123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590 |
- <?php
- declare(strict_types=1);
- namespace OC;
- use Doctrine\DBAL\Exception\TableExistsException;
- use OC\App\AppStore\Bundles\Bundle;
- use OC\App\AppStore\Fetcher\AppFetcher;
- use OC\AppFramework\Bootstrap\Coordinator;
- use OC\Archive\TAR;
- use OC\DB\Connection;
- use OC\DB\MigrationService;
- use OC_App;
- use OC_Helper;
- use OCP\App\IAppManager;
- use OCP\HintException;
- use OCP\Http\Client\IClientService;
- use OCP\IConfig;
- use OCP\ITempManager;
- use OCP\Migration\IOutput;
- use phpseclib\File\X509;
- use Psr\Log\LoggerInterface;
- class Installer {
- private ?bool $isInstanceReadyForUpdates = null;
- private ?array $apps = null;
- public function __construct(
- private AppFetcher $appFetcher,
- private IClientService $clientService,
- private ITempManager $tempManager,
- private LoggerInterface $logger,
- private IConfig $config,
- private bool $isCLI,
- ) {
- }
-
- public function installApp(string $appId, bool $forceEnable = false): string {
- $app = \OC_App::findAppInDirectories($appId);
- if ($app === false) {
- throw new \Exception('App not found in any app directory');
- }
- $basedir = $app['path'] . '/' . $appId;
- if (is_file($basedir . '/appinfo/database.xml')) {
- throw new \Exception('The appinfo/database.xml file is not longer supported. Used in ' . $appId);
- }
- $l = \OCP\Util::getL10N('core');
- $info = \OCP\Server::get(IAppManager::class)->getAppInfoByPath($basedir . '/appinfo/info.xml', $l->getLanguageCode());
- if (!is_array($info)) {
- throw new \Exception(
- $l->t('App "%s" cannot be installed because appinfo file cannot be read.',
- [$appId]
- )
- );
- }
- $ignoreMaxApps = $this->config->getSystemValue('app_install_overwrite', []);
- $ignoreMax = $forceEnable || in_array($appId, $ignoreMaxApps, true);
- $version = implode('.', \OCP\Util::getVersion());
- if (!\OC_App::isAppCompatible($version, $info, $ignoreMax)) {
- throw new \Exception(
-
- $l->t('App "%s" cannot be installed because it is not compatible with this version of the server.',
- [$info['name']]
- )
- );
- }
-
- \OC_App::checkAppDependencies($this->config, $l, $info, $ignoreMax);
-
- $coordinator = \OC::$server->get(Coordinator::class);
- $coordinator->runLazyRegistration($appId);
- \OC_App::registerAutoloading($appId, $basedir);
- $previousVersion = $this->config->getAppValue($info['id'], 'installed_version', false);
- if ($previousVersion) {
- OC_App::executeRepairSteps($appId, $info['repair-steps']['pre-migration']);
- }
-
- $ms = new MigrationService($info['id'], \OCP\Server::get(Connection::class));
- $ms->migrate('latest', !$previousVersion);
- if ($previousVersion) {
- OC_App::executeRepairSteps($appId, $info['repair-steps']['post-migration']);
- }
- \OC_App::setupBackgroundJobs($info['background-jobs']);
-
- self::includeAppScript($basedir . '/appinfo/install.php');
- OC_App::executeRepairSteps($appId, $info['repair-steps']['install']);
- $config = \OCP\Server::get(IConfig::class);
-
- $config->setAppValue($info['id'], 'installed_version', \OCP\Server::get(IAppManager::class)->getAppVersion($info['id'], false));
- $config->setAppValue($info['id'], 'enabled', 'no');
-
- foreach ($info['remote'] as $name => $path) {
- $config->setAppValue('core', 'remote_' . $name, $info['id'] . '/' . $path);
- }
- foreach ($info['public'] as $name => $path) {
