Yaron Shahrabani authored Feb 21, 2020 and Lukas Fleischer committed Feb 26, 2020

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Eli Schwartz authored Feb 12, 2020 and Lukas Fleischer committed Feb 13, 2020

The try_login() function documents it returns an array containing an
'error' key, and our only caller *only* consults the 'error' key. Then
the function returns null instead of an array, if the login succeeded!

I question why we bother returning the new SID if we never use it,
surely we could either return the error or return default null. But, for
now, I'm just going to fix it to return what it's actually supposed to,
without changing the API.
Signed-off-by: Eli Schwartz <eschwartz@archlinux.org>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Eli Schwartz authored Feb 12, 2020 and Lukas Fleischer committed Feb 13, 2020

If a db query returned NULL instead of an array, then accessing $row[0]
now throws a warning. The undocumented behavior of evaluating to NULL
is maintained, and we want to return NULL anyway, so add a check for the
value and fall back on the default function return type.
Signed-off-by: Eli Schwartz <eschwartz@archlinux.org>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Add more options to configure the smtplib implementation for sending
notification emails.

The port can be changed using the new smtp-port option.

Encryption can be configured using smtp-use-ssl and smtp-use-starttls.
Keep in mind that you usually also need to change the port when enabling
either of these options.

Authentication can be configured using smtp-user and smtp-password.
Authentication is disabled if either of these values is empty.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Support mail delivery without a local MTA. Instead, an SMTP server can
now be configured using the smtp-server option in the [notifications]
section. In order to use this option, the value of the sendmail option
must be empty.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Frédéric Mangano-Tarumi authored Feb 02, 2020 and Lukas Fleischer committed Feb 02, 2020

First, this gets rid of the deprecation warnings Python displayed.

Second, this fixes the case where a link contained a pair of
underscores, which used to be interpreted as an emphasis because the
linkify processor ran after the emphasis processor.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Frédéric Mangano-Tarumi authored Feb 02, 2020 and Lukas Fleischer committed Feb 02, 2020

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Frédéric Mangano-Tarumi authored Feb 02, 2020 and Lukas Fleischer committed Feb 02, 2020

When an FS#123 is part of a code block, it must not be converted into a
link. FS#123 may also appear inside an URL, in which case regular
linkifaction of URLs must take precedence.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Frédéric Mangano-Tarumi authored Feb 01, 2020 and Lukas Fleischer committed Feb 02, 2020

Fixes a few edge cases:

- URLs within code blocks used to get redundant <> added, breaking bash
  code snippets like `curl https://...`

 into `curl <https://...>`.

- Links written with markdown's <https://...> syntax also used to get an
  extra pair of brackets.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Frédéric Mangano-Tarumi authored Jan 31, 2020 and Lukas Fleischer committed Feb 02, 2020

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Frédéric Mangano-Tarumi authored Jan 30, 2020 and Lukas Fleischer committed Feb 02, 2020

Turn the git-commits markdown processor into an inline processor, which
is smart enough not to convert Git hashes contained in code blocks or
links.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Addresses FS#64983.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Support secondary email addresses that can be used to recover an account
in case access to the primary email address is lost. Reset keys for an
account are always sent to both the primary and the backup email
address.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

In addition to supporting email addresses in the reset key form, also
support user names. The reset key is then sent to the email address in
the user's profile.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Since commits daee20c6 (Require current password when setting a new one,
2020-01-30) and 8fc8898f

 (Require password when deleting an account,
2020-01-30), changing a password and deleting an account require the
current password. Extend this to all other profile changes.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Further reduce the attack surface in case of a stolen session ID.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

When changing the password of an account, instead of asking for the old
password of the account, ask for the password of the currently logged in
user. This allows privileged users to edit other accounts without
knowing their passwords.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Rollback an accidental change that sneaked into commit daee20c6

 (Require
current password when setting a new one, 2020-01-30).
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Since commit eeaa1c3a

 (Separate text from footer in notification emails,
2020-01-04), information about unsubscribing from notifications is added
in a signature block. Fix the test cases accordingly.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Since commit eeaa1c3a

 (Separate text from footer in notification emails,
2020-01-04), information about unsubscribing from notifications is added
in a signature block. However, the code to format the email body trimmed
the RFC 3676 signature delimiter, replacing "-- " by "--". Fix this by
adding a special case for signature delimiters.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Prevent from easily taking over an account by changing the password with
a stolen session ID.

Fixes FS#65325.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Stephan Springer authored Jan 04, 2020 and Lukas Fleischer committed Jan 06, 2020

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

The Git repository URLs are not meant to be visited using a web browser.
Copy the link to the clipboard instead.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

The SQLite schema is generated automatically from the main schema and
used in the test suite.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Since commit a66c7fa6

 (notify.py: Use a/an correctly when sending request
notifications, 2019-08-09), the body of notification emails sent when
filing orphan requests refers to "an orphan request" instead of "a
orphan request".
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

We support multiple database backends. Don't require Python modules for
all backends to be installed.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Verify that the update hook exists and is executable before running Git
to prevent from broken repositories when permissions are broken.
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

There's no need to use permanent storage for rate limiting information;
try to keep it in memory if caching is enabled.

From experiments with our live setup, this reduces the number of
INSERT/DELETE operations per second from 15 to almost 0. Disk writes on
the server hosting the AUR are reduced by 90% (from ~3MB/s to ~300kB/s).
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Limit the display to two decimal points for packages with a popularity
of at least 0.2.
Suggested-by: Allan McRae <allan@archlinux.org>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>