update.compare.inc 34 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831
  1. <?php
  2. /**
  3. * @file
  4. * Code required only when comparing available updates to existing data.
  5. */
  6. /**
  7. * Fetches an array of installed and enabled projects.
  8. *
  9. * This is only responsible for generating an array of projects (taking into
  10. * account projects that include more than one module or theme). Other
  11. * information like the specific version and install type (official release,
  12. * dev snapshot, etc) is handled later in update_process_project_info() since
  13. * that logic is only required when preparing the status report, not for
  14. * fetching the available release data.
  15. *
  16. * This array is fairly expensive to construct, since it involves a lot of disk
  17. * I/O, so we cache the results into the {cache_update} table using the
  18. * 'update_project_projects' cache ID. However, since this is not the data about
  19. * available updates fetched from the network, it is acceptable to invalidate it
  20. * somewhat quickly. If we keep this data for very long, site administrators are
  21. * more likely to see incorrect results if they upgrade to a newer version of a
  22. * module or theme but do not visit certain pages that automatically clear this
  23. * cache.
  24. *
  25. * @return
  26. * An associative array of currently enabled projects keyed by the
  27. * machine-readable project short name. Each project contains:
  28. * - name: The machine-readable project short name.
  29. * - info: An array with values from the main .info file for this project.
  30. * - name: The human-readable name of the project.
  31. * - package: The package that the project is grouped under.
  32. * - version: The version of the project.
  33. * - project: The Drupal.org project name.
  34. * - datestamp: The date stamp of the project's main .info file.
  35. * - _info_file_ctime: The maximum file change time for all of the .info
  36. * files included in this project.
  37. * - datestamp: The date stamp when the project was released, if known.
  38. * - includes: An associative array containing all projects included with this
  39. * project, keyed by the machine-readable short name with the human-readable
  40. * name as value.
  41. * - project_type: The type of project. Allowed values are 'module' and
  42. * 'theme'.
  43. * - project_status: This indicates if the project is enabled and will always
  44. * be TRUE, as the function only returns enabled projects.
  45. * - sub_themes: If the project is a theme it contains an associative array of
  46. * all sub-themes.
  47. * - base_themes: If the project is a theme it contains an associative array
  48. * of all base-themes.
  49. *
  50. * @see update_process_project_info()
  51. * @see update_calculate_project_data()
  52. * @see update_project_cache()
  53. */
  54. function update_get_projects() {
  55. $projects = &drupal_static(__FUNCTION__, array());
  56. if (empty($projects)) {
  57. // Retrieve the projects from cache, if present.
  58. $projects = update_project_cache('update_project_projects');
  59. if (empty($projects)) {
  60. // Still empty, so we have to rebuild the cache.
  61. $module_data = system_rebuild_module_data();
  62. $theme_data = system_rebuild_theme_data();
  63. _update_process_info_list($projects, $module_data, 'module', TRUE);
  64. _update_process_info_list($projects, $theme_data, 'theme', TRUE);
  65. if (variable_get('update_check_disabled', FALSE)) {
  66. _update_process_info_list($projects, $module_data, 'module', FALSE);
  67. _update_process_info_list($projects, $theme_data, 'theme', FALSE);
  68. }
  69. // Allow other modules to alter projects before fetching and comparing.
  70. drupal_alter('update_projects', $projects);
  71. // Cache the site's project data for at most 1 hour.
  72. _update_cache_set('update_project_projects', $projects, REQUEST_TIME + 3600);
  73. }
  74. }
  75. return $projects;
  76. }
  77. /**
  78. * Populates an array of project data.
  79. *
  80. * This iterates over a list of the installed modules or themes and groups them
  81. * by project and status. A few parts of this function assume that enabled
  82. * modules and themes are always processed first, and if disabled modules or
  83. * themes are being processed (there is a setting to control if disabled code
  84. * should be included or not in the 'Available updates' report), those are only
  85. * processed after $projects has been populated with information about the
  86. * enabled code. Modules and themes set as hidden are always ignored. This
  87. * function also records the latest change time on the .info files for each
  88. * module or theme, which is important data which is used when deciding if the
  89. * cached available update data should be invalidated.
  90. *
  91. * @param $projects
  92. * Reference to the array of project data of what's installed on this site.
