[aur-dev] [PATCH] Return 404 for invalid account/package subpages

[Lukas Fleischer]

Display an error page and return a 404 status code in the following
cases:

* An invalid package name is passed to the "packages" action.
* An invalid user name is passed to the "account" action.
* An invalid package action is passed.
* An invalid account action is passed.

Signed-off-by: Lukas Fleischer <archli...@cryptocrack.de>
---
 web/html/index.php | 34 ++++++++++++++++++++++++++--------
 1 file changed, 26 insertions(+), 8 deletions(-)

diff --git a/web/html/index.php b/web/html/index.php
index 422c0e5..3b46ab9 100644
--- a/web/html/index.php
+++ b/web/html/index.php
@@ -7,15 +7,21 @@ include_once("pkgfuncs.inc.php");
 $path = $_SERVER['PATH_INFO'];
 $tokens = explode('/', $path);
 
-if (isset($tokens[1]) && '/' . $tokens[1] == get_pkg_route()) {
-       if (isset($tokens[2])) {
+if (!empty($tokens[1]) && '/' . $tokens[1] == get_pkg_route()) {
+       if (!empty($tokens[2])) {
                /* TODO: Create a proper data structure to pass variables from
                 * the routing framework to the individual pages instead of
                 * initializing arbitrary variables here. */
                $pkgname = $tokens[2];
                $pkgid = pkgid_from_name($pkgname);
 
-               if (isset($tokens[3])) {
+               if (!$pkgid) {
+                       header("HTTP/1.0 404 Not Found");
+                       include "./404.php";
+                       return;
+               }
+
+               if (!empty($tokens[3])) {
                        if ($tokens[3] == 'voters') {
                                $_GET['ID'] = pkgid_from_name($tokens[2]);
                                include('voters.php');
@@ -49,6 +55,10 @@ if (isset($tokens[1]) && '/' . $tokens[1] == 
get_pkg_route()) {
                        case "merge":
                                include('pkgmerge.php');
                                return;
+                       default:
+                               header("HTTP/1.0 404 Not Found");
+                               include "./404.php";
+                               return;
                        }
 
                        if (isset($_COOKIE['AURSID'])) {
@@ -60,17 +70,25 @@ if (isset($tokens[1]) && '/' . $tokens[1] == 
get_pkg_route()) {
        }
 
        include get_route('/' . $tokens[1]);
-} elseif (isset($tokens[1]) && '/' . $tokens[1] == get_user_route()) {
-       if (isset($tokens[2])) {
-               $_REQUEST['U'] = $tokens[2];
+} elseif (!empty($tokens[1]) && '/' . $tokens[1] == get_user_route()) {
+       if (!empty($tokens[2])) {
+               $_REQUEST['ID'] = uid_from_username($tokens[2]);
 
-               if (isset($tokens[3])) {
+               if (!$_REQUEST['ID']) {
+                       header("HTTP/1.0 404 Not Found");
+                       include "./404.php";
+                       return;
+               }
+
+               if (!empty($tokens[3])) {
                        if ($tokens[3] == 'edit') {
                                $_REQUEST['Action'] = "DisplayAccount";
                        } elseif ($tokens[3] == 'update') {
                                $_REQUEST['Action'] = "UpdateAccount";
                        } else {
-                               $_REQUEST['Action'] = "AccountInfo";
+                               header("HTTP/1.0 404 Not Found");
+                               include "./404.php";
+                               return;
                        }
                } else {
                        $_REQUEST['Action'] = "AccountInfo";
-- 
1.8.0