mirror of
https://github.com/avecms/AVE.cms.git
synced 2026-08-01 08:45:44 +00:00
225 lines
13 KiB
PHP
225 lines
13 KiB
PHP
<?php
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------------------
|
|
| AVE.cms
|
|
|--------------------------------------------------------------------------------------
|
|
| @package AVE.cms
|
|
| @file system/App/Common/CoreUpdate/UpdateRepository.php
|
|
| @author AVE.cms <support@ave-cms.ru>
|
|
| @copyright 2007-2026 (c) AVE.cms
|
|
| @link https://ave-cms.ru
|
|
| @version 3.3
|
|
*/
|
|
|
|
namespace App\Common\CoreUpdate;
|
|
|
|
defined('BASEPATH') || die('Direct access to this location is not allowed.');
|
|
|
|
use App\Common\Cache;
|
|
use App\Common\DistributionProfile;
|
|
use App\Common\ModuleSettings;
|
|
use App\Common\OutboundHttpClient;
|
|
|
|
/** Signed owner-controlled catalog of core update patches. */
|
|
class UpdateRepository
|
|
{
|
|
const MODULE = 'core_updates';
|
|
const ENVELOPE_FORMAT = 'ave-core-update-repository-v1';
|
|
const PAYLOAD_FORMAT = 'ave-core-update-index-v1';
|
|
const CACHE_TTL = 900;
|
|
|
|
public static function settings()
|
|
{
|
|
return array(
|
|
'enabled' => (bool) ModuleSettings::value('repository_enabled', false, self::MODULE),
|
|
'url' => trim((string) ModuleSettings::value('repository_url', '', self::MODULE)),
|
|
'public_key' => trim((string) ModuleSettings::value('repository_public_key', '', self::MODULE)),
|
|
);
|
|
}
|
|
|
|
public static function saveSettings(array $input)
|
|
{
|
|
$enabled = !empty($input['enabled']);
|
|
$url = self::catalogUrl(isset($input['url']) ? $input['url'] : '', $enabled);
|
|
$key = self::publicKey(isset($input['public_key']) ? $input['public_key'] : '', $enabled);
|
|
ModuleSettings::set('repository_enabled', $enabled, self::MODULE, 'bool');
|
|
ModuleSettings::set('repository_url', $url, self::MODULE, 'string');
|
|
ModuleSettings::set('repository_public_key', $key, self::MODULE, 'string');
|
|
Cache::forgetTag('core-update-repository');
|
|
return self::settings();
|
|
}
|
|
|
|
public static function officialSettings()
|
|
{
|
|
try {
|
|
$profile = DistributionProfile::official();
|
|
$repository = DistributionProfile::repository($profile, 'core_updates');
|
|
return array('available' => true, 'name' => $profile['name'], 'error' => '') + $repository;
|
|
} catch (\Throwable $e) {
|
|
return array('available' => false, 'name' => '', 'url' => '', 'public_key' => '', 'fingerprint' => '', 'error' => $e->getMessage());
|
|
}
|
|
}
|
|
|
|
public static function restoreOfficial()
|
|
{
|
|
$official = self::officialSettings();
|
|
if (empty($official['available'])) { throw new \RuntimeException($official['error']); }
|
|
return self::saveSettings(array('enabled' => true, 'url' => $official['url'], 'public_key' => $official['public_key']));
|
|
}
|
|
|
|
public static function catalog($force = false)
|
|
{
|
|
$settings = self::settings();
|
|
if (!$settings['enabled']) { return self::emptyCatalog('Каталог обновлений выключен'); }
|
|
if ($settings['url'] === '' || $settings['public_key'] === '') { return self::emptyCatalog('Укажите URL и публичный ключ'); }
|
|
$key = 'core-update-repository:' . hash('sha256', $settings['url'] . "\0" . $settings['public_key']);
|
|
if ($force) { Cache::forget($key); }
|
|
try {
|
|
$catalog = Cache::rememberTagged($key, self::CACHE_TTL, array('core-update-repository'), function () use ($settings) {
|
|
$response = OutboundHttpClient::get($settings['url'], array('max_bytes' => 2097152, 'timeout' => 20));
|
|
return self::verifyEnvelope($response['body'], $settings['public_key'], $settings['url']);
|
|
});
|
|
$catalog['enabled'] = true;
|
|
return self::withState($catalog);
|
|
} catch (\Throwable $e) {
|
|
return self::emptyCatalog($e->getMessage(), true);
|
|
}
|
|
}
|
|
|
|
public static function download($id, $actorId = null)
|
|
{
|
|
$catalog = self::catalog(false);
|
|
if (!empty($catalog['error'])) { throw new \RuntimeException($catalog['error']); }
|
|
$item = null;
|
|
foreach ($catalog['items'] as $candidate) { if ($candidate['id'] === (string) $id) { $item = $candidate; break; } }
|
|
if (!$item || empty($item['applicable'])) { throw new \RuntimeException('Подходящий патч отсутствует в проверенном каталоге'); }
|
|
$response = OutboundHttpClient::get($item['archive'], array('max_bytes' => min(PatchPackage::MAX_ARCHIVE_BYTES, $item['size'] + 1), 'timeout' => 120));
|
|
if ((int) $response['bytes'] !== $item['size']) {
|
|
throw new \RuntimeException(
|
|
'Файл патча на сервере загружен не полностью: ожидалось ' . $item['size']
|
|
. ' байт, получено ' . (int) $response['bytes'] . '. Повторно загрузите архив репозитория.'
