markzz/aurweb.git/web/html/account.php, branch v3.3.0

Pick sane default registration language

2013-08-27T00:42:19Z

Instead of defaulting to Català (which is the first entry in the list of supported languages), choose whatever language the unregistered user is browsing the AUR in. Fixes FS#34825. Suggested-by: canyonknight Signed-off-by: Lukas Fleischer

Allow for setting an account's inactivity status

2013-08-22T15:43:13Z

This adds a field to the users table and corresponding fields to the account edit and display forms that allow for setting an (in-)activity status. This might turn out to be useful if a user is on vacation and can not respond to update/orphan/deletion requests. Signed-off-by: Lukas Fleischer

Remove superfluous search wrapper function

2013-04-24T09:05:51Z

The search_accounts_form() wrapper function doesn't have any arguments and only makes it unclear what is happening within account.php Signed-off-by: canyonknight Signed-off-by: Lukas Fleischer

Enforce e-mail validation during registration

2013-03-19T13:03:34Z

Remove the password field from the account creation form and always send a password reset request via e-mail instead. This ensures that only users with valid e-mail addresses are able to login. Signed-off-by: Lukas Fleischer

Fix default selection on the account edit page

2013-02-10T11:11:36Z

We used a mixture of account type IDs and account type descriptions on the account edit page. This resulted in the account type field always defaulting to "Normal user" after an invalid form had been submitted. Consistently use account type IDs to avoid this. Signed-off-by: Lukas Fleischer

Remove unneeded database connection calls

2013-02-10T11:10:38Z

Since all database related functions will establish a connection when needed, there is no need to pre-emptively try and establish a database connection. Signed-off-by: canyonknight Signed-off-by: Lukas Fleischer

Add database wrapper class and new connection method

2013-02-10T11:10:37Z

Uses the Singleton pattern to ensure all queries use the same database connection that is released upon script completion. All database connections should now be called with DB::connect() and not db_connect(). Signed-off-by: canyonknight Signed-off-by: Lukas Fleischer

Replace permission check code with can_edit_account()

2013-01-30T08:25:29Z

Signed-off-by: canyonknight Signed-off-by: Lukas Fleischer

Fix account editing and hijacking vulnerability

2012-11-29T22:23:10Z

Checks are in place to avoid users getting account editing forms they shouldn't have access to. The appropriate checks before editing the account in the backend are not in place. This vulnerability allows a user to craft malicious POST data to edit other user accounts, thereby allowing account hijacking. Add a new flexible function can_edit_account() to determine if a user has appropriate permissions. Run the permission check before processing any account information in the backend. Signed-off-by: canyonknight Signed-off-by: Lukas Fleischer

Overhaul ability to edit own account

2012-09-17T22:59:45Z

* Restructure account.php to remove redundant code. * Remove own_account_details(). * Rework logic check to default to no access to account edit form. * Make default account action viewing account info. Signed-off-by: canyonknight Signed-off-by: Lukas Fleischer