drupal/drupal/authorize.php

<?php
// $Id: authorize.php,v 1.3 2009/10/24 05:13:43 webchick Exp $

/**
 * @file
 * Administrative script for running authorized file operations.
 *
 * Using this script, the site owner (the user actually owning the files on
 * the webserver) can authorize certain file-related operations to proceed
 * with elevated privileges, for example to deploy and upgrade modules or
 * themes. Users should not visit this page directly, but instead use an
 * administrative user interface which knows how to redirect the user to this
 * script as part of a multistep process. This script actually performs the
 * selected operations without loading all of Drupal, to be able to more
 * gracefully recover from errors. Access to the script is controlled by a
 * global killswitch in settings.php ('allow_authorize_operations') and via
 * the 'administer software updates' permission.
 *
 * There are helper functions for setting up an operation to run via this
 * system in modules/system/system.module. For more information, see:
 * @link authorize Authorized operation helper functions @endlink
 */

/**
 * Root directory of Drupal installation.
 */
define('DRUPAL_ROOT', getcwd());

/**
 * Global flag to identify update.php and authorize.php runs, and so
 * avoid various unwanted operations, such as hook_init() and
 * hook_exit() invokes, css/js preprocessing and translation, and
 * solve some theming issues. This flag is checked on several places
 * in Drupal code (not just authorize.php).
 */
define('MAINTENANCE_MODE', 'update');

/**
 * Render a 403 access denied page for authorize.php
 */
function authorize_access_denied_page() {
  drupal_add_http_header('403 Forbidden');
  watchdog('access denied', 'authorize.php', NULL, WATCHDOG_WARNING);
  drupal_set_title('Access denied');
  return t('You are not allowed to access this page.');
}

/**
 * Determine if the current user is allowed to run authorize.php.
 *
 * The killswitch in settings.php overrides all else, otherwise, the user must
 * have access to the 'administer software updates' permission.
 *
 * @return
 *   TRUE if the current user can run authorize.php, otherwise FALSE.
 */
function authorize_access_allowed() {
  return variable_get('allow_authorize_operations', TRUE) && user_access('administer software updates');
}

// *** Real work of the script begins here. ***

require_once DRUPAL_ROOT . '/includes/bootstrap.inc';
require_once DRUPAL_ROOT . '/includes/session.inc';
require_once DRUPAL_ROOT . '/includes/common.inc';
require_once DRUPAL_ROOT . '/includes/file.inc';
require_once DRUPAL_ROOT . '/includes/module.inc';

// We prepare only a minimal bootstrap. This includes the database and
// variables, however, so we have access to the class autoloader registry.
drupal_bootstrap(DRUPAL_BOOTSTRAP_SESSION);

// This must go after drupal_bootstrap(), which unsets globals!
global $conf;

// We have to enable the user and system modules, even to check access and
// display errors via the maintainence theme.
$module_list['system']['filename'] = 'modules/system/system.module';
$module_list['user']['filename'] = 'modules/user/user.module';
module_list(TRUE, FALSE, FALSE, $module_list);
drupal_load('module', 'system');
drupal_load('module', 'user');

// We also want to have the language system available, but we do *NOT* want to
// actually call drupal_bootstrap(DRUPAL_BOOTSTRAP_LANGUAGE), since that would
// also force us through the DRUPAL_BOOTSTRAP_PAGE_HEADER phase, which loads
// all the modules, and that's exactly what we're trying to avoid.
drupal_language_initialize();

// Initialize the maintenance theme for this administrative script.
drupal_maintenance_theme();

$output = '';
$show_messages = TRUE;

if (authorize_access_allowed()) {
  // Load both the Form API and Batch API.
  require_once DRUPAL_ROOT . '/includes/form.inc';
  require_once DRUPAL_ROOT . '/includes/batch.inc';
  // Load the code that drives the authorize process.
  require_once DRUPAL_ROOT . '/includes/authorize.inc';

  // For the sake of Batch API and a few other low-level functions, we need to
  // initialize the URL path into $_GET['q']. However, we do not want to raise
  // our bootstrap level, nor do we want to call drupal_initialize_path(),
  // since that is assuming that modules are loaded and invoking hooks.
  // However, all we really care is if we're in the middle of a batch, in which
  // case $_GET['q'] will already be set, we just initialize it to an empty
  // string if it's not already defined.
  if (!isset($_GET['q'])) {
    $_GET['q'] = '';
  }

  if (isset($_SESSION['authorize_operation']['page_title'])) {
    drupal_set_title(check_plain($_SESSION['authorize_operation']['page_title']));
  }
  else {
    drupal_set_title(t('Authorize file system changes'));
  }