|
|
);
|
|
}
|
|
|
|
if (!hash_equals($item['sha256'], hash('sha256', $response['body']))) {
|
|
throw new \RuntimeException('Контрольная сумма патча на сервере не совпадает с подписанным каталогом. Повторно загрузите архив репозитория.');
|
|
}
|
|
|
|
$temporary = BASEPATH . '/tmp/.core-update-' . bin2hex(random_bytes(8)) . '.zip';
|
|
if (file_put_contents($temporary, $response['body'], LOCK_EX) === false) { throw new \RuntimeException('Не удалось сохранить загруженный патч'); }
|
|
@chmod($temporary, 0600);
|
|
try { return UpdateJob::create($temporary, self::settings()['public_key'], $actorId); }
|
|
finally { @unlink($temporary); }
|
|
}
|
|
|
|
public static function verifyEnvelope($raw, $publicKey, $catalogUrl)
|
|
{
|
|
$envelope = json_decode((string) $raw, true);
|
|
if (!is_array($envelope) || !isset($envelope['format'], $envelope['payload'], $envelope['signature']) || $envelope['format'] !== self::ENVELOPE_FORMAT) { throw new \RuntimeException('Формат каталога обновлений не поддерживается'); }
|
|
$payloadRaw = base64_decode((string) $envelope['payload'], true);
|
|
$signature = base64_decode((string) $envelope['signature'], true);
|
|
$key = openssl_pkey_get_public(self::publicKey($publicKey, true));
|
|
if ($payloadRaw === false || $signature === false || !$key || openssl_verify($payloadRaw, $signature, $key, OPENSSL_ALGO_SHA256) !== 1) { throw new \RuntimeException('Подпись каталога обновлений не прошла проверку'); }
|
|
if (is_resource($key)) { openssl_free_key($key); }
|
|
$payload = json_decode($payloadRaw, true);
|
|
if (!is_array($payload) || !isset($payload['format'], $payload['updates']) || $payload['format'] !== self::PAYLOAD_FORMAT || !is_array($payload['updates'])) { throw new \RuntimeException('Подписанные данные каталога повреждены'); }
|
|
$items = array();
|
|
foreach ($payload['updates'] as $update) { $item = self::normalizeItem($update, $catalogUrl); if (isset($items[$item['id']])) { throw new \RuntimeException('Каталог содержит повторяющийся патч'); } $items[$item['id']] = $item; }
|
|
return array('enabled' => true, 'verified' => true, 'error' => '', 'name' => isset($payload['name']) ? (string) $payload['name'] : 'AVE.cms core updates', 'channel' => isset($payload['channel']) ? (string) $payload['channel'] : 'stable', 'generated_at' => isset($payload['generated_at']) ? (string) $payload['generated_at'] : '', 'items' => array_values($items));
|
|
}
|
|
|
|
protected static function normalizeItem($item, $catalogUrl)
|
|
{
|
|
if (!is_array($item) || empty($item['id']) || !isset($item['from'], $item['to'], $item['archive'], $item['size'], $item['sha256'])) { throw new \RuntimeException('Некорректная запись обновления'); }
|
|
$id = trim((string) $item['id']);
|
|
$size = (int) $item['size'];
|
|
$checksum = strtolower((string) $item['sha256']);
|
|
if (!preg_match('/^[A-Za-z0-9._-]{6,160}$/', $id) || $size < 1 || $size > PatchPackage::MAX_ARCHIVE_BYTES || !preg_match('/^[a-f0-9]{64}$/', $checksum)) { throw new \RuntimeException('Некорректные метаданные обновления'); }
|
|
return array('id' => $id, 'from' => (array) $item['from'], 'to' => (array) $item['to'], 'cumulative' => !empty($item['cumulative']), 'archive' => self::archiveUrl($item['archive'], $catalogUrl), 'size' => $size, 'sha256' => $checksum, 'notes' => isset($item['notes']) ? trim((string) $item['notes']) : '', 'requirements' => isset($item['requirements']) ? (array) $item['requirements'] : array());
|
|
}
|
|
|
|
protected static function withState(array $catalog)
|
|
{
|
|
$current = ReleaseState::installed();
|
|
foreach ($catalog['items'] as &$item) {
|
|
$item['compatibility'] = ReleaseState::patchCompatibility($item['from'], $item['to'], !empty($item['cumulative']));
|
|
$item['applicable'] = $item['compatibility']['applicable'];
|
|
$item['installed'] = ReleaseState::targetInstalled($item['to'], $current);
|
|
$item['state'] = $item['installed'] ? 'installed' : ($item['applicable'] ? 'available' : 'unavailable');
|
|
}
|
|
|
|
unset($item);
|
|
$catalog['items'] = self::collapseVariants($catalog['items']);
