File inc/rights.inc.php changed (mode: 100644) (index 84ca2dd..d9851c9) |
... |
... |
function rg_rights_validate_ip($list) |
651 |
651 |
*/ |
*/ |
652 |
652 |
function rg_rights_test_ip($list, $ip) |
function rg_rights_test_ip($list, $ip) |
653 |
653 |
{ |
{ |
654 |
|
rg_debug() && rg_log('rights_test_ip: ip=' . $ip); |
|
|
654 |
|
rg_log_debug('rights_test_ip: ip=' . $ip); |
655 |
655 |
|
|
656 |
656 |
$r = rg_rights_split_ip($ip); |
$r = rg_rights_split_ip($ip); |
657 |
657 |
if ($r === FALSE) { |
if ($r === FALSE) { |
|
... |
... |
function rg_rights_test($list, $needed_rights, $ip, $misc) |
698 |
698 |
{ |
{ |
699 |
699 |
global $rg_rights_cmp_func; |
global $rg_rights_cmp_func; |
700 |
700 |
|
|
701 |
|
rg_log_enter("rights_test: needed_rights=$needed_rights ip=$ip" |
|
702 |
|
. " misc=" . $misc); |
|
|
701 |
|
rg_log_enter('rights_test: needed_rights=' . $needed_rights |
|
702 |
|
. ' ip=' . $ip . ' misc=' . $misc); |
703 |
703 |
|
|
704 |
704 |
$ret = FALSE; |
$ret = FALSE; |
705 |
|
while (1) { |
|
|
705 |
|
do { |
706 |
706 |
$needed = explode("|", $needed_rights); |
$needed = explode("|", $needed_rights); |
707 |
707 |
|
|
708 |
708 |
foreach ($list as $k => $v) { |
foreach ($list as $k => $v) { |
709 |
|
rg_debug() && rg_log('k=' . $k . ': ' . rg_array2string($v)); |
|
|
709 |
|
rg_log_debug('k=' . $k . ': ' . rg_array2string($v)); |
710 |
710 |
// Test IP |
// Test IP |
711 |
711 |
if (rg_rights_test_ip($v['ip'], $ip) !== TRUE) |
if (rg_rights_test_ip($v['ip'], $ip) !== TRUE) |
712 |
712 |
continue; |
continue; |
|
... |
... |
function rg_rights_test($list, $needed_rights, $ip, $misc) |
731 |
731 |
foreach ($needed as $needed1) { |
foreach ($needed as $needed1) { |
732 |
732 |
$r = rg_rights_mask($v['rights'], $needed1); |
$r = rg_rights_mask($v['rights'], $needed1); |
733 |
733 |
if (strcmp($r, $needed1) != 0) { |
if (strcmp($r, $needed1) != 0) { |
734 |
|
rg_log('mask[' . $r . '] != needed[' |
|
|
734 |
|
rg_log_debug('mask[' . $r . '] != needed[' |
735 |
735 |
. $needed1 . ']! Continue.'); |
. $needed1 . ']! Continue.'); |
736 |
736 |
continue; |
continue; |
737 |
737 |
} |
} |
|
... |
... |
function rg_rights_test($list, $needed_rights, $ip, $misc) |
741 |
741 |
if ($have_a_match === FALSE) |
if ($have_a_match === FALSE) |
742 |
742 |
continue; |
continue; |
743 |
743 |
|
|
744 |
|
rg_log_debug('rule id ' . $k . ' matched.'); |
|
|
744 |
|
rg_log_debug('rule id ' . $k . ' match'); |
745 |
745 |
$ret = TRUE; |
$ret = TRUE; |
746 |
746 |
break; |
break; |
747 |
747 |
} |
} |
748 |
|
|
|
749 |
|
break; |
|
750 |
|
} |
|
|
748 |
|
} while (0); |
751 |
749 |
if ($ret === FALSE) |
if ($ret === FALSE) |
752 |
750 |
rg_log('deny'); |
rg_log('deny'); |
753 |
751 |
|
|
|
... |
... |
function rg_rights_allow($db, $a) |
801 |
799 |
$_old = $e['misc']; |
