shell: Optionally restrict commands' access with firejail
[lhc/web/wiklou.git] / includes / GitInfo.php
1 <?php
2 /**
3 * A class to help return information about a git repo MediaWiki may be inside
4 * This is used by Special:Version and is also useful for the LocalSettings.php
5 * of anyone working on large branches in git to setup config that show up only
6 * when specific branches are currently checked out.
7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License along
19 * with this program; if not, write to the Free Software Foundation, Inc.,
20 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
21 * http://www.gnu.org/copyleft/gpl.html
22 *
23 * @file
24 */
25
26 use MediaWiki\Shell\Shell;
27
28 class GitInfo {
29
30 /**
31 * Singleton for the repo at $IP
32 */
33 protected static $repo = null;
34
35 /**
36 * Location of the .git directory
37 */
38 protected $basedir;
39
40 /**
41 * Path to JSON cache file for pre-computed git information.
42 */
43 protected $cacheFile;
44
45 /**
46 * Cached git information.
47 */
48 protected $cache = [];
49
50 /**
51 * @var array|false Map of repo URLs to viewer URLs. Access via static method getViewers().
52 */
53 private static $viewers = false;
54
55 /**
56 * @param string $repoDir The root directory of the repo where .git can be found
57 * @param bool $usePrecomputed Use precomputed information if available
58 * @see precomputeValues
59 */
60 public function __construct( $repoDir, $usePrecomputed = true ) {
61 $this->cacheFile = self::getCacheFilePath( $repoDir );
62 wfDebugLog( 'gitinfo',
63 "Computed cacheFile={$this->cacheFile} for {$repoDir}"
64 );
65 if ( $usePrecomputed &&
66 $this->cacheFile !== null &&
67 is_readable( $this->cacheFile )
68 ) {
69 $this->cache = FormatJson::decode(
70 file_get_contents( $this->cacheFile ),
71 true
72 );
73 wfDebugLog( 'gitinfo', "Loaded git data from cache for {$repoDir}" );
74 }
75
76 if ( !$this->cacheIsComplete() ) {
77 wfDebugLog( 'gitinfo', "Cache incomplete for {$repoDir}" );
78 $this->basedir = $repoDir . DIRECTORY_SEPARATOR . '.git';
79 if ( is_readable( $this->basedir ) && !is_dir( $this->basedir ) ) {
80 $GITfile = file_get_contents( $this->basedir );
81 if ( strlen( $GITfile ) > 8 &&
82 substr( $GITfile, 0, 8 ) === 'gitdir: '
83 ) {
84 $path = rtrim( substr( $GITfile, 8 ), "\r\n" );
85 if ( $path[0] === '/' || substr( $path, 1, 1 ) === ':' ) {
86 // Path from GITfile is absolute
87 $this->basedir = $path;
88 } else {
89 $this->basedir = $repoDir . DIRECTORY_SEPARATOR . $path;
90 }
91 }
92 }
93 }
94 }
95
96 /**
97 * Compute the path to the cache file for a given directory.
98 *
99 * @param string $repoDir The root directory of the repo where .git can be found
100 * @return string Path to GitInfo cache file in $wgGitInfoCacheDirectory or
101 * fallback in the extension directory itself
102 * @since 1.24
103 */
104 protected static function getCacheFilePath( $repoDir ) {
105 global $IP, $wgGitInfoCacheDirectory;
106
107 if ( $wgGitInfoCacheDirectory ) {
108 // Convert both $IP and $repoDir to canonical paths to protect against
109 // $IP having changed between the settings files and runtime.
