From patchwork Fri Jan 31 07:59:26 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Lukas Fleischer X-Patchwork-Id: 1481 Return-Path: Delivered-To: patchwork@archlinux.org Received: from apollo.archlinux.org (localhost [127.0.0.1]) by apollo.archlinux.org (Postfix) with ESMTP id 7A97D16C0AABB for ; Fri, 31 Jan 2020 07:59:32 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.4.3 (2019-12-06) on apollo.archlinux.org X-Spam-Level: X-Spam-Status: No, score=-3.4 required=5.0 tests=DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1,DKIM_VALID=-0.1,DKIM_VALID_AU=-0.1, MAILING_LIST_MULTI=-1,RCVD_IN_DNSWL_MED=-2.3,SPF_HELO_NONE=0.001, TVD_PH_BODY_ACCOUNTS_PRE=0.001,T_DMARC_POLICY_NONE=0.01, WEIRD_QUOTING=0.001 autolearn=ham autolearn_force=no version=3.4.3 X-Spam-BL-Results: [127.0.9.2] Received: from orion.archlinux.org (orion.archlinux.org [88.198.91.70]) by apollo.archlinux.org (Postfix) with ESMTPS for ; Fri, 31 Jan 2020 07:59:32 +0000 (UTC) Received: from orion.archlinux.org (localhost [127.0.0.1]) by orion.archlinux.org (Postfix) with ESMTP id 0C7D7188AD76A3; Fri, 31 Jan 2020 07:59:27 +0000 (UTC) Received: from luna.archlinux.org (luna.archlinux.org [5.9.250.164]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-384) server-signature RSA-PSS (4096 bits)) (No client certificate requested) (Authenticated sender: luna) by orion.archlinux.org (Postfix) with ESMTPSA id 0E7F3188AD768C; Fri, 31 Jan 2020 07:59:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=archlinux.org; s=orion; t=1580457565; bh=FaXoZVNUwXu2GKOML53x06z7Ympf1CJ6xEfGI5mXRD8=; h=From:To:Subject:Date:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe; b=D3ne+kf80VyrKVtQhs7qZFUzjg4r1ajHMrxZ7jFnfcK+s35PYlZmeJYr0+y4gg076 9Gc2eGXEGY6mcctTZ1ke+PJk8gLXJmvMEWRKBzM5aZwjTDRv55DohTStO9hHbrw+9P ZhlC0PNbJc4bz3x8EDGK7hWXs90R3XmZ1CDosdiCGYnCzv14vQ9KiKe7B3mL4lizeV +yXIP8vE/NzqflvMR/FybVq6EjgQdOZT7O71xuVhdysxtCmcSCZ4RHIqUfHR8wVjXH PIs8fDT5+PXNvNVpqFO+QzKXy6zqxlvbYIQl0Q0HWPNp8lUcf1XoI10+wMJ5EgDSD7 eUvrd4hJu+CT0ZROTl4KmZQ/UU6RnYvPraTXnNfY5CRjcHybJJ/QY7OTviVrbLHI7v skn6q4EKAVWjS6tTEV2eXMcMNEe0USgzN9p5aD2TbTnw1WTyImEnHTgR1gB/cweNxJ CcXFmyltKNubJn06nIWIqQIiVZKCX0b5jyYaBQy3Vc7cUkoyu9dXJng7ayfs3HtzRg zixLg6vLi/362c95InaT/icdFwxe7zbSXk3jKr+SQ2G86sy1fXi6OdUqat3+j0LfAC +qnTChTatLPSXOo3+IazTVVIervlWS6l1hRI/14imwHqWdj0MAOr5m7Jan7CJRJuBO jYOixdzTILKL6EMDbDSCWVI8= Received: from luna.archlinux.org (luna.archlinux.org [127.0.0.1]) by luna.archlinux.org (Postfix) with ESMTP id C91FA2BE52; Fri, 31 Jan 2020 07:59:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=archlinux.org; s=luna2; t=1580457564; bh=FaXoZVNUwXu2GKOML53x06z7Ympf1CJ6xEfGI5mXRD8=; h=From:To:Subject:Date:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe; b=OkLwMSVFK2VbVcqzcOPnNiMg+lCNS4Q284hYBe6kwuIlMDGK898s4CVKkaa38yNZL jM9UERKA1s9NJIw9MLhn8aUVDJ7gaCwxvIUwI7YGLAo923svSsTn3INdrUduDl05w6 nnE5RzLBz8s/Q09ELygpIhWrf0VsVwAp7gnY0pdpyYje/c+zikPXsPDcwSuIQtHaJg PGf+p3vnSHIXrLfaMF2tcjLrMZmNTbePr7tIH4b6Ll6y4NbJoubdtTA9rBgAnOrBc2 