markzz/aurweb.git/web/html/index.php, branch v2.3.0

Re-add CRSF tokens to most package actions

2013-08-27T00:27:19Z

We fixed all known CRSF vulnerabilities in commit 2c93f0a (Implement token system to fix CSRF vulnerabilities, 2012-06-23). c349cb2 (Add virtual path support for package actions, 2012-07-17) partly reverted this by injecting a valid CRSF token when virtual paths are in use. This patch allows for keeping the virtual path feature, while reintroducing POST forms and CRSF tokens. Actions like package flagging, votes and notifications are no longer prone to CRSF (see FS#35437 for details). Signed-off-by: Lukas Fleischer

Use minified typeahead JS from archweb

2013-03-25T23:54:18Z

Signed-off-by: Lukas Fleischer

Implemented typeahead suggest

2013-01-19T11:17:55Z

Use Twitter Bootstrap JavaScript framework for typeahead support. Add a new "suggest" JSON method, which returns the first 20 packages that match the beginning characters of a query. canyonknight: Link format change, commit message Signed-off-by: Lukas Fleischer

index.php: Move voter page token check to switch control structure

2012-11-24T12:20:44Z

Voter page token check takes place in the same way as other existing token checks. Move the check for consistency. Signed-off-by: canyonknight Signed-off-by: Lukas Fleischer

Return 404 for invalid account/package subpages

2012-10-30T13:56:43Z

Display an error page and return a 404 status code in the following cases: * An invalid package name is passed to the "packages" action. * An invalid user name is passed to the "account" action. * An invalid package action is passed. * An invalid account action is passed. Signed-off-by: Lukas Fleischer

Display an error page if a virtual path doesn't exist

2012-10-20T16:28:17Z

Give user feedback instead of bailing out with an empty HTTP response body. Signed-off-by: Lukas Fleischer

Move package merging to a separate page

2012-09-28T06:57:25Z

Package actions now have a separate box on the package details page. Add a package merge link in that box. Link leads to a new page (pkgmerge.php) that can be used to confirm package merging. A separate page with confirmation is used to avoid CSRFs. Signed-off-by: canyonknight Signed-off-by: Lukas Fleischer

Move package deletion to a separate page

2012-09-28T06:57:24Z

Package actions now have a separate box on the package details page. Make a package deletion link in that box. Link leads to a new page (pkgdel.php) that can be used to confirm package deletion. A separate page with confirmation is used to avoid CSRFs. Signed-off-by: canyonknight Signed-off-by: Lukas Fleischer

Do not set GET parameters in the routing framework

2012-09-18T12:05:11Z

Setting GET parameters manually is bad style and causes some strange side effects when using virtual URLs and mkurl(). Signed-off-by: Lukas Fleischer

index.php: Fix undefined variable notice

2012-09-18T12:01:09Z

Spotted when browsing the package details page while being logged out. Reported-by: canyonknight Signed-off-by: Lukas Fleischer