mirror of
https://gitlab.archlinux.org/archlinux/aurweb.git
synced 2025-02-03 10:43:03 +01:00
1a1a6eb36e
DEFAULT_LANG will essentially be used to specify what language strings are initially written in. This will eliminate the need for English translation arrays in AUR and make adding or changing the English strings a lot easier. DEFAULT_LANG may be required for strings to display properly. Also change the output when a translation isn't found. Eliminate the <b> which can cause validation errors depending on where the string is placed. Signed-off-by: Loui Chang <louipc.ist@gmail.com>
411 lines
9.2 KiB
PHP
411 lines
9.2 KiB
PHP
<?php
|
|
set_include_path(get_include_path() . PATH_SEPARATOR . '../template');
|
|
header('Content-Type: text/html; charset=utf-8');
|
|
header('Cache-Control: no-cache, must-revalidate');
|
|
header('Expires: Tue, 11 Oct 1988 22:00:00 GMT'); // quite a special day
|
|
header('Pragma: no-cache');
|
|
include_once("version.inc");
|
|
include_once("config.inc");
|
|
include_once("aur_po.inc");
|
|
// TODO: remove this, move translations over for login form
|
|
include_once("index_po.inc");
|
|
include_once("acctfuncs.inc");
|
|
|
|
# TODO do we need to set the domain on cookies? I seem to remember some
|
|
# security concerns about not using domains - but it's not like
|
|
# we really care if another site can see what language/SID a user
|
|
# is using...
|
|
#
|
|
|
|
|
|
|
|
# return an array of info for each Trusted user
|
|
#
|
|
function getTrustedUsers() {
|
|
$tus = array();
|
|
$dbh = db_connect();
|
|
$q = "SELECT * FROM Users WHERE AccountTypeID = 2 ";
|
|
$q.= "ORDER BY Username ASC";
|
|
$result = db_query($q, $dbh);
|
|
if ($result) {
|
|
while ($row = mysql_fetch_assoc($result)) {
|
|
$tus[$row["ID"]] = $row;
|
|
}
|
|
}
|
|
return $tus;
|
|
}
|
|
|
|
|
|
# return an array of info for each Developer
|
|
#
|
|
function getDevelopers() {
|
|
$devs = array();
|
|
$dbh = db_connect();
|
|
$q = "SELECT * FROM Users WHERE AccountTypeID = 3 ";
|
|
$q.= "ORDER BY Username ASC";
|
|
$result = db_query($q, $dbh);
|
|
if ($result) {
|
|
while ($row = mysql_fetch_assoc($result)) {
|
|
$devs[$row["ID"]] = $row;
|
|
}
|
|
}
|
|
return $devs;
|
|
}
|
|
|
|
# return an array of info for each user
|
|
function getUsers() {
|
|
$users = array();
|
|
$dbh = db_connect();
|
|
$q = "SELECT * FROM Users ORDER BY Username ASC";
|
|
$result = db_query($q, $dbh);
|
|
if ($result) {
|
|
while ($row = mysql_fetch_assoc($result)) {
|
|
$users[$row["ID"]] = $row;
|
|
}
|
|
}
|
|
return $users;
|
|
}
|
|
|
|
# see if the visitor is already logged in
|
|
#
|
|
function check_sid() {
|
|
global $_COOKIE;
|
|
global $LOGIN_TIMEOUT;
|
|
|
|
if (isset($_COOKIE["AURSID"])) {
|
|
$failed = 0;
|
|
# the visitor is logged in, try and update the session
|
|
#
|
|
$dbh = db_connect();
|
|
$q = "SELECT LastUpdateTS, UNIX_TIMESTAMP() FROM Sessions ";
|
|
$q.= "WHERE SessionID = '" . mysql_real_escape_string($_COOKIE["AURSID"]) . "'";
|
|
$result = db_query($q, $dbh);