  93. * @param $list
  94. * Array of data to process to add the relevant info to the $projects array.
  95. * @param $project_type
  96. * The kind of data in the list. Can be 'module' or 'theme'.
  97. * @param $status
  98. * Boolean that controls what status (enabled or disabled) to process out of
  99. * the $list and add to the $projects array.
  100. *
  101. * @see update_get_projects()
  102. */
  103. function _update_process_info_list(&$projects, $list, $project_type, $status) {
  104. foreach ($list as $file) {
  105. // A disabled base theme of an enabled sub-theme still has all of its code
  106. // run by the sub-theme, so we include it in our "enabled" projects list.
  107. if ($status && !$file->status && !empty($file->sub_themes)) {
  108. foreach ($file->sub_themes as $key => $name) {
  109. // Build a list of enabled sub-themes.
  110. if ($list[$key]->status) {
  111. $file->enabled_sub_themes[$key] = $name;
  112. }
  113. }
  114. // If there are no enabled subthemes, we should ignore this base theme
  115. // for the enabled case. If the site is trying to display disabled
  116. // themes, we'll catch it then.
  117. if (empty($file->enabled_sub_themes)) {
  118. continue;
  119. }
  120. }
  121. // Otherwise, just add projects of the proper status to our list.
  122. elseif ($file->status != $status) {
  123. continue;
  124. }
  125. // Skip if the .info file is broken.
  126. if (empty($file->info)) {
  127. continue;
  128. }
  129. // Skip if it's a hidden module or theme.
  130. if (!empty($file->info['hidden'])) {
  131. continue;
  132. }
  133. // If the .info doesn't define the 'project', try to figure it out.
  134. if (!isset($file->info['project'])) {
  135. $file->info['project'] = update_get_project_name($file);
  136. }
  137. // If we still don't know the 'project', give up.
  138. if (empty($file->info['project'])) {
  139. continue;
  140. }
  141. // If we don't already know it, grab the change time on the .info file
  142. // itself. Note: we need to use the ctime, not the mtime (modification
  143. // time) since many (all?) tar implementations will go out of their way to
  144. // set the mtime on the files it creates to the timestamps recorded in the
  145. // tarball. We want to see the last time the file was changed on disk,
  146. // which is left alone by tar and correctly set to the time the .info file
  147. // was unpacked.
  148. if (!isset($file->info['_info_file_ctime'])) {
  149. $info_filename = dirname($file->uri) . '/' . $file->name . '.info';
  150. $file->info['_info_file_ctime'] = filectime($info_filename);
  151. }
  152. if (!isset($file->info['datestamp'])) {
  153. $file->info['datestamp'] = 0;
  154. }
  155. $project_name = $file->info['project'];
  156. // Figure out what project type we're going to use to display this module
  157. // or theme. If the project name is 'drupal', we don't want it to show up
  158. // under the usual "Modules" section, we put it at a special "Drupal Core"
  159. // section at the top of the report.
  160. if ($project_name == 'drupal') {
  161. $project_display_type = 'core';
  162. }
  163. else {
  164. $project_display_type = $project_type;
  165. }
  166. if (empty($status) && empty($file->enabled_sub_themes)) {
  167. // If we're processing disabled modules or themes, append a suffix.
  168. // However, we don't do this to a a base theme with enabled
  169. // subthemes, since we treat that case as if it is enabled.
  170. $project_display_type .= '-disabled';
  171. }
  172. // Add a list of sub-themes that "depend on" the project and a list of base
  173. // themes that are "required by" the project.
  174. if ($project_name == 'drupal') {
  175. // Drupal core is always required, so this extra info would be noise.
  176. $sub_themes = array();
  177. $base_themes = array();
  178. }
  179. else {
  180. // Add list of enabled sub-themes.
  181. $sub_themes = !empty($file->enabled_sub_themes) ? $file->enabled_sub_themes : array();
  182. // Add list of base themes.
  183. $base_themes = !empty($file->base_themes) ? $file->base_themes : array();
  184. }
  185. if (!isset($projects[$project_name])) {
  186. // Only process this if we haven't done this project, since a single
  187. // project can have multiple modules or themes.
  188. $projects[$project_name] = array(
  189. 'name' => $project_name,
  190. // Only save attributes from the .info file we care about so we do not
  191. // bloat our RAM usage needlessly.