- $config->setAppValue('core', 'public_' . $name, $info['id'] . '/' . $path);
- }
- OC_App::setAppTypes($info['id']);
- return $info['id'];
- }
-
- public function updateAppstoreApp(string $appId, bool $allowUnstable = false): bool {
- if ($this->isUpdateAvailable($appId, $allowUnstable)) {
- try {
- $this->downloadApp($appId, $allowUnstable);
- } catch (\Exception $e) {
- $this->logger->error($e->getMessage(), [
- 'exception' => $e,
- ]);
- return false;
- }
- return OC_App::updateApp($appId);
- }
- return false;
- }
-
- private function splitCerts(string $cert): array {
- preg_match_all('([\-]{3,}[\S\ ]+?[\-]{3,}[\S\s]+?[\-]{3,}[\S\ ]+?[\-]{3,})', $cert, $matches);
- return $matches[0];
- }
-
- public function downloadApp(string $appId, bool $allowUnstable = false): void {
- $appId = strtolower($appId);
- $apps = $this->appFetcher->get($allowUnstable);
- foreach ($apps as $app) {
- if ($app['id'] === $appId) {
-
- $certificate = new X509();
- $rootCrt = file_get_contents(__DIR__ . '/../../resources/codesigning/root.crt');
- $rootCrts = $this->splitCerts($rootCrt);
- foreach ($rootCrts as $rootCrt) {
- $certificate->loadCA($rootCrt);
- }
- $loadedCertificate = $certificate->loadX509($app['certificate']);
-
- $crl = new X509();
- foreach ($rootCrts as $rootCrt) {
- $crl->loadCA($rootCrt);
- }
- $crl->loadCRL(file_get_contents(__DIR__ . '/../../resources/codesigning/root.crl'));
- if ($crl->validateSignature() !== true) {
- throw new \Exception('Could not validate CRL signature');
- }
- $csn = $loadedCertificate['tbsCertificate']['serialNumber']->toString();
- $revoked = $crl->getRevoked($csn);
- if ($revoked !== false) {
- throw new \Exception(
- sprintf(
- 'Certificate "%s" has been revoked',
- $csn
- )
- );
- }
-
- if ($certificate->validateSignature() !== true) {
- throw new \Exception(
- sprintf(
- 'App with id %s has a certificate not issued by a trusted Code Signing Authority',
- $appId
- )
- );
- }
-
- $certInfo = openssl_x509_parse($app['certificate']);
- if (!isset($certInfo['subject']['CN'])) {
- throw new \Exception(
- sprintf(
- 'App with id %s has a cert with no CN',
- $appId
- )
- );
- }
- if ($certInfo['subject']['CN'] !== $appId) {
- throw new \Exception(
- sprintf(
- 'App with id %s has a cert issued to %s',
- $appId,
- $certInfo['subject']['CN']
- )
- );
- }
-
- $tempFile = $this->tempManager->getTemporaryFile('.tar.gz');
- $timeout = $this->isCLI ? 0 : 120;
- $client = $this->clientService->newClient();
- $client->get($app['releases'][0]['download'], ['sink' => $tempFile, 'timeout' => $timeout]);
-
- $certificate = openssl_get_publickey($app['certificate']);
- $verified = openssl_verify(file_get_contents($tempFile), base64_decode($app['releases'][0]['signature']), $certificate, OPENSSL_ALGO_SHA512) === 1;
- if ($verified === true) {
-
- $extractDir = $this->tempManager->getTemporaryFolder();
- $archive = new TAR($tempFile);
- if (!$archive->extract($extractDir)) {
- $errorMessage = 'Could not extract app ' . $appId;
- $archiveError = $archive->getError();
- if ($archiveError instanceof \PEAR_Error) {
- $errorMessage .= ': ' . $archiveError->getMessage();
- }
- throw new \Exception($errorMessage);
- }
- $allFiles = scandir($extractDir);
- $folders = array_diff($allFiles, ['.', '..']);
- $folders = array_values($folders);
- if (count($folders) < 1) {
- throw new \Exception(
- sprintf(
- 'Extracted app %s has no folders',
