external/aurweb
0
0
Fork 0
mirror of https://gitlab.archlinux.org/archlinux/aurweb.git synced 2025-02-03 10:43:03 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Do not allow for overwriting arbitrary packages

Browse source 
A package should only be overwritten if it already belongs to the
package base that is trying to overwrite it.

Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de>
This commit is contained in:
Lukas Fleischer 2014-04-05 02:40:16 +02:00
parent afb02a10c6
commit 8921e4deb9
2 changed files with 42 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

44
web/html/pkgsubmit.php
View file

@ -410,33 +410,35 @@ if ($uid):
}
/* Upload PKGBUILD and tarball. */
if (!$error) {
/*
* First, check whether this package already exists and
* whether it can be overwritten.
*/
if (can_submit_pkgbase($pkgbase_name, $_COOKIE["AURSID"])) {
if (file_exists($incoming_pkgdir)) {
/*
* Blow away the existing directory and
* its contents.
*/
rm_tree($incoming_pkgdir);
}
if (!$error && !can_submit_pkgbase($pkgbase_name, $_COOKIE["AURSID"])) {
$error = __( "You are not allowed to overwrite the %s%s%s package.", "<strong>", $pkgbase_name, "</strong>");
}
/*
* The mode is masked by the current umask, so
* not as scary as it looks.
*/
if (!mkdir($incoming_pkgdir, 0777, true)) {
$error = __( "Could not create directory %s.", $incoming_pkgdir);
if (!$error) {
foreach ($pkginfo as $pi) {
if (!can_submit_pkg($pi['pkgname'], $base_id)) {
$error = __( "You are not allowed to overwrite the %s%s%s package.", "<strong>", $pi['pkgname'], "</strong>");
break;
}
} else {
$error = __( "You are not allowed to overwrite the %s%s%s package.", "<strong>", $pkg_name, "</strong>");
}
}
if (!$error) {
/*
* Blow away the existing directory and its contents.
*/
if (file_exists($incoming_pkgdir)) {
rm_tree($incoming_pkgdir);
}
/*
* The mode is masked by the current umask, so not as
* scary as it looks.
*/
if (!mkdir($incoming_pkgdir, 0777, true)) {
$error = __( "Could not create directory %s.", $incoming_pkgdir);
}
if (!chdir($incoming_pkgdir)) {
$error = __("Could not change directory to %s.", $incoming_pkgdir);
}