Commit graph

3267 commits

Author SHA1 Message Date
Lukas Fleischer
668826226a Release 1.8.2.
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-04-10 15:38:28 +02:00
Cédric Girard
77149ad011 Fix French translation.
* Translation of "notify" has been changed to the literal translation
  "notifier" which seems more appropriate (cf. recent thread on
  AUR-general)

* Uniformization of the translation of "flag"

* Addition of "TU" besides the translation of Trusted User as user may
  not understand that Trusted User and "Utilisateur de confiance" are
  the same thing

* Some capitalization correction (in French you don't put capital
  letters in the middle of a sentence as you do eg for title in
  English).

* "unsupported" translation has been replaced by "unsupported" (with
  quotes) as it makes no sense to translate it

* "Safe" translation has been replaced by "sûr" has it seems more
  appropriate than "sain" (sane)

Lukas: Added translator to "AUTHORS".

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-04-07 00:36:49 +02:00
Lukas Fleischer
5df16bf3c0 Merge branch 'wip' 2011-04-06 21:50:58 +02:00
Wieland Hoffmann
feff71ddfe Update the german translation
Lukas: Added missing translations strings. Added translator to
"AUTHORS".

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-04-06 21:42:59 +02:00
Lukas Fleischer
a5213daaec Make "Exact name" search option translatable.
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-04-06 19:29:35 +02:00
Lukas Fleischer
1c55e6b40c Add option to search for exact name matches only (fixes FS#23556).
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-04-06 19:21:19 +02:00
Lukas Fleischer
8cd2aef50d Initialize "$name" in pkgname_from_id().
Ensures "$name" is always initialized, even if the package doesn't
exist. Fixes PHP warnings appearing when retrieving package details of a
package with an invalid ID.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-04-05 11:38:43 +02:00
Lukas Fleischer
8b4b2d207e Remove File_Find PEAR module from code base.
We removed the code depending on this a long time ago - drop it and add
some note to "UPGRADING".

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-04-05 11:31:12 +02:00
Lukas Fleischer
d142ca4053 Fix PHP warning when browsing a non-existent package.
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-04-04 23:31:19 +02:00
Dan McGee
2005a2889c Add more stats to the front page table
Signed-off-by: Dan McGee <dan@archlinux.org>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-04-03 22:59:33 +02:00
Dan McGee
79ce38d271 Add indentation to stats table
Signed-off-by: Dan McGee <dan@archlinux.org>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-04-03 22:59:32 +02:00
Dan McGee
7c91c59245 Remove Dummy Package concept
Instead, we just store dependencies directly in the PackageDepends
table. Since we don't use this info anywhere besides the package details
page, there is little value in precalculating what is in the AUR vs.
what is not.

An upgrade path is provided via several SQL statements in the UPGRADING
document. There should be no user-visible change from this, but the DB
schema gets a bit more sane and we no longer have loads of junk packages
in our tables that are never shown to the end user. This should also
help the MySQL query planner in several cases as we no longer have to be
careful to exclude dummy packages on every query.

Signed-off-by: Dan McGee <dan@archlinux.org>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-04-03 22:59:32 +02:00
Dan McGee
1f252eba64 Always set ModifiedTS including new packages
Set it equal to the SubmittedTS field, which will be our indication the
package is new when we show the logo on the front page of the AUR.

This results in the ability to remove the use of the unindexable
GREATEST() function from the AUR code everywhere we had to use it before
to handle the 0 timestamp case.

Note that there is no race condition here in calling UNIX_TIMESTAMP()
twice- it always returns the time at the beginning of statment
execution:

    mysql> select unix_timestamp(), sleep(2), unix_timestamp();
    +------------------+----------+------------------+
    | unix_timestamp() | sleep(2) | unix_timestamp() |
    +------------------+----------+------------------+
    |       1300851746 |        0 |       1300851746 |
    +------------------+----------+------------------+
    1 row in set (2.00 sec)

Signed-off-by: Dan McGee <dan@archlinux.org>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-04-03 22:59:31 +02:00
Dan McGee
1128489bd0 Submission process code refactor
We had a ton of duplicate code shared between the insert and update
cases. Do a refactor so we can pull this stuff out below the if/else
block and only need it there once, saving some headaches.

