Call pkgbase_user_voted() and pkgbase_user_notify() using the package
base ID instead of using the package ID.

Fixes FS#40165.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

Split out package licenses into two separate tables in order to support
multiple licenses per package. The code on the package details page is
adjusted accordingly.

UPGRADING contains instructions on how to convert existing licenses in
the database to the new layout.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

The groups field is hidden if a package doesn't belong to any group.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

This adds information from the following three fields to the package
details page:

* conflicts
* provides
* replaces

If either of these fields is empty, it is not displayed.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

Collapse package dependency lists with more than 20 entries and add a
link to show the full list.

The JavaScript code for this originates from the archweb project. Note
that the full list is shown when JavaScript is disabled or unavailable.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

This adds a label to makedepends, checkdepends and optdepends on the
package details page. makedepends are labelled with "(make)",
checkdepends with "(check)" and optdepends are labeled with
"(optional)", followed by the optdepend description.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

Package actions now operate on package bases instead of packages. Move
all actions to the correct locations.

This also fixes some issues with comment notifications.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

* Extends changes in 81d4cc13


* Modify getvotes() to use the package name rather than package ID
* Rename getvotes() to votes_for_pkgname() for clarity with new changes
* Modify routing framework and links to now use package names for voters.php

Signed-off-by: canyonknight <canyonknight@gmail.com>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

* Changes adopting/disowning packages to use GET instead of POST
* Uses CSS to make form submit button look like a link
* Complements commit 3bc951e3



Signed-off-by: canyonknight <canyonknight@gmail.com>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

We fixed all known CRSF vulnerabilities in commit 2c93f0a9 (Implement
token system to fix CSRF vulnerabilities, 2012-06-23). c349cb2f

 (Add
virtual path support for package actions, 2012-07-17) partly reverted
this by injecting a valid CRSF token when virtual paths are in use.

This patch allows for keeping the virtual path feature, while
reintroducing POST forms and CRSF tokens. Actions like package flagging,
votes and notifications are no longer prone to CRSF (see FS#35437 for
details).

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

Use forms and POST instead of GET for following actions:

* Flagging/Unflagging a package out-of-date
* Voting for a package and removing votes
* Enabling/Disabling notifications

Use CSS to make the submit buttons of these forms look like links.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

Signed-off-by: canyonknight <canyonknight@gmail.com>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

Package names and dep conditions can be specially crafted for an XSS
attack. Properly sanitize these variables on the package details page.

In addition, avoid including dep conditions as part of a package link.

Signed-off-by: canyonknight <canyonknight@gmail.com>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

Fixes FS#32455.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

Fixes FS#32449.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

The main site, wiki, and BBS are using HTTPS exclusively, so link
directly to the correct protocol rather than forcing a redirect.

Signed-off-by: Dan McGee <dan@archlinux.org>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

Signed-off-by: canyonknight <canyonknight@gmail.com>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

When virtual URLs are enabled, simpler links can be used to access
a user's account details page. Change this for both the maintainer and
submitter links.

Keeps backwards compatibility with virtual URLs being disabled.

Signed-off-by: canyonknight <canyonknight@gmail.com>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

Package actions now have a separate box on the package details page. Add
a package merge link in that box.

Link leads to a new page (pkgmerge.php) that can be used to confirm package
merging. A separate page with confirmation is used to avoid CSRFs.

Signed-off-by: canyonknight <canyonknight@gmail.com>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

Package actions now have a separate box on the package details page. Make
a package deletion link in that box.

Link leads to a new page (pkgdel.php) that can be used to confirm package
deletion. A separate page with confirmation is used to avoid CSRFs.

Signed-off-by: canyonknight <canyonknight@gmail.com>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

Replace all occurrences of "<?php echo" and "<?php print" by "<?=" to
reduce noise in templates.

Note that as of PHP 5.4.0, "<?=" is always available and no longer
requires "short_open_tag" to be set.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

Reported-by: canyonknight <canyonknight@gmail.com>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

Currently everyone is allowed to unflag a package as out of date. This should
be limited to only the appropriate people for a specific package.

Fixes FS#27263

Signed-off-by: canyonknight <canyonknight@gmail.com>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

The "Required by" column already handles an empty list appropriately. Move a
</div> tag to match that behavior in the "Dependencies" column

Signed-off-by: canyonknight <canyonknight@gmail.com>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

Link to "/packages/$pkgname/voters/" instead of using "/voters/" and a
get parameter to request a specific package by ID.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

archweb uses "<div></div>" and "<p></p>" here.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

Move the flag/unflag action below the flag date.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

Note that this currently only works if the virtual path feature is
enabled. If you don't use virtual paths, these will still be displayed
as buttons below the package details listing.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

When a package is requested by name, the "ID" request parameter might be
unset. Use the "ID" field of the query result instead.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

Extend the routing front/back ends to allow for using
"/package/$pkgname/" for individual packages.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

Use virtual paths in links (e.g. link to "/packages/" instead of
"/packages.php" etc.) if the virtual path feature is enabled.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

The corresponding closing "</div>" tag is only printed if the if-branch
is taken, which results in broken HTML code if the if-branch is skipped.
Move the "<div>" tag so that either both or none of the tags are
included in the generated HTML code.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

Remove an erroneous quote from the destination URL of links to
officially supported package dependencies on archweb.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

* Rearrange order of package details to a more logical order
* Add widget box on right side of page that has package actions. Limited to
viewing PKGBUILD, downloading tarball, and printing package flag date.
Eventually should be able to support all AUR package actions.
* Move "Dependencies" and "Required by" to new CSS to allow for them to be
displayed as columns adjacent to one another, with one package per line.

Signed-off-by: canyonknight <canyonknight@gmail.com>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>

Using a div container to format heading is ridiculous. Use "<h2></h2>"
instead.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Signed-off-by: canyonknight <canyonknight@gmail.com>