  192. 'info' => update_filter_project_info($file->info),
  193. 'datestamp' => $file->info['datestamp'],
  194. 'includes' => array($file->name => $file->info['name']),
  195. 'project_type' => $project_display_type,
  196. 'project_status' => $status,
  197. 'sub_themes' => $sub_themes,
  198. 'base_themes' => $base_themes,
  199. );
  200. }
  201. elseif ($projects[$project_name]['project_type'] == $project_display_type) {
  202. // Only add the file we're processing to the 'includes' array for this
  203. // project if it is of the same type and status (which is encoded in the
  204. // $project_display_type). This prevents listing all the disabled
  205. // modules included with an enabled project if we happen to be checking
  206. // for disabled modules, too.
  207. $projects[$project_name]['includes'][$file->name] = $file->info['name'];
  208. $projects[$project_name]['info']['_info_file_ctime'] = max($projects[$project_name]['info']['_info_file_ctime'], $file->info['_info_file_ctime']);
  209. $projects[$project_name]['datestamp'] = max($projects[$project_name]['datestamp'], $file->info['datestamp']);
  210. if (!empty($sub_themes)) {
  211. $projects[$project_name]['sub_themes'] += $sub_themes;
  212. }
  213. if (!empty($base_themes)) {
  214. $projects[$project_name]['base_themes'] += $base_themes;
  215. }
  216. }
  217. elseif (empty($status)) {
  218. // If we have a project_name that matches, but the project_display_type
  219. // does not, it means we're processing a disabled module or theme that
  220. // belongs to a project that has some enabled code. In this case, we add
  221. // the disabled thing into a separate array for separate display.
  222. $projects[$project_name]['disabled'][$file->name] = $file->info['name'];
  223. }
  224. }
  225. }
  226. /**
  227. * Determines what project a given file object belongs to.
  228. *
  229. * @param $file
  230. * A file object as returned by system_get_files_database().
  231. *
  232. * @return
  233. * The canonical project short name.
  234. *
  235. * @see system_get_files_database()
  236. */
  237. function update_get_project_name($file) {
  238. $project_name = '';
  239. if (isset($file->info['project'])) {
  240. $project_name = $file->info['project'];
  241. }
  242. elseif (isset($file->info['package']) && (strpos($file->info['package'], 'Core') === 0)) {
  243. $project_name = 'drupal';
  244. }
  245. return $project_name;
  246. }
  247. /**
  248. * Determines version and type information for currently installed projects.
  249. *
  250. * Processes the list of projects on the system to figure out the currently
  251. * installed versions, and other information that is required before we can
  252. * compare against the available releases to produce the status report.
  253. *
  254. * @param $projects
  255. * Array of project information from update_get_projects().
  256. */
  257. function update_process_project_info(&$projects) {
  258. foreach ($projects as $key => $project) {
  259. // Assume an official release until we see otherwise.
  260. $install_type = 'official';
  261. $info = $project['info'];
  262. if (isset($info['version'])) {
  263. // Check for development snapshots
  264. if (preg_match('@(dev|HEAD)@', $info['version'])) {
  265. $install_type = 'dev';
  266. }
  267. // Figure out what the currently installed major version is. We need
  268. // to handle both contribution (e.g. "5.x-1.3", major = 1) and core
  269. // (e.g. "5.1", major = 5) version strings.
  270. $matches = array();
  271. if (preg_match('/^(\d+\.x-)?(\d+)\..*$/', $info['version'], $matches)) {
  272. $info['major'] = $matches[2];
  273. }
  274. elseif (!isset($info['major'])) {
  275. // This would only happen for version strings that don't follow the
  276. // drupal.org convention. We let contribs define "major" in their
  277. // .info in this case, and only if that's missing would we hit this.
  278. $info['major'] = -1;
  279. }
  280. }
  281. else {
  282. // No version info available at all.
  283. $install_type = 'unknown';
  284. $info['version'] = t('Unknown');
  285. $info['major'] = -1;
  286. }
  287. // Finally, save the results we care about into the $projects array.
  288. $projects[$key]['existing_version'] = $info['version'];
  289. $projects[$key]['existing_major'] = $info['major'];
  290. $projects[$key]['install_type'] = $install_type;
  291. }
  292. }
  293. /**
  294. * Calculates the current update status of all projects on the site.
