- Aur-dev - lists.archlinux.org

[aur-dev] [PATCH] Remove superfluous search wrapper function
by canyonknight 19 Apr '13

19 Apr '13

The search_accounts_form() wrapper function doesn't have any arguments and only makes it unclear what is happening within account.php Signed-off-by: canyonknight <canyonknight(a)gmail.com> --- web/html/account.php | 2 +- web/lib/acctfuncs.inc.php | 10 ---------- 2 files changed, 1 insertion(+), 11 deletions(-) diff --git a/web/html/account.php b/web/html/account.php index 50d376f..4af3043 100644 --- a/web/html/account.php +++ b/web/html/account.php @@ -88,7 +88,7 @@ if (isset($_COOKIE["AURSID"])) { # display the search page if they're a TU/dev # print __("Use this form to search existing accounts.")."<br />\n"; - search_accounts_form(); + include('search_accounts_form.php'); } else { print __("You are not allowed to access this area."); diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index 28f9f93..1deeac5 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -277,16 +277,6 @@ function process_account_form($UTYPE,$TYPE,$A,$U="",$T="",$S="",$E="", } /** - * Include the search accounts form - * - * @return void - */ -function search_accounts_form() { - include("search_accounts_form.php"); - return; -} - -/** * Display the search results page * * @param string $UTYPE User type of the account accessing the form -- 1.8.2.1

1 0

[aur-dev] [PATCH] Retrieve package details after package actions are processed
by canyonknight 14 Apr '13

14 Apr '13

Fixes FS#34508 Signed-off-by: canyonknight <canyonknight(a)gmail.com> --- web/html/packages.php | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/web/html/packages.php b/web/html/packages.php index a4a480c..b390d76 100644 --- a/web/html/packages.php +++ b/web/html/packages.php @@ -26,12 +26,9 @@ if (!isset($pkgid) || !isset($pkgname)) { } } -# Set the title to the current query and get package details if required -$details = array(); - +# Set the title to the current query or package name if (isset($pkgname)) { $title = $pkgname; - $details = get_package_details($pkgid); } else if (!empty($_GET['K'])) { $title = __("Search Criteria") . ": " . $_GET['K']; } else { @@ -102,6 +99,12 @@ if (check_token()) { } } +# Get package details after package actions have been attempted, FS#34508 +$details = array(); +if (isset($pkgname)) { + $details = get_package_details($pkgid); +} + html_header($title, $details); ?> -- 1.8.2.1

1 0

[aur-dev] AUR Android app
by Pedro Veloso 27 Mar '13

27 Mar '13

My name is Pedro Veloso and I'm an Android developer for more than 3 years now. I would like to contribute to Arch by making an application that could provide the user with functionality for searching packages, seeing their details and dependencies etc. All of this in a convenient way trough a native Android application. This application would be of course Apache licensed (or similar one, point being I intent to open-source the whole thing from the beginning). For this to work I would need a working API on the server side, I did a brief search and I found some work is already underway in that sense ( https://wiki.archlinux.org/index.php/AUR_2) where there seems to be a discussion on doing a REST API with OAuth authentication (which is great because I've worked with both standards in several projects as well). However I did not find what the current progress is on this, so that's what I intend to find out sending this email to the aur-dev mailing list. Thanks in advance, Pedro

4 3

[aur-dev] AUR 2.2.0 released
by Lukas Fleischer 26 Mar '13

26 Mar '13

Changes since 2.1.0: * Email address validation during registration. * Track last login IP address in the user database. * Add a table that allows for banning IP addresses. * Use minified typeahead JS from archweb (fixes several typeahead bugs). You can check the Git log [1] for a complete list of commits. The official Arch Linux AUR setup [2] has already been upgraded! [1] https://projects.archlinux.org/aur.git/log/?id=v2.2.0 [2] https://aur.archlinux.org/

1 0

[aur-dev] [PATCH] Show hint if password is empty during login
by Lukas Fleischer 25 Mar '13

