markzz/aurweb.git/web/template/pkg_details.php, branch v1.9.1

Fix some more XSS vulnerabilities

2012-02-19T03:48:31Z

Escape strings properly using htmlspecialchars(). Seems like we missed these in former cleanups. Fixes FS#28515. Signed-off-by: Lukas Fleischer

Add missing __() to category info in package details

2011-08-22T06:15:36Z

This makes the "Category" label as well as "Change category" button on the package details page translatable. Fixes FS#25692. Signed-off-by: Lukas Fleischer

Remove unnecessary atype and uid lookup from package_details()

2011-08-11T14:17:09Z

These were never used in the function. Where they are used is in the pkg_details.php template, so move them closer to their actual usage so as not to confuse poor programmers such as myself. Signed-off-by: Dan McGee Signed-off-by: Lukas Fleischer

Segment the upload directory by package name prefix

2011-08-10T12:34:07Z

This implements the following scheme: * /packages/cower/ --> /packages/co/cower/ * /packages/j/ --> /packages/j/j/ * /packages/zqy/ --> /packages/zq/zqy/ We take up to the first two characters of each package name as a intermediate subdirectory, and then the full package name lives underneath that. Shorter named packages live in a single letter directory. Why, you ask? Well because earlier today the AUR hit 32,000 entries in the unsupported/ directory, making new package uploads impossible. While some might argue we shouldn't have so many damn packages in the repos, we should be able to handle this case. Why two characters instead of one? Our two biggest two-char groups, 'pe' and 'py', both start with 'p', and have nearly 2000 packages each. Go Python and Perl. Still needed is a "move the existing data" script, as well as a set of rewrite rules for those wishing to preserve backward compatible URLs for any helper programs doing the wrong thing and relying on them. Signed-off-by: Dan McGee Signed-off-by: Lukas Fleischer

urlencode() query args for main site package search (fixes FS#23774).

2011-04-19T21:45:43Z

There may be characters in package dependencies that are reserved within URLs (e.g. "+"). Use urlencode() to ensure those are encoded correctly. Signed-off-by: Lukas Fleischer

Remove Dummy Package concept

2011-04-03T20:59:32Z

Instead, we just store dependencies directly in the PackageDepends table. Since we don't use this info anywhere besides the package details page, there is little value in precalculating what is in the AUR vs. what is not. An upgrade path is provided via several SQL statements in the UPGRADING document. There should be no user-visible change from this, but the DB schema gets a bit more sane and we no longer have loads of junk packages in our tables that are never shown to the end user. This should also help the MySQL query planner in several cases as we no longer have to be careful to exclude dummy packages on every query. Signed-off-by: Dan McGee Signed-off-by: Lukas Fleischer

Fix main site package search URL

2011-03-15T14:46:10Z

I've been wanting to kill this one for a long time. Signed-off-by: Dan McGee Signed-off-by: Lukas Fleischer

Fix XSS vulnerability in package search results and package details.

2011-03-11T18:15:04Z

Signed-off-by: Lukas Fleischer

Fix broken XHTML.

2011-03-11T18:00:50Z

Fix a lot of invalid XHTML in the templates and actions. There might still be some legacy code left, but this should cover most of it. Signed-off-by: Lukas Fleischer

Remove dead dependency/required by link code

2011-03-04T09:29:17Z

For some reason we were doing this song and dance "iterate all the known parameters" business. This is totally unnecessary, clutters the links, and was spewing errors all over the place, so kill it. Signed-off-by: Dan McGee Signed-off-by: Lukas Fleischer