Merge branch 'maint'

Conflicts:
	web/html/account.php
	web/html/addvote.php
	web/html/pkgsubmit.php
	web/lib/acctfuncs.inc.php
	web/template/actions_form.php
	web/template/pkg_comment_form.php
	web/template/pkg_comments.php
	web/template/pkg_details.php
	web/template/pkg_search_results.php
	web/template/tu_details.php

web/html/account.php

@@ -74,13 +74,13 @@ if (isset($_COOKIE["AURSID"])) {
 	} elseif ($action == "UpdateAccount") {
 		# user is submitting their modifications to an existing account
 		#
+		if (check_token()) {
 			process_account_form($atype, "edit", "UpdateAccount",
 					in_request("U"), in_request("T"), in_request("S"),
 					in_request("E"), in_request("P"), in_request("C"),
 					in_request("R"), in_request("L"), in_request("I"),
 					in_request("K"), in_request("ID"));
-
+		}
-
 	} else {
 		if ($atype == "Trusted User" || $atype == "Developer") {
 			# display the search page if they're a TU/dev

web/html/addvote.php

@@ -19,7 +19,11 @@ if (isset($_COOKIE["AURSID"])) {
 
 if ($atype == "Trusted User" || $atype == "Developer") {
 
-	if (!empty($_POST['addVote'])) {
+	if (!empty($_POST['addVote']) && !check_token()) {
+		$error = __("Invalid token for user action.");
+	}
+
+	if (!empty($_POST['addVote']) && check_token()) {
 		$error = "";
 
 		if (!empty($_POST['user'])) {
@@ -79,6 +83,7 @@ if ($atype == "Trusted User" || $atype == "Developer") {
 		<b><?php print __("Proposal") ?></b><br />
 		<textarea name="agenda" rows="15" cols="80"><?php if (!empty($_POST['agenda'])) { print htmlentities($_POST['agenda']); } ?></textarea><br />
 		<input type="hidden" name="addVote" value="1" />
+		<input type="hidden" name="token" value="<?php print htmlspecialchars($_COOKIE['AURSID']) ?>" />
 		<input type="submit" class="button" value="<?php print __("Submit"); ?>" />
 		</p>
 	</form>

web/html/packages.php

@@ -38,6 +38,7 @@ if (isset($_POST['IDs'])) {
 
 # Determine what action to do
 $output = "";
+if (check_token()) {
 	if (current_action("do_Flag")) {
 		$output = pkg_flag($atype, $ids, true);
 	} elseif (current_action("do_UnFlag")) {
@@ -79,6 +80,7 @@ if (current_action("do_Flag")) {
 	} elseif (current_action("do_ChangeCategory")) {
 		$output = pkg_change_category($atype);
 	}
+}
 
 html_header($title);
 ?>

web/html/pkgsubmit.php

@@ -27,6 +27,11 @@ if ($uid):
 
 	if (isset($_REQUEST['pkgsubmit'])) {
 
+		# Make sure authenticated user submitted the package themselves
+		if (!check_token()) {
+			$error = __("Invalid token for user action.");
+		}
+
 		# Before processing, make sure we even have a file
 		switch($_FILES['pfile']['error']) {
 			case UPLOAD_ERR_INI_SIZE:
@@ -428,6 +433,7 @@ html_header("Submit");
 	<fieldset>
 		<div>
 			<input type="hidden" name="pkgsubmit" value="1" />
+			<input type="hidden" name="token" value="<?php print htmlspecialchars($_COOKIE['AURSID']) ?>" /> </div>
 		</div>
 		<p>
 			<label for="id_category"><?php print __("Package Category"); ?>:</label>

web/html/tu.php

@@ -49,7 +49,7 @@ if ($atype == "Trusted User" || $atype == "Developer") {
 				}
 
 				if ($canvote == 1) {
-					if (isset($_POST['doVote'])) {
+					if (isset($_POST['doVote']) && check_token()) {
 						if (isset($_POST['voteYes'])) {
 							$myvote = "Yes";
 						} else if (isset($_POST['voteNo'])) {

web/lib/acctfuncs.inc.php

@@ -624,7 +624,7 @@ function user_suspended($id, $dbh=NULL) {
 	$result = db_query($q, $dbh);
 	if ($result) {
 		$row = mysql_fetch_row($result);
-		if ($result[0] == 1 ) {
+		if ($row[0]) {
 			return true;
 		}
 	}

web/lib/aur.inc.php

@@ -75,6 +75,16 @@ function check_sid($dbh=NULL) {
 	return;
 }
 
+# Verify the supplied token matches the expected token for POST forms
+#
+function check_token() {
+	if (isset($_POST['token'])) {
+		return ($_POST['token'] == $_COOKIE['AURSID']);
+	} else {
+		return false;
+	}
+}
+
 # verify that an email address looks like it is legitimate
 #
 function valid_email($addy) {

