<?php

/**

 * @file

 * Handles updates of Drupal core and contributed projects.

 *

 * The module checks for available updates of Drupal core and any installed

 * contributed modules and themes. It warns site administrators if newer

 * releases are available via the system status report (admin/reports/status),

 * the module and theme pages, and optionally via e-mail. It also provides the

 * ability to install contributed modules and themes via an user interface.

 */

/**

 * URL to check for updates, if a given project doesn't define its own.

 */

define('UPDATE_DEFAULT_URL', 'http://updates.drupal.org/release-history');

// These are internally used constants for this code, do not modify.

/**

 * Project is missing security update(s).

 */

define('UPDATE_NOT_SECURE', 1);

/**

 * Current release has been unpublished and is no longer available.

 */

define('UPDATE_REVOKED', 2);

/**

 * Current release is no longer supported by the project maintainer.

 */

define('UPDATE_NOT_SUPPORTED', 3);

/**

 * Project has a new release available, but it is not a security release.

 */

define('UPDATE_NOT_CURRENT', 4);

/**

 * Project is up to date.

 */

define('UPDATE_CURRENT', 5);

/**

 * Project's status cannot be checked.

 */

define('UPDATE_NOT_CHECKED', -1);

/**

 * No available update data was found for project.

 */

define('UPDATE_UNKNOWN', -2);

/**

 * There was a failure fetching available update data for this project.

 */

define('UPDATE_NOT_FETCHED', -3);

/**

 * We need to (re)fetch available update data for this project.

 */

define('UPDATE_FETCH_PENDING', -4);

/**

 * Maximum number of attempts to fetch available update data from a given host.

 */

define('UPDATE_MAX_FETCH_ATTEMPTS', 2);

/**

 * Maximum number of seconds to try fetching available update data at a time.

 */

define('UPDATE_MAX_FETCH_TIME', 30);

/**

 * Implements hook_help().

 */

function update_help($path, $arg) {

  switch ($path) {

    case 'admin/reports/updates':

      return '<p>' . t('Here you can find information about available updates for your installed modules and themes. Note that each module or theme is part of a "project", which may or may not have the same name, and might include multiple modules or themes within it.') . '</p>';

    case 'admin/help#update':

      $output = '';

      $output .= '<h3>' . t('About') . '</h3>';

      $output .= '<p>' . t("The Update manager module periodically checks for new versions of your site's software (including contributed modules and themes), and alerts administrators to available updates. In order to provide update information, anonymous usage statistics are sent to Drupal.org. If desired, you may disable the Update manager module from the <a href='@modules'>Module administration page</a>. For more information, see the online handbook entry for <a href='@update'>Update manager module</a>.", array('@update' => 'http://drupal.org/documentation/modules/update', '@modules' => url('admin/modules'))) . '</p>';

      // Only explain the Update manager if it has not been disabled.

      if (update_manager_access()) {

        $output .= '<p>' . t('The Update manager also allows administrators to update and install modules and themes through the administration interface.') . '</p>';

      }

      $output .= '<h3>' . t('Uses') . '</h3>';

      $output .= '<dl>';

      $output .= '<dt>' . t('Checking for available updates') . '</dt>';

      $output .= '<dd>' . t('A report of <a href="@update-report">available updates</a> will alert you when new releases are available for download. You may configure options for the frequency for checking updates (which are performed during <a href="@cron">cron</a> runs) and e-mail notifications at the <a href="@update-settings">Update manager settings</a>  page.', array('@update-report' => url('admin/reports/updates'), '@cron' => 'http://drupal.org/cron', '@update-settings' => url('admin/reports/updates/settings'))) . '</dd>';

      // Only explain the Update manager if it has not been disabled.

      if (update_manager_access()) {

        $output .= '<dt>' . t('Performing updates through the user interface') . '</dt>';

        $output .= '<dd>' . t('The Update manager module allows administrators to perform updates directly through the administration interface. At the top of the <a href="@modules_page">modules</a> and <a href="@themes_page">themes</a> pages you will see a link to update to new releases. This will direct you to the <a href="@update-page">update page</a> where you see a listing of all the missing updates and confirm which ones you want to upgrade. From there, you are prompted for your FTP/SSH password, which then transfers the files into your Drupal installation, overwriting your old files. More detailed instructions can be found in the <a href="@update">online handbook</a>.', array('@modules_page' => url('admin/modules'), '@themes_page' => url('admin/appearance'),  '@update-page' => url('admin/reports/updates/update'), '@update' => 'http://drupal.org/documentation/modules/update')) . '</dd>';

        $output .= '<dt>' . t('Installing new modules and themes through the user interface') . '</dt>';

        $output .= '<dd>' . t('You can also install new modules and themes in the same fashion, through the <a href="@install">install page</a>, or by clicking the <em>Install new module/theme</em> link at the top of the <a href="@modules_page">modules</a> and <a href="@themes_page">themes</a> pages. In this case, you are prompted to provide either the URL to the download, or to upload a packaged release file from your local computer.', array('@modules_page' => url('admin/modules'), '@themes_page' => url('admin/appearance'), '@install' => url('admin/reports/updates/install'))) . '</dd>';

      }

      $output .= '</dl>';

      return $output;

  }

}

/**

 * Implements hook_init().

