Skip to content

Commit 0c595a6

Browse files
bcremerbcremer
committed
Merge remote-tracking branch 'origin/master' into next
2 parents e54ba85 + 8c979d0 commit 0c595a6

File tree

8 files changed

+198
-13
lines changed

8 files changed

+198
-13
lines changed

‎UPGRADE.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -398,6 +398,12 @@ In this document you will find a changelog of the important changes related to t
398398
* Enable and disable function of a plugin bootstrap can now return same parameter as install, uninstall.
399399
* Added automatic APC detection for the general cache.
400400

401+
## 4.3.6
402+
* Backport ESI security patch from Symfony Upstream (http://symfony.com/blog/cve-2015-2308-esi-code-injection).
403+
404+
## 4.3.5
405+
* Additional checks for the auto update module in preparation for Shopware 5.
406+
401407
## 4.3.3
402408
* The config option `showException` now only applies to frontend errors. Backend errors will always display the exception details.
403409
* New event `Shopware_Modules_Basket_AddArticle_CheckBasketForArticle` in class sBasket

‎engine/Shopware/Components/HttpCache/AppCache.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,10 +24,10 @@
2424

2525
namespace Shopware\Components\HttpCache;
2626

27+
use Symfony\Component\HttpKernel\HttpCache\Esi;
2728
use Symfony\Component\HttpKernel\HttpCache\StoreInterface;
2829
use Symfony\Component\HttpKernel\HttpKernelInterface;
2930
use Symfony\Component\HttpKernel\HttpCache\HttpCache;
30-
use Symfony\Component\HttpKernel\HttpCache\Esi;
3131
use Symfony\Component\HttpFoundation\Request;
3232
use Symfony\Component\HttpFoundation\Response;
3333

‎engine/Shopware/Plugins/Default/Backend/SwagUpdate/Components/Checks/IonCubeLoaderCheck.php‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@ public function canHandle($requirement)
6464
*/
6565
public function check($requirement)
6666
{
67-
$requiredVerson = $requirement['value'];
67+
$requiredVersion = $requirement['value'];
6868

6969
if (!extension_loaded('ionCube Loader')) {
7070
return null;
@@ -76,21 +76,21 @@ public function check($requirement)
7676
'errorLevel' => $requirement['level'],
7777
'message' => sprintf(
7878
$this->namespace->get('controller/check_ioncubeloaderversion_unknown'),
79-
$requiredVerson
79+
$requiredVersion
8080
)
8181
);
8282
}
8383

8484
$installedVersion = ioncube_loader_version();
8585

86-
$isValid = version_compare(strtolower($installedVersion), $requiredVerson, '>');
86+
$isValid = version_compare(strtolower($installedVersion), $requiredVersion, '>');
8787
if ($isValid) {
8888
return array(
8989
'type' => self::CHECK_TYPE,
9090
'errorLevel' => Validation::REQUIREMENT_VALID,
9191
'message' => sprintf(
9292
$this->namespace->get('controller/check_ioncubeloaderversion_success'),
93-
$requiredVerson,
93+
$requiredVersion,
9494
$installedVersion
9595
)
9696
);
@@ -100,7 +100,7 @@ public function check($requirement)
100100
'errorLevel' => $requirement['level'],
101101
'message' => sprintf(
102102
$this->namespace->get('check_ioncubeloaderversion_failure'),
103-
$requiredVerson,
103+
$requiredVersion,
104104
$installedVersion
105105
)
106106
);

‎engine/Shopware/Plugins/Default/Backend/SwagUpdate/Components/Checks/LicenseCheck.php‎

