From a8ac2004d3f25877d9e7b4fa58f10009c39f8acf Mon Sep 17 00:00:00 2001 From: Lukas Fleischer Date: Thu, 27 Apr 2017 09:24:11 +0200 Subject: Add support for Terms of Service documents This allows for adding Terms of Service documents to the database that registered users need to accept before using the AUR. A revision field can be used to indicate whether a document was updated. If it is increased, all users are again asked to accept the new terms. Signed-off-by: Lukas Fleischer --- schema/aur-schema.sql | 20 +++++++++++++ upgrading/4.6.0.txt | 20 +++++++++++++ web/html/tos.php | 50 ++++++++++++++++++++++++++++++++ web/lib/acctfuncs.inc.php | 74 +++++++++++++++++++++++++++++++++++++++++++++++ web/lib/aur.inc.php | 23 +++++++++++++++ web/lib/routing.inc.php | 1 + 6 files changed, 188 insertions(+) create mode 100644 web/html/tos.php diff --git a/schema/aur-schema.sql b/schema/aur-schema.sql index e5841652..45272bbe 100644 --- a/schema/aur-schema.sql +++ b/schema/aur-schema.sql @@ -379,3 +379,23 @@ CREATE TABLE Bans ( BanTS TIMESTAMP NOT NULL, PRIMARY KEY (IPAddress) ) ENGINE = InnoDB; + +-- Terms and Conditions +-- +CREATE TABLE Terms ( + ID INTEGER UNSIGNED NOT NULL AUTO_INCREMENT, + Description VARCHAR(255) NOT NULL, + URL VARCHAR(8000) NOT NULL, + Revision INTEGER UNSIGNED NOT NULL DEFAULT 1, + PRIMARY KEY (ID) +) ENGINE = InnoDB; + +-- Terms and Conditions accepted by users +-- +CREATE TABLE AcceptedTerms ( + UsersID INTEGER UNSIGNED NOT NULL, + TermsID INTEGER UNSIGNED NOT NULL, + Revision INTEGER UNSIGNED NOT NULL DEFAULT 0, + FOREIGN KEY (UsersID) REFERENCES Users(ID) ON DELETE CASCADE, + FOREIGN KEY (TermsID) REFERENCES Terms(ID) ON DELETE CASCADE +) ENGINE = InnoDB; diff --git a/upgrading/4.6.0.txt b/upgrading/4.6.0.txt index b051baca..816409d5 100644 --- a/upgrading/4.6.0.txt +++ b/upgrading/4.6.0.txt @@ -15,3 +15,23 @@ UPDATE PackageDepends --- ALTER TABLE PackageComments ADD COLUMN RenderedComment TEXT NOT NULL; --- + +3. Add Terms and AcceptedTerms tables: + +--- +CREATE TABLE Terms ( + ID INTEGER UNSIGNED NOT NULL AUTO_INCREMENT, + Description VARCHAR(255) NOT NULL, + URL VARCHAR(8000) NOT NULL, + Revision INTEGER UNSIGNED NOT NULL DEFAULT 1, + PRIMARY KEY (ID) +) ENGINE = InnoDB; + +CREATE TABLE AcceptedTerms ( + UsersID INTEGER UNSIGNED NOT NULL, + TermsID INTEGER UNSIGNED NOT NULL, + Revision INTEGER UNSIGNED NOT NULL DEFAULT 0, + FOREIGN KEY (UsersID) REFERENCES Users(ID) ON DELETE CASCADE, + FOREIGN KEY (TermsID) REFERENCES Terms(ID) ON DELETE CASCADE +) ENGINE = InnoDB; +--- diff --git a/web/html/tos.php b/web/html/tos.php new file mode 100644 index 00000000..fc5d8765 --- /dev/null +++ b/web/html/tos.php @@ -0,0 +1,50 @@ + +
+

AUR

+ +
+
+

+ ' . username_from_sid($_COOKIE["AURSID"]) . ''); ?> +

+

+ +

+
    + +
  • "> ()
    • + +
+

+ + ]" value="" /> + + +

+

+ " /> +

+
+
+ +
+query($q); + + if ($result) { + return $result->fetchAll(); + } else { + return array(); + } +} + +/* + * Accept a list of given terms. + * + * @param int $uid The ID of the user to accept the terms. + * @param array $termrev An array mapping each term to the accepted revision. + * + * @return void + */ +function accept_terms($uid, $termrev) { + $dbh = DB::connect(); + + $q = "SELECT TermsID, Revision FROM AcceptedTerms "; + $q .= "WHERE UsersID = " . intval($uid); + + $result = $dbh->query($q); + + if (!$result) { + return; + } + + $termrev_update = array(); + while ($row = $result->fetch(PDO::FETCH_ASSOC)) { + $id = $row['TermsID']; + if (!array_key_exists($id, $termrev)) { + continue; + } + if ($row['Revision'] < $termrev[$id]) { + $termrev_update[$id] = $termrev[$id]; + } + } + $termrev_add = array_diff_key($termrev, $termrev_update); + + foreach ($termrev_add as $id => $rev) { + $q = "INSERT INTO AcceptedTerms (TermsID, UsersID, Revision) "; + $q .= "VALUES (" . intval($id) . ", " . intval($uid) . ", "; + $q .= intval($rev) . ")"; + $dbh->exec($q); + } + + foreach ($termrev_update as $id => $rev) { + $q = "UPDATE AcceptedTerms "; + $q .= "SET Revision = " . intval($rev) . " "; + $q .= "WHERE TermsID = " . intval($id) . " AND "; + $q .= "UsersID = " . intval($uid); + $dbh->exec($q); + } +} diff --git a/web/lib/aur.inc.php b/web/lib/aur.inc.php index 063de8fc..ce569ea7 100644 --- a/web/lib/aur.inc.php +++ b/web/lib/aur.inc.php @@ -22,6 +22,7 @@ include_once('timezone.inc.php'); set_tz(); check_sid(); +check_tos(); /** * Check if a visitor is logged in @@ -91,6 +92,28 @@ function check_sid() { return; } +/** + * Redirect user to the Terms of Service agreement if there are updated terms. + * + * @return void + */ +function check_tos() { + if (!isset($_COOKIE["AURSID"])) { + return; + } + + $path = $_SERVER['PATH_INFO']; + $route = get_route($path); + if (!$route || $route == "tos.php") { + return; + } + + if (count(fetch_updated_terms(uid_from_sid($_COOKIE["AURSID"]))) > 0) { + header('Location: ' . get_uri('/tos')); + exit(); + } +} + /** * Verify the supplied CSRF token matches expected token * diff --git a/web/lib/routing.inc.php b/web/lib/routing.inc.php index 8c45c626..7d9750a0 100644 --- a/web/lib/routing.inc.php +++ b/web/lib/routing.inc.php @@ -16,6 +16,7 @@ $ROUTES = array( '/passreset' => 'passreset.php', '/rpc' => 'rpc.php', '/rss' => 'rss.php', + '/tos' => 'tos.php', '/tu' => 'tu.php', '/addvote' => 'addvote.php', ); -- cgit v1.2.3-24-g4f1b