|
|
$catalog['items'] = self::preferCumulative($catalog['items']);
|
|
$available = 0;
|
|
foreach ($catalog['items'] as $item) { if (!empty($item['applicable'])) { $available++; } }
|
|
$catalog['available'] = $available;
|
|
return $catalog;
|
|
}
|
|
|
|
/** Keep one logical transition and select the variant matching this installation. */
|
|
protected static function collapseVariants(array $items)
|
|
{
|
|
$groups = array();
|
|
$order = array();
|
|
foreach ($items as $item) {
|
|
$key = (string) $item['from']['version'] . "\0" . (string) $item['from']['build']
|
|
. "\0" . (string) $item['to']['version'] . "\0" . (string) $item['to']['build'];
|
|
if (!isset($groups[$key])) {
|
|
$groups[$key] = array('selected' => $item, 'rank' => self::variantRank($item), 'count' => 1);
|
|
$order[] = $key;
|
|
continue;
|
|
}
|
|
|
|
$groups[$key]['count']++;
|
|
$rank = self::variantRank($item);
|
|
if ($rank < $groups[$key]['rank']) {
|
|
$groups[$key]['selected'] = $item;
|
|
$groups[$key]['rank'] = $rank;
|
|
}
|
|
}
|
|
|
|
$out = array();
|
|
foreach ($order as $key) {
|
|
$item = $groups[$key]['selected'];
|
|
$item['variant_count'] = (int) $groups[$key]['count'];
|
|
$out[] = $item;
|
|
}
|
|
|
|
return $out;
|
|
}
|
|
|
|
protected static function variantRank(array $item)
|
|
{
|
|
if (!empty($item['applicable'])) { return 0; }
|
|
return isset($item['compatibility']['code']) && $item['compatibility']['code'] === 'fingerprint_mismatch' ? 1 : 2;
|
|
}
|
|
|
|
/** Hide obsolete chain steps when one cumulative patch covers this build. */
|
|
protected static function preferCumulative(array $items)
|
|
{
|
|
$selected = null;
|
|
foreach ($items as $item) {
|
|
if (empty($item['cumulative']) || empty($item['applicable'])) { continue; }
|
|
if ($selected === null || version_compare((string) $item['to']['build'], (string) $selected['to']['build'], '>')) { $selected = $item; }
|
|
}
|
|
|
|
if ($selected === null) { return $items; }
|
|
$result = array();
|
|
foreach ($items as $item) {
|
|
if ($item['id'] === $selected['id']
|
|
|| version_compare((string) $item['to']['build'], (string) $selected['to']['build'], '>')) {
|
|
$result[] = $item;
|
|
}
|
|
}
|
|
|
|
return $result;
|
|
}
|
|
|
|
protected static function emptyCatalog($error, $enabled = false) { return array('enabled' => $enabled, 'verified' => false, 'error' => (string) $error, 'name' => '', 'channel' => '', 'generated_at' => '', 'items' => array(), 'available' => 0); }
|
|
protected static function catalogUrl($url, $required) { $url = trim((string) $url); if ($url === '' && !$required) { return ''; } OutboundHttpClient::inspectUrl($url); return $url; }
|
|
protected static function publicKey($key, $required) { $key = trim((string) $key); if ($key === '' && !$required) { return ''; } $resource = $key !== '' ? openssl_pkey_get_public($key) : false; if (!$resource) { throw new \InvalidArgumentException('Публичный RSA-ключ обновлений некорректен'); } $details = openssl_pkey_get_details($resource); if (is_resource($resource)) { openssl_free_key($resource); } if (!is_array($details) || !isset($details['type']) || $details['type'] !== OPENSSL_KEYTYPE_RSA) { throw new \InvalidArgumentException('Требуется публичный RSA-ключ'); } return $key; }
|
|
protected static function archiveUrl($archive, $catalogUrl) { $archive = trim((string) $archive); if (preg_match('#^https://#i', $archive)) { OutboundHttpClient::inspectUrl($archive); return $archive; } if ($archive === '' || $archive[0] === '/' || strpos($archive, '..') !== false) { throw new \RuntimeException('Некорректный URL архива обновления'); } $parts = parse_url($catalogUrl); if (!is_array($parts) || empty($parts['scheme']) || empty($parts['host'])) { throw new \RuntimeException('Некорректный URL каталога'); } $basePath = isset($parts['path']) ? dirname($parts['path']) : ''; $url = $parts['scheme'] . '://' . $parts['host'] . (isset($parts['port']) ? ':' . (int) $parts['port'] : '') . rtrim($basePath, '/') . '/' . ltrim($archive, '/'); OutboundHttpClient::inspectUrl($url); return $url; }
|
|
}
|