markzz/aurweb.git/web/template/pkg_comment_form.php, branch v2.0.0-rc2aurweb working repositoryhttps://git.markzz.net/markzz/aurweb.git/atom/web/template/pkg_comment_form.php?h=v2.0.0-rc22012-10-20T16:47:00Zpkg_comment_form.php: Remove reference to "call" attribute2012-10-20T16:47:00Zcanyonknightcanyonknight@gmail.com2012-10-18T21:12:25Zurn:sha1:61043de89bfcd15d056020ad863aaa74094c6919
Signed-off-by: canyonknight <canyonknight@gmail.com>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
pkg_comment_form.php: Remove redundant label for the comment box2012-10-11T19:19:20Zcanyonknightcanyonknight@gmail.com2012-10-10T20:25:52Zurn:sha1:350c9a9579d00a477042f1422279c2e97263afee
Comment box already uses <h2> tag. Additional label is not needed.
Also remove label for form submit button.
Reported-by: Dave Reisner <d@falconindy.com>
Signed-off-by: canyonknight <canyonknight@gmail.com>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Use echo shortcut syntax2012-09-24T10:23:04ZLukas Fleischerarchlinux@cryptocrack.de2012-09-21T06:57:29Zurn:sha1:6102759b7cb9fd23f4e7fa5f12137334ff30a410
Replace all occurrences of "<?php echo" and "<?php print" by "<?=" to
reduce noise in templates.
Note that as of PHP 5.4.0, "<?=" is always available and no longer
requires "short_open_tag" to be set.
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
pkg_comment_form.php: Fix PHP undefined variable notice for package "ID"2012-09-17T22:59:04Zcanyonknightcanyonknight@gmail.com2012-09-09T19:23:23Zurn:sha1:5186f83ab7869fd831cbe6db3f7e774dc1132448
Signed-off-by: canyonknight <canyonknight@gmail.com>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Merge branch 'maint'2012-07-14T20:52:04ZLukas Fleischerarchlinux@cryptocrack.de2012-07-14T20:47:04Zurn:sha1:f3ce74c714e3460bb3e3e786f626e397d3139062
Conflicts:
web/html/account.php
web/html/addvote.php
web/html/pkgsubmit.php
web/lib/acctfuncs.inc.php
web/template/actions_form.php
web/template/pkg_comment_form.php
web/template/pkg_comments.php
web/template/pkg_details.php
web/template/pkg_search_results.php
web/template/tu_details.php
pkg_comment_form.php: Pull out DB code2012-07-06T09:26:57Zcanyonknightcanyonknight@gmail.com2012-05-23T19:28:20Zurn:sha1:d3de6679010a1d140794305e747f1af0e7f21834
* Move DB code and e-mail code from pkg_comment_form.php to new function in
pkgfuncs.inc.php
* Centralization of DB code important in a future transition to PDO interface
Signed-off-by: canyonknight <canyonknight@gmail.com>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Refactor package comment form2012-07-06T09:26:12ZLukas Fleischerarchlinux@cryptocrack.de2012-05-23T17:45:17Zurn:sha1:ba120ca30457e1a146350871fa83757b501db16a
* Adjust style to match the overall layout.
* Use proper HTML tags and double quotes.
* Remove the "Reset" button.
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Signed-off-by: canyonknight <canyonknight@gmail.com>
Implement token system to fix CSRF vulnerabilities2012-06-24T08:59:23Zcanyonknightcanyonknight@gmail.com2012-06-23T18:40:11Zurn:sha1:2c93f0a98f0f6380fd07ea17fd16afa2c6e4925b
Specially crafted pages can force authenticated users to unknowingly perform
actions on the AUR website despite being on an attacker's website. This
cross-site request forgery (CSRF) vulnerability applies to all POST data on
the AUR.
Implement a token system using a double submit cookie. Have a hidden form
value on every page containing POST forms. Use the newly added check_token() to
verify the token sent via POST matches the "AURSID" cookie value. Random
nature of the token limits potential for CSRF.
Signed-off-by: canyonknight <canyonknight@gmail.com>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Always set the "To:" header when sending mail2012-03-08T10:43:48ZLukas Fleischerarchlinux@cryptocrack.de2012-03-08T10:43:48Zurn:sha1:f5e1652bf95ed7b63a27042d8bb8b1195d7c9158
Use "undisclosed-recipients: ;" when sending mass notifications (such as
comment notifications and the like. Addresses FS#28229.
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Add a new AUR_LOCATION setting2011-11-02T20:21:23ZDan McGeedan@archlinux.org2011-10-21T20:15:55Zurn:sha1:e571a694d6e15891b591c28dd40cd464740a7126
This should be set to something like 'http://localhost' for development
or 'https://aur.archlinux.org' in production. It ensures all links in
the site stay in the development site and there is no sudden jump from
development to production environments.
Signed-off-by: Dan McGee <dan@archlinux.org>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>