markzz/aurweb.git/web/template/pkg_details.php, branch v2.3.0

Re-add CRSF tokens to most package actions

2013-08-27T00:27:19Z

We fixed all known CRSF vulnerabilities in commit 2c93f0a (Implement token system to fix CSRF vulnerabilities, 2012-06-23). c349cb2 (Add virtual path support for package actions, 2012-07-17) partly reverted this by injecting a valid CRSF token when virtual paths are in use. This patch allows for keeping the virtual path feature, while reintroducing POST forms and CRSF tokens. Actions like package flagging, votes and notifications are no longer prone to CRSF (see FS#35437 for details). Signed-off-by: Lukas Fleischer

pkg_details: Convert most action links to forms

2013-08-27T00:10:13Z

Use forms and POST instead of GET for following actions: * Flagging/Unflagging a package out-of-date * Voting for a package and removing votes * Enabling/Disabling notifications Use CSS to make the submit buttons of these forms look like links. Signed-off-by: Lukas Fleischer

pkg_details.php: Add missing translatable string

2013-01-30T08:25:27Z

Signed-off-by: canyonknight Signed-off-by: Lukas Fleischer

pkg_details.php: Fix potential XSS for package names and dep conditions

2012-11-06T23:59:28Z

Package names and dep conditions can be specially crafted for an XSS attack. Properly sanitize these variables on the package details page. In addition, avoid including dep conditions as part of a package link. Signed-off-by: canyonknight Signed-off-by: Lukas Fleischer

pkg_details.php: Remove plural from the adopt/disown button

2012-11-04T16:08:35Z

Fixes FS#32455. Signed-off-by: Lukas Fleischer

Add missing internationalization to a few strings

2012-11-04T16:08:31Z

Fixes FS#32449. Signed-off-by: Lukas Fleischer

Use HTTPS links everywhere for Arch sites

2012-10-22T10:33:11Z

The main site, wiki, and BBS are using HTTPS exclusively, so link directly to the correct protocol rather than forcing a redirect. Signed-off-by: Dan McGee Signed-off-by: Lukas Fleischer

pkg_details.php: Add missing XHTML close tags

2012-10-20T16:47:00Z

Signed-off-by: canyonknight Signed-off-by: Lukas Fleischer

pkg_details.php: Utilize account details virtual URL

2012-09-28T06:57:25Z

When virtual URLs are enabled, simpler links can be used to access a user's account details page. Change this for both the maintainer and submitter links. Keeps backwards compatibility with virtual URLs being disabled. Signed-off-by: canyonknight Signed-off-by: Lukas Fleischer

Move package merging to a separate page

2012-09-28T06:57:25Z

Package actions now have a separate box on the package details page. Add a package merge link in that box. Link leads to a new page (pkgmerge.php) that can be used to confirm package merging. A separate page with confirmation is used to avoid CSRFs. Signed-off-by: canyonknight Signed-off-by: Lukas Fleischer