changes
This commit is contained in:
F4ilji
@@ -0,0 +1,434 @@
|
||||
<?php
|
||||
|
||||
namespace App\Containers\VikonIntegration\Actions\Updates;
|
||||
|
||||
use App\Containers\VikonIntegration\Tasks\CallVikonApiTask;
|
||||
use App\Containers\VikonIntegration\Tasks\ExtractZipArchiveTask;
|
||||
use App\Containers\VikonIntegration\Tasks\ManageModuleFilesTask;
|
||||
use Illuminate\Support\Facades\File;
|
||||
use Illuminate\Support\Facades\Log;
|
||||
|
||||
/**
|
||||
* Action: Download and install module core update
|
||||
*
|
||||
* Replaces old vikon_core/download_module_core.php with:
|
||||
* - Secure HTTP (SSL enabled)
|
||||
* - Zip Slip protection
|
||||
* - Atomic file operations with rollback
|
||||
* - Proper error handling
|
||||
*/
|
||||
class DownloadModuleUpdateAction
|
||||
{
|
||||
private const NEW_SUFFIX = '_new';
|
||||
private const OLD_SUFFIX = '_old';
|
||||
|
||||
/**
|
||||
* Allowed file extensions for module updates
|
||||
*
|
||||
* Only static files are allowed - NO executable scripts
|
||||
* This prevents RCE via malicious ZIP uploads from Vikon API
|
||||
*/
|
||||
private const ALLOWED_EXTENSIONS = [
|
||||
// Documents
|
||||
'pdf', 'doc', 'docx', 'xls', 'xlsx', 'ppt', 'pptx', 'txt', 'rtf', 'odt', 'ods', 'odp',
|
||||
// Web
|
||||
'html', 'htm', 'css', 'js', 'json', 'xml', 'map',
|
||||
// Images
|
||||
'png', 'jpg', 'jpeg', 'gif', 'svg', 'svgz', 'webp', 'ico', 'bmp', 'tiff', 'tif',
|
||||
// Fonts
|
||||
'woff', 'woff2', 'ttf', 'eot', 'otf',
|
||||
// Archives (for internal use only)
|
||||
'zip', 'rar', '7z', 'gz', 'tar',
|
||||
// Vikon-specific
|
||||
'vikon',
|
||||
];
|
||||
|
||||
/**
|
||||
* Dangerous file extensions that MUST be blocked
|
||||
* Even if Vikon sends them, they will be rejected
|
||||
*/
|
||||
private const BLOCKED_EXTENSIONS = [
|
||||
// PHP
|
||||
'php', 'php3', 'php4', 'php5', 'php7', 'php8', 'phps', 'phtml',
|
||||
// Other server-side scripts
|
||||
'asp', 'aspx', 'jsp', 'jspx', 'cfm', 'cfc',
|
||||
// Server configs
|
||||
'htaccess', 'htpasswd', 'conf', 'config',
|
||||
// Scripts
|
||||
'pl', 'py', 'pyc', 'pyo', 'rb', 'cgi', 'sh', 'bash', 'bat', 'cmd', 'exe', 'com',
|
||||
// PowerShell
|
||||
'ps1', 'psm1', 'psd1',
|
||||
// Node/JS runtime (JS allowed as static, but not server-side)
|
||||
'mjs', 'cjs', 'ts',
|
||||
// Compiled
|
||||
'so', 'dll', 'exe', 'bin', 'class',
|
||||
];
|
||||
|
||||
public function __construct(
|
||||
private readonly CallVikonApiTask $callVikonApiTask,
|
||||
private readonly ExtractZipArchiveTask $extractZipTask,
|
||||
private readonly array $modulesConfig,
|
||||
private readonly string $storagePath,
|
||||
private readonly string $basePath,
|
||||
) {}
|
||||
|
||||
/**
|
||||
* Download and install module update
|
||||
*
|
||||
* @param int $moduleId Module ID (1, 2, 6)
|
||||
* @param string $accessToken Valid Vikon access token
|
||||
* @return string Success message
|
||||
* @throws \RuntimeException
|
||||
*/
|
||||
public function run(int $moduleId, string $accessToken): string
|
||||
{
|
||||
$moduleConfig = $this->getModuleConfig($moduleId);
|
||||
$modulePath = $this->basePath . '/' . $moduleConfig['path'];
|
||||
$tempPath = $this->storagePath . '/temp/' . $moduleConfig['path'];
|
||||
|
||||
try {
|
||||
// Step 1: Download module core ZIP
|
||||
Log::info('Vikon update: downloading module core', ['module_id' => $moduleId]);
|
||||
|
||||
$zipContent = $this->callVikonApiTask->downloadWithToken(
|
||||
'pull_updates/generateEmptyModuleCore/' . $moduleId,
|
||||
$accessToken
|
||||
);
|
||||
|
||||
// Step 2: Prepare temp directory
|
||||
$this->prepareTempDirectory($tempPath);
|
||||
|
||||
// Step 3: Write ZIP to temp file
|
||||
$zipFile = $tempPath . '/module_core.zip';
|
||||
$writeResult = file_put_contents($zipFile, $zipContent);
