" value="<?= __('Update') ?>"/> </div> </form> +<?php +else: + foreach ($keywords as $kw) { + echo '<a class="keyword" href="'; + echo get_uri('/packages/') . '?K=' . urlencode($kw) . '&SB=p'; + echo '">' . htmlspecialchars($kw) . "</a>\n"; + } +endif; +?> </td> </tr> <?php endif; ?> -- 2.4.4

2 1