Lines changed: 171 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,171 @@
1+
<?php
2+
/**
3+
* Shopware 5
4+
* Copyright (c) shopware AG
5+
*
6+
* According to our dual licensing model, this program can be used either
7+
* under the terms of the GNU Affero General Public License, version 3,
8+
* or under a proprietary license.
9+
*
10+
* The texts of the GNU Affero General Public License with an additional
11+
* permission and of our proprietary license can be found at and
12+
* in the LICENSE file you have received along with this program.
13+
*
14+
* This program is distributed in the hope that it will be useful,
15+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
16+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17+
* GNU Affero General Public License for more details.
18+
*
19+
* "Shopware" is a registered trademark of shopware AG.
20+
* The licensing of the program under the AGPLv3 does not imply a
21+
* trademark license. Therefore any rights, title and interest in
22+
* our trademarks remain entirely with us.
23+
*/
24+
25+
namespace ShopwarePlugins\SwagUpdate\Components\Checks;
26+
27+
use Doctrine\DBAL\Connection;
28+
use ShopwarePlugins\SwagUpdate\Components\CheckInterface;
29+
use Enlight_Components_Snippet_Namespace as SnippetNamespace;
30+
use ShopwarePlugins\SwagUpdate\Components\Validation;
31+
32+
/**
33+
* @category Shopware
34+
* @package ShopwarePlugins\SwagUpdate\Components\Checks
35+
* @copyright Copyright (c) shopware AG (http://www.shopware.com)
36+
*/
37+
class LicenseCheck implements CheckInterface
38+
{
39+
const CHECK_TYPE = 'licensecheck';
40+
41+
/**
42+
* @var SnippetNamespace
43+
*/
44+
private $namespace;
45+
46+
/**
47+
* @var Connection
48+
*/
49+
private $connection;
50+
51+
/**
52+
* @var string
53+
*/
54+
private $shopwareVersion;
55+
56+
/**
57+
* @var string
58+
*/
59+
private $endpoint;
60+
61+
/**
62+
* @param Connection $connection
63+
* @param string $endpoint
64+
* @param string $shopwareVersion
65+
* @param SnippetNamespace $namespace
66+
*/
67+
public function __construct(Connection $connection, $endpoint, $shopwareVersion, SnippetNamespace $namespace)
68+
{
69+
$this->connection = $connection;
70+
$this->endpoint = $endpoint;
71+
$this->shopwareVersion = $shopwareVersion;
72+
$this->namespace = $namespace;
73+
}
74+
75+
/**
76+
* {@inheritdoc}
77+
*/
78+
public function canHandle($requirement)
79+
{
80+
return $requirement['type'] == self::CHECK_TYPE;
81+
}
82+
83+
/**
84+
* {@inheritdoc}
85+
*/
86+
public function check($requirement)
87+
{
88+
$licenseKeys = $requirement['value']['licenseKeys'];
89+
90+
if (empty($licenseKeys)) {
91+
return array(
92+
'type' => self::CHECK_TYPE,
93+
'errorLevel' => Validation::REQUIREMENT_WARNING,
94+
'message' => 'License check requested but no license key provided'
95+
);
96+
}
97+
$licenseData = $this->getLicenseData($licenseKeys);
98+
99+
if (empty($licenseData)) {
100+
return array(
101+
'type' => self::CHECK_TYPE,
102+
'errorLevel' => Validation::REQUIREMENT_VALID,
103+
'message' => $this->namespace->get('controller/check_license_nolicense')
104+
);
105+
}
106+
107+
$url = $this->endpoint.'/licenseupgrades/permission';
108+
$client = new \Zend_Http_Client(
109+
$url, array(
110+
'timeout' => 15
111+
)
112+
);
113+
114+
foreach ($licenseData as $licenseDatum) {
115+
$client->setParameterPost('domain', $licenseDatum['host']);
116+
$client->setParameterPost('licenseKey', $licenseDatum['license']);
117+
$client->setParameterPost('version', $this->shopwareVersion);
118+
119+
try {
120+
$response = $client->request(\Zend_Http_Client::POST);
121+
} catch (\Zend_Http_Client_Exception $e) {
122+
// Do not show exception to user if request times out
123+
return null;
124+
}
125+
126+
try {
127+
$body = $response->getBody();
128+
$json = \Zend_Json::decode($body, true);
129+
} catch (\Exception $e) {
130+
// Do not show exception to user if SBP returns an error
131+
return null;
132+
}
133+
134+
if ($json === true) {
135+
return array(
136+
'type' => self::CHECK_TYPE,
137+
'errorLevel' => Validation::REQUIREMENT_VALID,
138+
'message' => $this->namespace->get('controller/check_license_success')
139+
);
140+
}
141+
}
142+
143+
return array(
144+
'type' => self::CHECK_TYPE,
145+
'errorLevel' => $requirement['level'],
146+
'message' => $this->namespace->get('controller/check_license_failure')
147+
);
148+
}
149+
150+
/**
151+
* Returns existing license data for the provided keys
152+
*
153+
* @param array $licenseKeys
154+
* @return array
155+
*/
156+
private function getLicenseData($licenseKeys)
157+
{
158+
/** @var \Doctrine\DBAL\Query\QueryBuilder $queryBuilder */
159+
$queryBuilder = $this->connection->createQueryBuilder();
160+
$queryBuilder->select(array('host', 'license'))
161+
->from('s_core_licenses', 'license')
162+
->where('license.active = 1')
163+
->andWhere('license.module IN (:modules)')
164+
->setParameter(':modules', $licenseKeys, Connection::PARAM_INT_ARRAY);
165+
166+
$statement = $queryBuilder->execute();
167+
$licenseData = $statement->fetchAll();
168+
169+
return $licenseData;
170+
}
171+
}

‎engine/Shopware/Plugins/Default/Backend/SwagUpdate/Components/Checks/PHPExtensionCheck.php‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -63,18 +63,18 @@ public function canHandle($requirement)
6363
*/
6464
public function check($requirement)
6565
{
66-
$requiredExtesion = $requirement['value'];
66+
$requiredExtension = $requirement['value'];
6767

6868
$successMessage = $this->namespace->get('controller/check_phpextension_success');
6969
$failMessage = $this->namespace->get('controller/check_phpextension_failure');
7070