$_old = $e['misc']; |
802 |
800 |
$e['misc'] = str_replace('@USER@', |
$e['misc'] = str_replace('@USER@', |
803 |
801 |
$username, $e['misc']); |
$username, $e['misc']); |
804 |
|
rg_log("DEBUG [" . $_old . "] -> [" . $e['misc'] . "]"); |
|
|
802 |
|
rg_log_debug('[' . $_old . '] -> [' . $e['misc'] . ']'); |
805 |
803 |
} |
} |
806 |
804 |
//rg_log_debug('r[list]=' . print_r($r['list'], TRUE)); |
//rg_log_debug('r[list]=' . print_r($r['list'], TRUE)); |
807 |
805 |
} |
} |
File inc/user/packages.inc.php changed (mode: 100644) (index b3d1d1a..53020f4) |
... |
... |
$_f = array( |
14 |
14 |
rg_event_register_functions($_f); |
rg_event_register_functions($_f); |
15 |
15 |
|
|
16 |
16 |
/* |
/* |
17 |
|
* Some chars are not allowed in package names |
|
|
17 |
|
* Some chars are not allowed in package names. |
|
18 |
|
* This is security sensitive: a user may use special chars in username |
|
19 |
|
* that, after calling this function, will match another user. |
18 |
20 |
*/ |
*/ |
19 |
|
function rg_pkg_transform($type, $s) |
|
|
21 |
|
function rg_pkg_transform_user($type, $uid, $s) |
20 |
22 |
{ |
{ |
21 |
23 |
if (strcmp($type, 'deb') == 0) { |
if (strcmp($type, 'deb') == 0) { |
22 |
24 |
$s2 = strtolower($s); |
$s2 = strtolower($s); |
|
... |
... |
function rg_pkg_transform($type, $s) |
24 |
26 |
$s2 = str_replace('--', '-', $s2); |
$s2 = str_replace('--', '-', $s2); |
25 |
27 |
} else if (strcmp($type, 'rpm') == 0) { |
} else if (strcmp($type, 'rpm') == 0) { |
26 |
28 |
$s2 = preg_replace('/[^-A-Za-z0-9._]/', '-', $s); |
$s2 = preg_replace('/[^-A-Za-z0-9._]/', '-', $s); |
|
29 |
|
} else { |
|
30 |
|
$s2 = $s; |
27 |
31 |
} |
} |
28 |
|
rg_log_debug('pkg_transform[' . $type . ']: [' . $s . '] -> [' . $s2 . ']'); |
|
29 |
32 |
|
|
|
33 |
|
// I do not have a better idea. Maybe we can have a separate table with |
|
34 |
|
// a string provided by the user, but checked at user creation for |
|
35 |
|
// collisions. |
|
36 |
|
if (strcmp($s, $s2) != 0) |
|
37 |
|
$s2 = 'uid-' . $uid . '-' . $s2; |
|
38 |
|
|
|
39 |
|
rg_log_debug('pkg_transform_user[' . $type . ']: [' . $s . '] -> [' . $s2 . ']'); |
|
40 |
|
return $s2; |
|
41 |
|
} |
|
42 |
|
|
|
43 |
|
/* |
|
44 |
|
* Some chars are not allowed in package names. |
|
45 |
|
* This is NOT security sensitive because of the solving the user collision. |
|
46 |
|
*/ |
|
47 |
|
function rg_pkg_transform_repo($type, $s) |
|
48 |
|
{ |
|
49 |
|
if (strcmp($type, 'deb') == 0) { |
|
50 |
|
$s2 = strtolower($s); |
|
51 |
|
$s2 = preg_replace('/[^-a-z0-9.]/', '-', $s2); |
|
52 |
|
$s2 = str_replace('--', '-', $s2); |
|
53 |
|
} else if (strcmp($type, 'rpm') == 0) { |
|
54 |
|
$s2 = preg_replace('/[^-A-Za-z0-9._]/', '-', $s); |
|
55 |
|
} else { |
|
56 |
|
$s2 = $s; |
|
57 |
|
} |
|
58 |
|
|
|
59 |
|