|
||||
|
||||
if ($writeResult === false) {
|
||||
throw new \RuntimeException('Не удалось записать архив обновления. Проверьте права доступа.');
|
||||
}
|
||||
|
||||
// Step 4: Extract with Zip Slip protection
|
||||
$this->extractZipTask->run($zipFile, $tempPath);
|
||||
|
||||
// Step 5: Validate file types BEFORE syncing to module directory
|
||||
$blockedFiles = $this->validateFileTypes($tempPath);
|
||||
if (!empty($blockedFiles)) {
|
||||
throw new \RuntimeException(
|
||||
'Обнаружены запрещённые типы файлов: ' . implode(', ', $blockedFiles) .
|
||||
'. Обновление отклонено в целях безопасности.'
|
||||
);
|
||||
}
|
||||
|
||||
// Step 6: Remove vikon_core directory from archive (we use Laravel-based updater)
|
||||
$vikonCorePath = $tempPath . '/vikon_core';
|
||||
if (File::isDirectory($vikonCorePath)) {
|
||||
Log::info('Vikon update: removing vikon_core from archive (using Laravel updater instead)');
|
||||
File::deleteDirectory($vikonCorePath);
|
||||
}
|
||||
|
||||
// Step 7: Clean up ZIP
|
||||
File::delete($zipFile);
|
||||
|
||||
// Step 7: Sync extracted files to module directory
|
||||
$this->syncModuleFiles($tempPath, $modulePath, $moduleConfig['path']);
|
||||
|
||||
// Step 8: Clean module - remove files/folders not in allowed list (like old cleanUnitCore)
|
||||
$this->cleanModuleDirectory($modulePath, $moduleConfig['allowed_folders']);
|
||||
|
||||
// Step 9: Create .vikon flag file
|
||||
$this->createVikonFlag($modulePath);
|
||||
|
||||
// Step 9: Cleanup temp
|
||||
File::deleteDirectory($tempPath);
|
||||
|
||||
Log::info('Vikon update: module core updated successfully', ['module_id' => $moduleId]);
|
||||
|
||||
return 'Ядро модуля "' . $moduleConfig['name'] . '" успешно обновлено.';
|
||||
} catch (\Throwable $e) {
|
||||
// Rollback on error
|
||||
$this->rollback($modulePath, $moduleConfig['path']);
|
||||
|
||||
Log::error('Vikon update: failed', [
|
||||
'module_id' => $moduleId,
|
||||
'error' => $e->getMessage(),
|
||||
]);
|
||||
|
||||
throw new \RuntimeException('Ошибка обновления модуля: ' . $e->getMessage());
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Get module configuration
|
||||
*
|
||||
* @throws \RuntimeException
|
||||
*/
|
||||
private function getModuleConfig(int $moduleId): array
|
||||
{
|
||||
if (!isset($this->modulesConfig[$moduleId])) {
|
||||
throw new \RuntimeException('Неизвестный идентификатор модуля');
|
||||
}
|
||||
|
||||
return $this->modulesConfig[$moduleId];
|
||||
}
|
||||
|
||||
/**
|
||||
* Prepare temporary directory for extraction
|
||||
*/
|
||||
private function prepareTempDirectory(string $path): void
|
||||
{
|
||||
if (File::exists($path)) {
|
||||
File::deleteDirectory($path);
|
||||
}
|
||||
|
||||
File::makeDirectory($path, 0755, true, true);
|
||||
}
|
||||
|
||||
/**
|
||||
* Sync extracted files to module directory with atomic operations
|
||||
*
|
||||
* Strategy:
|
||||
* 1. Rename current file/dir to _old
|
||||
* 2. Move new file/dir to current location
|
||||
* 3. If error occurs, rollback from _old
|
||||
*/
|
||||
private function syncModuleFiles(string $sourcePath, string $targetPath, string $moduleFolder): void
|
||||
{
|
||||
$entries = File::directories($sourcePath);
|
||||
$files = File::files($sourcePath);
|
||||
|
||||
$failedEntries = [];
|
||||
|
||||
// Process directories
|
||||
foreach ($entries as $entry) {
|
||||
$entryName = basename($entry);
|
||||
$currentPath = $targetPath . '/' . $entryName;
|
||||
$newPath = $sourcePath . '/' . $entryName;
|
||||
|
||||
try {
|
||||
$this->syncDirectory($newPath, $currentPath, $targetPath);
|
||||
} catch (\Throwable $e) {
|
||||
$failedEntries[] = $entryName;
|
||||
Log::error('Vikon update: failed to sync directory', [
|
||||
'entry' => $entryName,
|
||||