  295. *
  296. * The results of this function are expensive to compute, especially on sites
  297. * with lots of modules or themes, since it involves a lot of comparisons and
  298. * other operations. Therefore, we cache the results into the {cache_update}
  299. * table using the 'update_project_data' cache ID. However, since this is not
  300. * the data about available updates fetched from the network, it is ok to
  301. * invalidate it somewhat quickly. If we keep this data for very long, site
  302. * administrators are more likely to see incorrect results if they upgrade to a
  303. * newer version of a module or theme but do not visit certain pages that
  304. * automatically clear this cache.
  305. *
  306. * @param array $available
  307. * Data about available project releases.
  308. *
  309. * @return
  310. * An array of installed projects with current update status information.
  311. *
  312. * @see update_get_available()
  313. * @see update_get_projects()
  314. * @see update_process_project_info()
  315. * @see update_project_cache()
  316. */
  317. function update_calculate_project_data($available) {
  318. // Retrieve the projects from cache, if present.
  319. $projects = update_project_cache('update_project_data');
  320. // If $projects is empty, then the cache must be rebuilt.
  321. // Otherwise, return the cached data and skip the rest of the function.
  322. if (!empty($projects)) {
  323. return $projects;
  324. }
  325. $projects = update_get_projects();
  326. update_process_project_info($projects);
  327. foreach ($projects as $project => $project_info) {
  328. if (isset($available[$project])) {
  329. update_calculate_project_update_status($project, $projects[$project], $available[$project]);
  330. }
  331. else {
  332. $projects[$project]['status'] = UPDATE_UNKNOWN;
  333. $projects[$project]['reason'] = t('No available releases found');
  334. }
  335. }
  336. // Give other modules a chance to alter the status (for example, to allow a
  337. // contrib module to provide fine-grained settings to ignore specific
  338. // projects or releases).
  339. drupal_alter('update_status', $projects);
  340. // Cache the site's update status for at most 1 hour.
  341. _update_cache_set('update_project_data', $projects, REQUEST_TIME + 3600);
  342. return $projects;
  343. }
  344. /**
  345. * Calculates the current update status of a specific project.
  346. *
  347. * This function is the heart of the update status feature. For each project it
  348. * is invoked with, it first checks if the project has been flagged with a
  349. * special status like "unsupported" or "insecure", or if the project node
  350. * itself has been unpublished. In any of those cases, the project is marked
  351. * with an error and the next project is considered.
  352. *
  353. * If the project itself is valid, the function decides what major release
  354. * series to consider. The project defines what the currently supported major
  355. * versions are for each version of core, so the first step is to make sure the
  356. * current version is still supported. If so, that's the target version. If the
  357. * current version is unsupported, the project maintainer's recommended major
  358. * version is used. There's also a check to make sure that this function never
  359. * recommends an earlier release than the currently installed major version.
  360. *
  361. * Given a target major version, the available releases are scanned looking for
  362. * the specific release to recommend (avoiding beta releases and development
  363. * snapshots if possible). For the target major version, the highest patch level
  364. * is found. If there is a release at that patch level with no extra ("beta",
  365. * etc.), then the release at that patch level with the most recent release date
  366. * is recommended. If every release at that patch level has extra (only betas),
  367. * then the latest release from the previous patch level is recommended. For
  368. * example:
  369. *
  370. * - 1.6-bugfix <-- recommended version because 1.6 already exists.
  371. * - 1.6
  372. *
  373. * or
  374. *
  375. * - 1.6-beta
  376. * - 1.5 <-- recommended version because no 1.6 exists.
  377. * - 1.4
  378. *
  379. * Also, the latest release from the same major version is looked for, even beta
  380. * releases, to display to the user as the "Latest version" option.
  381. * Additionally, the latest official release from any higher major versions that
  382. * have been released is searched for to provide a set of "Also available"
  383. * options.
  384. *
  385. * Finally, and most importantly, the release history continues to be scanned
  386. * until the currently installed release is reached, searching for anything
  387. * marked as a security update. If any security updates have been found between
  388. * the recommended release and the installed version, all of the releases that
  389. * included a security fix are recorded so that the site administrator can be
  390. * warned their site is insecure, and links pointing to the release notes for
  391. * each security update can be included (which, in turn, will link to the
  392. * official security announcements for each vulnerability).