 */

function update_init() {

  if (arg(0) == 'admin' && user_access('administer site configuration')) {

    switch ($_GET['q']) {

      // These pages don't need additional nagging.

      case 'admin/appearance/update':

      case 'admin/appearance/install':

      case 'admin/modules/update':

      case 'admin/modules/install':

      case 'admin/reports/updates':

      case 'admin/reports/updates/update':

      case 'admin/reports/updates/install':

      case 'admin/reports/updates/settings':

      case 'admin/reports/status':

      case 'admin/update/ready':

        return;

      // If we are on the appearance or modules list, display a detailed report

      // of the update status.

      case 'admin/appearance':

      case 'admin/modules':

        $verbose = TRUE;

        break;

    }

    module_load_install('update');

    $status = update_requirements('runtime');

    foreach (array('core', 'contrib') as $report_type) {

      $type = 'update_' . $report_type;

      if (!empty($verbose)) {

        if (isset($status[$type]['severity'])) {

          if ($status[$type]['severity'] == REQUIREMENT_ERROR) {

            drupal_set_message($status[$type]['description'], 'error', FALSE);

          }

          elseif ($status[$type]['severity'] == REQUIREMENT_WARNING) {

            drupal_set_message($status[$type]['description'], 'warning', FALSE);

          }

        }

      }

      // Otherwise, if we're on *any* admin page and there's a security

      // update missing, print an error message about it.

      else {

        if (isset($status[$type])

            && isset($status[$type]['reason'])

            && $status[$type]['reason'] === UPDATE_NOT_SECURE) {

          drupal_set_message($status[$type]['description'], 'error', FALSE);

        }

      }

    }

  }

}

/**

 * Implements hook_menu().

 */

function update_menu() {

  $items = array();

  $items['admin/reports/updates'] = array(

    'title' => 'Available updates',

    'description' => 'Get a status report about available updates for your installed modules and themes.',

    'page callback' => 'update_status',

    'access arguments' => array('administer site configuration'),

    'weight' => -50,

    'file' => 'update.report.inc',

  );

  $items['admin/reports/updates/list'] = array(

    'title' => 'List',

    'access arguments' => array('administer site configuration'),

    'type' => MENU_DEFAULT_LOCAL_TASK,

  );

  $items['admin/reports/updates/settings'] = array(

    'title' => 'Settings',

    'page callback' => 'drupal_get_form',

    'page arguments' => array('update_settings'),

    'access arguments' => array('administer site configuration'),

    'file' => 'update.settings.inc',

    'type' => MENU_LOCAL_TASK,

    'weight' => 50,

  );

  $items['admin/reports/updates/check'] = array(

    'title' => 'Manual update check',

    'page callback' => 'update_manual_status',

    'access arguments' => array('administer site configuration'),

    'type' => MENU_CALLBACK,

    'file' => 'update.fetch.inc',

  );

  // We want action links for updating projects at a few different locations:

  // both the module and theme administration pages, and on the available

  // updates report itself. The menu items will be mostly identical, except the

  // paths and titles, so we just define them in a loop. We pass in a string

  // indicating what context we're entering the action from, so that can

  // customize the appearance as needed.

  $paths = array(

    'report' => 'admin/reports/updates',

    'module' => 'admin/modules',

    'theme' => 'admin/appearance',

  );

  foreach ($paths as $context => $path) {

    $items[$path . '/install'] = array(

      'page callback' => 'drupal_get_form',

      'page arguments' => array('update_manager_install_form', $context),

      'access callback' => 'update_manager_access',

      'access arguments' => array(),

      'weight' => 25,

      'type' => MENU_LOCAL_ACTION,

      'file' => 'update.manager.inc',

    );

    $items[$path . '/update'] = array(

      'page callback' => 'drupal_get_form',

      'page arguments' => array('update_manager_update_form', $context),

      'access callback' => 'update_manager_access',

      'access arguments' => array(),

      'weight' => 10,

      'title' => 'Update',

      'type' => MENU_LOCAL_TASK,

      'file' => 'update.manager.inc',

    );

  }

  // Customize the titles of the action links depending on where they appear.

  // We use += array() to let the translation extractor find these menu titles.