- $appId
- )
- );
- }
- if (count($folders) > 1) {
- throw new \Exception(
- sprintf(
- 'Extracted app %s has more than 1 folder',
- $appId
- )
- );
- }
-
- $xml = simplexml_load_string(file_get_contents($extractDir . '/' . $folders[0] . '/appinfo/info.xml'));
- if ($xml === false) {
- throw new \Exception(
- sprintf(
- 'Failed to load info.xml for app id %s',
- $appId,
- )
- );
- }
- if ((string)$xml->id !== $appId) {
- throw new \Exception(
- sprintf(
- 'App for id %s has a wrong app ID in info.xml: %s',
- $appId,
- (string)$xml->id
- )
- );
- }
-
- $currentVersion = \OCP\Server::get(IAppManager::class)->getAppVersion($appId, true);
- $newVersion = (string)$xml->version;
- if (version_compare($currentVersion, $newVersion) === 1) {
- throw new \Exception(
- sprintf(
- 'App for id %s has version %s and tried to update to lower version %s',
- $appId,
- $currentVersion,
- $newVersion
- )
- );
- }
- $baseDir = OC_App::getInstallPath() . '/' . $appId;
-
- OC_Helper::rmdirr($baseDir);
-
- if (@mkdir($baseDir)) {
- $extractDir .= '/' . $folders[0];
- OC_Helper::copyr($extractDir, $baseDir);
- }
- OC_Helper::copyr($extractDir, $baseDir);
- OC_Helper::rmdirr($extractDir);
- return;
- }
-
- throw new \Exception(
- sprintf(
- 'App with id %s has invalid signature',
- $appId
- )
- );
- }
- }
- throw new \Exception(
- sprintf(
- 'Could not download app %s',
- $appId
- )
- );
- }
-
- public function isUpdateAvailable($appId, $allowUnstable = false): string|false {
- if ($this->isInstanceReadyForUpdates === null) {
- $installPath = OC_App::getInstallPath();
- if ($installPath === null) {
- $this->isInstanceReadyForUpdates = false;
- } else {
- $this->isInstanceReadyForUpdates = true;
- }
- }
- if ($this->isInstanceReadyForUpdates === false) {
- return false;
- }
- if ($this->isInstalledFromGit($appId) === true) {
- return false;
- }
- if ($this->apps === null) {
- $this->apps = $this->appFetcher->get($allowUnstable);
- }
- foreach ($this->apps as $app) {
- if ($app['id'] === $appId) {
- $currentVersion = \OCP\Server::get(IAppManager::class)->getAppVersion($appId, true);
- if (!isset($app['releases'][0]['version'])) {
- return false;
- }
- $newestVersion = $app['releases'][0]['version'];
- if ($currentVersion !== '0' && version_compare($newestVersion, $currentVersion, '>')) {
- return $newestVersion;
- } else {
- return false;
- }
- }
- }
- return false;
- }
-
- private function isInstalledFromGit(string $appId): bool {
- $app = \OC_App::findAppInDirectories($appId);
- if ($app === false) {
- return false;
- }
- $basedir = $app['path'] . '/' . $appId;
- return file_exists($basedir . '/.git/');
- }
-
- public function isDownloaded(string $name): bool {
- foreach (\OC::$APPSROOTS as $dir) {
- $dirToTest = $dir['path'];
- $dirToTest .= '/';
- $dirToTest .= $name;
- $dirToTest .= '/';
- if (is_dir($dirToTest)) {
- return true;
- }
- }
- return false;
- }
-
- public function removeApp(string $appId): bool {
- if ($this->isDownloaded($appId)) {
- if (\OCP\Server::get(IAppManager::class)->isShipped($appId)) {
- return false;
- }
- $appDir = OC_App::getInstallPath() . '/' . $appId;
- OC_Helper::rmdirr($appDir);
- return true;
- } else {
- $this->logger->error('can\'t remove app ' . $appId . '. It is not installed.');
- return false;
- }
- }
-
- public function installAppBundle(Bundle $bundle): void {
- $appIds = $bundle->getAppIdentifiers();
