external/aurweb
0
0
Fork 0
mirror of https://gitlab.archlinux.org/archlinux/aurweb.git synced 2025-02-03 10:43:03 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Sanitize merge base name in pkgreq_file()

Browse source 
Move the check introduced in 06b7099 (Validate package base name when
filing requests, 2014-07-02) from pkgbase.php to pkgreq_file().

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
This commit is contained in:
Lukas Fleischer 2014-07-03 10:32:31 +02:00
parent 87215cef00
commit b113764b0b
2 changed files with 5 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
web/html/pkgbase.php
View file

@ -98,12 +98,7 @@ if (check_token()) {
} elseif (current_action("do_ChangeCategory")) { } elseif (current_action("do_ChangeCategory")) {
list($ret, $output) = pkgbase_change_category($base_id, $atype); list($ret, $output) = pkgbase_change_category($base_id, $atype);
} elseif (current_action("do_FileRequest")) { } elseif (current_action("do_FileRequest")) {
if (empty($_POST['merge_into']) || preg_match("/^[a-z0-9][a-z0-9\.+_-]*$/", $_POST['merge_into'])) {
list($ret, $output) = pkgreq_file($ids, $_POST['type'], $_POST['merge_into'], $_POST['comments']); list($ret, $output) = pkgreq_file($ids, $_POST['type'], $_POST['merge_into'], $_POST['comments']);
} else {
$output = __("Invalid name: only lowercase letters are allowed.");
$ret = false;
}
} elseif (current_action("do_CloseRequest")) { } elseif (current_action("do_CloseRequest")) {
list($ret, $output) = pkgreq_close($_POST['reqid'], $_POST['reason'], $_POST['comments']); list($ret, $output) = pkgreq_close($_POST['reqid'], $_POST['reason'], $_POST['comments']);
} }

4
web/lib/pkgreqfuncs.inc.php
View file

@ -72,6 +72,10 @@ function pkgreq_file($ids, $type, $merge_into, $comments) {
global $AUR_LOCATION; global $AUR_LOCATION;
global $AUR_REQUEST_ML; global $AUR_REQUEST_ML;
if (!empty($merge_into) && !preg_match("/^[a-z0-9][a-z0-9\.+_-]*$/", $merge_into)) {
return array(false, __("Invalid name: only lowercase letters are allowed."));
}
if (empty($comments)) { if (empty($comments)) {
return array(false, __("The comment field must not be empty.")); return array(false, __("The comment field must not be empty."));
} }