markzz/aurweb.git/web, branch v2.0.1aurweb working repositoryhttps://git.markzz.net/markzz/aurweb.git/atom/web?h=v2.0.12012-11-07T00:00:43ZRelease 2.0.12012-11-07T00:00:43ZLukas Fleischerarchlinux@cryptocrack.de2012-11-07T00:00:43Zurn:sha1:dd61e561a0a222bc0952e428081f6811236aeba8
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
pkg_details.php: Fix potential XSS for package names and dep conditions2012-11-06T23:59:28Zcanyonknightcanyonknight@gmail.com2012-11-06T22:13:45Zurn:sha1:4161e147969a3445ffd84dcd10b99baaee523bce
Package names and dep conditions can be specially crafted for an XSS
attack. Properly sanitize these variables on the package details page.
In addition, avoid including dep conditions as part of a package link.
Signed-off-by: canyonknight <canyonknight@gmail.com>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Avoid use of "$_SERVER['REQUEST_URI']"2012-11-04T18:19:32ZLukas Fleischerarchlinux@cryptocrack.de2012-11-04T18:13:03Zurn:sha1:630f1cbae8473fb05e5f5af7244eccc60fe93812
Use the routing library to build proper URIs instead of relying on the
"REQUEST_URI" server variable which can be manipulated and might return
bogus URIs.
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Avoid double slashes in notifications2012-11-04T18:19:22ZLukas Fleischerarchlinux@cryptocrack.de2012-11-04T18:06:22Zurn:sha1:f190a845775381dfa8f583bd587337ae647629e8
Both get_pkg_uri() and get_user_uri() should always return root-relative
URLs -- do not prepend another "/".
Fixes FS#32460.
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
routing.inc.php: Return proper (non-virtual) URIs2012-11-04T18:14:11ZLukas Fleischerarchlinux@cryptocrack.de2012-11-04T17:54:21Zurn:sha1:9169c3a7ac3f1def04ccc34b03b4b8f7a9e82208
Make sure we always return root-relative URIs in get_pkg_uri() and in
get_user_uri() and prepend a slash ("/") if the virtual URL feature is
disabled.
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
pkgsubmit.php: Show a warning for split packages2012-11-04T17:03:18ZLukas Fleischerarchlinux@cryptocrack.de2012-11-04T16:53:57Zurn:sha1:789245077d1ded7b2aaf4631bbca2a9267690739
Display a special error message if the package is identified as split
package.
Currently, the AUR displays a very vague error message when a split
package is submitted ("Invalid name: only lowercase letters are
allowed"). This often caused confusion among package submitters, see
FS#22834 and FS#32450.
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
pkg_details.php: Remove plural from the adopt/disown button2012-11-04T16:08:35ZLukas Fleischerarchlinux@cryptocrack.de2012-11-04T16:05:12Zurn:sha1:73656e17bd93132dc6864c4730a549f538fbf6bd
Fixes FS#32455.
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Add missing internationalization to a few strings2012-11-04T16:08:31ZLukas Fleischerarchlinux@cryptocrack.de2012-11-04T16:02:13Zurn:sha1:274182a424e9ccce8966832bd457c4140bb1ceea
Fixes FS#32449.
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
header.php: Do not lowercase language selection entries2012-11-04T15:49:47ZLukas Fleischerarchlinux@cryptocrack.de2012-11-04T15:49:47Zurn:sha1:4e4db4133bb7bdbc99d83934081b0315c461861a
Commit 091c2b5f5523773604699b914c19e6b02ce290bc introduced lower casing
to the language drop-down list. Revert this and use htmlspecialchars()
to escape language entries instead.
Addresses FS#32453.
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Release 2.0.02012-11-04T10:15:10ZLukas Fleischerarchlinux@cryptocrack.de2012-11-04T10:15:10Zurn:sha1:406686bc22f39342c0faf8c83e4a68d7321611ff
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>