pkgsubmit.php: Simplify package name validation

Remove redundant filters -- single quotes are already removed in
$pkgbuild_new and we do not pass the package name to a shell
(additionally, the regular expression already checks for potentially
evil characters).

Also, move the $pkg_name extraction up to fix the split package check.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
pkgsubmit.php: Move URL protocol check down

Move all PKGBUILD field validations to a central location.

Also, change $pkgbuild[] to $new_pkgbuild[] in order to parse evaluated
PKGBUILD fields instead of raw ones.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
pkgsubmit.php: Parse .AURINFO metadata

This allows for adding a metadata file called ".AURINFO" to source
tarballs to overwrite specific PKGBUILD fields. .AURINFO files are
parsed line by line. The syntax for each line is "key = value", where
key is any of the following field names:

* pkgname
* pkgver
* pkgdesc
* url
* license
* depend

Multiple "depend" lines can be specified to add multiple dependencies.

This format closely matches the .PKGINFO format that is used for binary
packages in pacman/libalpm. It can be extended by field name prefixes or
sections to support split packages later.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
UPGRADING: Mention recent aurblup changes

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Translation updates from Transifex

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Release 2.1.0

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Fix typo in delete permission warning

Signed-off-by: Connor Behan <connor.behan@gmail.com>
Signed-off-by: canyonknight <canyonknight@gmail.com>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Move reset key submission to a separate function

This allows for reusing reset key submission for other things, such as
sending an initial password reset code during account registration.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
process_account_form(): Allow using empty passwords

If an empty password is passed during account registration, login for
the new user is disabled and a reset key is sent to the new user's
e-mail address so that they can set an initial password manually.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Enforce e-mail validation during registration

Remove the password field from the account creation form and always send
a password reset request via e-mail instead. This ensures that only
users with valid e-mail addresses are able to login.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
process_account_form(): Highlight errors

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Save last login IP address

Save the IP address used for the last login in the "Users" table. This
makes it a bit easier to create IP ban lists for spammers without
looking at web server logs.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Update AUTHORS file

* Update maintainer list.
* Replace contributor list by a reference to `git shortlog -s`.
* Sync introduction and formatting of translators with pacman.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Return 404 error page if invalid package ID is used

We already display the 404 error page if someone tries to access an
invalid package via virtual URLs ("/packages/nonexistent"). Add the same
check to "web/html/packages.php" to make sure the same error is shown if
a user requests package details of a nonexistent package ID via legacy
URLs ("/packages.php?ID=-1").

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Add "Bans" table to database schema

The "Bans" table creates a DB structure for the ability to ban IP
addresses. It takes an IP address converted by ip2long().

The table will eventually be able to be populated directly through
the web interface by Trusted Users and Developers.

Signed-off-by: canyonknight <canyonknight@gmail.com>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Implement IP banning for user registration and user login

Adds a new is_ipbanned() function to determine whether the user
attempting to login or register for an account has their IP
address listed in the "Bans" table.

Signed-off-by: canyonknight <canyonknight@gmail.com>
Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Update message catalog

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Show hint if password is empty during login

A user might have an empty password due to two reasons:

* The user just created an account and needs to set an initial password.
* The password has been reset by the administrator.

In both cases, the user might be confused as to why the login does not
work. Add a message that helps users debug the issue in both cases.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Update message catalog

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
Use minified typeahead JS from archweb

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>