The SQLite schema is generated automatically from the main schema and
used in the test suite.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Since commit a66c7fa6 (notify.py: Use a/an correctly when sending request
notifications, 2019-08-09), the body of notification emails sent when
filing orphan requests refers to "an orphan request" instead of "a
orphan request".

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

We support multiple database backends. Don't require Python modules for
all backends to be installed.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Verify that the update hook exists and is executable before running Git
to prevent from broken repositories when permissions are broken.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

There's no need to use permanent storage for rate limiting information;
try to keep it in memory if caching is enabled.

From experiments with our live setup, this reduces the number of
INSERT/DELETE operations per second from 15 to almost 0. Disk writes on
the server hosting the AUR are reduced by 90% (from ~3MB/s to ~300kB/s).

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Limit the display to two decimal points for packages with a popularity
of at least 0.2.

Suggested-by: Allan McRae <allan@archlinux.org>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

The TTL for package details can be much longer than for generic values
since they never change. Note that when an update is pushed via Git, all
packages belonging to that package base are deleted and new packages are
created.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Cache more package details if the global caching mechanism is enabled.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Cache the results of the extended fields computation if the global
caching mechanism is enabled.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

The package provider and dependency queries are quite CPU-intensive and
usually yield rather small result sets. Cache these values if the global
caching mechanism is enabled.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

With the previous implementation, unlucky users could have their CAPTCHA
be invalidated by a single account creation while filling out their
account registration form.

Make this more robust by allowing up to five account registrations
before rejecting a CAPTCHA salt.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Add a CAPTCHA to protect against automated account creation. The CAPTCHA
changes whenever three new accounts are registered.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Lars Rustand authored 5 years ago and Lukas Fleischer committed 5 years ago

Will no longer send notifications about "a orphan request", but determine
whether to use a/an based on the first character of the request type.

Signed-off-by: Lars Rustand <rustand.lars@gmail.com>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

In commit 3578e77a we implemented
listing of comments from the account details page , but this was
intended to only be available to TUs and Devs. As the comment says:
"display the comment list if they're a TU/dev"

The credential checking code, however, set this credential for all
users, contrary to the intention of the commit.

In order to preserve the ability to list a person's own comments, also
declare the allowed uids based on the profile being viewed.

Johannes Löthberg authored 5 years ago and Lukas Fleischer committed 5 years ago

Since 09cb61ab (schema: Remove invalid default values for TEXT columns,
2017-04-15) the PackageRequests.ClosureComment field no longer has a
default value.

Signed-off-by: Johannes Löthberg <johannes@kyriasis.com>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Michael Straube authored 5 years ago and Lukas Fleischer committed 5 years ago

Signed-off-by: Michael Straube <michael.straube@posteo.de>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

VCS packages should not be flagged out-of-date when the package version
does not match the most recent commit.

Implements FS#62733.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Addresses FS#61803.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Fixes FS#59837.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

After creating a new account, users need to verify their email address
and set an initial password. Without setting a password, users cannot
use their account on the web interface. However, when logging in via
SSH, we did not check whether the account is verified.

Fix this by only allowing SSH access once a password is set.

Reported-by: Pat Hogan <pathtofile@gmail.com>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Vladimir Panteleev authored 6 years ago and Lukas Fleischer committed 5 years ago

Currently, it is a little to easy to forget to enable notifications
for a package after leaving a comment, thus never being notified of a
reply. Even though the "Enable notifications" link is on the same
page, it is not part of the flow for posting a new comment, and so,
easy to miss.

Most web forums and comment systems include a checkbox to enable
notifications when posting for the first time in a thread. This patch
implements this in aurweb, as well.

Signed-off-by: Eli Schwartz <eschwartz@archlinux.org>

Because filtering by matching the sender && regular expressions on the
subject is awkward.

Signed-off-by: Eli Schwartz <eschwartz@archlinux.org>

Reverse the order of deletion and addition so that deletion comes first.
This prevents corner cases such as failing unique key constraints when a
provided package changes from lower case to upper case and the old name
is not yet gone.

Helped-by: Eli Schwartz <eschwartz@archlinux.org>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Florian Pritz authored 6 years ago and Eli Schwartz committed 6 years ago

Signed-off-by: Florian Pritz <bluewind@xinu.at>
Signed-off-by: Eli Schwartz <eschwartz@archlinux.org>

Notifications are still going to the wrong people. We tried to fix this
in commit b702e5c0, but only fixed it
for the python callers. There's another caller in the php code, which
needs to use the right order of arguments as well.

Fixes FS#60601

Signed-off-by: Eli Schwartz <eschwartz@archlinux.org>

Vladimir Panteleev authored 6 years ago and Eli Schwartz committed 6 years ago

As of today, there is no easy way to obtain a link to a specific
comment on a package page.

Many implementations of forums and comment systems today seem to
follow a convention where a comment's timestamp is an unobtrusive link
to the comment itself. Some examples are:

- phpBB (e.g. bbs.archlinux.org)
- GitHub
- Disqus
- Discourse

This patch adopts this convention as well, by making the timestamp a
link to the comment.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Use disjoint sets of IDs for users, package bases, package comments and
package requests to ensure the notification script expects the
parameters in the same order we pass them.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Since commit a7865ef5 (Make the locale directory configurable,
2018-07-22), we need to specify the locale directory in the
configuration file.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Eli Schwartz authored 6 years ago and Lukas Fleischer committed 6 years ago

In commit f3b4c5c6 (Refactor the notification script, 2018-05-17), the
parameters of the adopt, disown, comaintainer-add and
comaintainer-remove notification modules were accidentally pushed around
without changing the order in the callers. The notify script now expects
to see the userid followed by additional arguments like the pkgbase id.

As a result, some random userid with the same id as the pkgbase, got
sent a notification regarding some package with the same id as the real
user's id.

Fix this by changing the order in every invocation of the aforementioned
modules.

Signed-off-by: Eli Schwartz <eschwartz@archlinux.org>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Johannes Löthberg authored 6 years ago and Lukas Fleischer committed 6 years ago

Signed-off-by: Johannes Löthberg <johannes@kyriasis.com>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Johannes Löthberg authored 6 years ago and Lukas Fleischer committed 6 years ago

Signed-off-by: Johannes Löthberg <johannes@kyriasis.com>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>