110 $realIP = realpath( $IP );
111 $repoName = realpath( $repoDir );
112 if ( $repoName === false ) {
113 // Unit tests use fake path names
114 $repoName = $repoDir;
115 }
116 if ( strpos( $repoName, $realIP ) === 0 ) {
117 // Strip $IP from path
118 $repoName = substr( $repoName, strlen( $realIP ) );
119 }
120 // Transform path to git repo to something we can safely embed in
121 // a filename
122 $repoName = strtr( $repoName, DIRECTORY_SEPARATOR, '-' );
123 $fileName = 'info' . $repoName . '.json';
124 $cachePath = "{$wgGitInfoCacheDirectory}/{$fileName}";
125 if ( is_readable( $cachePath ) ) {
126 return $cachePath;
127 }
128 }
129
130 return "$repoDir/gitinfo.json";
131 }
132
133 /**
134 * Get the singleton for the repo at $IP
135 *
136 * @return GitInfo
137 */
138 public static function repo() {
139 if ( is_null( self::$repo ) ) {
140 global $IP;
141 self::$repo = new self( $IP );
142 }
143 return self::$repo;
144 }
145
146 /**
147 * Check if a string looks like a hex encoded SHA1 hash
148 *
149 * @param string $str The string to check
150 * @return bool Whether or not the string looks like a SHA1
151 */
152 public static function isSHA1( $str ) {
153 return !!preg_match( '/^[0-9A-F]{40}$/i', $str );
154 }
155
156 /**
157 * Get the HEAD of the repo (without any opening "ref: ")
158 *
159 * @return string|bool The HEAD (git reference or SHA1) or false
160 */
161 public function getHead() {
162 if ( !isset( $this->cache['head'] ) ) {
163 $headFile = "{$this->basedir}/HEAD";
164 $head = false;
165
166 if ( is_readable( $headFile ) ) {
167 $head = file_get_contents( $headFile );
168
169 if ( preg_match( "/ref: (.*)/", $head, $m ) ) {
170 $head = rtrim( $m[1] );
171 } else {
172 $head = rtrim( $head );
173 }
174 }
175 $this->cache['head'] = $head;
176 }
177 return $this->cache['head'];
178 }
179
180 /**
181 * Get the SHA1 for the current HEAD of the repo
182 *
183 * @return string|bool A SHA1 or false
184 */
185 public function getHeadSHA1() {
186 if ( !isset( $this->cache['headSHA1'] ) ) {
187 $head = $this->getHead();
188 $sha1 = false;
189
190 // If detached HEAD may be a SHA1
191 if ( self::isSHA1( $head ) ) {
192 $sha1 = $head;
193 } else {
194 // If not a SHA1 it may be a ref:
195 $refFile = "{$this->basedir}/{$head}";
196 $packedRefs = "{$this->basedir}/packed-refs";
197 $headRegex = preg_quote( $head, '/' );
198 if ( is_readable( $refFile ) ) {
199 $sha1 = rtrim( file_get_contents( $refFile ) );
200 } elseif ( is_readable( $packedRefs ) &&
201 preg_match( "/^([0-9A-Fa-f]{40}) $headRegex$/m", file_get_contents( $packedRefs ), $matches )
202 ) {
203 $sha1 = $matches[1];
204 }
205 }
206 $this->cache['headSHA1'] = $sha1;
207 }
208 return $this->cache['headSHA1'];
209 }
210
211 /**
212 * Get the commit date of HEAD entry of the git code repository
213 *
214 * @since 1.22
215 * @return int|bool Commit date (UNIX timestamp) or false
216 */
217 public function getHeadCommitDate() {
218 global $wgGitBin;
219
220 if ( !isset( $this->cache['headCommitDate'] ) ) {
221 $date = false;
222 if ( is_file( $wgGitBin ) &&
223 is_executable( $wgGitBin ) &&
224 $this->getHead() !== false
225 ) {
226 $cmd = [
227 $wgGitBin,
228 'show',
229 '-s',
230 '--format=format:%ct',
231 'HEAD',
232 ];
233 $result = Shell::command( $cmd )
234 ->environment( [ 'GIT_DIR' => $this->basedir ] )
235 ->restrict( Shell::RESTRICT_DEFAULT | Shell::NO_NETWORK )
236 ->whitelistPaths( [ $this->basedir ] )
237 ->execute();
238
239 if ( $result->getExitCode() === 0 ) {
240 $date = (int)$result->getStdout();
241 }
242 }
243 $this->cache['headCommitDate'] = $date;
244 }
245 return $this->cache['headCommitDate'];
246 }
247
248 /**
249 * Get the name of the current branch, or HEAD if not found
250 *
251 * @return string|bool The branch name, HEAD, or false
252 */
253 public function getCurrentBranch() {
254 if ( !isset( $this->cache['branch'] ) ) {
255 $branch = $this->getHead();
256 if ( $branch &&
257 preg_match( "#^refs/heads/(.*)$#", $branch, $m )
258 ) {
259 $branch = $m[1];
260 }
261 $this->cache['branch'] = $branch;
262 }
263 return $this->cache['branch'];
264 }
265
266 /**
267 * Get an URL to a web viewer link to the HEAD revision.