rg_log_debug('pkg_transform_repo[' . $type . ']: [' . $s . '] -> [' . $s2 . ']'); |
30 |
60 |
return $s2; |
return $s2; |
31 |
61 |
} |
} |
32 |
62 |
|
|
|
... |
... |
function rg_pkg_prepare_for_build($db, &$a) |
45 |
75 |
$ei = rg_env_info($a['env']); |
$ei = rg_env_info($a['env']); |
46 |
76 |
$a['env_codename'] = $ei['codename']; |
$a['env_codename'] = $ei['codename']; |
47 |
77 |
|
|
|
78 |
|
$a['repo_username_allowed'] = rg_pkg_transform_user( |
|
79 |
|
$ei['pkg_type'], $a['uid'], $a['repo_username']); |
48 |
80 |
if (isset($a['repo_name'])) |
if (isset($a['repo_name'])) |
49 |
|
$a['repo_name_allowed'] = rg_pkg_transform($ei['pkg_type'], |
|
|
81 |
|
$a['repo_name_allowed'] = rg_pkg_transform_repo($ei['pkg_type'], |
50 |
82 |
$a['repo_name']); |
$a['repo_name']); |
51 |
|
$a['repo_username_allowed'] = rg_pkg_transform($ei['pkg_type'], |
|
52 |
|
$a['repo_username']); |
|
53 |
83 |
|
|
54 |
84 |
if (!isset($a['event_callbacks'])) |
if (!isset($a['event_callbacks'])) |
55 |
85 |
$a['event_callbacks'] = array(); |
$a['event_callbacks'] = array(); |
File inc/user/pkg_repo.inc.php changed (mode: 100644) (index 19a7ec5..93dcf1a) |
... |
... |
function rg_pkg_repo_edit($db, $d) |
157 |
157 |
|
|
158 |
158 |
$ret = FALSE; |
$ret = FALSE; |
159 |
159 |
$rollback = FALSE; |
$rollback = FALSE; |
160 |
|
while (1) { |
|
|
160 |
|
do { |
161 |
161 |
$orig_id = $d['id']; |
$orig_id = $d['id']; |
162 |
162 |
|
|
163 |
163 |
if (rg_pkg_repo_ok($d['name']) !== TRUE) |
if (rg_pkg_repo_ok($d['name']) !== TRUE) |
|
... |
... |
function rg_pkg_repo_edit($db, $d) |
239 |
239 |
rg_debug_html_set('pkg_repo', $row); |
rg_debug_html_set('pkg_repo', $row); |
240 |
240 |
|
|
241 |
241 |
$ret = $row['id']; |
$ret = $row['id']; |
242 |
|
break; |
|
243 |
|
} |
|
|
242 |
|
} while (0); |
244 |
243 |
if ($rollback) |
if ($rollback) |
245 |
244 |
rg_sql_rollback($db); |
rg_sql_rollback($db); |
246 |
245 |
|
|
|
... |
... |
function rg_pkg_repo_remove($db, $uid, $list) |
259 |
258 |
|
|
260 |
259 |
$ret = FALSE; |
$ret = FALSE; |
261 |
260 |
$rollback = 0; |
$rollback = 0; |
262 |
|
while (1) { |
|
|
261 |
|
do { |
263 |
262 |
// Security check - a user may delete others' ids |
// Security check - a user may delete others' ids |
264 |
263 |
$err = FALSE; |
$err = FALSE; |
265 |
264 |
foreach ($list as $id => $junk) { |
foreach ($list as $id => $junk) { |
|
... |
... |
function rg_pkg_repo_remove($db, $uid, $list) |
332 |
331 |
rg_cache_unset($k . 'pkg_maps', RG_SOCKET_NO_WAIT); |
rg_cache_unset($k . 'pkg_maps', RG_SOCKET_NO_WAIT); |
333 |
332 |
|
|
334 |
333 |
$ret = TRUE; |
$ret = TRUE; |
335 |
|
break; |
|
336 |
|
} |
|
|
334 |
|
} while (0); |
337 |
335 |
if ($rollback) |
if ($rollback) |
338 |
336 |
rg_sql_rollback($db); |
rg_sql_rollback($db); |
339 |
337 |
|
|
|
... |
... |