'error' => $e->getMessage(),
|
||||
]);
|
||||
}
|
||||
}
|
||||
|
||||
// Process files
|
||||
foreach ($files as $file) {
|
||||
$fileName = basename($file);
|
||||
$currentPath = $targetPath . '/' . $fileName;
|
||||
$newPath = $sourcePath . '/' . $fileName;
|
||||
|
||||
try {
|
||||
$this->syncFile($newPath, $currentPath, $targetPath);
|
||||
} catch (\Throwable $e) {
|
||||
$failedEntries[] = $fileName;
|
||||
Log::error('Vikon update: failed to sync file', [
|
||||
'entry' => $fileName,
|
||||
'error' => $e->getMessage(),
|
||||
]);
|
||||
}
|
||||
}
|
||||
|
||||
if (!empty($failedEntries)) {
|
||||
throw new \RuntimeException(
|
||||
'Не удалось синхронизировать: ' . implode(', ', $failedEntries)
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Sync single directory with atomic rename
|
||||
*/
|
||||
private function syncDirectory(string $newPath, string $currentPath, string $basePath): void
|
||||
{
|
||||
if (File::exists($currentPath)) {
|
||||
// Rename current to _old
|
||||
$oldPath = $currentPath . self::OLD_SUFFIX;
|
||||
if (File::exists($oldPath)) {
|
||||
File::deleteDirectory($oldPath);
|
||||
}
|
||||
File::move($currentPath, $oldPath);
|
||||
}
|
||||
|
||||
// Move new to current
|
||||
File::copyDirectory($newPath, $currentPath);
|
||||
}
|
||||
|
||||
/**
|
||||
* Sync single file with atomic rename
|
||||
*/
|
||||
private function syncFile(string $newPath, string $currentPath, string $basePath): void
|
||||
{
|
||||
if (File::exists($currentPath)) {
|
||||
// Rename current to _old
|
||||
$oldPath = $currentPath . self::OLD_SUFFIX;
|
||||
if (File::exists($oldPath)) {
|
||||
File::delete($oldPath);
|
||||
}
|
||||
rename($currentPath, $oldPath);
|
||||
}
|
||||
|
||||
// Move new to current
|
||||
copy($newPath, $currentPath);
|
||||
}
|
||||
|
||||
/**
|
||||
* Create .vikon flag file in module directory
|
||||
*/
|
||||
private function createVikonFlag(string $modulePath): void
|
||||
{
|
||||
$flagPath = $modulePath . '/.vikon';
|
||||
|
||||
if (!File::exists($flagPath)) {
|
||||
File::put($flagPath, date('Y-m-d H:i:s'));
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Clean module directory - remove files/folders not in allowed list
|
||||
*
|
||||
* Replaces old Filesystem::cleanUnitCore()
|
||||
* After sync, removes any files/directories that are not in the allowed_folders list
|
||||
*/
|
||||
private function cleanModuleDirectory(string $modulePath, array $allowedFolders): void
|
||||
{
|
||||
$entries = File::directories($modulePath);
|
||||
|
||||
foreach ($entries as $entry) {
|
||||
$entryName = basename($entry);
|
||||
|
||||
if (in_array($entryName, $allowedFolders, true)) {
|
||||
continue;
|
||||
}
|
||||
|
||||
// Skip symlinks
|
||||
if (is_link($entry)) {
|
||||
Log::warning('Vikon update: skipping symlink during cleanup', [
|
||||
'path' => $entry,
|
||||
]);
|
||||
continue;
|
||||
}
|
||||
|
||||
Log::info('Vikon update: removing disallowed directory', [
|
||||
'directory' => $entryName,
|
||||
]);
|
||||
|
||||
File::deleteDirectory($entry);
|
||||
}
|
||||
|
||||
// Also check files at root level
|
||||
$files = File::files($modulePath);
|
||||
foreach ($files as $file) {
|
||||
$fileName = basename($file);
|
||||
|
||||
if (in_array($fileName, $allowedFolders, true)) {
|
||||
continue;
|
||||
}
|
||||
|
||||
// Skip .vikon flag and .htaccess
|
||||
if (in_array($fileName, ['.vikon', '.htaccess'], true)) {
|
||||
continue;
|
||||
}
|
||||
|
||||
Log::info('Vikon update: removing disallowed file', [
|
||||
'file' => $fileName,
|
||||
]);
|
||||
|
||||
File::delete($file);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Validate all extracted files against allowed/blocked extensions
|
||||
*
|
||||
* This is a security measure to prevent RCE via malicious ZIP from Vikon API.