268 *
269 * @return string|bool String if a URL is available or false otherwise
270 */
271 public function getHeadViewUrl() {
272 $url = $this->getRemoteUrl();
273 if ( $url === false ) {
274 return false;
275 }
276 foreach ( self::getViewers() as $repo => $viewer ) {
277 $pattern = '#^' . $repo . '$#';
278 if ( preg_match( $pattern, $url, $matches ) ) {
279 $viewerUrl = preg_replace( $pattern, $viewer, $url );
280 $headSHA1 = $this->getHeadSHA1();
281 $replacements = [
282 '%h' => substr( $headSHA1, 0, 7 ),
283 '%H' => $headSHA1,
284 '%r' => urlencode( $matches[1] ),
285 '%R' => $matches[1],
286 ];
287 return strtr( $viewerUrl, $replacements );
288 }
289 }
290 return false;
291 }
292
293 /**
294 * Get the URL of the remote origin.
295 * @return string|bool String if a URL is available or false otherwise.
296 */
297 protected function getRemoteUrl() {
298 if ( !isset( $this->cache['remoteURL'] ) ) {
299 $config = "{$this->basedir}/config";
300 $url = false;
301 if ( is_readable( $config ) ) {
302 MediaWiki\suppressWarnings();
303 $configArray = parse_ini_file( $config, true );
304 MediaWiki\restoreWarnings();
305 $remote = false;
306
307 // Use the "origin" remote repo if available or any other repo if not.
308 if ( isset( $configArray['remote origin'] ) ) {
309 $remote = $configArray['remote origin'];
310 } elseif ( is_array( $configArray ) ) {
311 foreach ( $configArray as $sectionName => $sectionConf ) {
312 if ( substr( $sectionName, 0, 6 ) == 'remote' ) {
313 $remote = $sectionConf;
314 }
315 }
316 }
317
318 if ( $remote !== false && isset( $remote['url'] ) ) {
319 $url = $remote['url'];
320 }
321 }
322 $this->cache['remoteURL'] = $url;
323 }
324 return $this->cache['remoteURL'];
325 }
326
327 /**
328 * Check to see if the current cache is fully populated.
329 *
330 * Note: This method is public only to make unit testing easier. There's
331 * really no strong reason that anything other than a test should want to
332 * call this method.
333 *
334 * @return bool True if all expected cache keys exist, false otherwise
335 */
336 public function cacheIsComplete() {
337 return isset( $this->cache['head'] ) &&
338 isset( $this->cache['headSHA1'] ) &&
339 isset( $this->cache['headCommitDate'] ) &&
340 isset( $this->cache['branch'] ) &&
341 isset( $this->cache['remoteURL'] );
342 }
343
344 /**
345 * Precompute and cache git information.
346 *
347 * Creates a JSON file in the cache directory associated with this
348 * GitInfo instance. This cache file will be used by subsequent GitInfo objects referencing
349 * the same directory to avoid needing to examine the .git directory again.
350 *
351 * @since 1.24
352 */
353 public function precomputeValues() {
354 if ( $this->cacheFile !== null ) {
355 // Try to completely populate the cache
356 $this->getHead();
357 $this->getHeadSHA1();
358 $this->getHeadCommitDate();
359 $this->getCurrentBranch();
360 $this->getRemoteUrl();
361
362 if ( !$this->cacheIsComplete() ) {
363 wfDebugLog( 'gitinfo',
364 "Failed to compute GitInfo for \"{$this->basedir}\""
365 );
366 return;
367 }
368
369 $cacheDir = dirname( $this->cacheFile );
370 if ( !file_exists( $cacheDir ) &&
371 !wfMkdirParents( $cacheDir, null, __METHOD__ )
372 ) {
373 throw new MWException( "Unable to create GitInfo cache \"{$cacheDir}\"" );
374 }
375
376 file_put_contents( $this->cacheFile, FormatJson::encode( $this->cache ) );
377 }
378 }
379
380 /**
381 * @see self::getHeadSHA1
382 * @return string
383 */
384 public static function headSHA1() {
385 return self::repo()->getHeadSHA1();
386 }
387
388 /**
389 * @see self::getCurrentBranch
390 * @return string
391 */
392 public static function currentBranch() {
393 return self::repo()->getCurrentBranch();
394 }
395
396 /**
397 * @see self::getHeadViewUrl()
398 * @return bool|string
399 */
400 public static function headViewUrl() {
401 return self::repo()->getHeadViewUrl();
402 }
403
404 /**
405 * Gets the list of repository viewers
406 * @return array
407 */
408 protected static function getViewers() {
409 global $wgGitRepositoryViewers;
410
411 if ( self::$viewers === false ) {
412 self::$viewers = $wgGitRepositoryViewers;
413 Hooks::run( 'GitViewers', [ &self::$viewers ] );
414 }
415
416 return self::$viewers;
417 }
418 }