|
|
if (mysql_num_rows($result) == 0) {
|
|
# Invalid SessionID - hacker alert!
|
|
#
|
|
$failed = 1;
|
|
} else {
|
|
$row = mysql_fetch_row($result);
|
|
if ($row[0] + $LOGIN_TIMEOUT <= $row[1]) {
|
|
$failed = 2;
|
|
}
|
|
}
|
|
if ($failed == 1) {
|
|
# clear out the hacker's cookie, and send them to a naughty page
|
|
# why do you have to be so harsh on these people!?
|
|
#
|
|
setcookie("AURSID", "", time() - (60*60*24*30), "/");
|
|
unset($_COOKIE['AURSID']);
|
|
} elseif ($failed == 2) {
|
|
# visitor's session id either doesn't exist, or the timeout
|
|
# was reached and they must login again, send them back to
|
|
# the main page where they can log in again.
|
|
#
|
|
$q = "DELETE FROM Sessions WHERE SessionID = '";
|
|
$q.= mysql_real_escape_string($_COOKIE["AURSID"]) . "'";
|
|
db_query($q, $dbh);
|
|
|
|
setcookie("AURSID", "", time() - (60*60*24*30), "/");
|
|
unset($_COOKIE['AURSID']);
|
|
} else {
|
|
# still logged in and haven't reached the timeout, go ahead
|
|
# and update the idle timestamp
|
|
#
|
|
$q = "UPDATE Sessions SET LastUpdateTS = UNIX_TIMESTAMP() ";
|
|
$q.= "WHERE SessionID = '".mysql_real_escape_string($_COOKIE["AURSID"])."'";
|
|
db_query($q, $dbh);
|
|
}
|
|
}
|
|
return;
|
|
}
|
|
|
|
# verify that an email address looks like it is legitimate
|
|
#
|
|
function valid_email($addy) {
|
|
return eregi("^[a-z0-9\._-]+@+[a-z0-9\._-]+\.+[a-z]{2,4}$", $addy);
|
|
}
|
|
|
|
# a new seed value for mt_srand()
|
|
#
|
|
function make_seed() {
|
|
list($usec, $sec) = explode(' ', microtime());
|
|
return (float) $sec + ((float) $usec * 10000);
|
|
}
|
|
|
|
# generate a (hopefully) unique session id
|
|
#
|
|
function new_sid() {
|
|
mt_srand(make_seed());
|
|
$ts = time();
|
|
$pid = getmypid();
|
|
|
|
$rand_num = mt_rand();
|
|
mt_srand(make_seed());
|
|
$rand_str = substr(md5(mt_rand()),2, 20);
|
|
|
|
$id = $rand_str . strtolower(md5($ts.$pid)) . $rand_num;
|
|
return strtoupper(md5($id));
|
|
}
|
|
|
|
|
|
# obtain the username if given their Users.ID
|
|
#
|
|
function username_from_id($id="") {
|
|
if (!$id) {
|
|
return "";
|
|
}
|
|
$dbh = db_connect();
|
|
$q = "SELECT Username FROM Users WHERE ID = " . mysql_real_escape_string($id);
|
|
$result = db_query($q, $dbh);
|
|
if (!$result) {
|
|
return "None";
|
|
}
|
|
$row = mysql_fetch_row($result);
|
|
|
|
return $row[0];
|
|
}
|
|
|
|
|
|
# obtain the username if given their current SID
|
|
