Merge "Fix sessionfailure i18n message during authentication"

[lhc/web/wiklou.git] / maintenance / update.php

diff --git a/maintenance/update.php b/maintenance/update.php
index 5e2947b..c780b6a 100755 (executable)
--- a/maintenance/update.php
+++ b/maintenance/update.php
@@ -66,23 +66,21 @@ class UpdateMediaWiki extends Maintenance {
 
                list( $pcreVersion ) = explode( ' ', PCRE_VERSION, 2 );
                if ( version_compare( $pcreVersion, $minimumPcreVersion, '<' ) ) {
-                       $this->error(
+                       $this->fatalError(
                                "PCRE $minimumPcreVersion or later is required.\n" .
                                "Your PHP binary is linked with PCRE $pcreVersion.\n\n" .
                                "More information:\n" .
                                "https://www.mediawiki.org/wiki/Manual:Errors_and_symptoms/PCRE\n\n" .
-                               "ABORTING.\n",
-                               true );
+                               "ABORTING.\n" );
                }
 
                $test = new PhpXmlBugTester();
                if ( !$test->ok ) {
-                       $this->error(
+                       $this->fatalError(
                                "Your system has a combination of PHP and libxml2 versions that is buggy\n" .
                                "and can cause hidden data corruption in MediaWiki and other web apps.\n" .
                                "Upgrade to libxml2 2.7.3 or later.\n" .
-                               "ABORTING (see https://bugs.php.net/bug.php?id=45996).\n",
-                               true );
+                               "ABORTING (see https://bugs.php.net/bug.php?id=45996).\n" );
                }
        }
 
@@ -94,22 +92,22 @@ class UpdateMediaWiki extends Maintenance {
                                || $this->hasOption( 'schema' )
                                || $this->hasOption( 'noschema' ) )
                ) {
-                       $this->error( "Do not run update.php on this wiki. If you're seeing this you should\n"
+                       $this->fatalError( "Do not run update.php on this wiki. If you're seeing this you should\n"
                                . "probably ask for some help in performing your schema updates or use\n"
                                . "the --noschema and --schema options to get an SQL file for someone\n"
                                . "else to inspect and run.\n\n"
-                               . "If you know what you are doing, you can continue with --force\n", true );
+                               . "If you know what you are doing, you can continue with --force\n" );
                }
 
                $this->fileHandle = null;
                if ( substr( $this->getOption( 'schema' ), 0, 2 ) === "--" ) {
-                       $this->error( "The --schema option requires a file as an argument.\n", true );
+                       $this->fatalError( "The --schema option requires a file as an argument.\n" );
                } elseif ( $this->hasOption( 'schema' ) ) {
                        $file = $this->getOption( 'schema' );
                        $this->fileHandle = fopen( $file, "w" );
                        if ( $this->fileHandle === false ) {
                                $err = error_get_last();
-                               $this->error( "Problem opening the schema file for writing: $file\n\t{$err['message']}", true );
+                               $this->fatalError( "Problem opening the schema file for writing: $file\n\t{$err['message']}" );
                        }
                }
 
@@ -133,7 +131,7 @@ class UpdateMediaWiki extends Maintenance {
 
                // Check external dependencies are up to date
                if ( !$this->hasOption( 'skip-external-dependencies' ) ) {
-                       $composerLockUpToDate = $this->runChild( 'CheckComposerLockUpToDate' );
+                       $composerLockUpToDate = $this->runChild( CheckComposerLockUpToDate::class );
                        $composerLockUpToDate->execute();
                } else {
                        $this->output(
@@ -145,6 +143,16 @@ class UpdateMediaWiki extends Maintenance {
                # This will vomit up an error if there are permissions problems
                $db = $this->getDB( DB_MASTER );
 
+               # Check to see whether the database server meets the minimum requirements
+               /** @var DatabaseInstaller $dbInstallerClass */
+               $dbInstallerClass = Installer::getDBInstallerClass( $db->getType() );
+               $status = $dbInstallerClass::meetsMinimumRequirement( $db->getServerVersion() );
+               if ( !$status->isOK() ) {
+                       // This might output some wikitext like <strong> but it should be comprehensible
+                       $text = $status->getWikiText();
+                       $this->fatalError( $text );
+               }
+
                $this->output( "Going to run database updates for " . wfWikiID() . "\n" );
                if ( $db->getType() === 'sqlite' ) {
                        /** @var IMaintainableDatabase|DatabaseSqlite $db */
@@ -160,6 +168,24 @@ class UpdateMediaWiki extends Maintenance {
 
                $time1 = microtime( true );
 
+               $badPhpUnit = dirname( __DIR__ ) . '/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php';
+               if ( file_exists( $badPhpUnit ) ) {
+                       // Bad versions of the file are:
+                       // https://raw.githubusercontent.com/sebastianbergmann/phpunit/c820f915bfae34e5a836f94967a2a5ea5ef34f21/src/Util/PHP/eval-stdin.php
+                       // https://raw.githubusercontent.com/sebastianbergmann/phpunit/3aaddb1c5bd9b9b8d070b4cf120e71c36fd08412/src/Util/PHP/eval-stdin.php
+                       $md5 = md5_file( $badPhpUnit );
+                       if ( $md5 === '120ac49800671dc383b6f3709c25c099'
+                               || $md5 === '28af792cb38fc9a1b236b91c1aad2876'
+                       ) {
+                               $success = unlink( $badPhpUnit );
+                               if ( $success ) {
+                                       $this->output( "Removed PHPUnit eval-stdin.php to protect against CVE-2017-9841\n" );
+                               } else {
+                                       $this->error( "Unable to remove $badPhpUnit, you should manually. See CVE-2017-9841" );
+                               }
+                       }
+               }
+
                $shared = $this->hasOption( 'doshared' );
 
                $updates = [ 'core', 'extensions' ];
@@ -207,13 +233,13 @@ class UpdateMediaWiki extends Maintenance {
                # This needs to be disabled early since extensions will try to use the l10n
                # cache from $wgExtensionFunctions (T22471)
                $wgLocalisationCacheConf = [
-                       'class' => 'LocalisationCache',
-                       'storeClass' => 'LCStoreNull',
+                       'class' => LocalisationCache::class,
+                       'storeClass' => LCStoreNull::class,
                        'storeDirectory' => false,
                        'manualRecache' => false,
                ];
        }
 }
 
-$maintClass = 'UpdateMediaWiki';
+$maintClass = UpdateMediaWiki::class;
 require_once RUN_MAINTENANCE_IF_MAIN;