Signed-off-by: Dan McGee <dan@archlinux.org>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-04-03 22:59:31 +02:00
Lukas Fleischer
a427bd72a7 Be more restrictive with source tarball contents.
Reject tarballs containing more than one directory or files outside a
directory.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-03-30 20:49:21 +02:00
Lukas Fleischer
0a625ae8ff Fix XSS vulnerability in "web/template/header.php".
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-03-30 17:07:27 +02:00
Lukas Fleischer
746c2b72b5 Fix PHP notice when submitting an empty file.
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-03-30 16:16:27 +02:00
Lukas Fleischer
e4130fcca6 Fix strict standards warnings in "web/html/pkgsubmit.php".
end() expects a reference but we pass a function return value here.
Using list() is a bit hacky as well as it expects a 0-based array
whereas unpack() returns a 1-based array - thus we use "list(, $foo)".

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-03-30 12:28:17 +02:00
Lukas Fleischer
47faf88f14 Check if submitted files are in GZIP format.
This is quite hacky but this way we can ensure users get comprehensible
error messages when trying to upload ".tar.xz" or ".tar.bz2" files.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-03-30 11:55:32 +02:00
Lukas Fleischer
2eb45e7d9e Fix XSS vulnerabilities in "web/html/voters.php".
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-03-30 11:10:16 +02:00
Lukas Fleischer
55eb55a75f Fix PHP undefined notice in "web/html/packages.php".
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-03-30 11:06:20 +02:00
Lukas Fleischer
3aa2240b7d Fix XSS vulnerabilities in package comment templates.
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-03-30 10:49:51 +02:00
Lukas Fleischer
11366b8a1a gendummydata.py: Do not touch output file until we need it.
Ensures there's no leftover (empty) file if something during
initialization fails.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-03-30 10:27:23 +02:00
Dan McGee
b6a34d013b Bump up default per-page value to 50
25 is woefully small for the number of packages many searches can
return, and with 28000+ packages in AUR, it makes sense to show a lot
more per page by default.

The new choices of (50, 100, 250) happen to match those from the main
site.

Signed-off-by: Dan McGee <dan@archlinux.org>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-03-24 15:32:08 +01:00
Dan McGee
044393c44b Fix main site package search URL
I've been wanting to kill this one for a long time.

Signed-off-by: Dan McGee <dan@archlinux.org>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-03-15 15:46:10 +01:00
Lukas Fleischer
bd36412321 Fix searching for orphans with "$LANG != 'en'" (fixes FS#23252).
Regression introduced in commit ef8fab0c. Removed the strict check again
instead of wrapping it in __() to ensure search URLs are language
independent.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-03-12 19:54:35 +01:00
Lukas Fleischer
9b112a56d0 Fix XSS vulnerability in package search results and package details.
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-03-11 19:15:04 +01:00
Lukas Fleischer
7f9e498e48 Fix broken XHTML.
Fix a lot of invalid XHTML in the templates and actions. There might
still be some legacy code left, but this should cover most of it.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-03-11 19:00:50 +01:00
Dan McGee
c34bebf428 Perform a second query to find total search count
This removes the need for SQL_CALC_FOUND_ROWS which can really slow down
queries in a lot of cases. The COUNT(*) query we end up performing can
reuse a lot of the original clauses from our primary query, but we can
really slim it up by omitting some joins and the sorting/limiting
clauses.

Signed-off-by: Dan McGee <dan@archlinux.org>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-03-10 18:16:00 +01:00
Dan McGee
2cfcddf24e Split package search query into parts
No functional change here; we should be rebuilding the same query at the
end of the process.

Signed-off-by: Dan McGee <dan@archlinux.org>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-03-10 18:16:00 +01:00
Dan McGee
80401c6afc More PHP Notice undefined fixups
Signed-off-by: Dan McGee <dan@archlinux.org>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-03-10 18:15:59 +01:00
Lukas Fleischer
29b2f3b399 Release 1.8.1.
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-03-09 17:44:21 +01:00
Dan McGee
171e297e5f Fix outdated link in My Statistics pane
Regression introduced in commit c39183c3ee.

Signed-off-by: Dan McGee <dan@archlinux.org>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-03-04 10:29:18 +01:00
Dan McGee
d186bcfd89 Add a sanitize_ids function and use it in all pkg_* functions
And use implode() instead of some looping/first time logic.

Signed-off-by: Dan McGee <dan@archlinux.org>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-03-04 10:29:18 +01:00
Dan McGee
d4b1ca7cf1 Set a default timezone
With our use of strtotime() in stats.inc, we are "required" to do so or at
least the emitted warning tells us it is a good idea.

