markzz/aurweb.git/web/lib/aur.inc.php, branch v1.9.1

Escape wildcards in "LIKE" patterns

2011-10-25T07:25:43Z

Percent signs ("%") and underscores ("_") are not escaped by mysql_real_escape_string() and are interpreted as wildcards if combined with "LIKE". Write a wrapper function db_escape_like() and use it where appropriate. Note that we already fixed this for the RPC interface in commit da2ebb667b7a332ddd8d905bf9b9a8694765fed6 but missed the other places. This patch should fix all remaining flaws reported in FS#26527. Signed-off-by: Lukas Fleischer Signed-off-by: Dan McGee

Wrap mysql_real_escape_string() in a function

2011-10-25T07:25:30Z

Wrap mysql_real_escape_string() in a wrapper function db_escape_string() to ease porting to other databases, and as another step to pulling more of the database code into a central location. This is a rebased version of a patch by elij submitted about half a year ago. Thanks-to: elij Signed-off-by: Lukas Fleischer Conflicts: web/lib/aur.inc.php

Use secure and httponly session cookies

2011-08-11T22:09:24Z

As discussed on the mailing list, enable "secure" and "httponly" for session cookies to prevent them from being transferred over insecure connections. Signed-off-by: Lukas Fleischer

Add a configuration setting to disallow HTTP login

2011-08-11T19:04:38Z

If this is enabled, do not show the login form and display a note suggesting to switch to a secure connection if a user accesses the site via HTTP. Signed-off-by: Lukas Fleischer

aur.inc.php: allow all functions using DB to take handle as arg

2011-08-11T14:17:08Z

This prevents needless calls to db_connect() if we already have a reference to a handle we can pass into a function. Although the current underlying implementation using mysql_connect() will return the same connection if all parameters are the same, this might not be true if we switch to a more modern (e.g. PDO) interface. In the face of safe transactions, it is extremely important all actions are being taken over the same connection to the database. Signed-off-by: Dan McGee Signed-off-by: Lukas Fleischer

Allow SQL_DEBUG to be undefined

2011-08-10T12:34:07Z

We shouldn't require this as it is a new config parameter and it causes PHP warnings to be spewed everywhere. Signed-off-by: Dan McGee Signed-off-by: Lukas Fleischer

Simplify session ID generation

2011-06-25T09:58:20Z

There was too much voodoo going on in new_sid(). Just use uniqid() with a random seed and the optional entropy parameter to generate MD5 input. Use the remote IP address as a salt to reduce the chance of two clients getting the same ID if they login at exactly the same time. Thanks-to: Florian Pritz Signed-off-by: Lukas Fleischer

Stricter email address validation

2011-06-25T09:58:13Z

Use PHP's filter extension to validate mail addresses. The filter extension is enabled by default as of PHP 5.2.0. Thanks-to: Florian Pritz Thanks-to: Cédric Girard Signed-off-by: Lukas Fleischer

Make cache type selectable based on config value

2011-06-22T13:21:21Z

Provie a mechanism to specify cache type from NONE, APC, or MEMCACHE based on a config variable. If MEMCACHE type is selected, a list of servers can be specified to provide multiserver support. Note that php-memcaced is required for MEMCACHE support. Lukas: Minor commenting style fixes. Signed-off-by: Lukas Fleischer

rename .inc files to .inc.php and adjust imports and references

2011-06-22T13:15:04Z

Lukas: Add note to "UPGRADING". Signed-off-by: Lukas Fleischer