jDQgFTUPBM22YTHSnn1YHfQefwP7qII17TRO1oalu9jh2577QvmoqzNP8WTCvC7Gq8 7AkZTzSPD1/npFWqQ5smN6HP0RakNJ4CP6spc94yuTzEv2WGRN6rjm1tSLhl24uzOu ePKk+zZu+DtobASsUz652QR2XRzEv+LPaW+zwoNR7BqB2LbofqagEkkgHOeChdY7CI IGIinth2u8c/SSpjou8uEkgyq4LOsV1O5ie2t1YxwhaFa+H15pTZhQ0wyUA7gp1Qxv 9GcyZb/ERQd44ralQmrRgx+kYGoWMkrrUQZIi7eUzaSFc8svu0VWN/6IcGZM6mVIob Z8usLjwhQDEEuOfOB+xPMt9WcsiWtu9pLuGDmanuF1y6Rb9lMLMfygYzxXP8ZlIOB3 smCCZiC1LfZpZqHydMnGunOE= Received: from luna.archlinux.org (luna.archlinux.org [127.0.0.1]) by luna.archlinux.org (Postfix) with ESMTP id 3176E2BA6A for ; Fri, 31 Jan 2020 07:59:20 +0000 (UTC) Received: from orion.archlinux.org (orion.archlinux.org [88.198.91.70]) by luna.archlinux.org (Postfix) with ESMTPS for ; Fri, 31 Jan 2020 07:59:20 +0000 (UTC) Received: from orion.archlinux.org (localhost [127.0.0.1]) by orion.archlinux.org (Postfix) with ESMTP id 46510188AD765F for ; Fri, 31 Jan 2020 07:59:18 +0000 (UTC) Received: from localhost (unknown [IPv6:2a02:8070:24e4:b800:b66b:fcff:fe3e:6273]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-384) server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: lfleischer) by orion.archlinux.org (Postfix) with ESMTPSA id 17807188AD765E for ; Fri, 31 Jan 2020 07:59:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=archlinux.org; s=orion; t=1580457558; bh=FaXoZVNUwXu2GKOML53x06z7Ympf1CJ6xEfGI5mXRD8=; h=From:To:Subject:Date; b=k5MUlnmwd2s6m9B490J3wksJLAkjDcCg2pkmYC7Ix3DRqMEIBUMKuxoOgzQLqlQvH eq1wtuamEqJ8UYx5usRAOaRwb/iZ/II6eZeRadwDF/6oYgZPmms5ip9jbuXy/aXFrz H8vew/xp25GYj9fVkpeDLJV1/7/iDC0LhOyALefqc/M21/PPSgxj7frKJFHuYX0OCE z654+Hf+rHqgiW0wMJtmbB6EAqsCwllN4h3SlDyUUCBrjNGxpWOijN+e+U2s/8CtKx Wy/iF1+hSu758hQJE2EBgOX2KV6I7OPQBiXi7PAbxX7ED9jtEm2czWARHHvbCeInAq syU766GYz5kYSXtVyCgmxqnaMaM7ACVdMXvqMiu35ZOSbm68p8BlQl0DnVNUM1r4QS RJ4RZgMEYbXeDcL/VsHGAmAGhSvTNtfQdxSeJ9800AXiZukV22wVkEfnotgoBCqmff 22+c0rTbjCiuHGIuQGMkcjeZHW88sWoZZJOrh0PKCy0f40Jf/cTQ7oVe8dXgj7ICbB 66geLnW4q1eoETe2iLgXEt0OOHlbarLTKS+gbaNVnj/7x6GUazI/C8bdW8v6+HRlit 2a1OG6/tMzVTyZ5Or2MM2RoNsZHkc9SDUlKzOidiFaP8L8kQzSEmK9DETwkX6CS+iX fsKD0K7VUMdRj62w/0tt6dqU= From: Lukas Fleischer To: aur-dev@archlinux.org Subject: [PATCH] Add support for backup email addresses Date: Fri, 31 Jan 2020 08:59:26 +0100 Message-Id: <20200131075926.115045-1-lfleischer@archlinux.org> X-Mailer: git-send-email 2.25.0 MIME-Version: 1.0 X-BeenThere: aur-dev@archlinux.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "Arch User Repository \(AUR\) Development" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: aur-dev-bounces@archlinux.org Sender: "aur-dev" Support secondary email addresses that can be used to recover an account in case access to the primary email address is lost. Reset keys for an account are always sent to both the primary and the backup email address. Signed-off-by: Lukas Fleischer --- aurweb/scripts/notify.py | 12 ++++++++---- schema/aur-schema.sql | 1 + upgrading/4.9.0.txt | 6 ++++++ web/html/account.php | 3 +++ web/html/login.php | 2 +- web/html/passreset.php | 6 +++--- web/html/register.php | 4 +++- web/lib/acctfuncs.inc.php | 15 +++++++++++---- web/template/account_edit_form.php | 12 +++++++++++- 9 files changed, 47 insertions(+), 14 deletions(-) diff --git a/aurweb/scripts/notify.py b/aurweb/scripts/notify.py index f2767fd..b0f218b 100755 --- a/aurweb/scripts/notify.py +++ b/aurweb/scripts/notify.py @@ -90,13 +90,17 @@ class Notification: class ResetKeyNotification(Notification): def __init__(self, conn, uid): - cur = conn.execute('SELECT UserName, Email, LangPreference, ' + - 'ResetKey FROM Users WHERE ID = ?', [uid]) - self._username, self._to, self._lang, self._resetkey = cur.fetchone() + cur = conn.execute('SELECT UserName, Email, BackupEmail, ' + + 'LangPreference, ResetKey ' + + 'FROM Users WHERE ID = ?', [uid]) + self._username, self._to, self._backup, self._lang, self._resetkey = cur.fetchone() super().__init__() def get_recipients(self): - return [(self._to, self._lang)] + if self._backup: + return [(self._to, self._lang), (self._backup, self._lang)] + else: + return [(self._to, self._lang)] def get_subject(self, lang): return self._l10n.translate('AUR Password Reset', lang) diff --git a/schema/aur-schema.sql b/schema/aur-schema.sql index fa991ba..1f86df2 100644 --- a/schema/aur-schema.sql +++ b/schema/aur-schema.sql @@ -23,6 +23,7 @@ CREATE TABLE Users ( Suspended TINYINT UNSIGNED NOT NULL DEFAULT 0, Username VARCHAR(32) NOT NULL, Email VARCHAR(254) NOT NULL, + BackupEmail VARCHAR(254) NULL DEFAULT NULL, HideEmail TINYINT UNSIGNED NOT NULL DEFAULT 0, Passwd VARCHAR(255) NOT NULL, Salt CHAR(32) NOT NULL DEFAULT '', diff --git a/upgrading/4.9.0.txt b/upgrading/4.9.0.txt index 4c79283..241f24a 100644 --- a/upgrading/4.9.0.txt +++ b/upgrading/4.9.0.txt @@ -4,3 +4,9 @@ ALTER TABLE PackageRequests ADD COLUMN ClosedTS BIGINT UNSIGNED NULL DEFAULT NULL; ALTER TABLE PackageRequests ADD COLUMN ClosedUID INTEGER UNSIGNED NULL DEFAULT NULL; ---- + +2. Add a new column to store backup email addresses: + +---- +ALTER TABLE Users ADD COLUMN BackupEmail VARCHAR(254) NULL DEFAULT NULL; +---- diff --git a/web/html/account.php b/web/html/account.php index ff9aba5..c05d136 100644 --- a/web/html/account.php +++ b/web/html/account.php @@ -33,6 +33,7 @@ if ($action == "UpdateAccount") { in_request("T"), in_request("S"), in_request("E"), + in_request("BE"), in_request("H"), in_request("P"), in_request("C"), @@ -97,6 +98,7 @@ if (isset($_COOKIE["AURSID"])) { $row["AccountTypeID"], $row["Suspended"], $row["Email"], + $row["BackupEmail"], $row["HideEmail"], "", "", @@ -159,6 +161,7 @@ if (isset($_COOKIE["AURSID"])) { in_request("T"), in_request("S"), in_request("E"), + in_request("BE"), in_request("H"), in_request("P"), in_request("C"), diff --git a/web/html/login.php b/web/html/login.php index df51705..0145441 100644 --- a/web/html/login.php +++ b/web/html/login.php @@ -26,7 +26,7 @@ html_header('AUR ' . __("Login"));

