markzz/aurweb.git/web/html, branch 1.8.1aurweb working repositoryhttps://git.markzz.net/markzz/aurweb.git/atom/web/html?h=1.8.12011-03-04T09:29:17ZFix PHP notices in account pages2011-03-04T09:29:17ZDan McGeedan@archlinux.org2011-03-01T18:24:34Zurn:sha1:cdc01130cf03ceac98626e9bedc369da3f0fd2c7
Signed-off-by: Dan McGee <dan@archlinux.org>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Add action lookup helper function2011-03-04T09:29:15ZDan McGeedan@archlinux.org2011-03-01T17:26:21Zurn:sha1:d1d0288598bb8f2fca299e0e3e6eadc6d4fbc32d
Signed-off-by: Dan McGee <dan@archlinux.org>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Improve cookie handling2011-03-04T09:29:13ZDan McGeedan@archlinux.org2011-03-01T15:24:34Zurn:sha1:984ce9529c926c884136780d017ae90f0b82b54b
* Remove comment that is mostly bogus- the domain is automatically set.
* When logging out, don't delete the language cookie.
* Make the language cookie persistent.
* Use the minimal time possible to expire cookies; no need to compute
anything.
Signed-off-by: Dan McGee <dan@archlinux.org>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Fix potential injection vulnerability2011-03-01T19:27:49ZDan McGeedan@archlinux.org2011-03-01T18:31:35Zurn:sha1:90485e8f422cec6d23af38574a53705fa7de008b
We trusted the values we pulled out of the IDs array and never coerced
them to integers, passing them to the backend unescaped and uncasted.
Ensure they are treated as integers only and validate the resulting
value is > 0.
Signed-off-by: Dan McGee <dan@archlinux.org>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Define "Packages.SubmitterUID" and "Packages.MaintainerUID" as "NULL".2011-02-27T18:46:19ZLukas Fleischerarchlinux@cryptocrack.de2011-02-27T16:12:43Zurn:sha1:1e3fa38de5f940fef474fc3961c70b357b976308
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Reject blacklisted packages on initial submission only.2011-02-25T10:18:02ZLukas Fleischerarchlinux@cryptocrack.de2011-02-25T10:17:42Zurn:sha1:2e1ce869ec2445f489d7e0d1890289d6f12761aa
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Protect users against ZIP bombs (fixes FS#22991).2011-02-23T10:17:27ZLukas Fleischerarchlinux@cryptocrack.de2011-02-22T18:46:51Zurn:sha1:09d8128f99c2edc27dd81efc63e9b3c797603ca1
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Reject packages with subdirectories (fixes FS#22995).2011-02-21T18:19:53ZLukas Fleischerarchlinux@cryptocrack.de2011-02-21T18:19:53Zurn:sha1:4b2b8afb8aad83588cd9d0cf9af28acfb5d3bb74
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Automatically adopt when updating an orphan package (fixes FS#22992).2011-02-21T16:56:19ZLukas Fleischerarchlinux@cryptocrack.de2011-02-21T16:56:12Zurn:sha1:31b0b68b479aff1f85feb89010ed3fcf40a95673
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Use move_uploaded_file() instead of rename() in "pkgsubmit.php".2011-02-21T16:07:51ZLukas Fleischerarchlinux@cryptocrack.de2011-02-21T16:06:47Zurn:sha1:bc207d25cd47e2ebc0a2d603f0414ca97cf94366
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>