71-
if (extension_loaded($requiredExtesion)) {
71+
if (extension_loaded($requiredExtension)) {
7272
return array(
7373
'type' => self::CHECK_TYPE,
7474
'errorLevel' => Validation::REQUIREMENT_VALID,
7575
'message' => sprintf(
7676
$successMessage,
77-
$requiredExtesion
77+
$requiredExtension
7878
)
7979
);
8080
} else {
@@ -83,7 +83,7 @@ public function check($requirement)
8383
'errorLevel' => $requirement['level'],
8484
'message' => sprintf(
8585
$failMessage,
86-
$requiredExtesion
86+
$requiredExtension
8787
)
8888
);
8989
}

‎engine/Shopware/Plugins/Default/Backend/SwagUpdate/Controllers/Backend/SwagUpdate.php‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
use Psr\Log\LoggerInterface;
2626
use Shopware\Components\Random;
2727
use ShopwarePlugins\SwagUpdate\Components\Checks\IonCubeLoaderCheck;
28+
use ShopwarePlugins\SwagUpdate\Components\Checks\LicenseCheck;
2829
use ShopwarePlugins\SwagUpdate\Components\Checks\MySQLVersionCheck;
2930
use ShopwarePlugins\SwagUpdate\Components\Checks\PHPExtensionCheck;
3031
use ShopwarePlugins\SwagUpdate\Components\Checks\PHPVersionCheck;
@@ -123,6 +124,7 @@ public function requirementsAction()
123124
new PHPExtensionCheck($namespace),
124125
new WritableCheck($fileSystem, $namespace),
125126
new IonCubeLoaderCheck($namespace),
127+
new LicenseCheck($conn, $this->container->getParameter('shopware.store.apiEndpoint'), $this->getShopwareVersion(), $namespace)
126128
);
127129
$validation = new Validation($namespace, $checks);
128130

@@ -152,7 +154,7 @@ public function pluginsAction()
152154
/**
153155
* $this->View()->assign(array(
154156
* 'success' => false,
155-
* 'error' => 'Their are some problems. SORRY!!'
157+
* 'error' => 'There are some problems. SORRY!!'
156158
* ));
157159
*
158160
* $this->View()->assign(array(

‎engine/Shopware/Plugins/Default/Backend/SwagUpdate/Snippets/backend/swag_update/main.ini‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,9 @@ controller/check_ioncubeloaderversion_failure = "Minimum ionCube loader Version:
2222
controller/check_ioncubeloaderversion_unknown = "ionCube Loader Version could not be detected. Required Version: %s."
2323
controller/check_phpextension_success = "PHP Extension '%s' loaded."
2424
controller/check_phpextension_failure = "PHP Extension '%s' not loaded."
25+
controller/check_license_failure = "No active Shopware subscription could be found for your shop.<br>The automatic update cannot be performed.<br>You can purchase a Shopware Subscription in the <a target="_blank" href="https://account.shopware.com">Shopware account page</a>."
26+
controller/check_license_success = "You have a valid Shopware subscription."
27+
controller/check_license_nolicense = "You are using Shopware CE."
2528

2629
ftp/info_text = "The file permissions could not be fixed.<br><br>Please fix all file permission problems in the tab requirements.<br><br>Alternatively fill in your ftp credentials."
2730
ftp/label_password = "Password"
@@ -84,6 +87,9 @@ controller/check_ioncubeloaderversion_failure = "Erforderliche ionCube Loader Ve
8487
controller/check_ioncubeloaderversion_unknown = "ionCube Loader Version konnte nicht ermittelt werden. Erforderliche Version %s"
8588
controller/check_phpextension_success = "PHP Extension '%s' verfügbar."
8689
controller/check_phpextension_failure = "PHP Extension '%s' nicht verfügbar."
90+
controller/check_license_failure = "Für ihre eingesetzte Shopware Version konnte keine aktive Software-Subscription ermittelt werden.<br>Das Auto-Update kann aktuell nicht durchgeführt werden.<br>Eine Shopware Software-Subscription können Sie bequem über den <a href=“https://account.shopware.com“ target=“_blank“>Shopware Account buchen.</a>"
91+
controller/check_license_success = "Aktive Software-Subscription ermittelt"
92+
controller/check_license_nolicense = "Sie benutzen die Shopware CE."
8793

8894
ftp/info_text = "Die Dateirechte konnten nicht automatisch angepasst werden.<br><br>Bitte lösen Sie alle Dateirechte-Warnungen im Reiter Voraussetzungen (empfohlen). <br><br>Alternativ tragen Sie Ihre FTP Zugangsdaten ein."
8995
ftp/label_password = "Passwort"

‎recovery/install/src/Requirements.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -109,9 +109,9 @@ protected function getRuntimeValue($name)
109109
} elseif (function_exists($name)) {
110110
return true;
111111
} elseif (($value = ini_get($name)) !== null) {
112-
if (strtolower($value) == 'off' || $value == 0) {
112+
if (strtolower($value) == 'off' || (is_numeric($value) && $value == 0)) {
113113
return false;
114-
} elseif (strtolower($value) == 'on' || $value == 1) {
114+
} elseif (strtolower($value) == 'on' || (is_numeric($value) && $value == 1)) {
115115
return true;
116116
} else {
117117
return $value;

0 commit comments

Comments
 (0)