- +

diff --git a/web/html/passreset.php b/web/html/passreset.php index b3c8bd2..26b9bbb 100644 --- a/web/html/passreset.php +++ b/web/html/passreset.php @@ -65,7 +65,7 @@ html_header(__("Password Reset"));

- + @@ -81,14 +81,14 @@ html_header(__("Password Reset")); -

', ''); ?>

-

+

diff --git a/web/html/register.php b/web/html/register.php index 610befc..fee0a68 100644 --- a/web/html/register.php +++ b/web/html/register.php @@ -23,6 +23,7 @@ if (in_request("Action") == "NewAccount") { 1, 0, in_request("E"), + in_request("BE"), in_request("H"), '', '', @@ -52,6 +53,7 @@ if (in_request("Action") == "NewAccount") { 1, 0, in_request("E"), + in_request("BE"), in_request("H"), '', '', @@ -75,7 +77,7 @@ if (in_request("Action") == "NewAccount") { } } else { print '

' . __("Use this form to create an account.") . '

'; - display_account_form("NewAccount", "", "", "", "", "", "", "", "", $LANG); + display_account_form("NewAccount", "", "", "", "", "", "", "", "", "", $LANG); } echo ''; diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index f6cda69..443fb4b 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -46,6 +46,7 @@ function html_format_pgp_fingerprint($fingerprint) { * @param string $T The account type of the displayed user * @param string $S Whether the displayed user has a suspended account * @param string $E The e-mail address of the displayed user + * @param string $BE The backup e-mail address of the displayed user * @param string $H Whether the e-mail address of the displayed user is hidden * @param string $P The password value of the displayed user * @param string $C The confirmed password value of the displayed user @@ -67,7 +68,7 @@ function html_format_pgp_fingerprint($fingerprint) { * * @return void */ -function display_account_form($A,$U="",$T="",$S="",$E="",$H="",$P="",$C="",$R="", +function display_account_form($A,$U="",$T="",$S="",$E="",$BE="",$H="",$P="",$C="",$R="", $L="",$TZ="",$HP="",$I="",$K="",$PK="",$J="",$CN="",$UN="",$ON="",$UID=0,$N="",$captcha_salt="",$captcha="") { global $SUPPORTED_LANGS; @@ -95,6 +96,7 @@ function display_account_form($A,$U="",$T="",$S="",$E="",$H="",$P="",$C="",$R="" * @param string $T The account type for the user * @param string $S Whether or not the account is suspended * @param string $E The e-mail address for the user + * @param string $BE The backup e-mail address for the user * @param string $H Whether or not the e-mail address should be hidden * @param string $P The password for the user * @param string $C The confirmed password for the user @@ -117,7 +119,7 @@ function display_account_form($A,$U="",$T="",$S="",$E="",$H="",$P="",$C="",$R="" * * @return array Boolean indicating success and message to be printed */ -function process_account_form($TYPE,$A,$U="",$T="",$S="",$E="",$H="",$P="",$C="", +function process_account_form($TYPE,$A,$U="",$T="",$S="",$E="",$BE="",$H="",$P="",$C="", $R="",$L="",$TZ="",$HP="",$I="",$K="",$PK="",$J="",$CN="",$UN="",$ON="",$UID=0,$N="",$passwd="",$captcha_salt="",$captcha="") { global $SUPPORTED_LANGS; @@ -175,6 +177,9 @@ function process_account_form($TYPE,$A,$U="",$T="",$S="",$E="",$H="",$P="",$C="" if (!$error && !valid_email($E)) { $error = __("The email address is invalid."); } + if (!$error && $BE && !valid_email($BE)) { + $error = __("The backup email address is invalid."); + } if (!$error && !empty($HP) && !valid_homepage($HP)) { $error = __("The home page is invalid, please specify the full HTTP(s) URL."); @@ -311,6 +316,7 @@ function process_account_form($TYPE,$A,$U="",$T="",$S="",$E="",$H="",$P="",$C="" } $U = $dbh->quote($U); $E = $dbh->quote($E); + $BE = $dbh->quote($BE); $P = $dbh->quote($P); $R = $dbh->quote($R); $L = $dbh->quote($L); @@ -319,9 +325,9 @@ function process_account_form($TYPE,$A,$U="",$T="",$S="",$E="",$H="",$P="",$C="" $I = $dbh->quote($I); $K = $dbh->quote(str_replace(" ", "", $K)); $q = "INSERT INTO Users (AccountTypeID, Suspended, "; - $q.= "InactivityTS, Username, Email, Passwd , "; + $q.= "InactivityTS, Username, Email, BackupEmail, Passwd , "; $q.= "RealName, LangPreference, Timezone, Homepage, IRCNick, PGPKey) "; - $q.= "VALUES (1, 0, 0, $U, $E, $P, $R, $L, $TZ, "; + $q.= "VALUES (1, 0, 0, $U, $E, $BE, $P, $R, $L, $TZ, "; $q.= "$HP, $I, $K)"; $result = $dbh->exec($q); if (!$result) { @@ -374,6 +380,7 @@ function process_account_form($TYPE,$A,$U="",$T="",$S="",$E="",$H="",$P="",$C="" $q.= ", Suspended = 0"; } $q.= ", Email = " . $dbh->quote($E); + $q.= ", BackupEmail = " . $dbh->quote($BE); if ($H) { $q.= ", HideEmail = 1"; } else { diff --git a/web/template/account_edit_form.php b/web/template/account_edit_form.php index 09d65c0..edacbbf 100644 --- a/web/template/account_edit_form.php +++ b/web/template/account_edit_form.php @@ -76,11 +76,21 @@ ()

-

+

+ + +

+

+ + + + +

+

/>