authorize.php 5.51 KB
Newer Older
1
2
3
4
<?php

/**
 * @file
5
6
 * Administrative script for running authorized file operations.
 *
7
8
9
10
11
12
13
14
 * Using this script, the site owner (the user actually owning the files on the
 * webserver) can authorize certain file-related operations to proceed with
 * elevated privileges, for example to deploy and upgrade modules or themes.
 * Users should not visit this page directly, but instead use an administrative
 * user interface which knows how to redirect the user to this script as part of
 * a multistep process. This script actually performs the selected operations
 * without loading all of Drupal, to be able to more gracefully recover from
 * errors. Access to the script is controlled by a global killswitch in
15
 * settings.php ('allow_authorize_operations') and via the 'administer software
16
 * updates' permission.
17
 *
18
19
20
 * There are helper functions for setting up an operation to run via this
 * system in modules/system/system.module. For more information, see:
 * @link authorize Authorized operation helper functions @endlink
21
22
 */

23
use Drupal\Component\Utility\Settings;
24
use Drupal\Core\Page\DefaultHtmlPageRenderer;
25

26
27
28
// Change the directory to the Drupal root.
chdir('..');

29
30
require_once __DIR__ . '/vendor/autoload.php';

31
/**
32
33
34
 * Global flag to identify update.php and authorize.php runs.
 *
 * Identifies update.php and authorize.php runs, avoiding unwanted operations
35
36
 * such as css/js preprocessing and translation, and solves some theming issues.
 * The flag is checked in other places in Drupal code (not just authorize.php).
37
 */
38
const MAINTENANCE_MODE = 'update';
39
40

/**
41
 * Determines if the current user is allowed to run authorize.php.
42
43
44
45
 *
 * The killswitch in settings.php overrides all else, otherwise, the user must
 * have access to the 'administer software updates' permission.
 *
46
 * @return bool
47
 *   TRUE if the current user can run authorize.php, and FALSE if not.
48
49
 */
function authorize_access_allowed() {
50
  \Drupal::service('session_manager')->initialize();
51
  return Settings::get('allow_authorize_operations', TRUE) && user_access('administer software updates');
52
53
54
55
}

// *** Real work of the script begins here. ***

56
57
58
59
60
require_once __DIR__ . '/includes/bootstrap.inc';
require_once __DIR__ . '/includes/common.inc';
require_once __DIR__ . '/includes/file.inc';
require_once __DIR__ . '/includes/module.inc';
require_once __DIR__ . '/includes/ajax.inc';
61

62
63
64
// Prepare a minimal bootstrap.
drupal_bootstrap(DRUPAL_BOOTSTRAP_PAGE_CACHE);
$request = \Drupal::request();
65
66

// We have to enable the user and system modules, even to check access and
67
// display errors via the maintenance theme.
68
69
\Drupal::moduleHandler()->addModule('system', 'core/modules/system');
\Drupal::moduleHandler()->addModule('user', 'core/modules/user');
70
71
\Drupal::moduleHandler()->load('system');
\Drupal::moduleHandler()->load('user');
72
73
74
75
76
77
78
79
80

// Initialize the maintenance theme for this administrative script.
drupal_maintenance_theme();

$output = '';
$show_messages = TRUE;

if (authorize_access_allowed()) {
  // Load both the Form API and Batch API.
81
82
  require_once __DIR__ . '/includes/form.inc';
  require_once __DIR__ . '/includes/batch.inc';
83

84
85
  if (isset($_SESSION['authorize_page_title'])) {
    $page_title = $_SESSION['authorize_page_title'];
86
87
  }
  else {
88
    $page_title = t('Authorize file system changes');
89
90
91
92
93
94
95
96
  }

  // See if we've run the operation and need to display a report.
  if (isset($_SESSION['authorize_results']) && $results = $_SESSION['authorize_results']) {

    // Clear the session out.
    unset($_SESSION['authorize_results']);
    unset($_SESSION['authorize_operation']);
97
    unset($_SESSION['authorize_filetransfer_info']);
98
99

    if (!empty($results['page_title'])) {
100
      $page_title = $results['page_title'];
101
102
103
104
105
    }
    if (!empty($results['page_message'])) {
      drupal_set_message($results['page_message']['message'], $results['page_message']['type']);
    }

106
107
108
109
110
    $authorize_report = array(
      '#theme' => 'authorize_report',
      '#messages' => $results['messages'],
    );
    $output = drupal_render($authorize_report);
111

112
113
114
115
    $links = array();
    if (is_array($results['tasks'])) {
      $links += $results['tasks'];
    }
116
117
118
119
120
121
    else {
      $links = array_merge($links, array(
        l(t('Administration pages'), 'admin'),
        l(t('Front page'), '<front>'),
      ));
    }
122

123
124
125
126
127
128
    $item_list = array(
      '#theme' => 'item_list',
      '#items' => $links,
      '#title' => t('Next steps'),
    );
    $output .= drupal_render($item_list);
129
130
  }
  // If a batch is running, let it run.
131
132
  elseif ($request->query->has('batch')) {
    $output = _batch_page($request);
133
134
  }
  else {
135
    if (empty($_SESSION['authorize_operation']) || empty($_SESSION['authorize_filetransfer_info'])) {
136
      $output = t('It appears you have reached this page in error.');
137
138
139
    }
    elseif (!$batch = batch_get()) {
      // We have a batch to process, show the filetransfer form.
140
      $elements = \Drupal::formBuilder()->getForm('Drupal\Core\FileTransfer\Form\FileTransferAuthorizeForm');
141
      $output = drupal_render($elements);
142
143
144
145
146
147
    }
  }
  // We defer the display of messages until all operations are done.
  $show_messages = !(($batch = batch_get()) && isset($batch['running']));
}
else {
148
149
150
151
  drupal_add_http_header('Status', '403 Forbidden');
  watchdog('access denied', 'authorize.php', NULL, WATCHDOG_WARNING);
  $page_title = t('Access denied');
  $output = t('You are not allowed to access this page.');
152
153
154
}

if (!empty($output)) {
155
  drupal_add_http_header('Content-Type', 'text/html; charset=utf-8');
156
  print DefaultHtmlPageRenderer::renderPage($output, $page_title, 'maintenance', array(
157
    '#show_messages' => $show_messages,
158
  ));
159
}