summaryrefslogtreecommitdiffstats
path: root/web/lib
AgeCommit message (Collapse)AuthorFilesLines
2014-02-04Add support for anonymous commentsLukas Fleischer1-5/+5
This allows for removing users without also removing the corresponding comments. Instead, all comments from deleted users will be displayed as "Anonymous comment". Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2014-02-01Sort last TU votes by vote and by user nameLukas Fleischer1-1/+1
Instead of using a random secondary order, sort by the ID of the last vote first, then by user name. Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2014-01-22Further optimize voters.php to only need the package namecanyonknight1-5/+6
* Extends changes in 81d4cc13dcae2f159ed937d4ce41e1df7d3c82b0 * Modify getvotes() to use the package name rather than package ID * Rename getvotes() to votes_for_pkgname() for clarity with new changes * Modify routing framework and links to now use package names for voters.php Signed-off-by: canyonknight <canyonknight@gmail.com> Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2014-01-20acctfuncs.inc.php: Allow translation of missing stringscanyonknight1-2/+2
Signed-off-by: canyonknight <canyonknight@gmail.com> Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2014-01-13Release 2.3.1Lukas Fleischer1-1/+1
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2013-09-02Release 2.3.0Lukas Fleischer1-1/+1
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2013-09-02Specify charset in Content-Type header when returning JSON data from API.Chris Down1-0/+1
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2013-08-28Only include current TUs in the last votes listLukas Fleischer1-3/+4
Do not show users that took part in past TU votes but no longer have TU powers. Also, fix the sorting column while we're touching these lines. Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2013-08-27Move package comment check to packages.phpLukas Fleischer1-4/+0
Checking whether to add a comment is something that really does not belong to a function named display_package_details(). Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2013-08-27Add boolean return values to several pkg_*() functionsLukas Fleischer1-42/+42
Change the return values of following functions to return both error/success and an error/success message: * pkg_flag() * pkg_unflag() * pkg_adopt() * pkg_vote() * pkg_delete() * pkg_notify() * pkg_delete_comment() * pkg_change_category() Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2013-08-27Exclude running votes from "Last Votes by TU"Lukas Fleischer1-1/+4
Showing running votes potentially allows for tracking votes and associating yes/no/abstain votes with specific TUs. Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2013-08-26Add Japanese and Slovak languagesLukas Fleischer1-0/+2
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2013-08-26Add "Last Votes by TU" listLukas Fleischer1-0/+19
This shows a list of all Trusted Users and the vote ID of the last proposal each of the TUs voted on. This list is sorted by vote ID. Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2013-08-22Add a vote type to the TU proposal formLukas Fleischer1-3/+4
There are only four valid reasons for starting a TU vote, so instead of letting the user choose a vote length, let her pick a reason and set vote length and quorum based on that selection. Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2013-08-22Store the number of TUs when starting a voteLukas Fleischer1-2/+8
This will be used for automated calculation of vote participation later. Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2013-08-22Allow for setting an account's inactivity statusLukas Fleischer1-6/+22
This adds a field to the users table and corresponding fields to the account edit and display forms that allow for setting an (in-)activity status. This might turn out to be useful if a user is on vacation and can not respond to update/orphan/deletion requests. Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2013-08-17Merge branch 'maint'Lukas Fleischer1-1/+1
2013-08-17Release 2.2.1Lukas Fleischer1-1/+1
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2013-08-17Merge branch 'maint'Lukas Fleischer1-18/+41
2013-08-17Upgrade Archive/Tar from PEAR to work with php 5.5Dave Reisner1-18/+41
This resolves issues with backwards incompatible changes to pack/unpack in php 5.5: http://www.php.net/manual/de/migration55.incompatible.php Signed-off-by: Dave Reisner <dreisner@archlinux.org> Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2013-04-24Remove superfluous search wrapper functioncanyonknight1-10/+0
The search_accounts_form() wrapper function doesn't have any arguments and only makes it unclear what is happening within account.php Signed-off-by: canyonknight <canyonknight@gmail.com> Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2013-03-26Release 2.2.0Lukas Fleischer1-1/+1
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2013-03-25Show hint if password is empty during loginLukas Fleischer1-2/+31
A user might have an empty password due to two reasons: * The user just created an account and needs to set an initial password. * The password has been reset by the administrator. In both cases, the user might be confused as to why the login does not work. Add a message that helps users debug the issue in both cases. Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2013-03-24Implement IP banning for user registration and user logincanyonknight1-1/+34
Adds a new is_ipbanned() function to determine whether the user attempting to login or register for an account has their IP address listed in the "Bans" table. Signed-off-by: canyonknight <canyonknight@gmail.com> Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2013-03-21Save last login IP addressLukas Fleischer1-1/+2
Save the IP address used for the last login in the "Users" table. This makes it a bit easier to create IP ban lists for spammers without looking at web server logs. Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2013-03-21process_account_form(): Highlight errorsLukas Fleischer1-1/+1
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2013-03-19process_account_form(): Allow using empty passwordsLukas Fleischer1-13/+25
