markzz/aurweb.git/web/lib/aurjson.class.php, branch v4.1.0aurweb working repositoryhttps://git.markzz.net/markzz/aurweb.git/atom/web/lib/aurjson.class.php?h=v4.1.02015-09-26T05:43:10Zaurjson.class.php: Sync error message with front-end2015-09-26T05:43:10ZLukas Fleischerlfleischer@archlinux.org2015-09-26T05:42:05Zurn:sha1:c67e5a1cdf970062c75ad11f019340d318193cbb
Instead of introducing a new message "You do not have the right to edit
this comment." for the RPC interface, use "You are not allowed to edit
this comment." which we already show in the front-end.
Reported-by: Christoph Seitz <seitz.christoph@gmail.com>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
aurjson.class.php: Fix "Undefined index" notices2015-09-25T06:35:43ZLukas Fleischerlfleischer@archlinux.org2015-09-24T16:27:21Zurn:sha1:2f8e0dfa3ac67a4225b27135977a48b124717762
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
Mitigate JSONP callback vulnerabilities2015-09-12T08:20:03ZLukas Fleischerlfleischer@archlinux.org2015-09-12T08:04:43Zurn:sha1:209b0b6edad0c18a2ea14eac83c6c4787264aa63
The callback parameter of the RPC interface currently allows for
specifying a prefix of arbitrary length of the returned result. This can
be exploited by certain attacks.
As a countermeasure, this patch restricts the allowed character set for
the callback name to letters, digits, underscores, parenthesis and dots.
It also limits the length of the name to 128 characters. Furthermore,
the reflected callback name is now always prepended with "/**/", which
is a common workaround to protect against attacks such as Rosetta Flash.
Fixes FS#46259.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
rpc: msearch: Give orphans on empty maintainer argument2015-08-11T11:57:04ZJohannes Löthbergjohannes@kyriasis.com2015-08-09T14:05:39Zurn:sha1:da1153857f63babd0080c0d8ebd75d5f8400e6e9
Signed-off-by: Johannes Löthberg <johannes@kyriasis.com>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
aurjson.class.php: Add missing PHPDoc2015-08-08T10:59:24ZLukas Fleischerlfleischer@archlinux.org2015-07-22T05:19:01Zurn:sha1:080b6f3d123c465f70a8f9f1e724111dd1b3cf56
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
aurjson.class.php: Add method get_comment_form()2015-08-08T10:59:24ZMarcel Korpelmarcel.korpel@gmail.com2015-07-21T20:53:56Zurn:sha1:8328223a5e4670fbeb62c13ef89aa345f3ccc4c8
This method will be used by the JavaScript comment editing and produces
a form containing the comment.
Signed-off-by: Marcel Korpel <marcel.korpel@gmail.com>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
Expose name-only search through the RPC interface2015-08-08T10:59:23ZJohannes Löthbergjohannes@kyriasis.com2015-06-28T17:48:23Zurn:sha1:d8142abbbee6a44693bd303838777fb93013b5c2
Fixes FS#37317.
Signed-off-by: Johannes Löthberg <johannes@kyriasis.com>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
aurjson: Pass http_data array to all functions2015-08-08T10:59:23ZJohannes Löthbergjohannes@kyriasis.com2015-06-28T17:48:22Zurn:sha1:94aeead4ecd230ea4c8cba0bb64501da1ef10886
This is a preparatory patch that simplifies adding more arguments to
the parse functions
Signed-off-by: Johannes Löthberg <johannes@kyriasis.com>
Signed-off-by: Marcel Korpel <marcel.korpel@gmail.com>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
Delete unused variable2015-08-08T10:59:23ZJohannes Löthbergjohannes@kyriasis.com2015-06-28T13:37:28Zurn:sha1:838639056a6d007224ec0a84e9845a541ab4662e
Signed-off-by: Johannes Löthberg <johannes@kyriasis.com>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
RPC: Add decimal_fields array for floating-point fields2015-07-04T11:02:37ZJohannes Löthbergjohannes@kyriasis.com2015-07-04T10:31:41Zurn:sha1:ea59f7277849c9f37a166375293d57bdd97bb20b
Fixes FS#45537.
Signed-off-by: Johannes Löthberg <johannes@kyriasis.com>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>