<?php set_include_path(get_include_path() . PATH_SEPARATOR . '../template'); header('Content-Type: text/html; charset=utf-8'); header('Cache-Control: no-cache, must-revalidate'); header('Expires: Tue, 11 Oct 1988 22:00:00 GMT'); // quite a special day header('Pragma: no-cache'); include_once("version.inc"); include_once("config.inc"); include_once("aur_po.inc"); // TODO: remove this, move translations over for login form include_once("index_po.inc"); include_once("acctfuncs.inc"); # TODO do we need to set the domain on cookies? I seem to remember some # security concerns about not using domains - but it's not like # we really care if another site can see what language/SID a user # is using... # # return an array of info for each Trusted user # function getTrustedUsers() { $tus = array(); $dbh = db_connect(); $q = "SELECT * FROM Users WHERE AccountTypeID = 2 "; $q.= "ORDER BY Username ASC"; $result = db_query($q, $dbh); if ($result) { while ($row = mysql_fetch_assoc($result)) { $tus[$row["ID"]] = $row; } } return $tus; } # return an array of info for each Developer # function getDevelopers() { $devs = array(); $dbh = db_connect(); $q = "SELECT * FROM Users WHERE AccountTypeID = 3 "; $q.= "ORDER BY Username ASC"; $result = db_query($q, $dbh); if ($result) { while ($row = mysql_fetch_assoc($result)) { $devs[$row["ID"]] = $row; } } return $devs; } # return an array of info for each user function getUsers() { $users = array(); $dbh = db_connect(); $q = "SELECT * FROM Users ORDER BY Username ASC"; $result = db_query($q, $dbh); if ($result) { while ($row = mysql_fetch_assoc($result)) { $users[$row["ID"]] = $row; } } return $users; } # see if the visitor is already logged in # function check_sid() { global $_COOKIE; global $LOGIN_TIMEOUT; if (isset($_COOKIE["AURSID"])) { $failed = 0; # the visitor is logged in, try and update the session # $dbh = db_connect(); $q = "SELECT LastUpdateTS, UNIX_TIMESTAMP() FROM Sessions "; $q.= "WHERE SessionID = '" . mysql_real_escape_string($_COOKIE["AURSID"]) . "'"; $result = db_query($q, $dbh); if (mysql_num_rows($result) == 0) { # Invalid SessionID - hacker alert! # $failed = 1; } else { $row = mysql_fetch_row($result); if ($row[0] + $LOGIN_TIMEOUT <= $row[1]) { $failed = 2; } } if ($failed == 1) { # clear out the hacker's cookie, and send them to a naughty page # why do you have to be so harsh on these people!? # setcookie("AURSID", "", time() - (60*60*24*30), "/"); unset($_COOKIE['AURSID']); } elseif ($failed == 2) { # visitor's session id either doesn't exist, or the timeout # was reached and they must login again, send them back to # the main page where they can log in again. # $q = "DELETE FROM Sessions WHERE SessionID = '"; $q.= mysql_real_escape_string($_COOKIE["AURSID"]) . "'"; db_query($q, $dbh); setcookie("AURSID", "", time() - (60*60*24*30), "/"); unset($_COOKIE['AURSID']); } else { # still logged in and haven't reached the timeout, go ahead # and update the idle timestamp # $q = "UPDATE Sessions SET LastUpdateTS = UNIX_TIMESTAMP() "; $q.= "WHERE SessionID = '".mysql_real_escape_string($_COOKIE["AURSID"])."'"; db_query($q, $dbh); } } return; } # verify that an email address looks like it is legitimate # function valid_email($addy) { return eregi("^[a-z0-9\._-]+@+[a-z0-9\._-]+\.+[a-z]{2,4}$", $addy); } # a new seed value for mt_srand() # function make_seed() { list($usec, $sec) = explode(' ', microtime()); return (float) $sec + ((float) $usec * 10000); } # generate a (hopefully) unique session id # function new_sid() { mt_srand(make_seed()); $ts = time(); $pid = getmypid(); $rand_num = mt_rand(); mt_srand(make_seed()); $rand_str = substr(md5(mt_rand()),2, 20); $id = $rand_str . strtolower(md5($ts.$pid)) . $rand_num; return strtoupper(md5($id)); } # obtain the username if given their Users.ID # function username_from_id($id="") { if (!$id) { return ""; } $dbh = db_connect(); $q = "SELECT Username FROM Users WHERE ID = " . mysql_real_escape_string($id); $result = db_query($q, $dbh); if (!$result) { return "None"; } $row = mysql_fetch_row($result); return $row[0]; } # obtain the username if given their current SID # function username_from_sid($sid="") { if (!$sid) { return ""; } $dbh = db_connect(); $q = "SELECT Username "; $q.= "FROM Users, Sessions "; $q.= "WHERE Users.ID = Sessions.UsersID "; $q.