summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)AuthorFilesLines
2020-02-27Properly escape passwords in the account edit formLukas Fleischer1-2/+2
Addresses FS#65639. Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2020-02-26Fix HTML code in the account search results tableLukas Fleischer1-15/+5
Do not add an opening <tbody> tag for every row. Instead, wrap all rows in <tbody></tbody>. While at it, also simplify the code used to color the rows. Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2020-02-26README.md: add references to TransifexLukas Fleischer1-0/+8
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2020-02-26README.md: fix a small typoYaron Shahrabani1-1/+1
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2020-02-13Fix more PHP 7.4 warningsEli Schwartz1-0/+1
The try_login() function documents it returns an array containing an 'error' key, and our only caller *only* consults the 'error' key. Then the function returns null instead of an array, if the login succeeded! I question why we bother returning the new SID if we never use it, surely we could either return the error or return default null. But, for now, I'm just going to fix it to return what it's actually supposed to, without changing the API. Signed-off-by: Eli Schwartz <eschwartz@archlinux.org> Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2020-02-13Fix PHP 7.4 warningsEli Schwartz2-8/+24
If a db query returned NULL instead of an array, then accessing $row[0] now throws a warning. The undocumented behavior of evaluating to NULL is maintained, and we want to return NULL anyway, so add a check for the value and fall back on the default function return type. Signed-off-by: Eli Schwartz <eschwartz@archlinux.org> Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2020-02-11Use relative URIs for {source_file,log,commit}_uriLukas Fleischer1-3/+3
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2020-02-11Make SMTP port and authentication configurableLukas Fleischer2-1/+24
Add more options to configure the smtplib implementation for sending notification emails. The port can be changed using the new smtp-port option. Encryption can be configured using smtp-use-ssl and smtp-use-starttls. Keep in mind that you usually also need to change the port when enabling either of these options. Authentication can be configured using smtp-user and smtp-password. Authentication is disabled if either of these values is empty. Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2020-02-11Support smtplib for sending emailsLukas Fleischer2-5/+20
Support mail delivery without a local MTA. Instead, an SMTP server can now be configured using the smtp-server option in the [notifications] section. In order to use this option, the value of the sendmail option must be empty. Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2020-02-11Update README and convert to Markdown syntaxLukas Fleischer1-26/+8
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2020-02-10Translation updates from TransifexLukas Fleischer29-980/+4002
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2020-02-02rendercomment: use python-markdown's new registration APIFrédéric Mangano-Tarumi2-6/+10
First, this gets rid of the deprecation warnings Python displayed. Second, this fixes the case where a link contained a pair of underscores, which used to be interpreted as an emphasis because the linkify processor ran after the emphasis processor. Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2020-02-02rendercomment: test headings loweringFrédéric Mangano-Tarumi1-0/+26
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2020-02-02rendercomment: safer Flyspray task linkificationFrédéric Mangano-Tarumi2-7/+40
When an FS#123 is part of a code block, it must not be converted into a link. FS#123 may also appear inside an URL, in which case regular linkifaction of URLs must take precedence. Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2020-02-02rendercomment: safer auto-linkification of URLsFrédéric Mangano-Tarumi2-10/+24
Fixes a few edge cases: - URLs within code blocks used to get redundant <> added, breaking bash code snippets like `curl https://...` into `curl <https://...>`. - Links written with markdown's <https://...> syntax also used to get an extra pair of brackets. Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2020-02-02rendercomment: add a test for Git commit linksFrédéric Mangano-Tarumi1-0/+29
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2020-02-02rendercomment: respectful linkification of Git commitsFrédéric Mangano-Tarumi1-16/+20
Turn the git-commits markdown processor into an inline processor, which is smart enough not to convert Git hashes contained in code blocks or links. Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2020-02-02Update message catalogLukas Fleischer1-21/+125
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2020-02-02Explain syntax/features in the comments sectionLukas Fleischer1-0/+4
Addresses FS#64983. Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2020-02-02Explain the hide email address settingLukas Fleischer1-5/+9
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2020-02-02Add support for backup email addressesLukas Fleischer9-14/+47
Support secondary email addresses that can be used to recover an account in case access to the primary email address is lost. Reset keys for an account are always sent to both the primary and the backup email address. Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2020-02-02Add option to send reset key for a given user nameLukas Fleischer2-19/+19
In addition to supporting email addresses in the reset key form, also support user names. The reset key is then sent to the email address in the user's profile. Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2020-01-30Update copyright range in the cgit footerLukas Fleischer1-1/+1
2020-01-30Require password when changing account informationLukas Fleischer4-24/+21
Since commits daee20c (Require current password when setting a new one, 2020-01-30) and 8fc8898 (Require password when deleting an account, 2020-01-30), changing a password and deleting an account require the current password. Extend this to all other profile changes. Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2020-01-30Require password when deleting an accountLukas Fleischer2-6/+22
