authorize.php 5.73 KB
Newer Older
1 2 3 4
<?php

/**
 * @file
5 6
 * Administrative script for running authorized file operations.
 *
7 8 9 10 11 12 13 14 15 16
 * Using this script, the site owner (the user actually owning the files on the
 * webserver) can authorize certain file-related operations to proceed with
 * elevated privileges, for example to deploy and upgrade modules or themes.
 * Users should not visit this page directly, but instead use an administrative
 * user interface which knows how to redirect the user to this script as part of
 * a multistep process. This script actually performs the selected operations
 * without loading all of Drupal, to be able to more gracefully recover from
 * errors. Access to the script is controlled by a global killswitch in
 * settings.php ('allow_authorize_operations') and via the 'administer software
 * updates' permission.
17
 *
18 19 20
 * There are helper functions for setting up an operation to run via this
 * system in modules/system/system.module. For more information, see:
 * @link authorize Authorized operation helper functions @endlink
21 22
 */

23 24 25
// Change the directory to the Drupal root.
chdir('..');

26
/**
27
 * Defines the root directory of the Drupal installation.
28 29 30 31
 */
define('DRUPAL_ROOT', getcwd());

/**
32 33 34 35 36 37
 * Global flag to identify update.php and authorize.php runs.
 *
 * Identifies update.php and authorize.php runs, avoiding unwanted operations
 * such as hook_init() and hook_exit() invokes, css/js preprocessing and
 * translation, and solves some theming issues. The flag is checked in other
 * places in Drupal code (not just authorize.php).
38
 */
39
const MAINTENANCE_MODE = 'update';
40 41

/**
42
 * Renders a 403 access denied page for authorize.php.
43 44
 */
function authorize_access_denied_page() {
45
  drupal_add_http_header('Status', '403 Forbidden');
46
  watchdog('access denied', 'authorize.php', array(), WATCHDOG_WARNING);
47
  drupal_set_title('Access denied');
48
  return t('You are not allowed to access this page.');
49 50 51
}

/**
52
 * Determines if the current user is allowed to run authorize.php.
53 54 55 56 57
 *
 * The killswitch in settings.php overrides all else, otherwise, the user must
 * have access to the 'administer software updates' permission.
 *
 * @return
58
 *   TRUE if the current user can run authorize.php, and FALSE if not.
59 60 61 62 63 64 65
 */
function authorize_access_allowed() {
  return variable_get('allow_authorize_operations', TRUE) && user_access('administer software updates');
}

// *** Real work of the script begins here. ***

66 67 68 69 70
require_once DRUPAL_ROOT . '/core/includes/bootstrap.inc';
require_once DRUPAL_ROOT . '/core/includes/common.inc';
require_once DRUPAL_ROOT . '/core/includes/file.inc';
require_once DRUPAL_ROOT . '/core/includes/module.inc';
require_once DRUPAL_ROOT . '/core/includes/ajax.inc';
71 72

// We prepare only a minimal bootstrap. This includes the database and
73
// variables, however, so we have access to the class autoloader.
74 75 76 77 78 79
drupal_bootstrap(DRUPAL_BOOTSTRAP_SESSION);

// This must go after drupal_bootstrap(), which unsets globals!
global $conf;

// We have to enable the user and system modules, even to check access and
80
// display errors via the maintenance theme.
81 82
$module_list['system']['filename'] = 'core/modules/system/system.module';
$module_list['user']['filename'] = 'core/modules/user/user.module';
83
module_list(NULL, $module_list);
84 85 86
drupal_load('module', 'system');
drupal_load('module', 'user');

87
// Initialize the language system.
88 89 90 91 92 93 94 95 96 97
drupal_language_initialize();

// Initialize the maintenance theme for this administrative script.
drupal_maintenance_theme();

$output = '';
$show_messages = TRUE;

if (authorize_access_allowed()) {
  // Load both the Form API and Batch API.
98 99
  require_once DRUPAL_ROOT . '/core/includes/form.inc';
  require_once DRUPAL_ROOT . '/core/includes/batch.inc';
100
  // Load the code that drives the authorize process.
101
  require_once DRUPAL_ROOT . '/core/includes/authorize.inc';
102 103

  if (isset($_SESSION['authorize_operation']['page_title'])) {
104
    drupal_set_title($_SESSION['authorize_operation']['page_title']);
105 106 107 108 109 110 111 112 113 114 115
  }
  else {
    drupal_set_title(t('Authorize file system changes'));
  }

  // See if we've run the operation and need to display a report.
  if (isset($_SESSION['authorize_results']) && $results = $_SESSION['authorize_results']) {

    // Clear the session out.
    unset($_SESSION['authorize_results']);
    unset($_SESSION['authorize_operation']);
116
    unset($_SESSION['authorize_filetransfer_info']);
117 118

    if (!empty($results['page_title'])) {
119
      drupal_set_title($results['page_title']);
120 121 122 123 124 125
    }
    if (!empty($results['page_message'])) {
      drupal_set_message($results['page_message']['message'], $results['page_message']['type']);
    }

    $output = theme('authorize_report', array('messages' => $results['messages']));
126

127 128 129 130
    $links = array();
    if (is_array($results['tasks'])) {
      $links += $results['tasks'];
    }
131 132 133 134 135 136
    else {
      $links = array_merge($links, array(
        l(t('Administration pages'), 'admin'),
        l(t('Front page'), '<front>'),
      ));
    }
137

138
    $output .= theme('item_list', array('items' => $links, 'title' => t('Next steps')));
139 140 141 142 143 144
  }
  // If a batch is running, let it run.
  elseif (isset($_GET['batch'])) {
    $output = _batch_page();
  }
  else {
145
    if (empty($_SESSION['authorize_operation']) || empty($_SESSION['authorize_filetransfer_info'])) {
146
      $output = t('It appears you have reached this page in error.');
147 148 149
    }
    elseif (!$batch = batch_get()) {
      // We have a batch to process, show the filetransfer form.
150 151
      $elements = drupal_get_form('authorize_filetransfer_form');
      $output = drupal_render($elements);
152 153 154 155 156 157 158 159 160 161 162 163
    }
  }
  // We defer the display of messages until all operations are done.
  $show_messages = !(($batch = batch_get()) && isset($batch['running']));
}
else {
  $output = authorize_access_denied_page();
}

if (!empty($output)) {
  print theme('update_page', array('content' => $output, 'show_messages' => $show_messages));
}