= "AND Sessions.SessionID = '" . mysql_real_escape_string($sid) . "'"; $result = db_query($q, $dbh); if (!$result) { return ""; } $row = mysql_fetch_row($result); return $row[0]; } # obtain the email address if given their current SID # function email_from_sid($sid="") { if (!$sid) { return ""; } $dbh = db_connect(); $q = "SELECT Email "; $q.= "FROM Users, Sessions "; $q.= "WHERE Users.ID = Sessions.UsersID "; $q.= "AND Sessions.SessionID = '" . mysql_real_escape_string($sid) . "'"; $result = db_query($q, $dbh); if (!$result) { return ""; } $row = mysql_fetch_row($result); return $row[0]; } # obtain the account type if given their current SID # Return either "", "User", "Trusted User", "Developer" # function account_from_sid($sid="") { if (!$sid) { return ""; } $dbh = db_connect(); $q = "SELECT AccountType "; $q.= "FROM Users, AccountTypes, Sessions "; $q.= "WHERE Users.ID = Sessions.UsersID "; $q.= "AND AccountTypes.ID = Users.AccountTypeID "; $q.= "AND Sessions.SessionID = '" . mysql_real_escape_string($sid) . "'"; $result = db_query($q, $dbh); if (!$result) { return ""; } $row = mysql_fetch_row($result); return $row[0]; } # obtain the Users.ID if given their current SID # function uid_from_sid($sid="") { if (!$sid) { return ""; } $dbh = db_connect(); $q = "SELECT Users.ID "; $q.= "FROM Users, Sessions "; $q.= "WHERE Users.ID = Sessions.UsersID "; $q.= "AND Sessions.SessionID = '" . mysql_real_escape_string($sid) . "'"; $result = db_query($q, $dbh); if (!$result) { return 0; } $row = mysql_fetch_row($result); return $row[0]; } # connect to the database # function db_connect() { $handle = mysql_pconnect(AUR_db_host, AUR_db_user, AUR_db_pass); if (!$handle) { die("Error connecting to AUR database: " . mysql_error()); } mysql_select_db(AUR_db_name, $handle) or die("Error selecting AUR database: " . mysql_error()); return $handle; } # wrapper function around db_query in case we want to put # query logging/debuggin in. # function db_query($query="", $db_handle="") { if (!$query) { return FALSE; } if (!$db_handle) { $db_handle = db_connect(); } $result = @mysql_query($query, $db_handle); return $result; } # set up the visitor's language # function set_lang() { global $_REQUEST; global $_COOKIE; global $LANG; global $SUPPORTED_LANGS; $update_cookie = 0; if (isset($_REQUEST['setlang'])) { # visitor is requesting a language change # $LANG = $_REQUEST['setlang']; $update_cookie = 1; } elseif (isset($_COOKIE['AURLANG'])) { # If a cookie is set, use that # $LANG = $_COOKIE['AURLANG']; } elseif (isset($_COOKIE["AURSID"])) { $dbh = db_connect(); $q = "SELECT LangPreference FROM Users, Sessions "; $q.= "WHERE Users.ID = Sessions.UsersID "; $q.= "AND Sessions.SessionID = '"; $q.= mysql_real_escape_string($_COOKIE["AURSID"])."'"; $result = db_query($q, $dbh); if (!$result) { $LANG = "en"; } else { $row = mysql_fetch_array($result); $LANG = $row[0]; } $update_cookie = 1; } # Set $LANG to default if nothing is valid. if (!array_key_exists($LANG, $SUPPORTED_LANGS)) { $LANG = DEFAULT_LANG; } if ($update_cookie) { setcookie("AURLANG", $LANG, 0, "/"); } return; } # common header # function html_header($title="") { global $_SERVER; global $_COOKIE; global $_POST; global $LANG; global $SUPPORTED_LANGS; $login = try_login(); $login_error = $login['error']; $title = htmlspecialchars($title, ENT_QUOTES); include('header.php'); return; } # common footer # function html_footer($ver="") { include('footer.php'); return; } # check to see if the user can submit a package # function can_submit_pkg($name="", $sid="") { if (!$name || !$sid) {return 0;} $dbh = db_connect(); $q = "SELECT MaintainerUID, DummyPkg "; $q.= "FROM Packages WHERE Name = '".mysql_real_escape_string($name)."'"; $result = db_query($q, $dbh); if (mysql_num_rows($result) == 0) {return 1;} $row = mysql_fetch_row($result); if ($row[1] == "1") { return 1; } $my_uid = uid_from_sid($sid); if ($row[0] == $my_uid) { return 1; } return 0; } # recursive delete directory # function rm_rf($dirname="") { if ($dirname != "") { exec('rm -rf ' . escapeshellcmd($dirname)); } return; } # obtain the uid given a Users.Username # function uid_from_username($username="") { if (!$username) { return ""; } $dbh = db_connect(); $q = "SELECT ID FROM Users WHERE Username = '".mysql_real_escape_string($username) ."'"; $result = db_query($q, $dbh); if (!$result) { return "None"; } $row = mysql_fetch_row($result); return $row[0]; }