Further reduce the attack surface in case of a stolen session ID. Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2020-01-30Verify current password against logged in userLukas Fleischer2-7/+6
When changing the password of an account, instead of asking for the old password of the account, ask for the password of the currently logged in user. This allows privileged users to edit other accounts without knowing their passwords. Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2020-01-30Undo accidental code additionLukas Fleischer1-1/+0
Rollback an accidental change that sneaked into commit daee20c (Require current password when setting a new one, 2020-01-30). Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2020-01-30t2500: fix test casesLukas Fleischer1-0/+3
Since commit eeaa1c3 (Separate text from footer in notification emails, 2020-01-04), information about unsubscribing from notifications is added in a signature block. Fix the test cases accordingly. Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2020-01-30Keep signature delimiters intact in notificationsLukas Fleischer1-0/+3
Since commit eeaa1c3 (Separate text from footer in notification emails, 2020-01-04), information about unsubscribing from notifications is added in a signature block. However, the code to format the email body trimmed the RFC 3676 signature delimiter, replacing "-- " by "--". Fix this by adding a special case for signature delimiters. Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2020-01-30Require current password when setting a new oneLukas Fleischer4-14/+36
Prevent from easily taking over an account by changing the password with a stolen session ID. Fixes FS#65325. Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2020-01-06Separate text from footer in notification emailsStephan Springer1-2/+3
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2019-12-11Copy Git repository URL on clickLukas Fleischer2-4/+30
The Git repository URLs are not meant to be visited using a web browser. Copy the link to the clipboard instead. Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2019-11-24.gitignore: add schema/aur-schema-sqlite.sqlLukas Fleischer1-0/+1
The SQLite schema is generated automatically from the main schema and used in the test suite. Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2019-11-23t2500: fix test case for orphan request notificationsLukas Fleischer1-1/+1
Since commit a66c7fa (notify.py: Use a/an correctly when sending request notifications, 2019-08-09), the body of notification emails sent when filing orphan requests refers to "an orphan request" instead of "a orphan request". Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2019-11-23Store timestamp and user ID when closing requestsLukas Fleischer5-6/+21
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2019-11-23Don't require all Python database modules to be installedLukas Fleischer1-2/+9
We support multiple database backends. Don't require Python modules for all backends to be installed. Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2019-11-23Upgrade Sharness to 1.1.0Lukas Fleischer1-40/+153
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2019-11-23git-serve: check update hook permissionsLukas Fleischer2-0/+9
Verify that the update hook exists and is executable before running Git to prevent from broken repositories when permissions are broken. Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2019-11-02aurjson: use APCu/memcached for rate limitingLukas Fleischer1-15/+32
There's no need to use permanent storage for rate limiting information; try to keep it in memory if caching is enabled. From experiments with our live setup, this reduces the number of INSERT/DELETE operations per second from 15 to almost 0. Disk writes on the server hosting the AUR are reduced by 90% (from ~3MB/s to ~300kB/s). Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2019-11-01Document maintenance tasks and internalsLukas Fleischer1-0/+108
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2019-10-27Display popularity with less decimal pointsLukas Fleischer2-2/+2
Limit the display to two decimal points for packages with a popularity of at least 0.2. Suggested-by: Allan McRae <allan@archlinux.org> Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2019-10-19Release 4.8.0v4.8.0origin/maintLukas Fleischer1-1/+1
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2019-10-19Translation updates from TransifexLukas Fleischer6-132/+136
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2019-10-19Sync CSS with archwebLukas Fleischer1-8/+10
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2019-10-09Cache package requirements and sourcesLukas Fleischer1-19/+9
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2019-10-07Make package details cache TTL configurableLukas Fleischer3-7/+15
The TTL for package details can be much longer than for generic values since they never change. Note that when an update is pushed via Git, all packages belonging to that package base are deleted and new packages are created. Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2019-10-07Cache package licenses, groups and relationsLukas Fleischer1-44/+22
Cache more package details if the global caching mechanism is enabled. Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2019-10-06aurjson: cache extended fieldsLukas Fleischer1-13/+4
Cache the results of the extended fields computation if the global caching mechanism is enabled. Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2019-10-06Cache package provider and dependency informationLukas Fleischer2-29/+28
The package provider and dependency queries are quite CPU-intensive and usually yield rather small result sets. Cache these values if the global caching mechanism is enabled. Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
2019-10-05Make CAPTCHA salt invalidation more robustLukas Fleischer1-9/+23
With the previous implementation, unlucky users could have their CAPTCHA be invalidated by a single account creation while filling out their account registration form. Make this more robust by allowing up to five account registrations before rejecting a CAPTCHA salt. Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
generated by cgit v1.2.3-24-g4f1b (git 2.32.0) at 2024-07-01 16:19:36 +0200