  // See if we've run the operation and need to display a report.
  if (isset($_SESSION['authorize_results']) && $results = $_SESSION['authorize_results']) {

    // Clear the session out.
    unset($_SESSION['authorize_results']);
    unset($_SESSION['authorize_operation']);
    unset($_SESSION['authorize_filetransfer_backends']);

    if (!empty($results['page_title'])) {
      drupal_set_title(check_plain($results['page_title']));
    }
    if (!empty($results['page_message'])) {
      drupal_set_message($results['page_message']['message'], $results['page_message']['type']);
    }

    $output = theme('authorize_report', array('messages' => $results['messages']));
    
    $links = array();
    if (is_array($results['tasks'])) {
      $links += $results['tasks'];
    }

    $links = array_merge($links, array(
      l(t('Administration pages'), 'admin'),
      l(t('Front page'), '<front>'),
    ));

    $output .= theme('item_list', array('items' => $links));
  }
  // If a batch is running, let it run.
  elseif (isset($_GET['batch'])) {
    $output = _batch_page();
  }
  else {
    if (empty($_SESSION['authorize_operation']) || empty($_SESSION['authorize_filetransfer_backends'])) {
      $output = t('It appears you have reached this page in error.');
    }
    elseif (!$batch = batch_get()) {
      // We have a batch to process, show the filetransfer form.
      $output = drupal_render(drupal_get_form('authorize_filetransfer_form'));
    }
  }
  // We defer the display of messages until all operations are done.
  $show_messages = !(($batch = batch_get()) && isset($batch['running']));
}
else {
  $output = authorize_access_denied_page();
}

if (!empty($output)) {
  print theme('update_page', array('content' => $output, 'show_messages' => $show_messages));
}

