Add a new function has_credential() that checks whether the currently
logged in user is allowed to perform a given action. Moving all
permission handling to this central place makes adding new user groups
and adjusting permissions much more convenient.
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
In commit e582cfe (Collapse long dependency lists, 2014-04-18), we added
code to automatically collapse dependency and requirement lists with
more than 20 entries. Add the same functionality to source lists.
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Collapse package dependency lists with more than 20 entries and add a
link to show the full list.
The JavaScript code for this originates from the archweb project. Note
that the full list is shown when JavaScript is disabled or unavailable.
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Package actions now operate on package bases instead of packages. Move
all actions to the correct locations.
This also fixes some issues with comment notifications.
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Deleting a single package without deleting the whole package base makes
no sense. Comments and votes are already stored on a per-package basis,
making this a straightforward extension.
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Checking whether to add a comment is something that really does not
belong to a function named display_package_details().
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Avoid showing a POST data resubmission dialog and simply redirect to the
package page if a package action completed successfully.
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Change the return values of following functions to return both
error/success and an error/success message:
* pkg_flag()
* pkg_unflag()
* pkg_adopt()
* pkg_vote()
* pkg_delete()
* pkg_notify()
* pkg_delete_comment()
* pkg_change_category()
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
We already display the 404 error page if someone tries to access an
invalid package via virtual URLs ("/packages/nonexistent"). Add the same
check to "web/html/packages.php" to make sure the same error is shown if
a user requests package details of a nonexistent package ID via legacy
URLs ("/packages.php?ID=-1").
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Currently, package flagging and unflagging takes place within the
pkg_flag() function. A bool is set to true or false depending on the
action.
Create new pkg_unflag() function with sole purpose of unflagging
and keep pkg_flag() in place. This split will be useful in the
overhaul of the notification system.
Signed-off-by: canyonknight <canyonknight@gmail.com>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Replace all occurrences of "<?php echo" and "<?php print" by "<?=" to
reduce noise in templates.
Note that as of PHP 5.4.0, "<?=" is always available and no longer
requires "short_open_tag" to be set.
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Add a package ID parameter to pkg_change_category() instead of relying
on the "ID" or "N" GET parameters.
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Setting GET parameters manually is bad style and causes some strange
side effects when using virtual URLs and mkurl().
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Specially crafted pages can force authenticated users to unknowingly perform
actions on the AUR website despite being on an attacker's website. This
cross-site request forgery (CSRF) vulnerability applies to all POST data on
the AUR.
Implement a token system using a double submit cookie. Have a hidden form
value on every page containing POST forms. Use the newly added check_token() to
verify the token sent via POST matches the "AURSID" cookie value. Random
nature of the token limits potential for CSRF.
Signed-off-by: canyonknight <canyonknight@gmail.com>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
This is more user-friendly than supporting package IDs only and can be
used as a basis to support direct links to AUR packages in places where
links are computer-produced (e.g. Wiki templates).
Addresses FS#21600 and FS#28839.
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Merge all comments and votes of deleted packages into another package if
the "Merge with" field is used. Duplicate votes (votes from a user who
already voted on the target package or voted on more than one of the
deleted packages) are discarded.
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
We trusted the values we pulled out of the IDs array and never coerced
them to integers, passing them to the backend unescaped and uncasted.
Ensure they are treated as integers only and validate the resulting
value is > 0.
Signed-off-by: Dan McGee <dan@archlinux.org>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
All of these are sourcing function libraries so we don't need to include
them more than once. Things that insert actual HTML into the output were
left calling include().
Signed-off-by: Dan McGee <dan@archlinux.org>
Signed-off-by: Loui Chang <louipc.ist@gmail.com>
Also changed it around a little bit so it's not tied down the search results function
Signed-off-by: Callan Barrett <wizzomafizzo@gmail.com>
Signed-off-by: Loui Chang <louipc.ist@gmail.com>
This includes only the requested language for each page and
makes top level language include files obsolete.
Signed-off-by: Loui Chang <louipc.ist@gmail.com>
Just displays message at the top of the page of what happened (errors or not) and goes back to the same page
Signed-off-by: Callan Barrett <wizzomafizzo@gmail.com>
Signed-off-by: Loui Chang <louipc.ist@gmail.com>
Package functions use a normal array of pkgids now and packages.php has been changed to accomodate for it
Signed-off-by: Callan Barrett <wizzomafizzo@gmail.com>
Signed-off-by: Loui Chang <louipc.ist@gmail.com>
Also modify the way notification is done. Instead of toggling
notification, users can explicitly notify or unnotify.
Signed-off-by: Loui Chang <louipc.ist@gmail.com>