  393. *
  394. * This function relies on the fact that the .xml release history data comes
  395. * sorted based on major version and patch level, then finally by release date
  396. * if there are multiple releases such as betas from the same major.patch
  397. * version (e.g., 5.x-1.5-beta1, 5.x-1.5-beta2, and 5.x-1.5). Development
  398. * snapshots for a given major version are always listed last.
  399. *
  400. * @param $project
  401. * An array containing information about a specific project.
  402. * @param $project_data
  403. * An array containing information about a specific project.
  404. * @param $available
  405. * Data about available project releases of a specific project.
  406. */
  407. function update_calculate_project_update_status($project, &$project_data, $available) {
  408. foreach (array('title', 'link') as $attribute) {
  409. if (!isset($project_data[$attribute]) && isset($available[$attribute])) {
  410. $project_data[$attribute] = $available[$attribute];
  411. }
  412. }
  413. // If the project status is marked as something bad, there's nothing else
  414. // to consider.
  415. if (isset($available['project_status'])) {
  416. switch ($available['project_status']) {
  417. case 'insecure':
  418. $project_data['status'] = UPDATE_NOT_SECURE;
  419. if (empty($project_data['extra'])) {
  420. $project_data['extra'] = array();
  421. }
  422. $project_data['extra'][] = array(
  423. 'class' => array('project-not-secure'),
  424. 'label' => t('Project not secure'),
  425. 'data' => t('This project has been labeled insecure by the Drupal security team, and is no longer available for download. Immediately disabling everything included by this project is strongly recommended!'),
  426. );
  427. break;
  428. case 'unpublished':
  429. case 'revoked':
  430. $project_data['status'] = UPDATE_REVOKED;
  431. if (empty($project_data['extra'])) {
  432. $project_data['extra'] = array();
  433. }
  434. $project_data['extra'][] = array(
  435. 'class' => array('project-revoked'),
  436. 'label' => t('Project revoked'),
  437. 'data' => t('This project has been revoked, and is no longer available for download. Disabling everything included by this project is strongly recommended!'),
  438. );
  439. break;
  440. case 'unsupported':
  441. $project_data['status'] = UPDATE_NOT_SUPPORTED;
  442. if (empty($project_data['extra'])) {
  443. $project_data['extra'] = array();
  444. }
  445. $project_data['extra'][] = array(
  446. 'class' => array('project-not-supported'),
  447. 'label' => t('Project not supported'),
  448. 'data' => t('This project is no longer supported, and is no longer available for download. Disabling everything included by this project is strongly recommended!'),
  449. );
  450. break;
  451. case 'not-fetched':
  452. $project_data['status'] = UPDATE_NOT_FETCHED;
  453. $project_data['reason'] = t('Failed to get available update data.');
  454. break;
  455. default:
  456. // Assume anything else (e.g. 'published') is valid and we should
  457. // perform the rest of the logic in this function.
  458. break;
  459. }
  460. }
  461. if (!empty($project_data['status'])) {
  462. // We already know the status for this project, so there's nothing else to
  463. // compute. Record the project status into $project_data and we're done.
  464. $project_data['project_status'] = $available['project_status'];
  465. return;
  466. }
  467. // Figure out the target major version.
  468. $existing_major = $project_data['existing_major'];
  469. $supported_majors = array();
  470. if (isset($available['supported_majors'])) {
  471. $supported_majors = explode(',', $available['supported_majors']);
  472. }
  473. elseif (isset($available['default_major'])) {
  474. // Older release history XML file without supported or recommended.
  475. $supported_majors[] = $available['default_major'];
  476. }
  477. if (in_array($existing_major, $supported_majors)) {
  478. // Still supported, stay at the current major version.
  479. $target_major = $existing_major;
  480. }
  481. elseif (isset($available['recommended_major'])) {
  482. // Since 'recommended_major' is defined, we know this is the new XML
  483. // format. Therefore, we know the current release is unsupported since
  484. // its major version was not in the 'supported_majors' list. We should
  485. // find the best release from the recommended major version.
  486. $target_major = $available['recommended_major'];
  487. $project_data['status'] = UPDATE_NOT_SUPPORTED;
  488. }
  489. elseif (isset($available['default_major'])) {
  490. // Older release history XML file without recommended, so recommend
  491. // the currently defined "default_major" version.