- foreach ($appIds as $appId) {
- if (!$this->isDownloaded($appId)) {
- $this->downloadApp($appId);
- }
- $this->installApp($appId);
- $app = new OC_App();
- $app->enable($appId);
- }
- $bundles = json_decode($this->config->getAppValue('core', 'installed.bundles', json_encode([])), true);
- $bundles[] = $bundle->getIdentifier();
- $this->config->setAppValue('core', 'installed.bundles', json_encode($bundles));
- }
-
- public static function installShippedApps(bool $softErrors = false, ?IOutput $output = null): array {
- if ($output instanceof IOutput) {
- $output->debug('Installing shipped apps');
- }
- $appManager = \OCP\Server::get(IAppManager::class);
- $config = \OCP\Server::get(IConfig::class);
- $errors = [];
- foreach (\OC::$APPSROOTS as $app_dir) {
- if ($dir = opendir($app_dir['path'])) {
- while (false !== ($filename = readdir($dir))) {
- if ($filename[0] !== '.' and is_dir($app_dir['path'] . "/$filename")) {
- if (file_exists($app_dir['path'] . "/$filename/appinfo/info.xml")) {
- if ($config->getAppValue($filename, 'installed_version', null) === null) {
- $enabled = $appManager->isDefaultEnabled($filename);
- if (($enabled || in_array($filename, $appManager->getAlwaysEnabledApps()))
- && $config->getAppValue($filename, 'enabled') !== 'no') {
- if ($softErrors) {
- try {
- Installer::installShippedApp($filename, $output);
- } catch (HintException $e) {
- if ($e->getPrevious() instanceof TableExistsException) {
- $errors[$filename] = $e;
- continue;
- }
- throw $e;
- }
- } else {
- Installer::installShippedApp($filename, $output);
- }
- $config->setAppValue($filename, 'enabled', 'yes');
- }
- }
- }
- }
- }
- closedir($dir);
- }
- }
- return $errors;
- }
-
- public static function installShippedApp(string $app, ?IOutput $output = null): string|false {
- if ($output instanceof IOutput) {
- $output->debug('Installing ' . $app);
- }
- $appManager = \OCP\Server::get(IAppManager::class);
- $config = \OCP\Server::get(IConfig::class);
- $appPath = $appManager->getAppPath($app);
- \OC_App::registerAutoloading($app, $appPath);
- $ms = new MigrationService($app, \OCP\Server::get(Connection::class));
- if ($output instanceof IOutput) {
- $ms->setOutput($output);
- }
- $previousVersion = $config->getAppValue($app, 'installed_version', false);
- $ms->migrate('latest', !$previousVersion);
-
- self::includeAppScript("$appPath/appinfo/install.php");
- $info = \OCP\Server::get(IAppManager::class)->getAppInfo($app);
- if (is_null($info)) {
- return false;
- }
- if ($output instanceof IOutput) {
- $output->debug('Registering tasks of ' . $app);
- }
- \OC_App::setupBackgroundJobs($info['background-jobs']);
- OC_App::executeRepairSteps($app, $info['repair-steps']['install']);
- $config->setAppValue($app, 'installed_version', \OCP\Server::get(IAppManager::class)->getAppVersion($app));
- if (array_key_exists('ocsid', $info)) {
- $config->setAppValue($app, 'ocsid', $info['ocsid']);
- }
-
- foreach ($info['remote'] as $name => $path) {
- $config->setAppValue('core', 'remote_' . $name, $app . '/' . $path);
- }
- foreach ($info['public'] as $name => $path) {
- $config->setAppValue('core', 'public_' . $name, $app . '/' . $path);
- }
- OC_App::setAppTypes($info['id']);
- return $info['id'];
- }
- private static function includeAppScript(string $script): void {
- if (file_exists($script)) {
- include $script;
- }
- }
- }
|