X-Git-Url: https://git.heureux-cyclage.org/?p=lhc%2Fweb%2Fwiklou.git;a=blobdiff_plain;f=maintenance%2Fupdate.php;h=2a1feb4603357c318699215d032c1b5e7d81793e;hp=ba66c766835f5bf4ce649ee30cf9cda2b0ca06c0;hb=a8408122fd7982ec1f6f380288c887298ba07045;hpb=1b13888ed6bd09731f10045650714a3392bb55df

diff --git a/maintenance/update.php b/maintenance/update.php
index ba66c76683..2a1feb4603 100755
--- a/maintenance/update.php
+++ b/maintenance/update.php
@@ -66,53 +66,54 @@ class UpdateMediaWiki extends Maintenance {
 
 		list( $pcreVersion ) = explode( ' ', PCRE_VERSION, 2 );
 		if ( version_compare( $pcreVersion, $minimumPcreVersion, '<' ) ) {
-			$this->error(
+			$this->fatalError(
 				"PCRE $minimumPcreVersion or later is required.\n" .
 				"Your PHP binary is linked with PCRE $pcreVersion.\n\n" .
 				"More information:\n" .
 				"https://www.mediawiki.org/wiki/Manual:Errors_and_symptoms/PCRE\n\n" .
-				"ABORTING.\n",
-				true );
+				"ABORTING.\n" );
 		}
 
 		$test = new PhpXmlBugTester();
 		if ( !$test->ok ) {
-			$this->error(
+			$this->fatalError(
 				"Your system has a combination of PHP and libxml2 versions that is buggy\n" .
 				"and can cause hidden data corruption in MediaWiki and other web apps.\n" .
 				"Upgrade to libxml2 2.7.3 or later.\n" .
-				"ABORTING (see https://bugs.php.net/bug.php?id=45996).\n",
-				true );
+				"ABORTING (see https://bugs.php.net/bug.php?id=45996).\n" );
 		}
 	}
 
 	function execute() {
-		global $wgVersion, $wgLang, $wgAllowSchemaUpdates;
+		global $wgVersion, $wgLang, $wgAllowSchemaUpdates, $wgMessagesDirs;
 
 		if ( !$wgAllowSchemaUpdates
 			&& !( $this->hasOption( 'force' )
 				|| $this->hasOption( 'schema' )
 				|| $this->hasOption( 'noschema' ) )
 		) {
-			$this->error( "Do not run update.php on this wiki. If you're seeing this you should\n"
+			$this->fatalError( "Do not run update.php on this wiki. If you're seeing this you should\n"
 				. "probably ask for some help in performing your schema updates or use\n"
 				. "the --noschema and --schema options to get an SQL file for someone\n"
 				. "else to inspect and run.\n\n"
-				. "If you know what you are doing, you can continue with --force\n", true );
+				. "If you know what you are doing, you can continue with --force\n" );
 		}
 
 		$this->fileHandle = null;
 		if ( substr( $this->getOption( 'schema' ), 0, 2 ) === "--" ) {
-			$this->error( "The --schema option requires a file as an argument.\n", true );
+			$this->fatalError( "The --schema option requires a file as an argument.\n" );
 		} elseif ( $this->hasOption( 'schema' ) ) {
 			$file = $this->getOption( 'schema' );
 			$this->fileHandle = fopen( $file, "w" );
 			if ( $this->fileHandle === false ) {
 				$err = error_get_last();
-				$this->error( "Problem opening the schema file for writing: $file\n\t{$err['message']}", true );
+				$this->fatalError( "Problem opening the schema file for writing: $file\n\t{$err['message']}" );
 			}
 		}
 
+		// T206765: We need to load the installer i18n files as some of errors come installer/updater code
+		$wgMessagesDirs['MediawikiInstaller'] = dirname( __DIR__ ) . '/includes/installer/i18n';
+
 		$lang = Language::factory( 'en' );
 		// Set global language to ensure localised errors are in English (T22633)
 		RequestContext::getMain()->setLanguage( $lang );
@@ -133,7 +134,7 @@ class UpdateMediaWiki extends Maintenance {
 
 		// Check external dependencies are up to date
 		if ( !$this->hasOption( 'skip-external-dependencies' ) ) {
-			$composerLockUpToDate = $this->runChild( 'CheckComposerLockUpToDate' );
+			$composerLockUpToDate = $this->runChild( CheckComposerLockUpToDate::class );
 			$composerLockUpToDate->execute();
 		} else {
 			$this->output(
@@ -152,7 +153,7 @@ class UpdateMediaWiki extends Maintenance {
 		if ( !$status->isOK() ) {
 			// This might output some wikitext like <strong> but it should be comprehensible
 			$text = $status->getWikiText();
-			$this->error( $text, 1 );
+			$this->fatalError( $text );
 		}
 
 		$this->output( "Going to run database updates for " . wfWikiID() . "\n" );
@@ -170,6 +171,24 @@ class UpdateMediaWiki extends Maintenance {
 
 		$time1 = microtime( true );
 
+		$badPhpUnit = dirname( __DIR__ ) . '/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php';
+		if ( file_exists( $badPhpUnit ) ) {
+			// Bad versions of the file are:
+			// https://raw.githubusercontent.com/sebastianbergmann/phpunit/c820f915bfae34e5a836f94967a2a5ea5ef34f21/src/Util/PHP/eval-stdin.php
+			// https://raw.githubusercontent.com/sebastianbergmann/phpunit/3aaddb1c5bd9b9b8d070b4cf120e71c36fd08412/src/Util/PHP/eval-stdin.php
+			$md5 = md5_file( $badPhpUnit );
+			if ( $md5 === '120ac49800671dc383b6f3709c25c099'
+				|| $md5 === '28af792cb38fc9a1b236b91c1aad2876'
+			) {
+				$success = unlink( $badPhpUnit );
+				if ( $success ) {
+					$this->output( "Removed PHPUnit eval-stdin.php to protect against CVE-2017-9841\n" );
+				} else {
+					$this->error( "Unable to remove $badPhpUnit, you should manually. See CVE-2017-9841" );
+				}
+			}
+		}
+
 		$shared = $this->hasOption( 'doshared' );
 
 		$updates = [ 'core', 'extensions' ];
@@ -217,13 +236,13 @@ class UpdateMediaWiki extends Maintenance {
 		# This needs to be disabled early since extensions will try to use the l10n
 		# cache from $wgExtensionFunctions (T22471)
 		$wgLocalisationCacheConf = [
-			'class' => 'LocalisationCache',
-			'storeClass' => 'LCStoreNull',
+			'class' => LocalisationCache::class,
+			'storeClass' => LCStoreNull::class,
 			'storeDirectory' => false,
 			'manualRecache' => false,
 		];
 	}
 }
 
-$maintClass = 'UpdateMediaWiki';
+$maintClass = UpdateMediaWiki::class;
 require_once RUN_MAINTENANCE_IF_MAIN;