#
|
|
function username_from_sid($sid="") {
|
|
if (!$sid) {
|
|
return "";
|
|
}
|
|
$dbh = db_connect();
|
|
$q = "SELECT Username ";
|
|
$q.= "FROM Users, Sessions ";
|
|
$q.= "WHERE Users.ID = Sessions.UsersID ";
|
|
$q.= "AND Sessions.SessionID = '" . mysql_real_escape_string($sid) . "'";
|
|
$result = db_query($q, $dbh);
|
|
if (!$result) {
|
|
return "";
|
|
}
|
|
$row = mysql_fetch_row($result);
|
|
|
|
return $row[0];
|
|
}
|
|
|
|
# obtain the email address if given their current SID
|
|
#
|
|
function email_from_sid($sid="") {
|
|
if (!$sid) {
|
|
return "";
|
|
}
|
|
$dbh = db_connect();
|
|
$q = "SELECT Email ";
|
|
$q.= "FROM Users, Sessions ";
|
|
$q.= "WHERE Users.ID = Sessions.UsersID ";
|
|
$q.= "AND Sessions.SessionID = '" . mysql_real_escape_string($sid) . "'";
|
|
$result = db_query($q, $dbh);
|
|
if (!$result) {
|
|
return "";
|
|
}
|
|
$row = mysql_fetch_row($result);
|
|
|
|
return $row[0];
|
|
}
|
|
|
|
# obtain the account type if given their current SID
|
|
# Return either "", "User", "Trusted User", "Developer"
|
|
#
|
|
function account_from_sid($sid="") {
|
|
if (!$sid) {
|
|
return "";
|
|
}
|
|
$dbh = db_connect();
|
|
$q = "SELECT AccountType ";
|
|
$q.= "FROM Users, AccountTypes, Sessions ";
|
|
$q.= "WHERE Users.ID = Sessions.UsersID ";
|
|
$q.= "AND AccountTypes.ID = Users.AccountTypeID ";
|
|
$q.= "AND Sessions.SessionID = '" . mysql_real_escape_string($sid) . "'";
|
|
$result = db_query($q, $dbh);
|
|
if (!$result) {
|
|
return "";
|
|
}
|
|
$row = mysql_fetch_row($result);
|
|
|
|
return $row[0];
|
|
}
|
|
|
|
# obtain the Users.ID if given their current SID
|
|
#
|
|
function uid_from_sid($sid="") {
|
|
if (!$sid) {
|
|
return "";
|
|
}
|
|
$dbh = db_connect();
|
|
$q = "SELECT Users.ID ";
|
|
$q.= "FROM Users, Sessions ";
|
|
$q.= "WHERE Users.ID = Sessions.UsersID ";
|
|
$q.= "AND Sessions.SessionID = '" . mysql_real_escape_string($sid) . "'";
|
|
$result = db_query($q, $dbh);
|
|
if (!$result) {
|
|
return 0;
|
|
}
|
|
$row = mysql_fetch_row($result);
|
|
|
|
return $row[0];
|
|
}
|
|
|
|
# connect to the database
|
|
#
|
|
function db_connect() {
|
|
|
|
$handle = mysql_pconnect(AUR_db_host, AUR_db_user, AUR_db_pass);
|
|
if (!$handle) {
|
|
die("Error connecting to AUR database: " . mysql_error());
|
|
}
|
|
|
|
mysql_select_db(AUR_db_name, $handle) or
|
|
die("Error selecting AUR database: " . mysql_error());
|
|
|
|
return $handle;
