po/POTFILES: Fix library file paths

[aur.git] / web / html / pkgsubmit.php

<?php

set_include_path(get_include_path() . PATH_SEPARATOR . '../lib');
include_once("config.inc.php");

require_once('Archive/Tar.php');

include_once("aur.inc.php");         # access AUR common functions
include_once("pkgfuncs.inc.php");    # package functions

set_lang();                 # this sets up the visitor's language
check_sid();                # see if they're still logged in

$cwd = getcwd();

if ($_COOKIE["AURSID"]) {
        $uid = uid_from_sid($_COOKIE['AURSID']);
}
else {
        $uid = NULL;
}

if ($uid):

        # Track upload errors
        $error = "";

        if (isset($_REQUEST['pkgsubmit'])) {

                # Before processing, make sure we even have a file
                if ($_FILES['pfile']['size'] == 0){
                        $error = __("Error - No file uploaded");
                }

                # Check whether the file is gzip'ed
                if (!$error) {
                        $fh = fopen($_FILES['pfile']['tmp_name'], 'rb');
                        fseek($fh, 0, SEEK_SET);
                        list(, $magic) = unpack('v', fread($fh, 2));

                        if ($magic != 0x8b1f) {
                                $error = __("Error - unsupported file format (please submit gzip'ed tarballs generated by makepkg(8) only).");
                        }
                }

                # Check uncompressed file size (ZIP bomb protection)
                if (!$error && $MAX_FILESIZE_UNCOMPRESSED) {
                        fseek($fh, -4, SEEK_END);
                        list(, $filesize_uncompressed) = unpack('V', fread($fh, 4));

                        if ($filesize_uncompressed > $MAX_FILESIZE_UNCOMPRESSED) {
                                $error = __("Error - uncompressed file size too large.");
                        }
                }

                # Close file handle before extracting stuff
                if (isset($fh) && is_resource($fh)) {
                        fclose($fh);
                }

                if (!$error) {
                        $tar = new Archive_Tar($_FILES['pfile']['tmp_name']);

                        # Extract PKGBUILD into a string
                        $pkgbuild_raw = '';
                        $dircount = 0;
                        foreach ($tar->listContent() as $tar_file) {
                                if (preg_match('/^[^\/]+\/PKGBUILD$/', $tar_file['filename'])) {
                                        $pkgbuild_raw = $tar->extractInString($tar_file['filename']);
                                }
                                elseif (preg_match('/^[^\/]+\/$/', $tar_file['filename'])) {
                                        if (++$dircount > 1) {
                                                $error = __("Error - source tarball may not contain more than one directory.");
                                                break;
                                        }
                                }
                                elseif (preg_match('/^[^\/]+$/', $tar_file['filename'])) {
                                        $error = __("Error - source tarball may not contain files outside a directory.");
                                        break;
                                }
                                elseif (preg_match('/^[^\/]+\/[^\/]+\//', $tar_file['filename'])) {
                                        $error = __("Error - source tarball may not contain nested subdirectories.");
                                        break;
                                }
                        }

                        if (!$error && empty($pkgbuild_raw)) {
                                $error = __("Error trying to unpack upload - PKGBUILD does not exist.");
                        }
                }

                # if no error, get list of directory contents and process PKGBUILD
                # TODO: This needs to be completely rewritten to support stuff like arrays
                # and variable substitution among other things.
                if (!$error) {
                        # process PKGBUILD - remove line concatenation
                        #
                        $pkgbuild = array();
                        $line_no = 0;
                        $lines = array();
                        $continuation_line = 0;
                        $current_line = "";
                        $paren_depth = 0;
                        foreach (explode("\n", $pkgbuild_raw) as $line) {
                                $line = trim($line);
                                # Remove comments
                                $line = preg_replace('/\s*#.*/', '', $line);

                                $char_counts = count_chars($line, 0);
                                $paren_depth += $char_counts[ord('(')] - $char_counts[ord(')')];
                                if (substr($line, strlen($line)-1) == "\\") {
                                        # continue appending onto existing line_no
                                        #
                                        $current_line .= substr($line, 0, strlen($line)-1);
                                        $continuation_line = 1;
                                } elseif ($paren_depth > 0) {
                                        # assumed continuation
                                        # continue appending onto existing line_no
                                        #
                                        $current_line .= $line . " ";
                                        $continuation_line = 1;
                                } else {
                                        # maybe the last line in a continuation, or a standalone line?
                                        #
                                        if ($continuation_line) {
                                                # append onto existing line_no
                                                #
                                                $current_line .= $line;
                                                $lines[$line_no] = $current_line;
                                                $current_line = "";
                                        } else {
                                                # it's own line_no
                                                #
                                                $lines[$line_no] = $line;
                                        }
                                        $continuation_line = 0;
                                        $line_no++;
                                }
                        }