1	<?php
2	// $Id: authorize.php,v 1.3 2009/10/24 05:13:43 webchick Exp $
3
4	/**
5	* @file
6	* Administrative script for running authorized file operations.
7	*
8	* Using this script, the site owner (the user actually owning the files on
9	* the webserver) can authorize certain file-related operations to proceed
10	* with elevated privileges, for example to deploy and upgrade modules or
11	* themes. Users should not visit this page directly, but instead use an
12	* administrative user interface which knows how to redirect the user to this
13	* script as part of a multistep process. This script actually performs the
14	* selected operations without loading all of Drupal, to be able to more
15	* gracefully recover from errors. Access to the script is controlled by a
16	* global killswitch in settings.php ('allow_authorize_operations') and via
17	* the 'administer software updates' permission.
18	*
19	* There are helper functions for setting up an operation to run via this
20	* system in modules/system/system.module. For more information, see:
21	* @link authorize Authorized operation helper functions @endlink
22	*/
23
24	/**
25	* Root directory of Drupal installation.
26	*/
27	define('DRUPAL_ROOT', getcwd());
28
29	/**
30	* Global flag to identify update.php and authorize.php runs, and so
31	* avoid various unwanted operations, such as hook_init() and
32	* hook_exit() invokes, css/js preprocessing and translation, and
33	* solve some theming issues. This flag is checked on several places
34	* in Drupal code (not just authorize.php).
35	*/
36	define('MAINTENANCE_MODE', 'update');
37
38	/**
39	* Render a 403 access denied page for authorize.php
40	*/
41	function authorize_access_denied_page() {
42	drupal_add_http_header('403 Forbidden');
43	watchdog('access denied', 'authorize.php', NULL, WATCHDOG_WARNING);
44	drupal_set_title('Access denied');
45	return t('You are not allowed to access this page.');
46	}
47
48	/**
49	* Determine if the current user is allowed to run authorize.php.
50	*
51	* The killswitch in settings.php overrides all else, otherwise, the user must
52	* have access to the 'administer software updates' permission.
53	*
54	* @return
55	* TRUE if the current user can run authorize.php, otherwise FALSE.
56	*/
57	function authorize_access_allowed() {
58	return variable_get('allow_authorize_operations', TRUE) && user_access('administer software updates');
59	}
60
61	// * Real work of the script begins here. *
62
63	require_once DRUPAL_ROOT . '/includes/bootstrap.inc';
64	require_once DRUPAL_ROOT . '/includes/session.inc';
65	require_once DRUPAL_ROOT . '/includes/common.inc';
66	require_once DRUPAL_ROOT . '/includes/file.inc';
67	require_once DRUPAL_ROOT . '/includes/module.inc';
68
69	// We prepare only a minimal bootstrap. This includes the database and
70	// variables, however, so we have access to the class autoloader registry.
71	drupal_bootstrap(DRUPAL_BOOTSTRAP_SESSION);
72
73	// This must go after drupal_bootstrap(), which unsets globals!
74	global $conf;
75
76	// We have to enable the user and system modules, even to check access and
77	// display errors via the maintainence theme.
78	$module_list['system']['filename'] = 'modules/system/system.module';
79	$module_list['user']['filename'] = 'modules/user/user.module';
80	module_list(TRUE, FALSE, FALSE, $module_list);
81	drupal_load('module', 'system');
82	drupal_load('module', 'user');
83
84	// We also want to have the language system available, but we do NOT want to
85	// actually call drupal_bootstrap(DRUPAL_BOOTSTRAP_LANGUAGE), since that would
86	// also force us through the DRUPAL_BOOTSTRAP_PAGE_HEADER phase, which loads
87	// all the modules, and that's exactly what we're trying to avoid.
88	drupal_language_initialize();
89
90	// Initialize the maintenance theme for this administrative script.
91	drupal_maintenance_theme();
92
93	$output = '';
94	$show_messages = TRUE;
95
96	if (authorize_access_allowed()) {
97	// Load both the Form API and Batch API.
98	require_once DRUPAL_ROOT . '/includes/form.inc';
99	require_once DRUPAL_ROOT . '/includes/batch.inc';
100	// Load the code that drives the authorize process.
101	require_once DRUPAL_ROOT . '/includes/authorize.inc';
102
103	// For the sake of Batch API and a few other low-level functions, we need to
104	// initialize the URL path into $_GET['q']. However, we do not want to raise
105	// our bootstrap level, nor do we want to call drupal_initialize_path(),
106	// since that is assuming that modules are loaded and invoking hooks.
107	// However, all we really care is if we're in the middle of a batch, in which
108	// case $_GET['q'] will already be set, we just initialize it to an empty
109	// string if it's not already defined.
110	if (!isset($_GET['q'])) {
111	$_GET['q'] = '';
112	}
113
114	if (isset($_SESSION['authorize_operation']['page_title'])) {
115	drupal_set_title(check_plain($_SESSION['authorize_operation']['page_title']));
116	}
117	else {
118	drupal_set_title(t('Authorize file system changes'));
119	}
120
121	// See if we've run the operation and need to display a report.
122	if (isset($_SESSION['authorize_results']) && $results = $_SESSION['authorize_results']) {
123
124	// Clear the session out.
125	unset($_SESSION['authorize_results']);
126	unset($_SESSION['authorize_operation']);
127	unset($_SESSION['authorize_filetransfer_backends']);
128
129	if (!empty($results['page_title'])) {
130	drupal_set_title(check_plain($results['page_title']));
131	}
132	if (!empty($results['page_message'])) {
133	drupal_set_message($results['page_message']['message'], $results['page_message']['type']);
134	}
135
136	$output = theme('authorize_report', array('messages' => $results['messages']));
137
138	$links = array();
139	if (is_array($results['tasks'])) {
140	$links += $results['tasks'];
141	}
142
143	$links = array_merge($links, array(
144	l(t('Administration pages'), 'admin'),
145	l(t('Front page'), '<front>'),
146	));
147
148	$output .= theme('item_list', array('items' => $links));
149	}
150	// If a batch is running, let it run.
151	elseif (isset($_GET['batch'])) {
152	$output = _batch_page();
153	}
154	else {
155	if (empty($_SESSION['authorize_operation']) \|\| empty($_SESSION['authorize_filetransfer_backends'])) {
156	$output = t('It appears you have reached this page in error.');
157	}
158	elseif (!$batch = batch_get()) {
159	// We have a batch to process, show the filetransfer form.
160	$output = drupal_render(drupal_get_form('authorize_filetransfer_form'));
161	}
162	}
163	// We defer the display of messages until all operations are done.
164	$show_messages = !(($batch = batch_get()) && isset($batch['running']));
165	}
166	else {
167	$output = authorize_access_denied_page();
168	}
169
170	if (!empty($output)) {
171	print theme('update_page', array('content' => $output, 'show_messages' => $show_messages));
172	}
173