r75392 MediaWiki - Code Review archive

Repository:MediaWiki
Revision:r75391‎ | r75392 | r75393 >
Date:23:18, 25 October 2010
Author:demon
Status:ok (Comments)
Tags:
Comment:
(bug 198: Easy, secure in-place upgrade) Introduce new $wgUpgradeKey. When set in LocalSettings, it allows the user to unlock the installer/upgrader with a hidden key. The days of having to move LocalSettings.php in order to perform an upgrade are gone. The key is the only thing loaded by the installer, you still have to provide the SQL information yourself (as an extra layer of sanity to keep unauthorized users from running it)
Modified paths:
  • /trunk/phase3/RELEASE-NOTES (modified) (history)
  • /trunk/phase3/includes/DefaultSettings.php (modified) (history)
  • /trunk/phase3/includes/installer/CoreInstaller.php (modified) (history)
  • /trunk/phase3/includes/installer/Installer.i18n.php (modified) (history)
  • /trunk/phase3/includes/installer/Installer.php (modified) (history)
  • /trunk/phase3/includes/installer/WebInstaller.php (modified) (history)
  • /trunk/phase3/includes/installer/WebInstallerPage.php (modified) (history)

Diff [purge]

Index: trunk/phase3/includes/installer/WebInstaller.php
@@ -163,7 +163,15 @@
164164 # Get the page name.
165165 $pageName = $this->request->getVal( 'page' );
166166
167 - if ( in_array( $pageName, $this->otherPages ) ) {
 167+ # Check LocalSettings status
 168+ $localSettings = $this->getLocalSettingsStatus();
 169+
 170+ if( !$localSettings->isGood() && $this->getVar( '_LocalSettingsLocked' ) ) {
 171+ $pageName = 'Locked';
 172+ $pageId = false;
 173+ $page = $this->getPageByName( $pageName );
 174+ $page->setLocalSettingsStatus( $localSettings );
 175+ } elseif ( in_array( $pageName, $this->otherPages ) ) {
168176 # Out of sequence
169177 $pageId = false;
170178 $page = $this->getPageByName( $pageName );
@@ -212,14 +220,8 @@
213221 # Execute the page.
214222 $this->currentPageName = $page->getName();
215223 $this->startPageWrapper( $pageName );
216 - $localSettings = $this->getLocalSettingsStatus();
217224
218 - if( !$localSettings->isGood() ) {
219 - $this->showStatusBox( $localSettings );
220 - $result = 'output';
221 - } else {
222 - $result = $page->execute();
223 - }
 225+ $result = $page->execute();
224226
225227 $this->endPageWrapper();
226228
Index: trunk/phase3/includes/installer/Installer.php
@@ -230,10 +230,13 @@
231231 wfRestoreWarnings();
232232
233233 if( $ls ) {
234 - if( $this->getDBInstaller()->needsUpgrade() ) {
 234+ $wgCacheEpoch = $wgCommandLineMode = false;
 235+ require_once( "$IP/LocalSettings.php" );
 236+ $vars = get_defined_vars();
 237+ if( isset( $vars['wgUpgradeKey'] ) && $vars['wgUpgradeKey'] ) {
235238 $status->warning( 'config-localsettings-upgrade' );
236 - }
237 - else {
 239+ $this->setVar( '_UpgradeKey', $vars['wgUpgradeKey' ] );
 240+ } else {
238241 $status->fatal( 'config-localsettings-noupgrade' );
239242 }
240243 }
Index: trunk/phase3/includes/installer/CoreInstaller.php
@@ -83,6 +83,8 @@
8484 '_Extensions' => array(),
8585 '_MemCachedServers' => '',
8686 '_ExternalHTTP' => false,
 87+ '_LocalSettingsLocked' => true,
 88+ '_UpgradeKey' => '',
8789 );
8890
8991 /**
Index: trunk/phase3/includes/installer/Installer.i18n.php
@@ -16,8 +16,9 @@
1717 'config-title' => 'MediaWiki $1 installation',
1818 'config-information' => 'Information',
1919 'config-localsettings-upgrade' => "'''Warning''': A <code>LocalSettings.php</code> file has been detected.
20 -Your software is able to upgrade.
21 -Please move <code>LocalSettings.php</code> to somewhere safe and then run the installer again.",
 20+Your software is able to upgrade. Please fill in the value of <code>\$wgUpgradeKey.php</code> in the box",
 21+ 'config-localsettings-key' => 'Upgrade key:',
 22+ 'config-localsettings-badkey' => 'The key you provided is incorrect',
2223 'config-localsettings-noupgrade' => "'''Error''': A <code>LocalSettings.php</code> file has been detected.
2324 Your software is not able to upgrade at this time.
2425 The installer has been disabled for security reasons.",
@@ -51,6 +52,7 @@
5253 'config-page-releasenotes' => 'Release notes',
5354 'config-page-copying' => 'Copying',
5455 'config-page-upgradedoc' => 'Upgrading',
 56+ 'config-page-locked' => 'Permission denied',
5557 'config-help-restart' => 'Do you want to clear all saved data that you have entered and restart the installation process?',
5658 'config-restart' => 'Yes, restart it',
5759 'config-welcome' => "=== Environmental checks ===
Index: trunk/phase3/includes/installer/WebInstallerPage.php
@@ -102,6 +102,56 @@
103103
104104 }
105105
 106+class WebInstaller_Locked extends WebInstallerPage {
 107+
 108+ // The status of Installer::getLocalSettingsStatus()
 109+ private $status;
 110+
 111+ public function setLocalSettingsStatus( Status $s ) {
 112+ $this->status = $s;
 113+ }
 114+
 115+ public function execute() {
 116+ $r = $this->parent->request;
 117+ if( !$r->wasPosted() || !$this->status->isOK() ) {
 118+ $this->display();
 119+ return 'output';
 120+ } else {
 121+ $key = $r->getText( 'config_wpUpgradeKey' );
 122+ if( !$key || $key !== $this->getVar( '_UpgradeKey' ) ) {
 123+ $this->display( true );
 124+ return 'output';
 125+ } else {
 126+ $this->setVar( '_LocalSettingsLocked', false );
 127+ return 'continue';
 128+ }
 129+ }
 130+ }
 131+
 132+ /**
 133+ * Display stuff to the end user
 134+ * @param $badKey bool Whether the key input by the user was bad
 135+ */
 136+ private function display( $badKey = false ) {
 137+ $this->startForm();
 138+ if( $this->status->isOK() && !$this->status->isGood() ) {
 139+ if( $badKey ) {
 140+ $this->parent->showError( 'config-localsettings-badkey' );
 141+ }
 142+ $this->parent->output->addWikiText( wfMsg( 'config-localsettings-upgrade' ) );
 143+ $this->addHTML( "<br />" .
 144+ $this->parent->getTextBox( array(
 145+ 'var' => 'wpUpgradeKey',
 146+ 'label' => 'config-localsettings-key',
 147+ ) )
 148+ );
 149+ } else {
 150+ $this->parent->showStatusBox( $this->status );
 151+ }
 152+ $this->endForm();
 153+ }
 154+}
 155+
106156 class WebInstaller_Language extends WebInstallerPage {
107157
108158 public function execute() {
Index: trunk/phase3/includes/DefaultSettings.php
@@ -3988,7 +3988,7 @@
39893989 */
39903990 $wgReadOnly = null;
39913991
3992 -/***
 3992+/**
39933993 * If this lock file exists (size > 0), the wiki will be forced into read-only mode.
39943994 * Its contents will be shown to users as part of the read-only warning
39953995 * message.
@@ -3997,6 +3997,12 @@
39983998 */
39993999 $wgReadOnlyFile = false;
40004000
 4001+/**
 4002+ * If this is set to some string, this opens up config/index.php for upgrades
 4003+ * when needed. You will need to provide this key to use it
 4004+ */
 4005+$wgUpgradeKey = false;
 4006+
40014007 /** @} */ # End of maintenance }
40024008
40034009 /************************************************************************//**
Index: trunk/phase3/RELEASE-NOTES
@@ -75,6 +75,8 @@
7676 available as input for other configuration items, either.
7777 * Remove $wgRemoteUploads. It was not well supported and superseded by
7878 $wgUploadNavigationUrl.
 79+* $wgUpgradeKey allows unlocking the web installer for upgrades without having
 80+ to move LocalSettings.php
7981
8082 === New features in 1.17 ===
8183 * (bug 10183) Users can now add personal styles and scripts to all skins via

