Implement token system to fix CSRF vulnerabilities

Specially crafted pages can force authenticated users to unknowingly perform
actions on the AUR website despite being on an attacker's website. This
cross-site request forgery (CSRF) vulnerability applies to all POST data on
the AUR.

Implement a token system using a double submit cookie. Have a hidden form
value on every page containing POST forms. Use the newly added check_token() to
verify the token sent via POST matches the "AURSID" cookie value. Random
nature of the token limits potential for CSRF.

Signed-off-by: canyonknight <canyonknight@gmail.com>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
acctfuncs.inc.php: Make user_suspended() work correctly

Fixes broken account suspension system.

Signed-off-by: canyonknight <canyonknight@gmail.com>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
aur.inc.php: Use delete_session_id() where appropriate

Signed-off-by: canyonknight <canyonknight@gmail.com>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
pkgsubmit.php: Refactor source processing to fix PHP notice

A foreach() being run without checking to see if the uploaded PKGBUILD had any
sources now no longer causes an undefined index notice when there are no
sources.

Signed-off-by: canyonknight <canyonknight@gmail.com>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Merge branch 'maint'

Conflicts:
	web/html/account.php
	web/html/addvote.php
	web/html/pkgsubmit.php
	web/lib/acctfuncs.inc.php
	web/template/actions_form.php
	web/template/pkg_comment_form.php
	web/template/pkg_comments.php
	web/template/pkg_details.php
	web/template/pkg_search_results.php
	web/template/tu_details.php
Add routing front/back ends

This adds a URL mapping library that can be used to implement virtual
paths. Also, "web/html/index.php" is moved to "web/html/home.php" and
"web/html/index.php" becomes a routing front end that maps virtual paths
to corresponding files.

To enable the virtual path feature, all requests need to be redirected
to the "index.php" routing script. If you use lighttpd, following
rewrite rule can be used:

    url.rewrite = ( "^(.*)$" => "/index.php/$1" )

A similar rule can be used for Apache (using mod_rewrite).

Note that the current routing front end only works if PATH_INFO is
provided.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Use absolute URIs for style sheets and images

This is needed for our new URI scheme, since we will use virtual
directories, such as "/packages/" instead of "/packages.php" etc.

Having relative URIs results in incorrect paths, such as
"/packages/css/aur.css" (instead of "/css/aur.css").

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Use virtual path feature for links

Use virtual paths in links (e.g. link to "/packages/" instead of
"/packages.php" etc.) if the virtual path feature is enabled.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Use virtual paths for package details

Extend the routing front/back ends to allow for using
"/package/$pkgname/" for individual packages.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Redirect to the home page after successful login

Jump to the home page instead of displaying a page that only tells you
that you're logged in.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
web/html/pkgsubmit.php: Remove stray "</div>"

Regression introduced in f3ce74c714e3460bb3e3e786f626e397d3139062 when
resolving conflicts.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
pkg_details.php: Fix link to voters if ID is unset

When a package is requested by name, the "ID" request parameter might be
unset. Use the "ID" field of the query result instead.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
account_edit_form.php: Remove another stray "</div>"

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>