function rg_pkg_repo_info($db, $uid, $id) |
438 |
436 |
$ret = array(); |
$ret = array(); |
439 |
437 |
$ret['ok'] = 0; |
$ret['ok'] = 0; |
440 |
438 |
$ret['exists'] = 0; |
$ret['exists'] = 0; |
441 |
|
while (1) { |
|
|
439 |
|
do { |
442 |
440 |
$list = rg_pkg_repo_list($db, $uid); |
$list = rg_pkg_repo_list($db, $uid); |
443 |
441 |
if ($list === FALSE) |
if ($list === FALSE) |
444 |
442 |
break; |
break; |
|
... |
... |
function rg_pkg_repo_info($db, $uid, $id) |
453 |
451 |
|
|
454 |
452 |
$ret = array_merge($ret, $list[$id]); |
$ret = array_merge($ret, $list[$id]); |
455 |
453 |
$ret['exists'] = 1; |
$ret['exists'] = 1; |
456 |
|
break; |
|
457 |
|
} |
|
|
454 |
|
} while (0); |
458 |
455 |
|
|
459 |
456 |
rg_log_exit(); |
rg_log_exit(); |
460 |
457 |
rg_prof_end('pkg_repo_info'); |
rg_prof_end('pkg_repo_info'); |
|
... |
... |
function rg_pkg_repo_info_by_name($db, $uid, $name) |
498 |
495 |
*/ |
*/ |
499 |
496 |
function rg_pkg_repo_select($db, $name, $uid, $pkg_repo_id, $strict) |
function rg_pkg_repo_select($db, $name, $uid, $pkg_repo_id, $strict) |
500 |
497 |
{ |
{ |
501 |
|
if ($strict) |
|
|
498 |
|
if ($strict) // TODO: do we ever use strict? |
502 |
499 |
$list = rg_pkg_repo_list_one($db, $uid); |
$list = rg_pkg_repo_list_one($db, $uid); |
503 |
500 |
else |
else |
504 |
501 |
$list = rg_pkg_repo_list($db, $uid); |
$list = rg_pkg_repo_list($db, $uid); |
|
... |
... |
function rg_pkg_repo_list_high_level($db, $rg, $paras) |
528 |
525 |
rg_log_enter('pkg_repo_list_high_level'); |
rg_log_enter('pkg_repo_list_high_level'); |
529 |
526 |
|
|
530 |
527 |
$ret = ''; |
$ret = ''; |
531 |
|
while (1) { |
|
532 |
|
$errmsg = array(); |
|
533 |
|
|
|
|
528 |
|
do { |
534 |
529 |
$ui_login = rg_ui_login(); |
$ui_login = rg_ui_login(); |
535 |
|
$strict_list = rg_pkg_repo_list_one($db, $ui_login['uid']); // rename this to ..._no_global? |
|
536 |
|
if ($strict_list === FALSE) { |
|
537 |
|
$rg['errmsg'] = rg_pkg_repo_error(); |
|
538 |
|
$ret .= rg_template('user/settings/packages/repo/list_err.html', |
|
539 |
|
$rg, TRUE /*xss*/); |
|
540 |
|
break; |
|
541 |
|
} |
|
542 |
|
|
|
543 |
|
$list = rg_pkg_repo_list($db, $ui_login['uid']); |
|
|
530 |
|
$use_uid = $ui_login['is_admin'] == 1 ? 0 : $ui_login['uid']; |
|
531 |
|
$list = rg_pkg_repo_list($db, $use_uid); |
544 |
532 |
if ($list === FALSE) { |
if ($list === FALSE) { |
545 |
533 |
$rg['errmsg'] = rg_pkg_repo_error(); |
$rg['errmsg'] = rg_pkg_repo_error(); |
546 |
534 |
$ret .= rg_template('user/settings/packages/repo/list_err.html', |
$ret .= rg_template('user/settings/packages/repo/list_err.html', |
|
... |
... |
function rg_pkg_repo_list_high_level($db, $rg, $paras) |
550 |
538 |
rg_pkg_repo_cosmetic_list($db, $list); |
rg_pkg_repo_cosmetic_list($db, $list); |
551 |
539 |
|
|
552 |
540 |