  492. $target_major = $available['default_major'];
  493. }
  494. else {
  495. // Malformed XML file? Stick with the current version.
  496. $target_major = $existing_major;
  497. }
  498. // Make sure we never tell the admin to downgrade. If we recommended an
  499. // earlier version than the one they're running, they'd face an
  500. // impossible data migration problem, since Drupal never supports a DB
  501. // downgrade path. In the unfortunate case that what they're running is
  502. // unsupported, and there's nothing newer for them to upgrade to, we
  503. // can't print out a "Recommended version", but just have to tell them
  504. // what they have is unsupported and let them figure it out.
  505. $target_major = max($existing_major, $target_major);
  506. $release_patch_changed = '';
  507. $patch = '';
  508. // If the project is marked as UPDATE_FETCH_PENDING, it means that the
  509. // data we currently have (if any) is stale, and we've got a task queued
  510. // up to (re)fetch the data. In that case, we mark it as such, merge in
  511. // whatever data we have (e.g. project title and link), and move on.
  512. if (!empty($available['fetch_status']) && $available['fetch_status'] == UPDATE_FETCH_PENDING) {
  513. $project_data['status'] = UPDATE_FETCH_PENDING;
  514. $project_data['reason'] = t('No available update data');
  515. $project_data['fetch_status'] = $available['fetch_status'];
  516. return;
  517. }
  518. // Defend ourselves from XML history files that contain no releases.
  519. if (empty($available['releases'])) {
  520. $project_data['status'] = UPDATE_UNKNOWN;
  521. $project_data['reason'] = t('No available releases found');
  522. return;
  523. }
  524. foreach ($available['releases'] as $version => $release) {
  525. // First, if this is the existing release, check a few conditions.
  526. if ($project_data['existing_version'] === $version) {
  527. if (isset($release['terms']['Release type']) &&
  528. in_array('Insecure', $release['terms']['Release type'])) {
  529. $project_data['status'] = UPDATE_NOT_SECURE;
  530. }
  531. elseif ($release['status'] == 'unpublished') {
  532. $project_data['status'] = UPDATE_REVOKED;
  533. if (empty($project_data['extra'])) {
  534. $project_data['extra'] = array();
  535. }
  536. $project_data['extra'][] = array(
  537. 'class' => array('release-revoked'),
  538. 'label' => t('Release revoked'),
  539. 'data' => t('Your currently installed release has been revoked, and is no longer available for download. Disabling everything included in this release or upgrading is strongly recommended!'),
  540. );
  541. }
  542. elseif (isset($release['terms']['Release type']) &&
  543. in_array('Unsupported', $release['terms']['Release type'])) {
  544. $project_data['status'] = UPDATE_NOT_SUPPORTED;
  545. if (empty($project_data['extra'])) {
  546. $project_data['extra'] = array();
  547. }
  548. $project_data['extra'][] = array(
  549. 'class' => array('release-not-supported'),
  550. 'label' => t('Release not supported'),
  551. 'data' => t('Your currently installed release is now unsupported, and is no longer available for download. Disabling everything included in this release or upgrading is strongly recommended!'),
  552. );
  553. }
  554. }
  555. // Otherwise, ignore unpublished, insecure, or unsupported releases.
  556. if ($release['status'] == 'unpublished' ||
  557. (isset($release['terms']['Release type']) &&
  558. (in_array('Insecure', $release['terms']['Release type']) ||
  559. in_array('Unsupported', $release['terms']['Release type'])))) {
  560. continue;
  561. }
  562. // See if this is a higher major version than our target and yet still
  563. // supported. If so, record it as an "Also available" release.
  564. // Note: some projects have a HEAD release from CVS days, which could
  565. // be one of those being compared. They would not have version_major
  566. // set, so we must call isset first.
  567. if (isset($release['version_major']) && $release['version_major'] > $target_major) {
  568. if (in_array($release['version_major'], $supported_majors)) {
  569. if (!isset($project_data['also'])) {
  570. $project_data['also'] = array();
  571. }
  572. if (!isset($project_data['also'][$release['version_major']])) {
  573. $project_data['also'][$release['version_major']] = $version;
  574. $project_data['releases'][$version] = $release;
  575. }
  576. }
  577. // Otherwise, this release can't matter to us, since it's neither
  578. // from the release series we're currently using nor the recommended
  579. // release. We don't even care about security updates for this
  580. // branch, since if a project maintainer puts out a security release
  581. // at a higher major version and not at the lower major version,
  582. // they must remove the lower version from the supported major
  583. // versions at the same time, in which case we won't hit this code.