25 Mar '13

A user might have an empty password due to two reasons: * The user just created an account and needs to set an initial password. * The password has been reset by the administrator. In both cases, the user might be confused as to why the login does not work. Add a message that helps users debug the issue in both cases. Signed-off-by: Lukas Fleischer <archlinux(a)cryptocrack.de> --- web/lib/acctfuncs.inc.php | 33 +++++++++++++++++++++++++++++++-- 1 file changed, 31 insertions(+), 2 deletions(-) diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index aa4c70b..28f9f93 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -486,8 +486,16 @@ function try_login() { else { $login_error = "Error trying to generate session id."; } - } - else { + } elseif (passwd_is_empty($userID)) { + $login_error = __('Your password has been reset. ' . + 'If you just created a new account, please ' . + 'use the link from the confirmation email ' . + 'to set an initial password. Otherwise, ' . + 'please request a reset key on the %s' . + 'Password Reset%s page.', '<a href="' . + htmlspecialchars(get_uri('/passreset')) . '">', + '</a>'); + } else { $login_error = __("Bad username or password."); } } @@ -746,6 +754,27 @@ function valid_passwd($userID, $passwd) { } /** + * Determine if a user's password is empty + * + * @param string $uid The user ID to check for an empty password + * + * @return bool True if the user's password is empty, otherwise false + */ +function passwd_is_empty($uid) { + $dbh = DB::connect(); + + $q = "SELECT * FROM Users WHERE ID = " . $dbh->quote($uid) . " "; + $q .= "AND Passwd = " . $dbh->quote(''); + $result = $dbh->query($q); + + if ($result->fetchColumn()) { + return true; + } else { + return false; + } +} + +/** * Determine if the PGP key fingerprint is valid (must be 40 hexadecimal digits) * * @param string $fingerprint PGP fingerprint to check if valid -- 1.8.2.411.g65a544e

1 2

[aur-dev] 2.2.0 string freeze
by Lukas Fleischer 24 Mar '13

24 Mar '13

I just uploaded new strings for 2.2.0. Note that the string freeze already ends on Tuesday, 2013-03-26. I would like to release 2.2.0 as soon as possible so that the account creation page can be re-enabled in the near term. There will probably be another release soon.

1 0

[aur-dev] [PATCH 1/2] Add "Bans" table to database schema
by canyonknight 24 Mar '13

24 Mar '13

The "Bans" table creates a DB structure for the ability to ban IP addresses. It takes an IP address converted by ip2long(). It can easily be extended for other features such as time limits (for temporary bans). The table will eventually be able to be populated directly through the web interface by Trusted Users and Developers. Signed-off-by: canyonknight <canyonknight(a)gmail.com> --- UPGRADING | 11 +++++++++++ support/schema/aur-schema.sql | 9 +++++++++ 2 files changed, 20 insertions(+) diff --git a/UPGRADING b/UPGRADING index 9c05467..7d13c43 100644 --- a/UPGRADING +++ b/UPGRADING @@ -11,6 +11,17 @@ ALTER TABLE Users ADD COLUMN LastLoginIPAddress INTEGER UNSIGNED NOT NULL DEFAULT 0; ---- +2. Add a new "Bans" table: + +---- +CREATE TABLE Bans ( + ID INTEGER UNSIGNED NOT NULL AUTO_INCREMENT, + IPAddress INTEGER UNSIGNED NOT NULL DEFAULT 0, + PRIMARY KEY (ID), + UNIQUE (IPAddress) +) ENGINE = InnoDB; +---- + From 2.0.0 to 2.1.0 ------------------- diff --git a/support/schema/aur-schema.sql b/support/schema/aur-schema.sql index fab40d6..2d268fa 100644 --- a/support/schema/aur-schema.sql +++ b/support/schema/aur-schema.sql @@ -213,3 +213,12 @@ CREATE TABLE IF NOT EXISTS TU_Votes ( FOREIGN KEY (VoteID) REFERENCES TU_VoteInfo(ID) ON DELETE CASCADE, FOREIGN KEY (UserID) REFERENCES Users(ID) ON DELETE CASCADE ) ENGINE = InnoDB; + +-- Malicious user banning +-- +CREATE TABLE Bans ( + ID INTEGER UNSIGNED NOT NULL AUTO_INCREMENT, + IPAddress INTEGER UNSIGNED NOT NULL DEFAULT 0, + PRIMARY KEY (ID), + UNIQUE (IPAddress) +) ENGINE = InnoDB; -- 1.8.2