$xlist = rg_var_str('delete_list'); |
$xlist = rg_var_str('delete_list'); |
|
541 |
|
rg_log_debug('xlist: ' . rg_array2string($xlist)); |
553 |
542 |
while (!empty($xlist)) { |
while (!empty($xlist)) { |
554 |
543 |
$del_errmsg = array(); |
$del_errmsg = array(); |
|
544 |
|
|
555 |
545 |
if (!rg_valid_referer()) |
if (!rg_valid_referer()) |
556 |
546 |
$del_errmsg[] = 'invalid referer; try again'; |
$del_errmsg[] = 'invalid referer; try again'; |
557 |
547 |
|
|
|
... |
... |
function rg_pkg_repo_list_high_level($db, $rg, $paras) |
568 |
558 |
$ret .= rg_template('user/settings/packages/repo/delete_ok.html', |
$ret .= rg_template('user/settings/packages/repo/delete_ok.html', |
569 |
559 |
$rg, TRUE /*xss*/); |
$rg, TRUE /*xss*/); |
570 |
560 |
foreach ($xlist as $_id => $junk) |
foreach ($xlist as $_id => $junk) |
571 |
|
unset($strict_list[$_id]); |
|
|
561 |
|
unset($list[$_id]); |
572 |
562 |
break; |
break; |
573 |
563 |
} |
} |
574 |
564 |
|
|
|
... |
... |
function rg_pkg_repo_list_high_level($db, $rg, $paras) |
577 |
567 |
} |
} |
578 |
568 |
|
|
579 |
569 |
$rg['rg_form_token'] = rg_token_get($db, $rg, 'pkg_repo_list'); |
$rg['rg_form_token'] = rg_token_get($db, $rg, 'pkg_repo_list'); |
580 |
|
$rg['HTML:errmsg'] = rg_template_errmsg($errmsg); |
|
581 |
570 |
$ret .= rg_template_table('user/settings/packages/repo/list', $list, $rg); |
$ret .= rg_template_table('user/settings/packages/repo/list', $list, $rg); |
582 |
|
break; |
|
583 |
|
} |
|
|
571 |
|
} while (0); |
584 |
572 |
|
|
585 |
573 |
rg_log_exit(); |
rg_log_exit(); |
586 |
574 |
return $ret; |
return $ret; |
|
... |
... |
function rg_pkg_repo_high_level($db, &$rg, $paras) |
705 |
693 |
rg_log_enter('pkg_repo_high_level paras:' . rg_array2string($paras)); |
rg_log_enter('pkg_repo_high_level paras:' . rg_array2string($paras)); |
706 |
694 |
|
|
707 |
695 |
$ret = ''; |
$ret = ''; |
708 |
|
while (1) { |
|
|
696 |
|
do { |
709 |
697 |
$old_url = $rg['url']; |
$old_url = $rg['url']; |
710 |
698 |
$rg['url'] .= '/repo'; |
$rg['url'] .= '/repo'; |
711 |
699 |
|
|
|
... |
... |
function rg_pkg_repo_high_level($db, &$rg, $paras) |
732 |
720 |
$rg, TRUE /*xss*/); |
$rg, TRUE /*xss*/); |
733 |
721 |
|
|
734 |
722 |
$rg['url'] = $old_url; |
$rg['url'] = $old_url; |
735 |
|
break; |
|
736 |
|
} |
|
|
723 |
|
} while (0); |
737 |
724 |
|
|
738 |
725 |
rg_log_exit(); |
rg_log_exit(); |
739 |
726 |
rg_prof_end('pkg_repo_high_level'); |
rg_prof_end('pkg_repo_high_level'); |
File inc/user/pkg_subrepo.inc.php changed (mode: 100644) (index 7b83216..97a4a92) |
1 |
1 |
<?php |
<?php |
2 |
2 |
include_once(__DIR__ . '/pkg_repo.inc.php'); |
include_once(__DIR__ . '/pkg_repo.inc.php'); |
3 |
|
include_once(__DIR__ . '/packages_rpm.inc.php'); |
|
|
3 |
|
include_once(__DIR__ . '/packages_rpm.inc.php'); // TODO: only rpm?! |
