markzz/aurweb.git/web/html/addvote.php, branch v3.0.0-rc2

Add a vote type to the TU proposal form

2013-08-22T15:48:18Z

There are only four valid reasons for starting a TU vote, so instead of letting the user choose a vote length, let her pick a reason and set vote length and quorum based on that selection. Signed-off-by: Lukas Fleischer

Avoid use of ""/""

2012-09-24T10:23:05Z

* Use ""/"" for form labels. * Use ""/"" for important text. * Use "

"/"

" for headings. * Drop ""/"" everywhere else. Signed-off-by: Lukas Fleischer

Use echo shortcut syntax

2012-09-24T10:23:04Z

Replace all occurrences of "

Use virtual path feature for links

2012-07-15T20:44:51Z

Use virtual paths in links (e.g. link to "/packages/" instead of "/packages.php" etc.) if the virtual path feature is enabled. Signed-off-by: Lukas Fleischer

Merge branch 'maint'

2012-07-14T20:52:04Z

Conflicts: web/html/account.php web/html/addvote.php web/html/pkgsubmit.php web/lib/acctfuncs.inc.php web/template/actions_form.php web/template/pkg_comment_form.php web/template/pkg_comments.php web/template/pkg_details.php web/template/pkg_search_results.php web/template/tu_details.php

addvote.php: Pull out DB code

2012-07-06T09:26:51Z

* Verifying a username exists should use already present valid_user function * Create new functions in acctfuncs.inc.php with SQL queries from addvote.php * Centralization of DB code important in a future transition to PDO interface Signed-off-by: canyonknight Signed-off-by: Lukas Fleischer

addvote.php: Overhaul to match archweb

2012-07-06T09:26:28Z

* Switch CSS over to archweb styling * General clean-up of XHTML * Set proposal box size to something more sane for a default Signed-off-by: canyonknight Signed-off-by: Lukas Fleischer

Remove all traces of "pgboxtitle"

2012-07-06T09:25:58Z

Using a div container to format heading is ridiculous. Use "

" instead. Signed-off-by: Lukas Fleischer Signed-off-by: canyonknight

Be consistent in PHP logical operator usage

2012-07-06T09:25:45Z

A mix of logical operator styles are currently in use. The predominant style uses "&&" and "||" instead of "and" and "or", respectively. This inconsistency is minor, but is easily avoided. Signed-off-by: canyonknight Signed-off-by: Lukas Fleischer

Implement token system to fix CSRF vulnerabilities

2012-06-24T08:59:23Z

Specially crafted pages can force authenticated users to unknowingly perform actions on the AUR website despite being on an attacker's website. This cross-site request forgery (CSRF) vulnerability applies to all POST data on the AUR. Implement a token system using a double submit cookie. Have a hidden form value on every page containing POST forms. Use the newly added check_token() to verify the token sent via POST matches the "AURSID" cookie value. Random nature of the token limits potential for CSRF. Signed-off-by: canyonknight Signed-off-by: Lukas Fleischer