  584. continue;
  585. }
  586. // Look for the 'latest version' if we haven't found it yet. Latest is
  587. // defined as the most recent version for the target major version.
  588. if (!isset($project_data['latest_version'])
  589. && $release['version_major'] == $target_major) {
  590. $project_data['latest_version'] = $version;
  591. $project_data['releases'][$version] = $release;
  592. }
  593. // Look for the development snapshot release for this branch.
  594. if (!isset($project_data['dev_version'])
  595. && $release['version_major'] == $target_major
  596. && isset($release['version_extra'])
  597. && $release['version_extra'] == 'dev') {
  598. $project_data['dev_version'] = $version;
  599. $project_data['releases'][$version] = $release;
  600. }
  601. // Look for the 'recommended' version if we haven't found it yet (see
  602. // phpdoc at the top of this function for the definition).
  603. if (!isset($project_data['recommended'])
  604. && $release['version_major'] == $target_major
  605. && isset($release['version_patch'])) {
  606. if ($patch != $release['version_patch']) {
  607. $patch = $release['version_patch'];
  608. $release_patch_changed = $release;
  609. }
  610. if (empty($release['version_extra']) && $patch == $release['version_patch']) {
  611. $project_data['recommended'] = $release_patch_changed['version'];
  612. $project_data['releases'][$release_patch_changed['version']] = $release_patch_changed;
  613. }
  614. }
  615. // Stop searching once we hit the currently installed version.
  616. if ($project_data['existing_version'] === $version) {
  617. break;
  618. }
  619. // If we're running a dev snapshot and have a timestamp, stop
  620. // searching for security updates once we hit an official release
  621. // older than what we've got. Allow 100 seconds of leeway to handle
  622. // differences between the datestamp in the .info file and the
  623. // timestamp of the tarball itself (which are usually off by 1 or 2
  624. // seconds) so that we don't flag that as a new release.
  625. if ($project_data['install_type'] == 'dev') {
  626. if (empty($project_data['datestamp'])) {
  627. // We don't have current timestamp info, so we can't know.
  628. continue;
  629. }
  630. elseif (isset($release['date']) && ($project_data['datestamp'] + 100 > $release['date'])) {
  631. // We're newer than this, so we can skip it.
  632. continue;
  633. }
  634. }
  635. // See if this release is a security update.
  636. if (isset($release['terms']['Release type'])
  637. && in_array('Security update', $release['terms']['Release type'])) {
  638. $project_data['security updates'][] = $release;
  639. }
  640. }
  641. // If we were unable to find a recommended version, then make the latest
  642. // version the recommended version if possible.
  643. if (!isset($project_data['recommended']) && isset($project_data['latest_version'])) {
  644. $project_data['recommended'] = $project_data['latest_version'];
  645. }
  646. //
  647. // Check to see if we need an update or not.
  648. //
  649. if (!empty($project_data['security updates'])) {
  650. // If we found security updates, that always trumps any other status.
  651. $project_data['status'] = UPDATE_NOT_SECURE;
  652. }
  653. if (isset($project_data['status'])) {
  654. // If we already know the status, we're done.
  655. return;
  656. }
  657. // If we don't know what to recommend, there's nothing we can report.
  658. // Bail out early.
  659. if (!isset($project_data['recommended'])) {
  660. $project_data['status'] = UPDATE_UNKNOWN;
  661. $project_data['reason'] = t('No available releases found');
  662. return;
  663. }
  664. // If we're running a dev snapshot, compare the date of the dev snapshot
  665. // with the latest official version, and record the absolute latest in
  666. // 'latest_dev' so we can correctly decide if there's a newer release
  667. // than our current snapshot.