4 |
4 |
|
|
5 |
5 |
$rg_pkg_subrepo_error = ''; |
$rg_pkg_subrepo_error = ''; |
6 |
6 |
|
|
|
... |
... |
function rg_pkg_subrepo_edit($db, $uid, $d) |
335 |
335 |
function rg_pkg_subrepo_remove($db, $uid, $list) |
function rg_pkg_subrepo_remove($db, $uid, $list) |
336 |
336 |
{ |
{ |
337 |
337 |
rg_prof_start('pkg_subrepo_remove'); |
rg_prof_start('pkg_subrepo_remove'); |
338 |
|
rg_log_enter('pkg_subrepo_remove: list=' . rg_array2string($list)); |
|
|
338 |
|
rg_log_enter('pkg_subrepo_remove: uid=' . $uid |
|
339 |
|
. ' list=' . rg_array2string($list)); |
339 |
340 |
|
|
340 |
341 |
$ret = FALSE; |
$ret = FALSE; |
341 |
342 |
$rollback = FALSE; |
$rollback = FALSE; |
342 |
|
while (1) { |
|
|
343 |
|
do { |
|
344 |
|
// Security check - a user may try to delete others' ids |
|
345 |
|
$err = FALSE; |
|
346 |
|
foreach ($list as $id => $junk) { |
|
347 |
|
$sri = rg_pkg_subrepo_info($db, $uid, $id); |
|
348 |
|
if ($sri['exists'] != 1) { |
|
349 |
|
rg_pkg_subrepo_set_error('invalid pkg subrepo id'); |
|
350 |
|
$err = TRUE; |
|
351 |
|
break; |
|
352 |
|
} |
|
353 |
|
$ri = rg_pkg_repo_info($db, $uid, $sri['pkg_repo_id']); |
|
354 |
|
if ($ri['exists'] != 1) { |
|
355 |
|
pkg_subrepo_set_error('invalid pkg repo id'); |
|
356 |
|
$err = TRUE; |
|
357 |
|
break; |
|
358 |
|
} |
|
359 |
|
if (!rg_pkg_has_rights($db, $ri, 'D')) { |
|
360 |
|
rg_pkg_subrepo_set_error('invalid id'); |
|
361 |
|
$err = TRUE; |
|
362 |
|
break; |
|
363 |
|
} |
|
364 |
|
} |
|
365 |
|
if ($err) |
|
366 |
|
break; |
343 |
367 |
if (rg_sql_begin($db) !== TRUE) { |
if (rg_sql_begin($db) !== TRUE) { |
344 |
368 |
rg_pkg_subrepo_set_error('start transaction failed'); |
rg_pkg_subrepo_set_error('start transaction failed'); |
345 |
369 |
break; |
break; |
|
... |
... |
function rg_pkg_subrepo_remove($db, $uid, $list) |
383 |
407 |
rg_cache_unset($k . 'pkg_maps', RG_SOCKET_NO_WAIT); |
rg_cache_unset($k . 'pkg_maps', RG_SOCKET_NO_WAIT); |
384 |
408 |
|
|
385 |
409 |
$ret = TRUE; |
$ret = TRUE; |
386 |
|
break; |
|
387 |
|
} |
|
|
410 |
|
} while (0); |
388 |
411 |
if ($rollback) |
if ($rollback) |
389 |
412 |
rg_sql_rollback($db); |
rg_sql_rollback($db); |
390 |
413 |
|
|
|
... |
... |
function rg_pkg_subrepo_cosmetic_list($db, &$a) |
421 |
444 |
function rg_pkg_subrepo_list_one($db, $uid) |
function rg_pkg_subrepo_list_one($db, $uid) |
422 |
445 |
{ |
{ |
423 |
446 |
rg_prof_start('pkg_subrepo_list_one'); |
rg_prof_start('pkg_subrepo_list_one'); |
424 |
|
rg_log_enter('pkg_subrepo_list_one'); |
|
|
447 |
|
rg_log_enter('pkg_subrepo_list_one: uid=' . $uid); |
425 |
448 |
|
|
426 |
449 |
$ret = FALSE; |
$ret = FALSE; |
427 |
450 |
do { |
do { |
|
... |
... |
function rg_pkg_subrepo_list_high_level($db, $rg) |
613 |
636 |
rg_log_enter('pkg_subrepo_list_high_level'); |
