Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Support secondary email addresses that can be used to recover an account
in case access to the primary email address is lost. Reset keys for an
account are always sent to both the primary and the backup email
address.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Florian Pritz authored 6 years ago and Eli Schwartz committed 6 years ago

Signed-off-by: Florian Pritz <bluewind@xinu.at>
Signed-off-by: Eli Schwartz <eschwartz@archlinux.org>

Florian Pritz authored 7 years ago and Lukas Fleischer committed 7 years ago

This allows us to prevent users from hammering the API every few seconds
to check if any of their packages were updated. Real world users check
as often as every 5 or 10 seconds.

Signed-off-by: Florian Pritz <bluewind@xinu.at>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

This allows for adding Terms of Service documents to the database that
registered users need to accept before using the AUR. A revision field
can be used to indicate whether a document was updated. If it is
increased, all users are again asked to accept the new terms.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Instead of converting package comments from plain text to HTML code when
they are displayed, do the conversion when the comment is posted and
store the rendered result in the database. The conversion itself is done
by a Python script which uses Bleach for sanitizing the text.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Split optional dependency descriptions from dependency names before
storing them in the database and use a separate column to store the
descriptions.

This allows us to simplify and optimize the SQL queries in
pkg_dependencies() as well as pkg_required().

Suggested-by: Florian Pritz <bluewind@xinu.at>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Replace the default hash function used for storing passwords by
password_hash() which internally uses bcrypt. Legacy MD5 hashes are
still supported and are immediately converted to the new format when a
user logs in.

Since big parts of the authentication system needed to be rewritten in
this context, this patch also includes some simplification and
refactoring of all code related to password checking and resetting.

Fixes FS#52297.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Inspired by commit 32c8d0c3 (Store last login address as plain text,
2016-03-13).

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

In addition to logging the last login date and IP address on the web
interface, store the time stamp and IP address of the last SSH login in
the database.

This simplifies user banning if one of the new SSH interface features,
such as the voting mechanism implemented in 7ee2fddc (git-serve: Add
support for (un-)voting, 2017-01-23), is abused.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Mark Weiman authored 8 years ago and Lukas Fleischer committed 8 years ago

Currently, aurweb displays all dates and times in UTC time. This patch
adds a capability for each logged in user to set their preferred
timezone.

Implements FS#48729.

Signed-off-by: Mark Weiman <mark.weiman@markzz.com>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Add wrappers for the maintenance scripts to the setuptools
configuration.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Since d4fe77ac (Reorganize Git interface scripts, 2016-10-08), the key
components of the aurweb SSH interface are installed system-wide. Update
the default configuration path to point to a central location.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

The location of the Git interface wrapper scripts was changed by commit
d4fe77ac (Reorganize Git interface scripts, 2016-10-08). Add a note to
the upgrade instructions to remind users to update their configuration
files.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

According to RFC 7230, URLs can be up too 8000 characters long. Resize
all URL fields accordingly.

Also, add a test to verify that URLs with more than 8000 characters are
rejected by the update hook.

Reported-by: Andreas Linz <klingt.net@gmail.com>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Johannes Löthberg authored 8 years ago and Lukas Fleischer committed 8 years ago

The language code for Latin American Spanish is es_419, which is longer
than the 5 characters previously allowed.

Signed-off-by: Johannes Löthberg <johannes@kyriasis.com>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Allow users to add a link to their homepage to their profile.

Implements FS#22774.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

When updating the list of packages provided by the official
repositories, also save the repository names.

Make sure that all valid IPv6 addresses fit into the LastLoginIPAddress
field.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Directly store the information contained in $_SERVER['REMOTE_ADDR']
instead of using ip2long() which does not support IPv6 addresses. Note
that the LastLoginIPAddress field is designed to be used by the
administrator on rare occasions only (e.g. to fight spam) and is not
displayed anywhere.

Fixes FS#48557.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Add a new option that makes it possible to subscribe to package
ownership changes (adoption/disownment).

Fixes FS#15412.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Add a shell script to rebuild the documentation and install
translations. Can be executed manually or used as a post-checkout hook
in Git.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Introduce a new notification option to receive notifications when a new
commit is pushed to a package repository.

Implements FS#30109.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Add a configuration option to the account edit page that allows for
globally enabling/disabling package base comment notifications.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

As a preparatory step to adding support for package notifications on
events other than comments, rename the database table accordingly.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Mark Weiman authored 9 years ago and Lukas Fleischer committed 9 years ago

Makes FlaggerComments a TEXT field to be more consistent with package
comments.

Signed-off-by: Mark Weiman <mark.weiman@markzz.com>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Instead of modifying EditedTS when a comment is deleted, use a separate
field DelTS. Use this field to determine whether a comment has been
deleted, instead of checking DelUsersID which might be unset when the
corresponding user is deleted.

Fixes FS#47362.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Mark Weiman authored 9 years ago and Lukas Fleischer committed 9 years ago

Adds capability to pin comments before others.

Implements FS#10863.

Signed-off-by: Mark Weiman <mark.weiman@markzz.com>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Stefan Auditor authored 9 years ago and Lukas Fleischer committed 9 years ago

Using unique indexes on VARCHAR fields with a character count of more
than 255 produces an error in MySQL with InnoDB tables and UTF-8
encoding.

Also, as per https://www.rfc-editor.org/errata_search.php?eid=1690

, the
maximum length for email addresses is limited to 254 characters.

Fixes FS#47038.

Signed-off-by: Stefan Auditor <stefan.auditor@erdfisch.de>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

According to RFC 3696 (and the associated errata), an email address can
be up to 256 characters long. Change the database field and the length
limit on all input fields accordingly.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Maintain a list of virtual provisions of packages from the official
binary package repositories. The list can be updated using the aurblup
script, e.g. via a cronjob.

This allows for adding proper links to package dependencies: If an AUR
package depends on a package from the official repositories (or on a
name provided by a package from the official repositories), add a link
to the corresponding archweb package details page. If an AUR package
depends on another AUR package (or on a name provided by another AUR
package), add a link to the corresponding aurweb package details page.
Otherwise, just display the name and do not add a link at all.

Fixes FS#46549.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Marcel Korpel authored 9 years ago and Lukas Fleischer committed 9 years ago

Implements FS#42343.

Signed-off-by: Marcel Korpel <marcel.korpel@gmail.com>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Marcel Korpel authored 9 years ago and Lukas Fleischer committed 9 years ago

Signed-off-by: Marcel Korpel <marcel.korpel@gmail.com>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Implements FS#42827.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Add a new FlaggerUID field to the database and use it to store the user
ID of the account who recently flagged a package out-of-date.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Marcel Korpel authored 9 years ago and Lukas Fleischer committed 9 years ago

Create two new actions, do_AddComment and do_EditComment. When editing
or deleting a comment, a timestamp is added.

Signed-off-by: Marcel Korpel <marcel.korpel@gmail.com>
Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>

Attaching more than one SSH public key to the same account is useful,
e.g. if one uses different machines to access the AUR SSH interface.
Multiple keys can now be specified by adding multiple lines to the text
area on the account edit form.

Implements FS#45469.

Signed-off-by: Lukas Fleischer <lfleischer@archlinux.org>
Acked-by: Leonidas Spyropoulos <artafinde@gmail.com>