|
||||
* Even if Vikon sends PHP/ASP files, they will be rejected here.
|
||||
*
|
||||
* @return array List of blocked file paths
|
||||
*/
|
||||
private function validateFileTypes(string $extractPath): array
|
||||
{
|
||||
$blockedFiles = [];
|
||||
|
||||
$this->scanDirectoryForBlockedFiles($extractPath, $blockedFiles);
|
||||
|
||||
return $blockedFiles;
|
||||
}
|
||||
|
||||
/**
|
||||
* Recursively scan directory for blocked file types
|
||||
*/
|
||||
private function scanDirectoryForBlockedFiles(string $directory, array &$blockedFiles): void
|
||||
{
|
||||
// Check files
|
||||
$files = File::files($directory);
|
||||
foreach ($files as $file) {
|
||||
$extension = strtolower(pathinfo($file, PATHINFO_EXTENSION));
|
||||
$relativePath = str_replace(base_path() . '/', '', $file);
|
||||
|
||||
if (in_array($extension, self::BLOCKED_EXTENSIONS, true)) {
|
||||
$blockedFiles[] = $relativePath;
|
||||
}
|
||||
}
|
||||
|
||||
// Recurse into subdirectories
|
||||
$dirs = File::directories($directory);
|
||||
foreach ($dirs as $dir) {
|
||||
$this->scanDirectoryForBlockedFiles($dir, $blockedFiles);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Rollback failed update from _old backups
|
||||
*/
|
||||
private function rollback(string $modulePath, string $moduleFolder): void
|
||||
{
|
||||
Log::warning('Vikon update: rolling back failed update', [
|
||||
'module' => $moduleFolder,
|
||||
]);
|
||||
|
||||
// Restore directories
|
||||
$dirs = File::directories($modulePath);
|
||||
foreach ($dirs as $dir) {
|
||||
$dirName = basename($dir);
|
||||
$oldPath = $dir . self::OLD_SUFFIX;
|
||||
|
||||
if (File::exists($oldPath)) {
|
||||
try {
|
||||
// Remove failed new version
|
||||
File::deleteDirectory($dir);
|
||||
// Restore old version
|
||||
File::move($oldPath, $dir);
|
||||
} catch (\Throwable $e) {
|
||||
Log::error('Vikon update: rollback failed for directory', [
|
||||
'entry' => $dirName,
|
||||
'error' => $e->getMessage(),
|
||||
]);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Restore files
|
||||
$files = File::files($modulePath);
|
||||
foreach ($files as $file) {
|
||||
$fileName = basename($file);
|
||||
$oldPath = $file . self::OLD_SUFFIX;
|
||||
|
||||
if (File::exists($oldPath)) {
|
||||
try {
|
||||
// Remove failed new version
|
||||
File::delete($file);
|
||||
// Restore old version
|
||||
rename($oldPath, $file);
|
||||
} catch (\Throwable $e) {
|
||||
Log::error('Vikon update: rollback failed for file', [
|
||||
'entry' => $fileName,
|
||||
'error' => $e->getMessage(),
|
||||
]);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user