  $items['admin/reports/updates/install'] += array('title' => 'Install new module or theme');

  $items['admin/modules/install'] += array('title' => 'Install new module');

  $items['admin/appearance/install'] += array('title' => 'Install new theme');

  // Menu callback used for the confirmation page after all the releases

  // have been downloaded, asking you to backup before installing updates.

  $items['admin/update/ready'] = array(

    'title' => 'Ready to update',

    'page callback' => 'drupal_get_form',

    'page arguments' => array('update_manager_update_ready_form'),

    'access callback' => 'update_manager_access',

    'access arguments' => array(),

    'type' => MENU_CALLBACK,

    'file' => 'update.manager.inc',

  );

  return $items;

}

/**

 * Access callback: Resolves if the current user can access updater menu items.

 *

 * It both enforces the 'administer software updates' permission and the global

 * kill switch for the authorize.php script.

 *

 * @return

 *   TRUE if the current user can access the updater menu items; FALSE

 *   otherwise.

 *

 * @see update_menu()

 */

function update_manager_access() {

  return variable_get('allow_authorize_operations', TRUE) && user_access('administer software updates');

}

/**

 * Implements hook_theme().

 */

function update_theme() {

  return array(

    'update_manager_update_form' => array(

      'render element' => 'form',

      'file' => 'update.manager.inc',

    ),

    'update_last_check' => array(

      'variables' => array('last' => NULL),

    ),

    'update_report' => array(

      'variables' => array('data' => NULL),

      'file' => 'update.report.inc',

    ),

    'update_version' => array(

      'variables' => array('version' => NULL, 'tag' => NULL, 'class' => array()),

      'file' => 'update.report.inc',

    ),

    'update_status_label' => array(

      'variables' => array('status' => NULL),

      'file' => 'update.report.inc',

    ),

  );

}

/**

 * Implements hook_cron().

 */

function update_cron() {

  $frequency = variable_get('update_check_frequency', 1);

  $interval = 60 * 60 * 24 * $frequency;

  if ((REQUEST_TIME - variable_get('update_last_check', 0)) > $interval) {

    // If the configured update interval has elapsed, we want to invalidate

    // the cached data for all projects, attempt to re-fetch, and trigger any

    // configured notifications about the new status.

    update_refresh();

    update_fetch_data();

  }

  else {

    // Otherwise, see if any individual projects are now stale or still

    // missing data, and if so, try to fetch the data.

    update_get_available(TRUE);

  }

  if ((REQUEST_TIME - variable_get('update_last_email_notification', 0)) > $interval) {

    // If configured time between notifications elapsed, send email about

    // updates possibly available.

    module_load_include('inc', 'update', 'update.fetch');

    _update_cron_notify();

  }

  // Clear garbage from disk.

  update_clear_update_disk_cache();

}

/**

 * Implements hook_themes_enabled().

 *

 * If themes are enabled, we invalidate the cache of available updates.

 */

function update_themes_enabled($themes) {

  // Clear all update module caches.

  _update_cache_clear();

}

/**

 * Implements hook_themes_disabled().

 *

 * If themes are disabled, we invalidate the cache of available updates.

 */

function update_themes_disabled($themes) {

  // Clear all update module caches.

  _update_cache_clear();

}

/**

 * Implements hook_form_FORM_ID_alter() for system_modules().

 *

 * Adds a form submission handler to the system modules form, so that if a site

 * admin saves the form, we invalidate the cache of available updates.

 *

 * @see _update_cache_clear()

 */

function update_form_system_modules_alter(&$form, $form_state) {

  $form['#submit'][] = 'update_cache_clear_submit';

}

/**

 * Form submission handler for system_modules().

 *

 * @see update_form_system_modules_alter()

 */

function update_cache_clear_submit($form, &$form_state) {

  // Clear all update module caches.

  _update_cache_clear();

}

/**

 * Returns a warning message when there is no data about available updates.

 */

function _update_no_data() {

  $destination = drupal_get_destination();

  return t('No update information available. <a href="@run_cron">Run cron</a> or <a href="@check_manually">check manually</a>.', array(

    '@run_cron' => url('admin/reports/status/run-cron', array('query' => $destination)),

    '@check_manually' => url('admin/reports/updates/check', array('query' => $destination)),

  ));

}

/**

 * Tries to get update information from cache and refreshes it when necessary.

 *

 * In addition to checking the cache lifetime, this function also ensures that

 * there are no .info files for enabled modules or themes that have a newer

 * modification timestamp than the last time we checked for available update

 * data. If any .info file was modified, it almost certainly means a new version

 * of something was installed. Without fresh available update data, the logic in

 * update_calculate_project_data() will be wrong and produce confusing, bogus

 * results.

