markzz/aurweb.git/web/html/account.php, branch v2.0.0

Overhaul ability to edit own account

2012-09-17T22:59:45Z

* Restructure account.php to remove redundant code. * Remove own_account_details(). * Rework logic check to default to no access to account edit form. * Make default account action viewing account info. Signed-off-by: canyonknight Signed-off-by: Lukas Fleischer

Merge branch 'maint'

2012-07-14T20:52:04Z

Conflicts: web/html/account.php web/html/addvote.php web/html/pkgsubmit.php web/lib/acctfuncs.inc.php web/template/actions_form.php web/template/pkg_comment_form.php web/template/pkg_comments.php web/template/pkg_details.php web/template/pkg_search_results.php web/template/tu_details.php

acctfuncs.inc.php: Move XHTML to account_details.php template

2012-07-06T09:27:16Z

XHTML should be eliminated from lib/ as much as possible. This pulls the XHTML out of the display_account_info function that echoes the code, and moves it to the new account_details.php template file. Signed-off-by: canyonknight Signed-off-by: Lukas Fleischer

account.php: Pull out DB code

2012-07-06T09:27:03Z

* Move DB code in account.php to new functions in acctfuncs.inc.php * Centralization of DB code important in a future transition to PDO interface * Consolidate redudant SQL statements from DisplayAccount and AccountInfo * Consolidation also adds ability to edit accounts based on username Signed-off-by: canyonknight Signed-off-by: Lukas Fleischer

Overhaul account pages to match archweb

2012-07-06T09:26:30Z

* Use CSS from archweb * General clean-up of XHTML formatting Signed-off-by: canyonknight Signed-off-by: Lukas Fleischer

Remove all traces of "pgboxtitle"

2012-07-06T09:25:58Z

Using a div container to format heading is ridiculous. Use "

" instead. Signed-off-by: Lukas Fleischer Signed-off-by: canyonknight

Implement token system to fix CSRF vulnerabilities

2012-06-24T08:59:23Z

Specially crafted pages can force authenticated users to unknowingly perform actions on the AUR website despite being on an attacker's website. This cross-site request forgery (CSRF) vulnerability applies to all POST data on the AUR. Implement a token system using a double submit cookie. Have a hidden form value on every page containing POST forms. Use the newly added check_token() to verify the token sent via POST matches the "AURSID" cookie value. Random nature of the token limits potential for CSRF. Signed-off-by: canyonknight Signed-off-by: Lukas Fleischer

Support canonical links to accounts

2012-03-24T09:34:35Z

Addresses FS#9582 and FS#21600. Signed-off-by: Lukas Fleischer

Add field for PGP key in profile information

2012-03-24T09:34:32Z

This is handy for verifying the PGP key of new Trusted Users. Also, this could potentially used as a basis to allow signed package uploads in the future. Implements FS#29028. Signed-off-by: Lukas Fleischer

Wrap mysql_real_escape_string() in a function

2011-10-25T07:25:30Z

Wrap mysql_real_escape_string() in a wrapper function db_escape_string() to ease porting to other databases, and as another step to pulling more of the database code into a central location. This is a rebased version of a patch by elij submitted about half a year ago. Thanks-to: elij Signed-off-by: Lukas Fleischer Conflicts: web/lib/aur.inc.php