3 4

[aur-dev] [PATCH] Add an IP ban list
by Lukas Fleischer 23 Mar '13

23 Mar '13

This allows for specifying a list of IP addresses that will no longer be able to register new accounts and login. The list of banned IP addresses can be configured in "web/lib/config.inc.php". Signed-off-by: Lukas Fleischer <archlinux(a)cryptocrack.de> --- web/lib/acctfuncs.inc.php | 24 +++++++++++++++++++++--- web/lib/config.inc.php.proto | 3 +++ 2 files changed, 24 insertions(+), 3 deletions(-) diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index aabb096..c202f47 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -91,7 +91,17 @@ function process_account_form($UTYPE,$TYPE,$A,$U="",$T="",$S="",$E="", $P="",$C="",$R="",$L="",$I="",$K="",$UID=0) { # error check and process request for a new/modified account - global $SUPPORTED_LANGS, $AUR_LOCATION; + global $SUPPORTED_LANGS, $AUR_LOCATION, $BANNED_IPS; + + $error = ""; + + if (in_array($_SERVER['REMOTE_ADDR'], $BANNED_IPS)) { + $error = __('The login form is currently ' . + 'disabled for your IP address, probably due ' . + 'to sustained spam attacks. Sorry for the ' . + 'inconvenience -- we hope to be back up ' . + 'soon.'); + } $dbh = DB::connect(); @@ -102,7 +112,6 @@ function process_account_form($UTYPE,$TYPE,$A,$U="",$T="",$S="",$E="", $editor_user = null; } - $error = ""; if (empty($E) || empty($U)) { $error = __("Missing a required field."); } @@ -393,13 +402,22 @@ function search_results_page($UTYPE,$O=0,$SB="",$U="",$T="", * @return array Session ID for user, error message if applicable */ function try_login() { - global $MAX_SESSIONS_PER_USER, $PERSISTENT_COOKIE_TIMEOUT; + global $MAX_SESSIONS_PER_USER, $PERSISTENT_COOKIE_TIMEOUT, $BANNED_IPS; $login_error = ""; $new_sid = ""; $userID = null; if ( isset($_REQUEST['user']) || isset($_REQUEST['passwd']) ) { + if (in_array($_SERVER['REMOTE_ADDR'], $BANNED_IPS)) { + $login_error = __('The login form is currently ' . + 'disabled for your IP address, probably due ' . + 'to sustained spam attacks. Sorry for the ' . + 'inconvenience -- we hope to be back up ' . + 'soon.'); + return array('SID' => '', 'error' => $login_error); + } + $dbh = DB::connect(); $userID = valid_user($_REQUEST['user']); diff --git a/web/lib/config.inc.php.proto b/web/lib/config.inc.php.proto index 1fe7dbc..0422ac5 100644 --- a/web/lib/config.inc.php.proto +++ b/web/lib/config.inc.php.proto @@ -59,3 +59,6 @@ $USE_VIRTUAL_URLS = true; # Maximum number of package results to return through an RPC connection. # Avoid setting this too high and having a PHP too much memory error. $MAX_RPC_RESULTS = 5000; + +# Prevent a list of remote addresses from logging in and creating new accounts. +$BANNED_IPS = array(); -- 1.8.2.480.g556678c

4 7

[aur-dev] [PATCH] Return 404 error page if invalid package ID is used
by Lukas Fleischer 21 Mar '13

21 Mar '13

We already display the 404 error page if someone tries to access an invalid package via virtual URLs ("/packages/nonexistent"). Add the same check to "web/html/packages.php" to make sure the same error is shown if a user requests package details of a nonexistent package ID via legacy URLs ("/packages.php?ID=-1"). Signed-off-by: Lukas Fleischer <archlinux(a)cryptocrack.de> --- web/html/packages.php | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/web/html/packages.php b/web/html/packages.php index c1e54e1..a4a480c 100644 --- a/web/html/packages.php +++ b/web/html/packages.php @@ -18,6 +18,12 @@ if (!isset($pkgid) || !isset($pkgname)) { } else { unset($pkgid, $pkgname); } + + if (isset($pkgid) && ($pkgid == 0 || $pkgid == NULL || $pkgname == NULL)) { + header("HTTP/1.0 404 Not Found"); + include "./404.php"; + return; + } } # Set the title to the current query and get package details if required -- 1.8.2.480.g556678c

1 0

[aur-dev] [PATCH] Display user's IP address on their user profile page
by canyonknight 19 Mar '13

19 Mar '13

The IP address is only visible to Trusted Users and Developers. Signed-off-by: canyonknight <canyonknight(a)gmail.com> --- web/template/account_details.php | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/web/template/account_details.php b/web/template/account_details.php index fdebfb3..9f7e578 100644 --- a/web/template/account_details.php +++ b/web/template/account_details.php @@ -43,6 +43,14 @@ <?= $row["LastVoted"] ? date("Y-m-d", $row["LastVoted"]) : __("Never"); ?> </td> </tr> + + <?php if ($atype == "Trusted User" || $atype == "Developer"): ?> + <tr> + <th><?= __("Last Login IP Address") . ":" ?></th> + <td><?= long2ip($row["LastLoginIPAddress"]); ?></td> + </tr> + <?php endif; ?> + <tr> <th>Links:</th> <td> -- 1.8.2

1 0