web/lib/pkgfuncs.inc.php

@@ -395,7 +395,7 @@ function package_details($id=0, $SID="", $dbh=NULL) {
 			# Actions Bar
 			if ($SID) {
 				include('actions_form.php');
-				if (isset($_REQUEST['comment'])) {
+				if (isset($_REQUEST['comment']) && check_token()) {
 					$uid = uid_from_sid($SID, $dbh);
 					add_package_comment($id, $uid, $_REQUEST['comment'], $dbh);
 				}

web/template/account_edit_form.php

@@ -3,6 +3,7 @@
 		<input type="hidden" name="Action" value="<?php echo $A ?>" />
 		<?php if ($UID): ?>
 		<input type="hidden" name="ID" value="<?php echo $UID ?>" />
+		<input type="hidden" name="token" value="<?php print htmlspecialchars($_COOKIE['AURSID']) ?>" /> </div>
 		<?php endif; ?>
 	</fieldset>
 	<table>

web/template/actions_form.php

@@ -3,6 +3,7 @@
 		<fieldset>
 			<input type="hidden" name="IDs[<?php echo $row['ID'] ?>]" value="1" />
 			<input type="hidden" name="ID" value="<?php echo $row['ID'] ?>" />
+			<input type="hidden" name="token" value="<?php echo htmlspecialchars($_COOKIE['AURSID']) ?>" />
 
 		<?php if (user_voted($uid, $row['ID'])): ?>
 			<input type="submit" class="button" name="do_UnVote" value="<?php echo __("UnVote") ?>" />

web/template/pkg_comment_form.php

@@ -3,12 +3,13 @@
 	<form call="general-form" action="<?php echo $_SERVER['REQUEST_URI'] ?>" method="post">
 		<fieldset>
 <?php
-if (isset($_REQUEST['comment'])) {
+if (isset($_REQUEST['comment']) && check_token()) {
 	echo '<p>' . __('Comment has been added.') . '</p>';
 }
 ?>
 			<div>
 				<input type="hidden" name="ID" value="<?php echo intval($_REQUEST['ID']) ?>" />
+				<input type="hidden" name="token" value="<?php echo htmlspecialchars($_COOKIE['AURSID']) ?>" />
 			</div>
 			<p>
 				<label for="id_comment"><?php echo __("Comment") . ':' ?></label>

web/template/pkg_comments.php

@@ -18,6 +18,7 @@ $count = package_comments_count($_GET['ID']);
 					<fieldset style="display:inline;">
 						<input type="hidden" name="action" value="do_DeleteComment" />
 						<input type="hidden" name="comment_id" value="<?php echo $row['ID'] ?>" />
+						<input type="hidden" name="token" value="<?php echo htmlspecialchars($_COOKIE['AURSID']) ?>" />
 						<input type="image" src="images/x.png" alt="<?php echo __('Delete comment') ?> name="submit" value="1" />
 					</fieldset>
 				</form>

web/template/pkg_details.php

@@ -60,6 +60,9 @@ if ($SID && ($uid == $row["MaintainerUID"] ||
 				<form method="post" action="packages.php?ID=<?php echo $pkgid ?>">
 					<div>
 						<input type="hidden" name="action" value="do_ChangeCategory" />
+						<?php if ($SID): ?>
+						<input type="hidden" name="token" value="<?php echo htmlspecialchars($_COOKIE['AURSID']) ?>" />
+						<?php endif; ?>
 						<select name="category_id">
 <?php
 	foreach ($catarr as $cid => $catname):

web/template/pkg_search_results.php

@@ -115,6 +115,7 @@ if (!$result): ?>
 						<input type="text" id="merge_Into" name="merge_Into" />
 						<input type="checkbox" name="confirm_Delete" value="1" /> <?php echo __("Confirm") ?>
 					<?php endif; ?>
+					<input type="hidden" name="token" value="<?php echo htmlspecialchars($_COOKIE['AURSID']) ?>" />
 					<input type="submit" class="button" style="width: 80px" value="<?php echo __("Go") ?>" />
 				</p>
 			<?php endif; # if ($SID) ?>

web/template/tu_details.php

@@ -67,6 +67,7 @@
 			<input type="submit" class="button" name="voteNo" value="<?php print __("No") ?>" />
 			<input type="submit" class="button" name="voteAbstain" value="<?php print __("Abstain") ?>" />
 			<input type="hidden" name="doVote" value="1" />
+			<input type="hidden" name="token" value="<?php echo htmlspecialchars($_COOKIE['AURSID']) ?>" />
 		</fieldset>
 	</form>
 <?php else: