Rev 650 | Rev 652 | Go to most recent revision | Details | Compare with Previous | Last modification | View Log | RSS feed
Rev | Author | Line No. | Line |
---|---|---|---|
635 | daniel-mar | 1 | <?php |
2 | |||
3 | /* |
||
4 | * OIDplus 2.0 |
||
5 | * Copyright 2019 - 2021 Daniel Marschall, ViaThinkSoft |
||
6 | * |
||
7 | * Licensed under the Apache License, Version 2.0 (the "License"); |
||
8 | * you may not use this file except in compliance with the License. |
||
9 | * You may obtain a copy of the License at |
||
10 | * |
||
11 | * http://www.apache.org/licenses/LICENSE-2.0 |
||
12 | * |
||
13 | * Unless required by applicable law or agreed to in writing, software |
||
14 | * distributed under the License is distributed on an "AS IS" BASIS, |
||
15 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||
16 | * See the License for the specific language governing permissions and |
||
17 | * limitations under the License. |
||
18 | */ |
||
19 | |||
20 | if (!defined('INSIDE_OIDPLUS')) die(); |
||
21 | |||
22 | class OIDplusPageAdminSoftwareUpdate extends OIDplusPagePluginAdmin { |
||
23 | |||
24 | public function init($html=true) { |
||
25 | } |
||
26 | |||
27 | public function action($actionID, $params) { |
||
28 | if ($actionID == 'update_now') { |
||
647 | daniel-mar | 29 | @set_time_limit(0); |
635 | daniel-mar | 30 | |
31 | if (!OIDplus::authUtils()->isAdminLoggedIn()) { |
||
32 | throw new OIDplusException(_L('You need to <a %1>log in</a> as administrator.',OIDplus::gui()->link('oidplus:login$admin'))); |
||
33 | } |
||
34 | |||
647 | daniel-mar | 35 | $rev = $params['rev']; |
635 | daniel-mar | 36 | |
651 | daniel-mar | 37 | // Download and unzip |
38 | |||
650 | daniel-mar | 39 | if (function_exists('gzdecode')) { |
40 | $url = "https://www.oidplus.com/updates/update_".($rev-1)."_to_".($rev).".txt.gz"; // TODO: in consts.ini |
||
41 | $cont = @file_get_contents($url); |
||
42 | if ($cont !== false) $cont = @gzdecode($cont); |
||
43 | } else { |
||
44 | $url = "https://www.oidplus.com/updates/update_".($rev-1)."_to_".($rev).".txt"; // TODO: in consts.ini |
||
45 | $cont = @file_get_contents($url); |
||
46 | } |
||
635 | daniel-mar | 47 | |
651 | daniel-mar | 48 | if ($cont === false) throw new OIDplusException(_L("Update %1 could not be downloaded from ViaThinkSoft server. Please try again later.",$rev)); |
650 | daniel-mar | 49 | |
651 | daniel-mar | 50 | // Check signature... |
51 | |||
52 | if (function_exists('openssl_verify')) { |
||
53 | |||
54 | if (!preg_match('@<\?php /\* <ViaThinkSoftSignature>(.+)</ViaThinkSoftSignature> \*/ \?>\n@ismU', $cont, $m)) { |
||
55 | throw new OIDplusException(_L("Update package file of revision %1 not digitally signed",$rev)); |
||
56 | } |
||
57 | $signature = base64_decode($m[1]); |
||
58 | |||
59 | $naked = preg_replace('@<\?php /\* <ViaThinkSoftSignature>(.+)</ViaThinkSoftSignature> \*/ \?>\n@ismU', '', $cont); |
||
60 | $hash = hash("sha256", $naked."update_".($rev-1)."_to_".($rev).".txt"); |
||
61 | |||
62 | $public_key = file_get_contents(__DIR__.'/public.pem'); |
||
63 | if (!openssl_verify($hash, $signature, $public_key, OPENSSL_ALGO_SHA256)) { |
||
64 | throw new OIDplusException(_L("Update package file of revision %1: Signature invalid",$rev)); |
||
65 | } |
||
66 | |||
67 | } |
||
68 | |||
69 | // All OK! Write file |
||
70 | |||
647 | daniel-mar | 71 | file_put_contents(OIDplus::localpath().'update.tmp.php', $cont); |
635 | daniel-mar | 72 | |
647 | daniel-mar | 73 | # TODO: instead use cURL? |
74 | // Note: we may not use eval() because script uses die() |
||
75 | $cont = @file_get_contents(OIDplus::webpath().'update.tmp.php'); |
||
76 | if ($cont === false) throw new OIDplusException(_L("Failed to execute update-script. Probably file_get_contents() may not open URLs!")); |
||
77 | |||
78 | return array("status" => 0, "content" => $cont); |
||
635 | daniel-mar | 79 | } |
80 | } |
||
81 | |||
82 | public function gui($id, &$out, &$handled) { |
||
83 | $parts = explode('.',$id,2); |
||
84 | if (!isset($parts[1])) $parts[1] = ''; |
||
85 | if ($parts[0] == 'oidplus:software_update') { |
||
86 | @set_time_limit(0); |
||
87 | |||
88 | $handled = true; |
||
89 | $out['title'] = _L('Software update'); |
||
90 | $out['icon'] = OIDplus::webpath(__DIR__).'icon_big.png'; |
||
91 | |||
92 | if (!OIDplus::authUtils()->isAdminLoggedIn()) { |
||
93 | $out['icon'] = 'img/error_big.png'; |
||
94 | $out['text'] = '<p>'._L('You need to <a %1>log in</a> as administrator.',OIDplus::gui()->link('oidplus:login$admin')).'</p>'; |
||
95 | return; |
||
96 | } |
||
97 | |||
98 | $out['text'] .= '<p><u>'._L('There are three possibilities how to keep OIDplus up-to-date').':</u></p>'; |
||
99 | |||
100 | $out['text'] .= '<p><b>'._L('Method A').'</b>: '._L('Install OIDplus using the subversion tool in your SSH/Linux shell using the command <code>svn co %1</code> and update it regularly with the command <code>svn update</code> . This will automatically download the latest version and check for conflicts. Highly recommended if you have a Shell/SSH access to your webspace!',htmlentities(parse_ini_file(__DIR__.'/consts.ini')['svn']).'/trunk').'</p>'; |
||
101 | |||
102 | $out['text'] .= '<p><b>'._L('Method B').'</b>: '._L('Install OIDplus using the Git client in your SSH/Linux shell using the command <code>git clone %1</code> and update it regularly with the command <code>git pull</code> . This will automatically download the latest version and check for conflicts. Highly recommended if you have a Shell/SSH access to your webspace!','https://github.com/danielmarschall/oidplus.git').'</p>'; |
||
103 | |||
104 | $out['text'] .= '<p><b>'._L('Method C').'</b>: '._L('Install OIDplus by downloading a TAR.GZ file from www.viathinksoft.com, which contains an SVN snapshot, and extract it to your webspace. The TAR.GZ file contains a file named "oidplus_version.txt" which contains the SVN revision of the snapshot. This update-tool will then try to update your files on-the-fly by downloading them from the ViaThinkSoft SVN repository directly into your webspace directory. A change conflict detection is NOT implemented. It is required that the files on your webspace have create/write/delete permissions. Only recommended if you have no access to the SSH/Linux shell.').'</p>'; |
||
105 | |||
106 | $out['text'] .= '<hr>'; |
||
107 | |||
108 | $installType = OIDplus::getInstallType(); |
||
109 | |||
110 | if ($installType === 'ambigous') { |
||
111 | $out['text'] .= '<font color="red">'.strtoupper(_L('Error')).': '._L('Multiple version files/directories (oidplus_version.txt, .git and .svn) are existing! Therefore, the version is ambiguous!').'</font>'; |
||
112 | } else if ($installType === 'unknown') { |
||
113 | $out['text'] .= '<font color="red">'.strtoupper(_L('Error')).': '._L('The version cannot be determined, and the update needs to be applied manually!').'</font>'; |
||
114 | } else if (($installType === 'svn-wc') || ($installType === 'git-wc')) { |
||
115 | if ($installType === 'svn-wc') { |
||
116 | $out['text'] .= '<p>'._L('You are using <b>method A</b> (SVN working copy).').'</p>'; |
||
117 | } else { |
||
118 | $out['text'] .= '<p>'._L('You are using <b>method B</b> (Git working copy).').'</p>'; |
||
119 | } |
||
120 | |||
121 | $local_installation = OIDplus::getVersion(); |
||
648 | daniel-mar | 122 | $newest_version = $this->getLatestRevision(); |
635 | daniel-mar | 123 | |
124 | $out['text'] .= _L('Local installation: %1',($local_installation ? $local_installation : _L('unknown'))).'<br>'; |
||
125 | $out['text'] .= _L('Latest published version: %1',($newest_version ? $newest_version : _L('unknown'))).'<br>'; |
||
126 | |||
127 | $requireInfo = ($installType === 'svn-wc') ? _L('shell access with svn/svnversion tool, or PDO/SQLite3 PHP extension') : _L('shell access with Git client'); |
||
128 | $updateCommand = ($installType === 'svn-wc') ? 'svn update' : 'git pull'; |
||
129 | |||
130 | if (!$newest_version) { |
||
131 | $out['text'] .= '<p><font color="red">'._L('OIDplus could not determine the latest version. Probably the ViaThinkSoft server could not be reached.').'</font></p>'; |
||
132 | } |
||
133 | else if (!$local_installation) { |
||
134 | $out['text'] .= '<p><font color="red">'._L('OIDplus could not determine its version. (Required: %1). Please update your system manually via the "%2" command regularly.',$requireInfo,$updateCommand).'</font></p>'; |
||
135 | } else if ($local_installation == $newest_version) { |
||
136 | $out['text'] .= '<p><font color="green">'._L('You are already using the latest version of OIDplus.').'</font></p>'; |
||
137 | } else { |
||
138 | $out['text'] .= '<p><font color="blue">'._L('Please enter %1 into the SSH shell to update OIDplus to the latest version.','<code>'.$updateCommand.'</code>').'</font></p>'; |
||
139 | |||
140 | $out['text'] .= '<h2 id="update_header">'._L('Preview of update %1 → %2',$local_installation,$newest_version).'</h2>'; |
||
141 | |||
142 | ob_start(); |
||
143 | try { |
||
648 | daniel-mar | 144 | $cont = $this->showChangelog($local_installation); |
635 | daniel-mar | 145 | } catch (Exception $e) { |
146 | $cont = _L('Error: %1',$e->getMessage()); |
||
147 | } |
||
148 | ob_end_clean(); |
||
149 | |||
150 | $cont = preg_replace('@!!!(.+)\\n@', '<font color="red">!!!\\1</font>'."\n", $cont); |
||
151 | |||
152 | $out['text'] .= '<pre id="update_infobox">'.$cont.'</pre>'; |
||
153 | } |
||
154 | } else if ($installType === 'svn-snapshot') { |
||
647 | daniel-mar | 155 | $out['text'] .= '<div id="update_versioninfo">'; |
156 | |||
635 | daniel-mar | 157 | $out['text'] .= '<p>'._L('You are using <b>method C</b> (Snapshot TAR.GZ file with oidplus_version.txt file).').'</p>'; |
158 | |||
159 | $local_installation = OIDplus::getVersion(); |
||
648 | daniel-mar | 160 | $newest_version = $this->getLatestRevision(); |
635 | daniel-mar | 161 | |
162 | $out['text'] .= _L('Local installation: %1',($local_installation ? $local_installation : _L('unknown'))).'<br>'; |
||
163 | $out['text'] .= _L('Latest published version: %1',($newest_version ? $newest_version : _L('unknown'))).'<br>'; |
||
164 | |||
165 | if (!$newest_version) { |
||
166 | $out['text'] .= '<p><font color="red">'._L('OIDplus could not determine the latest version. Probably the ViaThinkSoft server could not be reached.').'</font></p>'; |
||
647 | daniel-mar | 167 | $out['text'] .= '</div>'; |
635 | daniel-mar | 168 | } |
169 | else if ($local_installation == $newest_version) { |
||
170 | $out['text'] .= '<p><font color="green">'._L('You are already using the latest version of OIDplus.').'</font></p>'; |
||
647 | daniel-mar | 171 | $out['text'] .= '</div>'; |
635 | daniel-mar | 172 | } else { |
173 | $out['text'] .= '<p><font color="red">'.strtoupper(_L('Warning')).': '._L('Please make a backup of your files before updating. In case of an error, the OIDplus system (including this update-assistant) might become unavailable. Also, since the web-update does not contain collision-detection, changes you have applied (like adding, removing or modified files) might get reverted/lost! In case the update fails, you can download and extract the complete <a href="https://www.viathinksoft.com/projects/oidplus">SVN-Snapshot TAR.GZ file</a> again. Since all your data should lay inside the folder "userdata" and "userdata_pub", this should be safe.').'</font></p>'; |
||
174 | $out['text'] .= '<form method="POST" action="index.php">'; |
||
175 | |||
648 | daniel-mar | 176 | $out['text'] .= '<p><input type="button" onclick="OIDplusPageAdminSoftwareUpdate.doUpdateOIDplus('.((int)substr($local_installation,4)+1).', '.substr($newest_version,4).')" value="'._L('Update NOW').'"></p>'; |
635 | daniel-mar | 177 | |
647 | daniel-mar | 178 | $out['text'] .= '</div>'; |
179 | |||
635 | daniel-mar | 180 | $out['text'] .= '<h2 id="update_header">'._L('Preview of update %1 → %2',$local_installation,$newest_version).'</h2>'; |
181 | |||
182 | ob_start(); |
||
183 | try { |
||
648 | daniel-mar | 184 | $cont = $this->showChangelog($local_installation); |
635 | daniel-mar | 185 | } catch (Exception $e) { |
186 | $cont = _L('Error: %1',$e->getMessage()); |
||
187 | } |
||
188 | ob_end_clean(); |
||
189 | |||
190 | $cont = preg_replace('@!!!(.+)\\n@', '<font color="red">!!!\\1</font>'."\n", $cont); |
||
191 | |||
192 | $out['text'] .= '<pre id="update_infobox">'.$cont.'</pre>'; |
||
193 | } |
||
194 | } |
||
195 | } else { |
||
196 | $handled = false; |
||
197 | } |
||
198 | } |
||
199 | |||
200 | public function tree(&$json, $ra_email=null, $nonjs=false, $req_goto='') { |
||
201 | if (!OIDplus::authUtils()->isAdminLoggedIn()) return false; |
||
202 | |||
203 | if (file_exists(__DIR__.'/treeicon.png')) { |
||
204 | $tree_icon = OIDplus::webpath(__DIR__).'treeicon.png'; |
||
205 | } else { |
||
206 | $tree_icon = null; // default icon (folder) |
||
207 | } |
||
208 | |||
209 | $json[] = array( |
||
210 | 'id' => 'oidplus:software_update', |
||
211 | 'icon' => $tree_icon, |
||
212 | 'text' => _L('Software update') |
||
213 | ); |
||
214 | |||
215 | return true; |
||
216 | } |
||
217 | |||
218 | public function tree_search($request) { |
||
219 | return false; |
||
220 | } |
||
648 | daniel-mar | 221 | |
222 | private $releases_ser = null; |
||
223 | |||
224 | private function showChangelog($local_ver) { |
||
225 | |||
226 | try { |
||
227 | if (is_null($this->releases_ser)) { |
||
228 | $url = "https://www.oidplus.com/updates/releases.ser"; // TODO: in consts.ini |
||
229 | $cont = @file_get_contents($url); |
||
230 | if ($cont === false) return false; |
||
231 | $this->releases_ser = $cont; |
||
232 | } else { |
||
233 | $cont = $this->releases_ser; |
||
234 | } |
||
235 | $content = ''; |
||
236 | $ary = @unserialize($cont); |
||
237 | if ($ary === false) return false; |
||
238 | krsort($ary); |
||
239 | foreach ($ary as $rev => $data) { |
||
240 | if ($rev <= substr($local_ver,4)) continue; |
||
241 | $comment = empty($data['msg']) ? _L('No comment') : $data['msg']; |
||
242 | $tex = _L("New revision %1 by %2",$rev,$data['author'])." (".$data['date'].") "; |
||
243 | $content .= trim($tex . str_replace("\n", "\n".str_repeat(' ', strlen($tex)), $comment)); |
||
244 | $content .= "\n"; |
||
245 | } |
||
246 | return $content; |
||
247 | } catch (Exception $e) { |
||
248 | return false; |
||
249 | } |
||
250 | |||
251 | } |
||
252 | |||
253 | private function getLatestRevision() { |
||
254 | try { |
||
255 | if (is_null($this->releases_ser)) { |
||
256 | $url = "https://www.oidplus.com/updates/releases.ser"; // TODO: in consts.ini |
||
257 | $cont = @file_get_contents($url); |
||
258 | if ($cont === false) return false; |
||
259 | $this->releases_ser = $cont; |
||
260 | } else { |
||
261 | $cont = $this->releases_ser; |
||
262 | } |
||
263 | $ary = @unserialize($cont); |
||
264 | if ($ary === false) return false; |
||
265 | krsort($ary); |
||
266 | $max_rev = array_keys($ary)[0]; |
||
267 | $newest_version = 'svn-' . $max_rev; |
||
268 | return $newest_version; |
||
269 | } catch (Exception $e) { |
||
270 | return false; |
||
271 | } |
||
272 | } |
||
635 | daniel-mar | 273 | } |