markzz/aurweb.git/web/lib/aurjson.class.php, branch v4.2.0

aurjson: Add package base keywords

2016-02-09T20:54:39Z

Expose package base keywords through the RPC interface (version 5). Signed-off-by: Lukas Fleischer

aurjson: Do not search by ID when argument is numeric

2015-12-13T09:22:59Z

When performing info or multiinfo queries, one can currently either pass package names or package IDs as parameters. As a consequence, it is impossible to search for packages with a numeric package name because numeric arguments are always treated as IDs. Since package IDs are not public anymore these days, simply remove the possibility to search by ID in revision 5 of the RPC interface. Fixes FS#47324. Suggested-by: Dave Reisner Signed-off-by: Lukas Fleischer

aurjson: Allow underscores in JSONP callback names

2015-10-24T16:03:19Z

Signed-off-by: Lukas Fleischer

aurjson: Rename the search_by parameter to "by"

2015-10-09T15:35:51Z

This parameter is only supported by the search command. We do not need to repeat ourselves. Signed-off-by: Lukas Fleischer

aurjson: Merge info and multiinfo commands

2015-10-04T09:40:38Z

Signed-off-by: Lukas Fleischer

aurjson: Add "maintainer" search type

2015-10-04T09:40:37Z

Deprecate the msearch command and add a new search type to the search command. Signed-off-by: Lukas Fleischer

Fix parameter processing in parse_multiinfo_args()

2015-10-03T09:07:39Z

Fixes a regression introduced in 94aeead (aurjson: Pass http_data array to all functions, 2015-06-28). Signed-off-by: Lukas Fleischer

aurjson.class.php: Sync error message with front-end

2015-09-26T05:43:10Z

Instead of introducing a new message "You do not have the right to edit this comment." for the RPC interface, use "You are not allowed to edit this comment." which we already show in the front-end. Reported-by: Christoph Seitz Signed-off-by: Lukas Fleischer

aurjson.class.php: Fix "Undefined index" notices

2015-09-25T06:35:43Z

Signed-off-by: Lukas Fleischer

Mitigate JSONP callback vulnerabilities

2015-09-12T08:20:03Z

The callback parameter of the RPC interface currently allows for specifying a prefix of arbitrary length of the returned result. This can be exploited by certain attacks. As a countermeasure, this patch restricts the allowed character set for the callback name to letters, digits, underscores, parenthesis and dots. It also limits the length of the name to 128 characters. Furthermore, the reflected callback name is now always prepended with "/**/", which is a common workaround to protect against attacks such as Rosetta Flash. Fixes FS#46259. Signed-off-by: Lukas Fleischer