rg_log_enter('pkg_subrepo_list_high_level'); |
614 |
637 |
|
|
615 |
638 |
$ret = ''; |
$ret = ''; |
616 |
|
while (1) { |
|
617 |
|
$errmsg = array(); |
|
618 |
|
|
|
|
639 |
|
do { |
619 |
640 |
$ui_login = rg_ui_login(); |
$ui_login = rg_ui_login(); |
620 |
641 |
$use_uid = $ui_login['is_admin'] == 1 ? 0 : $ui_login['uid']; |
$use_uid = $ui_login['is_admin'] == 1 ? 0 : $ui_login['uid']; |
621 |
|
$list = rg_pkg_subrepo_list_one($db, $use_uid); |
|
|
642 |
|
$list = rg_pkg_subrepo_list($db, $use_uid); |
622 |
643 |
if ($list === FALSE) { |
if ($list === FALSE) { |
623 |
644 |
$rg['errmsg'] = rg_pkg_subrepo_error(); |
$rg['errmsg'] = rg_pkg_subrepo_error(); |
624 |
645 |
$ret .= rg_template('user/settings/packages/subrepo/list_err.html', |
$ret .= rg_template('user/settings/packages/subrepo/list_err.html', |
|
... |
... |
function rg_pkg_subrepo_list_high_level($db, $rg) |
628 |
649 |
rg_pkg_subrepo_cosmetic_list($db, $list); |
rg_pkg_subrepo_cosmetic_list($db, $list); |
629 |
650 |
|
|
630 |
651 |
$xlist = rg_var_str('delete_list'); |
$xlist = rg_var_str('delete_list'); |
|
652 |
|
rg_log_debug('xlist: ' . rg_array2string($xlist)); |
631 |
653 |
while (!empty($xlist)) { |
while (!empty($xlist)) { |
632 |
654 |
$del_errmsg = array(); |
$del_errmsg = array(); |
|
655 |
|
|
633 |
656 |
if (!rg_valid_referer()) |
if (!rg_valid_referer()) |
634 |
657 |
$del_errmsg[] = 'invalid referer; try again'; |
$del_errmsg[] = 'invalid referer; try again'; |
635 |
658 |
|
|
636 |
659 |
if (!rg_token_valid($db, $rg, 'pkg_subrepo_list', FALSE)) |
if (!rg_token_valid($db, $rg, 'pkg_subrepo_list', FALSE)) |
637 |
660 |
$del_errmsg[] = 'invalid token; try again.'; |
$del_errmsg[] = 'invalid token; try again.'; |
638 |
661 |
|
|
639 |
|
// Security check - a user may delete others' ids |
|
640 |
|
if (!rg_pkg_subrepo_list_valid($list, $xlist)) |
|
641 |
|
$del_errmsg[] = rg_template( |
|
642 |
|
'user/settings/packages/subrepo/invalid_id.html', |
|
643 |
|
$rg, TRUE /*xss*/); |
|
644 |
|
|
|
645 |
662 |
if (empty($del_errmsg)) { |
if (empty($del_errmsg)) { |
646 |
663 |
$r = rg_pkg_subrepo_remove($db, $ui_login['uid'], $xlist); |
$r = rg_pkg_subrepo_remove($db, $ui_login['uid'], $xlist); |
647 |
664 |
if ($r !== TRUE) |
if ($r !== TRUE) |
|
... |
... |
function rg_pkg_subrepo_list_high_level($db, $rg) |
661 |
678 |
} |
} |
662 |
679 |
|
|
663 |
680 |
$rg['rg_form_token'] = rg_token_get($db, $rg, 'pkg_subrepo_list'); |
$rg['rg_form_token'] = rg_token_get($db, $rg, 'pkg_subrepo_list'); |
664 |
|
$rg['errmsg'] = ''; |
|
665 |
681 |
$ret .= rg_template_table('user/settings/packages/subrepo/list', $list, $rg); |
$ret .= rg_template_table('user/settings/packages/subrepo/list', $list, $rg); |
666 |
|
break; |
|
667 |
|
} |
|
|
682 |
|
} while (0); |
668 |
683 |
|
|
669 |
684 |
rg_log_exit(); |