                        # Now process the lines and put any var=val lines into the
                        # 'pkgbuild' array.
                        while (list($k, $line) = each($lines)) {
                                # Neutralize parameter substitution
                                $line = preg_replace('/\${(\w+)#(\w*)}?/', '$1$2', $line);

                                $lparts = Array();
                                # Match variable assignment only.
                                if (preg_match('/^\s*[_\w]+=[^=].*/', $line, $matches)) {
                                        $lparts = explode("=", $matches[0], 2);
                                }

                                if (!empty($lparts)) {
                                        # this is a variable/value pair, strip out
                                        # array parens and any quoting, except in pkgdesc
                                        # for pkgdesc, only remove start/end pairs of " or '
                                        if ($lparts[0]=="pkgdesc") {
                                                if ($lparts[1]{0} == '"' &&
                                                                $lparts[1]{strlen($lparts[1])-1} == '"') {
                                                        $pkgbuild[$lparts[0]] = substr($lparts[1], 1, -1);
                                                }
                                                elseif
                                                        ($lparts[1]{0} == "'" &&
                                                         $lparts[1]{strlen($lparts[1])-1} == "'") {
                                                        $pkgbuild[$lparts[0]] = substr($lparts[1], 1, -1);
                                                } else {
                                                        $pkgbuild[$lparts[0]] = $lparts[1];
                                                }
                                        } else {
                                                $pkgbuild[$lparts[0]] = str_replace(array("(",")","\"","'"), "",
                                                                $lparts[1]);
                                        }
                                }
                        }

                        # some error checking on PKGBUILD contents - just make sure each
                        # variable has a value. This does not do any validity checking
                        # on the values, or attempts to fix line continuation/wrapping.
                        $req_vars = array("url", "pkgdesc", "license", "pkgrel", "pkgver", "arch", "pkgname");
                        foreach ($req_vars as $var) {
                                if (!array_key_exists($var, $pkgbuild)) {
                                        $error = __('Missing %s variable in PKGBUILD.', $var);
                                        break;
                                }
                        }
                }

                # TODO This is where other additional error checking can be
                # performed. Examples: #md5sums == #sources?, md5sums of any
                # included files match?, install scriptlet file exists?
                #

                # Check for http:// or other protocol in url
                #
                if (!$error) {
                        $parsed_url = parse_url($pkgbuild['url']);
                        if (!$parsed_url['scheme']) {
                                $error = __("Package URL is missing a protocol (ie. http:// ,ftp://)");
                        }
                }

                # Now, run through the pkgbuild array, and do "eval" and simple substituions.
                if (!$error) {
                        while (list($k, $v) = each($pkgbuild)) {
                                if (strpos($k,'eval ') !== false) {
                                        $k = preg_replace('/^eval[\s]*/', "", $k);
                                        ##"eval" replacements
                                        $pattern_eval = '/{\$({?)([\w]+)(}?)}/';
                                        while (preg_match($pattern_eval,$v,$regs)) {
                                                $pieces = explode(",",$pkgbuild["$regs[2]"]);
                                                ## nongreedy matching! - preserving the order of "eval"
                                                $pattern = '/([\S]*?){\$'.$regs[1].$regs[2].$regs[3].'}([\S]*)/';
                                                while (preg_match($pattern,$v,$regs_replace)) {
                                                        $replacement = "";
                                                        for ($i = 0; $i < sizeof($pieces); $i++) {
                                                                $replacement .= $regs_replace[1].$pieces[$i].$regs_replace[2]." ";
                                                        }
                                                        $v=preg_replace($pattern, $replacement, $v, 1);
                                                }
                                        }
                                }

                                # Simple variable replacement
                                $pattern_var = '/\$({?)([_\w]+)(}?)/';
                                $offset = 0;
                                while (preg_match($pattern_var, $v, $regs, PREG_OFFSET_CAPTURE, $offset)) {
                                        $var = $regs[2][0];
                                        $pos = $regs[0][1];
                                        $len = strlen($regs[0][0]);

                                        if (isset($new_pkgbuild[$var])) {
                                                $replacement = substr($new_pkgbuild[$var], strpos($new_pkgbuild[$var], " "));
                                        }
                                        else {
                                                $replacement = '';
                                        }

                                        $v = substr_replace($v, $replacement, $pos, $len);
                                        $offset = $pos + strlen($replacement);
                                }
                                $new_pkgbuild[$k] = $v;
                        }
                }

                # Now we've parsed the pkgbuild, let's move it to where it belongs
                if (!$error) {
                        $pkg_name = str_replace("'", "", $new_pkgbuild['pkgname']);
                        $pkg_name = escapeshellarg($pkg_name);
                        $pkg_name = str_replace("'", "", $pkg_name);

                        $presult = preg_match("/^[a-z0-9][a-z0-9\.+_-]*$/", $pkg_name);

                        if (!$presult) {
                                $error = __("Invalid name: only lowercase letters are allowed.");
                        }
                }

                if (isset($pkg_name)) {
                        $incoming_pkgdir = INCOMING_DIR . substr($pkg_name, 0, 2) . "/" . $pkg_name;
                }

                if (!$error) {
                        # First, see if this package already exists, and if it can be overwritten
                        $pkg_id = pkgid_from_name($pkg_name);
                        if (can_submit_pkg($pkg_name, $_COOKIE["AURSID"])) {
                                if (file_exists($incoming_pkgdir)) {
                                        # Blow away the existing file/dir and contents
                                        rm_tree($incoming_pkgdir);
                                }

                                # The mode is masked by the current umask, so not as scary as it looks
                                if (!mkdir($incoming_pkgdir, 0777, true)) {
                                        $error = __( "Could not create directory %s.", $incoming_pkgdir);
                                }
                        } else {
                                $error = __( "You are not allowed to overwrite the %h%s%h package.", "<b>", $pkg_name, "</b>");
                        }

                if (!$error) {
                        # Check if package name is blacklisted.
                        if (!$pkg_id && pkgname_is_blacklisted($pkg_name)) {
                                if (!canSubmitBlacklisted(account_from_sid($_COOKIE["AURSID"]))) {
                                        $error = __( "%s is on the package blacklist, please check if it's available in the official repos.", $pkg_name);
                                }
                        }
                }
                }

                if (!$error) {
                        if (!chdir($incoming_pkgdir)) {
                                $error = __("Could not change directory to %s.", $incoming_pkgdir);
                        }

                        file_put_contents('PKGBUILD', $pkgbuild_raw);
                        move_uploaded_file($_FILES['pfile']['tmp_name'], $pkg_name . '.tar.gz');
                }

                # Update the backend database
                if (!$error) {

                        $dbh = db_connect();
                        db_query("BEGIN", $dbh);

                        $q = "SELECT * FROM Packages WHERE Name = '" . mysql_real_escape_string($new_pkgbuild['pkgname']) . "'";
                        $result = db_query($q, $dbh);
                        $pdata = mysql_fetch_assoc($result);

                        if (isset($new_pkgbuild['epoch']) && (int)$new_pkgbuild['epoch'] > 0) {
                                $pkg_version = sprintf('%d:%s-%s', $new_pkgbuild['epoch'], $new_pkgbuild['pkgver'], $new_pkgbuild['pkgrel']);
                        } else {
                                $pkg_version = sprintf('%s-%s', $new_pkgbuild['pkgver'], $new_pkgbuild['pkgrel']);
                        }

                        if ($pdata) {
                                # This is an overwrite of an existing package, the database ID
                                # needs to be preserved so that any votes are retained. However,
                                # PackageDepends and PackageSources can be purged.
                                $packageID = $pdata["ID"];

                                # Flush out old data that will be replaced with new data
                                $q = "DELETE FROM PackageDepends WHERE PackageID = " . $packageID;
                                db_query($q, $dbh);
                                $q = "DELETE FROM PackageSources WHERE PackageID = " . $packageID;
                                db_query($q, $dbh);

                                # If a new category was chosen, change it to that
                                if ($_POST['category'] > 1) {
                                        $q = sprintf( "UPDATE Packages SET CategoryID = %d WHERE ID = %d",
                                                mysql_real_escape_string($_REQUEST['category']),
                                                $packageID);

                                        db_query($q, $dbh);
                                }

                                # Update package data
                                $q = sprintf("UPDATE Packages SET ModifiedTS = UNIX_TIMESTAMP(), Name = '%s', Version = '%s', License = '%s', Description = '%s', URL = '%s', OutOfDateTS = NULL, MaintainerUID = %d WHERE ID = %d",
                                        mysql_real_escape_string($new_pkgbuild['pkgname']),
                                        mysql_real_escape_string($pkg_version),
                                        mysql_real_escape_string($new_pkgbuild['license']),
                                        mysql_real_escape_string($new_pkgbuild['pkgdesc']),
                                        mysql_real_escape_string($new_pkgbuild['url']),
                                        $uid,
                                        $packageID);

                                db_query($q, $dbh);

