main
This commit is contained in:
@@ -0,0 +1,172 @@
|
||||
<?php
|
||||
/**
|
||||
* Pi-Star firmware/software upgrade runner.
|
||||
*
|
||||
* Triggers `sudo /usr/local/sbin/pistar-upgrade` (a longer-running
|
||||
* sibling of /admin/update.php's pistar-update). Output streams to
|
||||
* /var/log/pi-star/pi-star_upgrade.log and is tailed via AJAX.
|
||||
* Requires an explicit POST confirmation field before kicking off.
|
||||
*/
|
||||
require_once($_SERVER['DOCUMENT_ROOT'].'/config/security_headers.php');
|
||||
require_once($_SERVER['DOCUMENT_ROOT'].'/config/csrf.php');
|
||||
require_once($_SERVER['DOCUMENT_ROOT'].'/config/banner_warnings.inc');
|
||||
setSecurityHeaders();
|
||||
|
||||
// CSRF protection — see config/csrf.php for the full rationale.
|
||||
// Critical here: line 29 below kicks off `sudo pistar-upgrade`
|
||||
// the moment a `confirm_update` POST lands. csrf_verify() MUST
|
||||
// run before that, so a hostile cross-site POST can never start
|
||||
// a long-running privileged upgrade on the device.
|
||||
csrf_verify();
|
||||
|
||||
// Layer 2 of the default-password protection — see config/banner_warnings.inc.
|
||||
// MUST run BEFORE any output so header('Location: ...') works.
|
||||
pistar_warnings_enforce_redirect();
|
||||
|
||||
// Load the language support
|
||||
require_once('../config/language.php');
|
||||
// Load the Pi-Star Release file
|
||||
$pistarReleaseConfig = '/etc/pistar-release';
|
||||
$configPistarRelease = array();
|
||||
$configPistarRelease = parse_ini_file($pistarReleaseConfig, true);
|
||||
// Load the Version Info
|
||||
require_once('../config/version.php');
|
||||
|
||||
// Sanity Check that this file has been opened correctly
|
||||
if ($_SERVER["PHP_SELF"] == "/admin/expert/upgrade.php") {
|
||||
|
||||
// Only proceed with upgrade if user has confirmed via POST submission
|
||||
if (!isset($_GET['ajax']) && !empty($_POST) && isset($_POST['confirm_update'])) {
|
||||
// truncate creates+clears in one synchronous call — see
|
||||
// admin/update.php for the full rationale (the prior touch + echo
|
||||
// redirect pair was racy under `&` and the `>` ran as www-data,
|
||||
// defeating the sudo on the truncation step).
|
||||
system('sudo truncate -s 0 /var/log/pi-star/pi-star_upgrade.log');
|
||||
system('sudo /usr/local/sbin/pistar-upgrade > /dev/null 2>&1 &');
|
||||
}
|
||||
|
||||
// Sanity Check Passed.
|
||||
header('Cache-Control: no-cache');
|
||||
// session_start() is no longer called here — csrf_verify() at
|
||||
// the top already started the session via csrf_session_start().
|
||||
// The existing $_SESSION['update_offset'] log-tail logic below
|
||||
// works unchanged against the already-active session.
|
||||
|
||||
// Initialize session offset only if upgrade has been confirmed
|
||||
if (!isset($_GET['ajax']) && !empty($_POST) && isset($_POST['confirm_update'])) {
|
||||
//unset($_SESSION['update_offset']);
|
||||
if (file_exists('/var/log/pi-star/pi-star_upgrade.log')) {
|
||||
$_SESSION['update_offset'] = filesize('/var/log/pi-star/pi-star_upgrade.log');
|
||||
} else {
|
||||
$_SESSION['update_offset'] = 0;
|
||||
}
|
||||
}
|
||||
|
||||
if (isset($_GET['ajax'])) {
|
||||
//session_start();
|
||||
if (!file_exists('/var/log/pi-star/pi-star_upgrade.log')) {
|
||||
exit();
|
||||
}
|
||||
|
||||
$handle = fopen('/var/log/pi-star/pi-star_upgrade.log', 'rb');
|
||||
if (isset($_SESSION['update_offset'])) {
|
||||
fseek($handle, 0, SEEK_END);
|
||||
if ($_SESSION['update_offset'] > ftell($handle)) //log rotated/truncated
|
||||
$_SESSION['update_offset'] = 0; //continue at beginning of the new log
|
||||
$data = stream_get_contents($handle, -1, $_SESSION['update_offset']);
|
||||
$_SESSION['update_offset'] += strlen($data);
|
||||
echo nl2br($data);
|
||||
}
|
||||
else {
|
||||
fseek($handle, 0, SEEK_END);
|
||||
