5 * Administrative script for running authorized file operations.
7 * Using this script, the site owner (the user actually owning the files on the
8 * webserver) can authorize certain file-related operations to proceed with
9 * elevated privileges, for example to deploy and upgrade modules or themes.
10 * Users should not visit this page directly, but instead use an administrative
11 * user interface which knows how to redirect the user to this script as part of
12 * a multistep process. This script actually performs the selected operations
13 * without loading all of Drupal, to be able to more gracefully recover from
14 * errors. Access to the script is controlled by a global killswitch in
15 * settings.php ('allow_authorize_operations') and via the 'administer software
16 * updates' permission.
18 * There are helper functions for setting up an operation to run via this
19 * system in modules/system/system.module. For more information, see:
20 * @link authorize Authorized operation helper functions @endlink
23 use Drupal\Core\DrupalKernel;
24 use Drupal\Core\Form\EnforcedResponseException;
26 use Symfony\Component\HttpKernel\Exception\HttpExceptionInterface;
27 use Symfony\Component\HttpFoundation\Request;
28 use Symfony\Component\HttpFoundation\Response;
29 use Drupal\Core\Site\Settings;
31 // Change the directory to the Drupal root.
34 $autoloader = require_once 'autoload.php';
37 * Global flag to identify update.php and authorize.php runs.
39 * Identifies update.php and authorize.php runs, avoiding unwanted operations
40 * such as css/js preprocessing and translation, and solves some theming issues.
41 * The flag is checked in other places in Drupal code (not just authorize.php).
43 const MAINTENANCE_MODE = 'update';
46 * Determines if the current user is allowed to run authorize.php.
48 * The killswitch in settings.php overrides all else, otherwise, the user must
49 * have access to the 'administer software updates' permission.
51 * @param \Symfony\Component\HttpFoundation\Request $request
52 * The incoming request.
55 * TRUE if the current user can run authorize.php, and FALSE if not.
57 function authorize_access_allowed(Request $request) {
58 $account = \Drupal::service('authentication')->authenticate($request);
60 \Drupal::currentUser()->setAccount($account);
62 return Settings::get('allow_authorize_operations', TRUE) && \Drupal::currentUser()->hasPermission('administer software updates');
66 $request = Request::createFromGlobals();
67 $kernel = DrupalKernel::createFromRequest($request, $autoloader, 'prod');
68 $kernel->prepareLegacyRequest($request);
70 catch (HttpExceptionInterface $e) {
71 $response = new Response('', $e->getStatusCode());
72 $response->prepare($request)->send();
76 // We have to enable the user and system modules, even to check access and
77 // display errors via the maintenance theme.
78 \Drupal::moduleHandler()->addModule('system', 'core/modules/system');
79 \Drupal::moduleHandler()->addModule('user', 'core/modules/user');
80 \Drupal::moduleHandler()->load('system');
81 \Drupal::moduleHandler()->load('user');
83 // Initialize the maintenance theme for this administrative script.
84 drupal_maintenance_theme();
87 $show_messages = TRUE;
89 $is_allowed = authorize_access_allowed($request);
93 // Load both the Form API and Batch API.
94 require_once __DIR__ . '/includes/form.inc';
95 require_once __DIR__ . '/includes/batch.inc';
97 if (isset($_SESSION['authorize_page_title'])) {
98 $page_title = $_SESSION['authorize_page_title'];
101 $page_title = t('Authorize file system changes');
104 // See if we've run the operation and need to display a report.
105 if (isset($_SESSION['authorize_results']) && $results = $_SESSION['authorize_results']) {
107 // Clear the session out.
108 unset($_SESSION['authorize_results']);
109 unset($_SESSION['authorize_operation']);
110 unset($_SESSION['authorize_filetransfer_info']);
112 if (!empty($results['page_title'])) {
113 $page_title = $results['page_title'];
115 if (!empty($results['page_message'])) {
116 drupal_set_message($results['page_message']['message'], $results['page_message']['type']);
119 $content['authorize_report'] = [
120 '#theme' => 'authorize_report',
121 '#messages' => $results['messages'],
124 if (is_array($results['tasks'])) {
125 $links = $results['tasks'];
128 // Since this is being called outsite of the primary front controller,
129 // the base_url needs to be set explicitly to ensure that links are
130 // relative to the site root.
131 // @todo Simplify with https://www.drupal.org/node/2548095
136 'base_url' => $GLOBALS['base_url'],
141 '#url' => Url::fromRoute('system.admin'),
142 '#title' => t('Administration pages'),
145 '#url' => Url::fromRoute('<front>'),
146 '#title' => t('Front page'),
151 $content['next_steps'] = [
152 '#theme' => 'item_list',
154 '#title' => t('Next steps'),
157 // If a batch is running, let it run.
158 elseif ($request->query->has('batch')) {
159 $content = _batch_page($request);
160 // If _batch_page() returns a response object (likely a JsonResponse for
161 // JavaScript-based batch processing), send it immediately.
162 if ($content instanceof Response) {
168 if (empty($_SESSION['authorize_operation']) || empty($_SESSION['authorize_filetransfer_info'])) {
169 $content = ['#markup' => t('It appears you have reached this page in error.')];
171 elseif (!$batch = batch_get()) {
172 // We have a batch to process, show the filetransfer form.
174 $content = \Drupal::formBuilder()->getForm('Drupal\Core\FileTransfer\Form\FileTransferAuthorizeForm');
176 catch (EnforcedResponseException $e) {
177 $e->getResponse()->send();
182 // We defer the display of messages until all operations are done.
183 $show_messages = !(($batch = batch_get()) && isset($batch['running']));
186 \Drupal::logger('access denied')->warning('authorize.php');
187 $page_title = t('Access denied');
188 $content = ['#markup' => t('You are not allowed to access this page.')];
191 $bare_html_page_renderer = \Drupal::service('bare_html_page_renderer');
192 $response = $bare_html_page_renderer->renderBarePage($content, $page_title, 'maintenance_page', [
193 '#show_messages' => $show_messages,
196 $response->setStatusCode(403);