external/aurweb
0
0
Fork 0
mirror of https://gitlab.archlinux.org/archlinux/aurweb.git synced 2025-02-03 10:43:03 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Do not allow for overwriting arbitrary packages

Browse source 
A package should only be overwritten if it already belongs to the
package base that is trying to overwrite it.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
This commit is contained in:
Lukas Fleischer 2014-04-05 02:40:16 +02:00
parent afb02a10c6
commit 8921e4deb9
2 changed files with 42 additions and 21 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

44
web/html/pkgsubmit.php
View file

@ -410,33 +410,35 @@ if ($uid):
}
/* Upload PKGBUILD and tarball. */
if (!$error) {
/*
* First, check whether this package already exists and
* whether it can be overwritten.
*/
if (can_submit_pkgbase($pkgbase_name, $_COOKIE["AURSID"])) {
if (file_exists($incoming_pkgdir)) {
/*
* Blow away the existing directory and
* its contents.
*/
rm_tree($incoming_pkgdir);
}
if (!$error && !can_submit_pkgbase($pkgbase_name, $_COOKIE["AURSID"])) {
$error = __( "You are not allowed to overwrite the %s%s%s package.", "<strong>", $pkgbase_name, "</strong>");
}
/*
* The mode is masked by the current umask, so
* not as scary as it looks.
*/
if (!mkdir($incoming_pkgdir, 0777, true)) {
$error = __( "Could not create directory %s.", $incoming_pkgdir);
if (!$error) {
foreach ($pkginfo as $pi) {
if (!can_submit_pkg($pi['pkgname'], $base_id)) {
$error = __( "You are not allowed to overwrite the %s%s%s package.", "<strong>", $pi['pkgname'], "</strong>");
break;
}
} else {
$error = __( "You are not allowed to overwrite the %s%s%s package.", "<strong>", $pkg_name, "</strong>");
}
}
if (!$error) {
/*
* Blow away the existing directory and its contents.
*/
if (file_exists($incoming_pkgdir)) {
rm_tree($incoming_pkgdir);
}
/*
* The mode is masked by the current umask, so not as
* scary as it looks.
*/
if (!mkdir($incoming_pkgdir, 0777, true)) {
$error = __( "Could not create directory %s.", $incoming_pkgdir);
}
if (!chdir($incoming_pkgdir)) {
$error = __("Could not change directory to %s.", $incoming_pkgdir);
}

19
web/lib/aur.inc.php
View file

@ -312,6 +312,25 @@ function can_submit_pkgbase($name="", $sid="") {
return 0;
}
/**
* Determine if a package can be overwritten by some package base
*
* @param string $name Name of the package to be submitted
* @param int $base_id The ID of the package base
*
* @return bool True if the package can be overwritten, false if not
*/
function can_submit_pkg($name, $base_id) {
$dbh = DB::connect();
$q = "SELECT COUNT(*) FROM Packages WHERE ";
$q.= "Name = " . $dbh->quote($name) . " AND ";
$q.= "PackageBaseID <> " . intval($base_id);
$result = $dbh->query($q);
if (!$result) return false;
return ($result->fetchColumn() == 0);
}
/**
* Recursively delete a directory
*