$_SESSION['update_offset'] = ftell($handle);
|
||||
}
|
||||
exit();
|
||||
}
|
||||
|
||||
?>
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
|
||||
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:v="urn:schemas-microsoft-com:vml" lang="en">
|
||||
<head>
|
||||
<meta name="robots" content="index" />
|
||||
<meta name="robots" content="follow" />
|
||||
<meta name="language" content="English" />
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
|
||||
<meta name="Author" content="Andrew Taylor (MW0MWZ)" />
|
||||
<meta name="Description" content="Pi-Star Update" />
|
||||
<meta name="KeyWords" content="Pi-Star" />
|
||||
<meta http-equiv="Cache-Control" content="no-cache, no-store, must-revalidate" />
|
||||
<meta http-equiv="pragma" content="no-cache" />
|
||||
<link rel="shortcut icon" href="images/favicon.ico" type="image/x-icon" />
|
||||
<meta http-equiv="Expires" content="0" />
|
||||
<title>Pi-Star - <?php echo $lang['digital_voice']." ".$lang['dashboard']." - ".$lang['update'];?></title>
|
||||
<link rel="stylesheet" type="text/css" href="../css/pistar-css.php" />
|
||||
<?php if (!empty($_POST) && isset($_POST['confirm_update'])) { ?>
|
||||
<script type="text/javascript" src="/jquery.min.js"></script>
|
||||
<script type="text/javascript" src="/jquery-timing.min.js"></script>
|
||||
<script type="text/javascript">
|
||||
$(function() {
|
||||
$.repeat(1000, function() {
|
||||
$.get('/admin/expert/upgrade.php?ajax', function(data) {
|
||||
if (data.length < 1) return;
|
||||
var objDiv = document.getElementById("tail");
|
||||
var isScrolledToBottom = objDiv.scrollHeight - objDiv.clientHeight <= objDiv.scrollTop + 1;
|
||||
$('#tail').append(data);
|
||||
if (isScrolledToBottom)
|
||||
objDiv.scrollTop = objDiv.scrollHeight;
|
||||
});
|
||||
});
|
||||
});
|
||||
</script>
|
||||
<?php } ?>
|
||||
</head>
|
||||
<body>
|
||||
<?php pistar_warnings_render(); ?>
|
||||
<div class="container">
|
||||
<?php include './header-menu.inc'; ?>
|
||||
<div class="contentwide">
|
||||
<?php if (!empty($_POST) && isset($_POST['confirm_update'])) { ?>
|
||||
<table role="presentation" width="100%">
|
||||
<tr><th>Upgrade Running</th></tr>
|
||||
<tr><td align="left"><div id="tail">Starting upgrade, please wait...<br /></div></td></tr>
|
||||
</table>
|
||||
<?php } else { ?>
|
||||
<form action="<?php echo htmlspecialchars($_SERVER["PHP_SELF"]); ?>" method="post">
|
||||
<?php csrf_field(); ?>
|
||||
<table width="100%">
|
||||
<tr>
|
||||
<th>Upgrade</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td align="center" style="padding: 20px;">
|
||||
<p style="margin-bottom: 20px;">
|
||||
<strong>This will upgrade your Pi-Star installation to the latest version.</strong><br />
|
||||
<br />
|
||||
The upgrade process may take several minutes to complete.<br />
|
||||
Please do not interrupt the process or power off your system during the upgrade.
|
||||
</p>
|
||||
<button style="border: none; background: none; cursor: pointer;" type="submit" name="confirm_update" value="1">
|
||||
<img src="/images/download.png" border="0" alt="Start Upgrade" /><br />
|
||||
<strong>Start Upgrade</strong>
|
||||
</button>
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
</form>
|
||||
<?php } ?>
|
||||
</div>
|
||||
<footer aria-label="footer">
|
||||
<div class="footer">
|
||||
Pi-Star web config, © Andy Taylor (MW0MWZ) 2014-<?php echo date("Y"); ?>.<br />
|
||||
Need help? Click <a style="color: #ffffff;" href="https://www.facebook.com/groups/pistarusergroup/" target="_new">here for the Support Group</a><br />
|
||||
Get your copy of Pi-Star from <a style="color: #ffffff;" href="http://www.pistar.uk/downloads/" target="_blank">here</a>.<br />
|
||||
<br />
|
||||
</div>
|
||||
</footer>
|
||||
</div>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
<?php
|
||||
}
|
||||
Reference in New Issue
Block a user