rg_log_exit(); |
670 |
685 |
return $ret; |
return $ret; |
File tests/wh_build.php changed (mode: 100644) (index 3e6c880..6498dc9) |
... |
... |
rg_log_exit(); |
321 |
321 |
|
|
322 |
322 |
rg_log(''); |
rg_log(''); |
323 |
323 |
rg_log_enter('Downloading package as good (owner) user'); |
rg_log_enter('Downloading package as good (owner) user'); |
324 |
|
$u = rg_pkg_transform('deb', $rg_ui['username']); |
|
|
324 |
|
$u = rg_pkg_transform_user('deb', $rg_ui['username']); |
325 |
325 |
$u1 = substr($u, 0, 1); $u2 = substr($u, 1, 1); |
$u1 = substr($u, 0, 1); $u2 = substr($u, 1, 1); |
326 |
326 |
$r = rg_test_packages_file($rg_ui, $rg_ui, 'user', |
$r = rg_test_packages_file($rg_ui, $rg_ui, 'user', |
327 |
327 |
$pkg_repo_priv_name, $pkg_subrepo_priv['sr::name'], |
$pkg_repo_priv_name, $pkg_subrepo_priv['sr::name'], |
328 |
328 |
'debian', 'bullseye', |
'debian', 'bullseye', |
329 |
329 |
'pool/main/' . $u1 . '/' . $u2 . '/' . $u |
'pool/main/' . $u1 . '/' . $u2 . '/' . $u |
330 |
|
. '+' . rg_pkg_transform('deb', $repo['name']) . '_0.1_amd64.deb'); |
|
|
330 |
|
. '+' . rg_pkg_transform_repo('deb', $repo['name']) . '_0.1_amd64.deb'); |
331 |
331 |
rg_log_ml('r: ' . print_r($r, TRUE)); |
rg_log_ml('r: ' . print_r($r, TRUE)); |
332 |
332 |
$e = 'content-type: application/octet-stream'; |
$e = 'content-type: application/octet-stream'; |
333 |
333 |
if (!stristr($r['header'], $e) || ($r['ci']['http_code'] != 200)) { |
if (!stristr($r['header'], $e) || ($r['ci']['http_code'] != 200)) { |
|
... |
... |
rg_log_exit(); |
354 |
354 |
|
|
355 |
355 |
rg_log(''); |
rg_log(''); |
356 |
356 |
rg_log_enter('Downloading package as bad (not owner) user'); |
rg_log_enter('Downloading package as bad (not owner) user'); |
357 |
|
$u = rg_pkg_transform('deb', $rg_ui['username']); |
|
|
357 |
|
$u = rg_pkg_transform_user('deb', $rg_ui['username']); |
358 |
358 |
$u1 = substr($u, 0, 1); $u2 = substr($u, 1, 1); |
$u1 = substr($u, 0, 1); $u2 = substr($u, 1, 1); |
359 |
359 |
$r = rg_test_packages_file($rg_bad, $rg_ui, 'user', |
$r = rg_test_packages_file($rg_bad, $rg_ui, 'user', |
360 |
360 |
$pkg_repo_priv_name, $pkg_subrepo_priv['sr::name'], |
$pkg_repo_priv_name, $pkg_subrepo_priv['sr::name'], |
361 |
361 |
'debian', 'bullseye', |
'debian', 'bullseye', |
362 |
362 |
'pool/main/' . $u1 . '/' . $u2 . '/' . $u |
'pool/main/' . $u1 . '/' . $u2 . '/' . $u |
363 |
|
. '+' . rg_pkg_transform('deb', $repo['name']) . '_0.1_amd64.deb'); |
|
|
363 |
|
. '+' . rg_pkg_transform_repo('deb', $repo['name']) . '_0.1_amd64.deb'); |
364 |
364 |
rg_log_ml('r: ' . print_r($r, TRUE)); |
rg_log_ml('r: ' . print_r($r, TRUE)); |
365 |
365 |
if ($r['ci']['http_code'] != 404) { |
if ($r['ci']['http_code'] != 404) { |
366 |
366 |
rg_log_ml('headers: ' . $r['header']); |
rg_log_ml('headers: ' . $r['header']); |