If an empty password is passed during account registration, login for the new user is disabled and a reset key is sent to the new user's e-mail address so that they can set an initial password manually. Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2013-03-19Move reset key submission to a separate functionLukas Fleischer1-0/+26
This allows for reusing reset key submission for other things, such as sending an initial password reset code during account registration. Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2013-03-19Fix typo in delete permission warningConnor Behan1-1/+1
Signed-off-by: Connor Behan <connor.behan@gmail.com> Signed-off-by: canyonknight <canyonknight@gmail.com> Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2013-03-18Release 2.1.0Lukas Fleischer1-1/+1
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2013-02-10Remove checks before calling connection methodcanyonknight3-226/+75
Large amount of boilerplate code that checks if a database connection exists is useless now that the new connection method automatically does the same check. Signed-off-by: canyonknight <canyonknight@gmail.com> Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2013-02-10Remove documentation references to database parametercanyonknight4-71/+0
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2013-02-10Remove unnecessary database connection parameter from all functionscanyonknight5-115/+116
All functions now have a database connection method that will use the same database connection. This imitates the functionality of passing a database connection as an argument and makes it redundant. Signed-off-by: canyonknight <canyonknight@gmail.com> Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2013-02-10Add database wrapper class and new connection methodcanyonknight6-98/+108
Uses the Singleton pattern to ensure all queries use the same database connection that is released upon script completion. All database connections should now be called with DB::connect() and not db_connect(). Signed-off-by: canyonknight <canyonknight@gmail.com> Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2013-01-30Merge branch 'maint'Lukas Fleischer2-8/+26
2013-01-30acctfuncs.inc.php: Change wording of account editing messagecanyonknight1-1/+1
An error message is printed when the number of affected rows is 0 for an edited account. A count of 0 doesn't imply an error, only that no changes were made in the database. Signed-off-by: canyonknight <canyonknight@gmail.com> Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2013-01-30Clear a user's active sessions following account suspensioncanyonknight1-0/+19
A suspended user can stay in active sessions. Introduce new function delete_user_sessions to remove all open sessions for a specific user. Allows suspensions to take effect immediately. Signed-off-by: canyonknight <canyonknight@gmail.com> Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2013-01-30acctfuncs.inc.php: Change return type of valid_username functioncanyonknight1-6/+5
The function is only determining whether a username is valid, so it makes more sense to simply return a boolean value. Signed-off-by: canyonknight <canyonknight@gmail.com> Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2013-01-30aur.inc.php: Fix PHP undefined index notice for AURSIDcanyonknight1-1/+1
Occurs in the rare situation where a logged out user tries to POST a CSRF token. Signed-off-by: canyonknight <canyonknight@gmail.com> Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2013-01-19Merge branch 'maint'Lukas Fleischer2-5/+0
2013-01-19stats.inc.php: Remove unnecessary account type lookupcanyonknight1-3/+0
Signed-off-by: canyonknight <canyonknight@gmail.com> Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2013-01-19Remove double htmlspecialcharsMarcel Korpel1-2/+0
This is already done in header.php; doing this double will result in &amp; in title element Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2013-01-19Add description meta-element to package pagesMarcel Korpel2-31/+52
Implements FS#33294 Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2013-01-19Implemented typeahead suggestMarcel Korpel1-1/+21
Use Twitter Bootstrap JavaScript framework for typeahead support. Add a new "suggest" JSON method, which returns the first 20 packages that match the beginning characters of a query. canyonknight: Link format change, commit message Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2012-12-22Merge branch 'maint'Lukas Fleischer1-1/+1
2012-12-22Changed 'Dutch' to 'Nederlands'Marcel Korpel1-1/+1
Supported languages are listed in their native language. Only Dutch is in English. Translate reference into Dutch. canyonknight: Commit message clarity Signed-off-by: canyonknight <canyonknight@gmail.com> Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2012-12-07Merge branch 'maint'Lukas Fleischer1-2/+31
2012-12-07Split package flagging and unflagging into separate functionscanyonknight@gmail.com1-31/+43
Currently, package flagging and unflagging takes place within the pkg_flag() function. A bool is set to true or false depending on the action. Create new pkg_unflag() function with sole purpose of unflagging and keep pkg_flag() in place. This split will be useful in the overhaul of the notification system. Signed-off-by: canyonknight <canyonknight@gmail.com> Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2012-11-29Fix account privilege escalation vulnerabilitycanyonknight1-2/+2
A check is only done to verify a Trusted User isn't promoting their account. An attacker can send tampered account type POST data to change their "User" level account to a "Developer" account. Add check so that all users cannot increase their own account permissions. Signed-off-by: canyonknight <canyonknight@gmail.com> Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
2012-11-29Fix account editing and hijacking vulnerabilitycanyonknight1-0/+29
Checks are in place to avoid users getting account editing forms they shouldn't have access to. The appropriate checks before editing the account in the backend are not in place. This vulnerability allows a user to craft malicious POST data to edit other user accounts, thereby allowing account hijacking. Add a new flexible function can_edit_account() to determine if a user has appropriate permissions. Run the permission check before processing any account information in the backend. Signed-off-by: canyonknight <canyonknight@gmail.com> Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
generated by cgit v1.2.3-54-g00ecf (git 2.44.0) at 2024-07-10 18:14:42 +0000