                        } else {
                                # This is a brand new package
                                $q = sprintf("INSERT INTO Packages (Name, License, Version, CategoryID, Description, URL, SubmittedTS, ModifiedTS, SubmitterUID, MaintainerUID) VALUES ('%s', '%s', '%s', %d, '%s', '%s', UNIX_TIMESTAMP(), UNIX_TIMESTAMP(), %d, %d)",
                                        mysql_real_escape_string($new_pkgbuild['pkgname']),
                                        mysql_real_escape_string($new_pkgbuild['license']),
                                        mysql_real_escape_string($pkg_version),
                                        mysql_real_escape_string($_REQUEST['category']),
                                        mysql_real_escape_string($new_pkgbuild['pkgdesc']),
                                        mysql_real_escape_string($new_pkgbuild['url']),
                                        $uid,
                                        $uid);

                                db_query($q, $dbh);
                                $packageID = mysql_insert_id($dbh);

                        }

                        # Update package depends
                        $depends = explode(" ", $new_pkgbuild['depends']);
                        if ($depends !== false) {
                                foreach ($depends as $dep) {
                                        $deppkgname = preg_replace("/(<|<=|=|>=|>).*/", "", $dep);
                                        $depcondition = str_replace($deppkgname, "", $dep);

                                        if ($deppkgname == "") {
                                                continue;
                                        }
                                        else if ($deppkgname == "#") {
                                                break;
                                        }

                                        $q = sprintf("INSERT INTO PackageDepends (PackageID, DepName, DepCondition) VALUES (%d, '%s', '%s')",
                                                $packageID,
                                                mysql_real_escape_string($deppkgname),
                                                mysql_real_escape_string($depcondition));

                                        db_query($q, $dbh);
                                }
                        }

                        # Insert sources
                        $sources = explode(" ", $new_pkgbuild['source']);
                        foreach ($sources as $src) {
                                if ($src != "" ) {
                                        $q = "INSERT INTO PackageSources (PackageID, Source) VALUES (";
                                        $q .= $packageID . ", '" . mysql_real_escape_string($src) . "')";
                                        db_query($q, $dbh);
                                }
                        }

                        # If we just created this package, or it was an orphan and we
                        # auto-adopted, add submitting user to the notification list.
                        if (!$pdata || $pdata["MaintainerUID"] === NULL) {
                                pkg_notify(account_from_sid($_COOKIE["AURSID"], $dbh), array($packageID), true, $dbh);
                        }

                        # Entire package creation process is atomic
                        db_query("COMMIT", $dbh);

                        header('Location: packages.php?ID=' . $packageID);
                }

                chdir($cwd);
        }

# Logic over, let's do some output

html_header("Submit");

?>

<?php if ($error): ?>
        <p class="pkgoutput"><?php print $error ?></p>
<?php endif; ?>

<div class="pgbox">
        <div class="pgboxtitle">
                <span class="f3"><?php print __("Submit"); ?></span>
        </div>
        <div class="pgboxbody">
        <p><?php echo __("Upload your source packages here. Create source packages with `makepkg --source`.") ?></p>

<?php
        if (empty($_REQUEST['pkgsubmit']) || $error):
                # User is not uploading, or there were errors uploading - then
                # give the visitor the default upload form
                if (ini_get("file_uploads")):

                        $pkg_categories = pkgCategories();
?>

<form action='pkgsubmit.php' method='post' enctype='multipart/form-data'>
        <div> <input type='hidden' name='pkgsubmit' value='1' /> </div>
        <table border='0' cellspacing='5'>
                <tr>
                        <td class='f4' align='right'><?php print __("Package Category"); ?>:</td>
                        <td class='f4' align='left'>
                        <select name='category'>
                                <option value='1'><?php print __("Select Category"); ?></option>
                                <?php
                                        foreach ($pkg_categories as $num => $cat):
                                                print "<option value='" . $num . "'";
                                                if (isset($_POST['category']) && $_POST['category'] == $cat):
                                                        print " selected='selected'";
                                                endif;
                                                print ">" . $cat . "</option>";
                                        endforeach;
                                ?>
                        </select>
                        </td>
                </tr>
                <tr>
                        <td class='f4' align='right'><?php print __("Upload package file"); ?>:</td>
                        <td class='f4' align='left'>
                                <input type='file' name='pfile' size='30' />
                        </td>
                </tr>
                <tr>
                        <td align='left'>
                                <input class='button' type='submit' value='<?php print __("Upload"); ?>' />
                        </td>
                </tr>
        </table>
</form>

<?php
                else:
                        print __("Sorry, uploads are not permitted by this server.");
?>

<br />

<?php
                endif;
        endif;
else:
        # Visitor is not logged in
        print __("You must create an account before you can upload packages.");
        exit();
?>

<br />

<?php
endif;
?>

        </div>
</div>

<?php
html_footer(AUR_VERSION);