Follow-up revisions

RevisionCommit summaryAuthorDate
r75413Followup r75392: reduce some duplication, eliminate bool paramdemon11:45, 26 October 2010
r76224Follow up r75392....platonides23:49, 6 November 2010
r76391Followup r75392. Per IRC, we should generate a default $wgUpgradeKey (took a ...demon16:51, 9 November 2010

Comments

#Comment by Platonides (talk | contribs)   15:38, 31 October 2010

+$wgCacheEpoch = $wgCommandLineMode = false; What is the purpose of this line?

#Comment by 😂 (talk | contribs)   15:50, 31 October 2010

LocalSettings.php expects both of these to already be set to some default value.

#Comment by Platonides (talk | contribs)   15:57, 31 October 2010

But LocalSettings requires at the top "$IP/includes/DefaultSettings.php" which defines both of them.

#Comment by 😂 (talk | contribs)   16:10, 31 October 2010

I get an E_NOTICE for undefined vars.

#Comment by Platonides (talk | contribs)   23:49, 6 November 2010

You are right. I get undefined variable errors from the extensions, too: Undefined variable: wgFileExtensions, Undefined variable: wgVersion...

The problem is that DefaultSettings.php is already loaded in the global scope, so the require_once inside LocalSettings is a no-op. Fixed in r76224.

Status & tagging log