Signed-off-by: Dan McGee <dan@archlinux.org>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-03-04 10:29:17 +01:00
Dan McGee
cdc01130cf Fix PHP notices in account pages
Signed-off-by: Dan McGee <dan@archlinux.org>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-03-04 10:29:17 +01:00
Dan McGee
ddbe6d0d33 Remove dead dependency/required by link code
For some reason we were doing this song and dance "iterate all the known
parameters" business. This is totally unnecessary, clutters the links,
and was spewing errors all over the place, so kill it.

Signed-off-by: Dan McGee <dan@archlinux.org>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-03-04 10:29:17 +01:00
Dan McGee
ef8fab0c12 Ensure all variables are set in package search form
Signed-off-by: Dan McGee <dan@archlinux.org>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-03-04 10:29:16 +01:00
Dan McGee
3d5b735fae Fix PHP notices in pkg_search_form
If we were displaying this without coming from a previous query submit,
notices were emitted all over the place. Fix them by adding an isset()
first to each variable we try to access.

Signed-off-by: Dan McGee <dan@archlinux.org>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-03-04 10:29:16 +01:00
Dan McGee
f4fd7f7c9b Fix PHP notice: requiredby array
Required by query does not have a dep condition element.

Signed-off-by: Dan McGee <dan@archlinux.org>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-03-04 10:29:16 +01:00
Dan McGee
9b51f2d842 Fix main site URL
Signed-off-by: Dan McGee <dan@archlinux.org>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-03-04 10:29:15 +01:00
Dan McGee
d1d0288598 Add action lookup helper function
Signed-off-by: Dan McGee <dan@archlinux.org>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-03-04 10:29:15 +01:00
Dan McGee
bbc90846f5 Ensure all package ID values are coerced to integers
We don't need mysql_real_escape_string(), we need valid integer
conversions.

Signed-off-by: Dan McGee <dan@archlinux.org>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-03-04 10:29:15 +01:00
Dan McGee
0e30410767 Vastly simplify pkg_delete function
Since only TUs/Devs can delete packages, we can remove almost all checks
except the account type check. And now that our DB uses foreign keys,
all of the other deletes happen implicitly when a package is deleted so
we don't need to take care of it here.

Signed-off-by: Dan McGee <dan@archlinux.org>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-03-04 10:29:14 +01:00
Dan McGee
f9eba12312 Ensure users can be deleted when foreign keys are present
This change is necessary to prevent this:
    mysql> delete from Users where ID = 112;
    ERROR 1451 (23000): Cannot delete or update a parent row: a foreign key constraint fails (`aur`.`Packages`, CONSTRAINT `Packages_ibfk_2` FOREIGN KEY (`SubmitterUID`) REFERENCES `Users` (`ID`) ON DELETE NO ACTION)

As a bonus, due to foreign keys, orphaning of packages will be
automatic.

Signed-off-by: Dan McGee <dan@archlinux.org>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-03-04 10:29:14 +01:00
Dan McGee
abd41bbb51 Allow DB connection values to come from the environment
Stop hardcoding everything everywhere for those of us that don't use the
localhost/aur/aur/AUR setup. Also allow for the dummy data to be created
in the reload script if it does not exist. Finally, remove two
assumptions that the AUR database already exists.

Signed-off-by: Dan McGee <dan@archlinux.org>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-03-04 10:29:14 +01:00
Dan McGee
b9690972d0 Use a single transaction to write dummy data
This is immensely faster when using InnoDB since we don't need to sync
after each and every INSERT statement.

Signed-off-by: Dan McGee <dan@archlinux.org>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-03-04 10:29:13 +01:00
Dan McGee
fcaee28818 Small template cleanup
Signed-off-by: Dan McGee <dan@archlinux.org>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-03-04 10:29:13 +01:00
Dan McGee
984ce9529c Improve cookie handling
* Remove comment that is mostly bogus- the domain is automatically set.
* When logging out, don't delete the language cookie.
* Make the language cookie persistent.
* Use the minimal time possible to expire cookies; no need to compute
  anything.

Signed-off-by: Dan McGee <dan@archlinux.org>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-03-04 10:29:13 +01:00
Dan McGee
90485e8f42 Fix potential injection vulnerability
We trusted the values we pulled out of the IDs array and never coerced
them to integers, passing them to the backend unescaped and uncasted.
Ensure they are treated as integers only and validate the resulting
value is > 0.

Signed-off-by: Dan McGee <dan@archlinux.org>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2011-03-01 20:27:49 +01:00