  668. if ($project_data['install_type'] == 'dev') {
  669. if (isset($project_data['dev_version']) && $available['releases'][$project_data['dev_version']]['date'] > $available['releases'][$project_data['latest_version']]['date']) {
  670. $project_data['latest_dev'] = $project_data['dev_version'];
  671. }
  672. else {
  673. $project_data['latest_dev'] = $project_data['latest_version'];
  674. }
  675. }
  676. // Figure out the status, based on what we've seen and the install type.
  677. switch ($project_data['install_type']) {
  678. case 'official':
  679. if ($project_data['existing_version'] === $project_data['recommended'] || $project_data['existing_version'] === $project_data['latest_version']) {
  680. $project_data['status'] = UPDATE_CURRENT;
  681. }
  682. else {
  683. $project_data['status'] = UPDATE_NOT_CURRENT;
  684. }
  685. break;
  686. case 'dev':
  687. $latest = $available['releases'][$project_data['latest_dev']];
  688. if (empty($project_data['datestamp'])) {
  689. $project_data['status'] = UPDATE_NOT_CHECKED;
  690. $project_data['reason'] = t('Unknown release date');
  691. }
  692. elseif (($project_data['datestamp'] + 100 > $latest['date'])) {
  693. $project_data['status'] = UPDATE_CURRENT;
  694. }
  695. else {
  696. $project_data['status'] = UPDATE_NOT_CURRENT;
  697. }
  698. break;
  699. default:
  700. $project_data['status'] = UPDATE_UNKNOWN;
  701. $project_data['reason'] = t('Invalid info');
  702. }
  703. }
  704. /**
  705. * Retrieves data from {cache_update} or empties the cache when necessary.
  706. *
  707. * Two very expensive arrays computed by this module are the list of all
  708. * installed modules and themes (and .info data, project associations, etc), and
  709. * the current status of the site relative to the currently available releases.
  710. * These two arrays are cached in the {cache_update} table and used whenever
  711. * possible. The cache is cleared whenever the administrator visits the status
  712. * report, available updates report, or the module or theme administration
  713. * pages, since we should always recompute the most current values on any of
  714. * those pages.
  715. *
  716. * Note: while both of these arrays are expensive to compute (in terms of disk
  717. * I/O and some fairly heavy CPU processing), neither of these is the actual
  718. * data about available updates that we have to fetch over the network from
  719. * updates.drupal.org. That information is stored with the
  720. * 'update_available_releases' cache ID -- it needs to persist longer than 1
  721. * hour and never get invalidated just by visiting a page on the site.
  722. *
  723. * @param $cid
  724. * The cache ID of data to return from the cache. Valid options are
  725. * 'update_project_data' and 'update_project_projects'.
  726. *
  727. * @return
  728. * The cached value of the $projects array generated by
  729. * update_calculate_project_data() or update_get_projects(), or an empty array
  730. * when the cache is cleared.
  731. */
  732. function update_project_cache($cid) {
  733. $projects = array();
  734. // On certain paths, we should clear the cache and recompute the projects for
  735. // update status of the site to avoid presenting stale information.
  736. $q = $_GET['q'];
  737. $paths = array(
  738. 'admin/modules',
  739. 'admin/modules/update',
  740. 'admin/appearance',
  741. 'admin/appearance/update',
  742. 'admin/reports',
  743. 'admin/reports/updates',
  744. 'admin/reports/updates/update',
  745. 'admin/reports/status',
  746. 'admin/reports/updates/check',
  747. );
  748. if (in_array($q, $paths)) {
  749. _update_cache_clear($cid);
  750. }
  751. else {
  752. $cache = _update_cache_get($cid);
  753. if (!empty($cache->data) && $cache->expire > REQUEST_TIME) {
  754. $projects = $cache->data;
  755. }
  756. }
  757. return $projects;
  758. }
  759. /**
  760. * Filters the project .info data to only save attributes we need.
  761. *
  762. * @param array $info
  763. * Array of .info file data as returned by drupal_parse_info_file().
  764. *
  765. * @return
  766. * Array of .info file data we need for the update manager.
  767. *
  768. * @see _update_process_info_list()
  769. */
  770. function update_filter_project_info($info) {
  771. $whitelist = array(
  772. '_info_file_ctime',
  773. 'datestamp',
  774. 'major',
  775. 'name',
  776. 'package',
  777. 'project',
  778. 'project status url',
  779. 'version',
  780. );
  781. return array_intersect_key($info, drupal_map_assoc($whitelist));
  782. }