markzz/aurweb.git/web/template, branch v1.9.1

Escape all output strings in the header and footer

2012-02-19T04:21:48Z

Escape each output string using htmlspecialchars(). These aren't exploitable; it's still better to escape them properly. Signed-off-by: Lukas Fleischer

Fix some more XSS vulnerabilities

2012-02-19T03:48:31Z

Escape strings properly using htmlspecialchars(). Seems like we missed these in former cleanups. Fixes FS#28515. Signed-off-by: Lukas Fleischer

Wrap mysql_real_escape_string() in a function

2011-10-25T07:25:30Z

Wrap mysql_real_escape_string() in a wrapper function db_escape_string() to ease porting to other databases, and as another step to pulling more of the database code into a central location. This is a rebased version of a patch by elij submitted about half a year ago. Thanks-to: elij Signed-off-by: Lukas Fleischer Conflicts: web/lib/aur.inc.php

web/template/login_form.php: Escape the request URI

2011-09-05T14:56:09Z

Reported-by: Thomas Bächler Signed-off-by: Lukas Fleischer

Link to current page in the login bar HTTPs link

2011-09-05T14:47:57Z

This is way more convenient if you follow a HTTP link. Implements FS#25757. Signed-off-by: Lukas Fleischer

Add missing __() to category info in package details

2011-08-22T06:15:36Z

This makes the "Category" label as well as "Change category" button on the package details page translatable. Fixes FS#25692. Signed-off-by: Lukas Fleischer

Add a configuration setting to disallow HTTP login

2011-08-11T19:04:38Z

If this is enabled, do not show the login form and display a note suggesting to switch to a secure connection if a user accesses the site via HTTP. Signed-off-by: Lukas Fleischer

Remove unnecessary atype and uid lookup from package_details()

2011-08-11T14:17:09Z

These were never used in the function. Where they are used is in the pkg_details.php template, so move them closer to their actual usage so as not to confuse poor programmers such as myself. Signed-off-by: Dan McGee Signed-off-by: Lukas Fleischer

Allow for merging deleted packages into existing ones

2011-08-11T14:17:07Z

Merge all comments and votes of deleted packages into another package if the "Merge with" field is used. Duplicate votes (votes from a user who already voted on the target package or voted on more than one of the deleted packages) are discarded. Signed-off-by: Lukas Fleischer

Segment the upload directory by package name prefix

2011-08-10T12:34:07Z

This implements the following scheme: * /packages/cower/ --> /packages/co/cower/ * /packages/j/ --> /packages/j/j/ * /packages/zqy/ --> /packages/zq/zqy/ We take up to the first two characters of each package name as a intermediate subdirectory, and then the full package name lives underneath that. Shorter named packages live in a single letter directory. Why, you ask? Well because earlier today the AUR hit 32,000 entries in the unsupported/ directory, making new package uploads impossible. While some might argue we shouldn't have so many damn packages in the repos, we should be able to handle this case. Why two characters instead of one? Our two biggest two-char groups, 'pe' and 'py', both start with 'p', and have nearly 2000 packages each. Go Python and Perl. Still needed is a "move the existing data" script, as well as a set of rewrite rules for those wishing to preserve backward compatible URLs for any helper programs doing the wrong thing and relying on them. Signed-off-by: Dan McGee Signed-off-by: Lukas Fleischer