Age | Commit message (Collapse) | Author | Files | Lines |
|
Signed-off-by: Jelle van der Waa <jelle@vdwaa.nl>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
It is now possible to search for packages that depend on a given package,
for instance:
/rpc/?v=5&type=search&by=depends&arg=ocaml
It is similarly possible to match on "makedepends", "checkdepends" and
"optdepends".
Signed-off-by: Baptiste Jonglez <git@bitsofnetworks.org>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
Implements FS#53832.
Signed-off-by: Mark Weiman <mark.weiman@markzz.com>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
This allows us to prevent users from hammering the API every few seconds
to check if any of their packages were updated. Real world users check
as often as every 5 or 10 seconds.
Signed-off-by: Florian Pritz <bluewind@xinu.at>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
For some reason, running the SELECT .. WHERE .. OR .. query takes e.g.
58ms on a randomly generated db for some dependency name. Splitting the
OR into two dedicated queries and UNIONing the result takes only 0.42ms.
On the Arch Linux installation, searching for the providers of e.g.
mongodb takes >=110ms when not cached by the query cache. The new query
takes <1ms even when not cached.
Signed-off-by: Florian Pritz <bluewind@xinu.at>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
In commit 8c98db0b82cc85a4498589e5d60299fefd93b421 support was added for
package co-maintainers to pin comments in addition to maintainers.
Due to a typo, the SQL query was reset halfway through and only added
the co-maintainer IDs to the list of allowed users.
Fixes FS#56783.
Signed-off-by: Eli Schwartz <eschwartz@archlinux.org>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
Since commit 4efba18 (Only allow valid HTTP(s) URLs as home page,
2017-11-05), the home page field in the account settings must be a valid
URL. However, this new check prevents from leaving the field empty. Keep
the check in place but skip it if the home page field is left empty.
Fixes FS#56550.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
This partially fixes FS#56472.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
A bug introduced in commit 7d7e079 (Hide the table sorting links on the
dashboard, 2017-02-04) resulted in multiple clicks on a table heading in
the package search results table no longer having any effect, instead of
changing the sorting order. Fix this by removing erroneous spaces from
the GET parameters in the search URL.
Fixes FS#56261.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
Implements FS#56255.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
Replace special characters in the referer GET parameter using
htmlspecialchars() before inserting it into the login form fields to
prevent from XSS attacks.
Fixes FS#55286.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
The home page specified in the account settings is converted to a
clickable link on the user's profile. Make sure it is a valid URL which
uses the http or https scheme.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
Do not allow to render aurweb pages in a frame to protect against
clickjacking.
Fixes FS#56168.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
When removing an account, remove the user from all last packager fields
before deletion to make sure that no package bases are deleted, even if
propagation constraints are missing.
Fixes FS#53956.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
This allows for adding Terms of Service documents to the database that
registered users need to accept before using the AUR. A revision field
can be used to indicate whether a document was updated. If it is
increased, all users are again asked to accept the new terms.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
Instead of calling check_sid() from every single PHP script representing
a web page, add the call to aur.inc.php which is sourced by all of them.
Also, remove set_lang() calls from the scripts since these are also
already included in aur.inc.php.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
In commit 4abde89 (Use JavaScript to collapse long comments,
2017-04-19), support for collapsing/expanding long comments was added.
This was broken by the recent Markdown support since comments no longer
live inside a single HTML paragraph. Fix this by wrapping each comment
in another div container.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
Instead of converting package comments from plain text to HTML code when
they are displayed, do the conversion when the comment is posted and
store the rendered result in the database. The conversion itself is done
by a Python script which uses Bleach for sanitizing the text.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
Instead of using CSS to limit the height of package comments as
implemented in 7b13203 (Limit comment height to 15 lines, 2016-03-12),
use JavaScript to collapse long comments and add a link to expand them.
Clicking the same link twice results in the corresponding comment being
collapsed again.
If JavaScript is disabled, the full comments are shown (without any
possibility to collapse or expand).
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
Split optional dependency descriptions from dependency names before
storing them in the database and use a separate column to store the
descriptions.
This allows us to simplify and optimize the SQL queries in
pkg_dependencies() as well as pkg_required().
Suggested-by: Florian Pritz <bluewind@xinu.at>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
Make sure that the get_extended_fields() invocation succeeded before
merging regular and extended fields in process_query().
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
Instead of unconditionally calling fetch on the return value of query(),
error out early if the value evaluates to false.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
Instead of unconditionally calling fetch on the return value of query(),
error out early if the value evaluates to false. Also, make sure that
the results array is always initialized, even if the result set is
empty.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
Instead of unconditionally calling fetch on the return value of query(),
error out early if the value evaluates to false.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
Do not trigger a PHP warning if there are no votes to be added or
removed.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
Only show the comment paragraph if the package base is actually flagged
out-of-date.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
The variable $action is always undefined in pkgbase_delete() which makes
the if-statement always true and triggers a warning whenever a package
base is removed.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
In commit e171f6f (Migrate all DB code to use PDO, 2012-08-08),
PDOStatement::fetchAll() was introduced as a drop-in replacement for
mysql_fetch_array(). However, PDOStatement::fetchAll() returns a list of
all results while mysql_fetch_array() returns a single result only.
Instead of adding the missing indirection, simplify the code by using
PDO::fetchColumn().
Also add some safeguards to prevent warnings if the result set returned
by the query is empty.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
The SQL query retrieving the time zone from the database may return an
empty result set if the session timeout was reached. Handle such cases
gracefully by leaving the timezone variable unset.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
Drop the fragment part of the redirection code which is an artifact of
the original code copy-pasted in commit ca954fe (Do not redirect when
showing errors during flagging, 2015-10-21).
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
The $salt variable is no longer needed as of 29a4870 (Use bcrypt to hash
passwords, 2017-02-24).
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
The pkgbuild_uri option was replaced by source_file_uri in 9df1bd5 (Add
direct links to each source file, 2017-02-12). Change one remaining
reference to pkgbuild_uri accordingly.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
Fixes a regression introduced in 608c483 (Add user set timezones,
2017-01-20).
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
Display a message that no requests matched the filter criteria instead
of showing an empty package requests table.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
Replace the default hash function used for storing passwords by
password_hash() which internally uses bcrypt. Legacy MD5 hashes are
still supported and are immediately converted to the new format when a
user logs in.
Since big parts of the authentication system needed to be rewritten in
this context, this patch also includes some simplification and
refactoring of all code related to password checking and resetting.
Fixes FS#52297.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|
|
Do not overwrite the $uid variable when updating co-maintainers.
Fixes FS#52225.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
|