 *

 * @param $refresh

 *   (optional) Boolean to indicate if this method should refresh the cache

 *   automatically if there's no data. Defaults to FALSE.

 *

 * @return

 *   Array of data about available releases, keyed by project shortname.

 *

 * @see update_refresh()

 * @see update_get_projects()

 */

function update_get_available($refresh = FALSE) {

  module_load_include('inc', 'update', 'update.compare');

  $needs_refresh = FALSE;

  // Grab whatever data we currently have cached in the DB.

  $available = _update_get_cached_available_releases();

  $num_avail = count($available);

  $projects = update_get_projects();

  foreach ($projects as $key => $project) {

    // If there's no data at all, we clearly need to fetch some.

    if (empty($available[$key])) {

      update_create_fetch_task($project);

      $needs_refresh = TRUE;

      continue;

    }

    // See if the .info file is newer than the last time we checked for data,

    // and if so, mark this project's data as needing to be re-fetched. Any

    // time an admin upgrades their local installation, the .info file will

    // be changed, so this is the only way we can be sure we're not showing

    // bogus information right after they upgrade.

    if ($project['info']['_info_file_ctime'] > $available[$key]['last_fetch']) {

      $available[$key]['fetch_status'] = UPDATE_FETCH_PENDING;

    }

    // If we have project data but no release data, we need to fetch. This

    // can be triggered when we fail to contact a release history server.

    if (empty($available[$key]['releases'])) {

      $available[$key]['fetch_status'] = UPDATE_FETCH_PENDING;

    }

    // If we think this project needs to fetch, actually create the task now

    // and remember that we think we're missing some data.

    if (!empty($available[$key]['fetch_status']) && $available[$key]['fetch_status'] == UPDATE_FETCH_PENDING) {

      update_create_fetch_task($project);

      $needs_refresh = TRUE;

    }

  }

  if ($needs_refresh && $refresh) {

    // Attempt to drain the queue of fetch tasks.

    update_fetch_data();

    // After processing the queue, we've (hopefully) got better data, so pull

    // the latest from the cache again and use that directly.

    $available = _update_get_cached_available_releases();

  }

  return $available;

}

/**

 * Creates a new fetch task after loading the necessary include file.

 *

 * @param $project

 *   Associative array of information about a project. See update_get_projects()

 *   for the keys used.

 *

 * @see _update_create_fetch_task()

 */

function update_create_fetch_task($project) {

  module_load_include('inc', 'update', 'update.fetch');

  return _update_create_fetch_task($project);

}

/**

 * Refreshes the release data after loading the necessary include file.

 *

 * @see _update_refresh()

 */

function update_refresh() {

  module_load_include('inc', 'update', 'update.fetch');

  return _update_refresh();

}

/**

 * Attempts to fetch update data after loading the necessary include file.

 *

 * @see _update_fetch_data()

 */

function update_fetch_data() {

  module_load_include('inc', 'update', 'update.fetch');

  return _update_fetch_data();

}

/**

 * Returns all currently cached data about available releases for all projects.

 *

 * @return

 *   Array of data about available releases, keyed by project shortname.

 */

function _update_get_cached_available_releases() {

  $data = array();

  $cache_items = _update_get_cache_multiple('available_releases');

  foreach ($cache_items as $cid => $cache) {

    $cache->data['last_fetch'] = $cache->created;

    if ($cache->expire < REQUEST_TIME) {

      $cache->data['fetch_status'] = UPDATE_FETCH_PENDING;

    }

    // The project shortname is embedded in the cache ID, even if there's no

    // data for this project in the DB at all, so use that for the indexes in

    // the array.

    $parts = explode('::', $cid, 2);

    $data[$parts[1]] = $cache->data;

  }

  return $data;

}

/**

 * Implements hook_mail().

 *

 * Constructs the e-mail notification message when the site is out of date.

 *

 * @param $key

 *   Unique key to indicate what message to build, always 'status_notify'.

 * @param $message

 *   Reference to the message array being built.

 * @param $params

 *   Array of parameters to indicate what kind of text to include in the message

 *   body. This is a keyed array of message type ('core' or 'contrib') as the

 *   keys, and the status reason constant (UPDATE_NOT_SECURE, etc) for the

 *   values.

 *

 * @see drupal_mail()

 * @see _update_cron_notify()

 * @see _update_message_text()

 */

function update_mail($key, &$message, $params) {

  $language = $message['language'];

  $langcode = $language->language;

  $message['subject'] .= t('New release(s) available for !site_name', array('!site_name' => variable_get('site_name', 'Drupal')), array('langcode' => $langcode));

  foreach ($params as $msg_type => $msg_reason) {

    $message['body'][] = _update_message_text($msg_type, $msg_reason, FALSE, $language);