|
|
}
|
|
|
|
# wrapper function around db_query in case we want to put
|
|
# query logging/debuggin in.
|
|
#
|
|
function db_query($query="", $db_handle="") {
|
|
if (!$query) {
|
|
return FALSE;
|
|
}
|
|
if (!$db_handle) {
|
|
$db_handle = db_connect();
|
|
}
|
|
$result = @mysql_query($query, $db_handle);
|
|
return $result;
|
|
}
|
|
|
|
# set up the visitor's language
|
|
#
|
|
function set_lang() {
|
|
global $_REQUEST;
|
|
global $_COOKIE;
|
|
global $LANG;
|
|
global $SUPPORTED_LANGS;
|
|
|
|
$update_cookie = 0;
|
|
if (isset($_REQUEST['setlang'])) {
|
|
# visitor is requesting a language change
|
|
#
|
|
$LANG = $_REQUEST['setlang'];
|
|
$update_cookie = 1;
|
|
|
|
} elseif (isset($_COOKIE['AURLANG'])) {
|
|
# If a cookie is set, use that
|
|
#
|
|
$LANG = $_COOKIE['AURLANG'];
|
|
|
|
} elseif (isset($_COOKIE["AURSID"])) {
|
|
$dbh = db_connect();
|
|
$q = "SELECT LangPreference FROM Users, Sessions ";
|
|
$q.= "WHERE Users.ID = Sessions.UsersID ";
|
|
$q.= "AND Sessions.SessionID = '";
|
|
$q.= mysql_real_escape_string($_COOKIE["AURSID"])."'";
|
|
$result = db_query($q, $dbh);
|
|
if (!$result) {
|
|
$LANG = "en";
|
|
} else {
|
|
$row = mysql_fetch_array($result);
|
|
$LANG = $row[0];
|
|
}
|
|
$update_cookie = 1;
|
|
}
|
|
|
|
# Set $LANG to default if nothing is valid.
|
|
if (!array_key_exists($LANG, $SUPPORTED_LANGS)) {
|
|
$LANG = DEFAULT_LANG;
|
|
}
|
|
|
|
if ($update_cookie) {
|
|
setcookie("AURLANG", $LANG, 0, "/");
|
|
}
|
|
return;
|
|
}
|
|
|
|
|
|
# common header
|
|
#
|
|
function html_header($title="") {
|
|
global $_SERVER;
|
|
global $_COOKIE;
|
|
global $_POST;
|
|
global $LANG;
|
|
global $SUPPORTED_LANGS;
|
|
|
|
$login = try_login();
|
|
$login_error = $login['error'];
|
|
|
|
$title = htmlspecialchars($title, ENT_QUOTES);
|
|
|
|
include('header.php');
|
|
return;
|
|
}
|
|
|
|
|
|
# common footer
|
|
#
|
|
function html_footer($ver="") {
|
|
include('footer.php');
|
|
return;
|
|
}
|
|
|
|
# check to see if the user can submit a package
|
|
#
|
|
function can_submit_pkg($name="", $sid="") {
|
|
if (!$name || !$sid) {return 0;}
|
|
$dbh = db_connect();
|
|
$q = "SELECT MaintainerUID, DummyPkg ";
|
|
$q.= "FROM Packages WHERE Name = '".mysql_real_escape_string($name)."'";
|
|
$result = db_query($q, $dbh);
|
|
if (mysql_num_rows($result) == 0) {return 1;}
|
|
$row = mysql_fetch_row($result);
|
|
if ($row[1] == "1") { return 1; }
|
|
$my_uid = uid_from_sid($sid);
|
|
|
|
if ($row[0] == $my_uid) {
|
|
return 1;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
# recursive delete directory
|
|
#
|
|
function rm_rf($dirname="") {
|
|
$d = dir($dirname);
|
|
while ($f = $d->read()) {
|
|
if ($f != "." && $f != "..") {
|
|
if (is_dir($dirname."/".$f)) {
|
|
rm_rf($dirname."/".$f);
|
|
}
|
|
if (is_file($dirname."/".$f) || is_link($dirname."/".$f)) {
|
|
unlink($dirname."/".$f);
|
|
}
|
|
}
|
|
}
|
|
$d->close();
|
|
rmdir($dirname);
|
|
return;
|
|
}
|
|
|
|
# obtain the uid given a Users.Username
|
|
#
|
|
function uid_from_username($username="")
|
|
{
|
|
if (!$username) {
|
|
return "";
|
|
}
|
|
$dbh = db_connect();
|
|
$q = "SELECT ID FROM Users WHERE Username = '".mysql_real_escape_string($username)
|
|
."'";
|
|
$result = db_query($q, $dbh);
|
|
if (!$result) {
|
|
return "None";
|
|
}
|
|
$row = mysql_fetch_row($result);
|
|
|
|
return $row[0];
|
|
}
|
|
|