modules/Administration/UpgradeAccess.php

   1 <?php
   2 if(!defined('sugarEntry') || !sugarEntry) die('Not A Valid Entry Point');
   3 /*********************************************************************************
   4  * SugarCRM is a customer relationship management program developed by
   5  * SugarCRM, Inc. Copyright (C) 2004-2011 SugarCRM Inc.
   6  *
   7  * This program is free software; you can redistribute it and/or modify it under
   8  * the terms of the GNU Affero General Public License version 3 as published by the
   9  * Free Software Foundation with the addition of the following permission added
  10  * to Section 15 as permitted in Section 7(a): FOR ANY PART OF THE COVERED WORK
  11  * IN WHICH THE COPYRIGHT IS OWNED BY SUGARCRM, SUGARCRM DISCLAIMS THE WARRANTY
  12  * OF NON INFRINGEMENT OF THIRD PARTY RIGHTS.
  13  *
  14  * This program is distributed in the hope that it will be useful, but WITHOUT
  15  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
  16  * FOR A PARTICULAR PURPOSE.  See the GNU Affero General Public License for more
  17  * details.
  18  *
  19  * You should have received a copy of the GNU Affero General Public License along with
  20  * this program; if not, see http://www.gnu.org/licenses or write to the Free
  21  * Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
  22  * 02110-1301 USA.
  23  *
  24  * You can contact SugarCRM, Inc. headquarters at 10050 North Wolfe Road,
  25  * SW2-130, Cupertino, CA 95014, USA. or at email address contact@sugarcrm.com.
  26  *
  27  * The interactive user interfaces in modified source and object code versions
  28  * of this program must display Appropriate Legal Notices, as required under
  29  * Section 5 of the GNU Affero General Public License version 3.
  30  *
  31  * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
  32  * these Appropriate Legal Notices must retain the display of the "Powered by
  33  * SugarCRM" logo. If the display of the logo is not reasonably feasible for
  34  * technical reasons, the Appropriate Legal Notices must display the words
  35  * "Powered by SugarCRM".
  36  ********************************************************************************/
  37
  38
  39
  40
  41 global $mod_strings;
  42 global $sugar_config;
  43
  44 $ignoreCase = (substr_count(strtolower($_SERVER['SERVER_SOFTWARE']), 'apache/2') > 0)?'(?i)':'';
  45 $htaccess_file   = getcwd() . "/.htaccess";
  46 $contents = '';
  47 $restrict_str = <<<EOQ
  48
  49 # BEGIN SUGARCRM RESTRICTIONS
  50 RedirectMatch 403 {$ignoreCase}.*\.log$
  51 RedirectMatch 403 {$ignoreCase}/+not_imported_.*\.txt
  52 RedirectMatch 403 {$ignoreCase}/+(soap|cache|xtemplate|data|examples|include|log4php|metadata|modules)/+.*\.(php|tpl)
  53 RedirectMatch 403 {$ignoreCase}/+emailmandelivery\.php
  54 RedirectMatch 403 {$ignoreCase}/+cache/+upload
  55 RedirectMatch 403 {$ignoreCase}/+cache/+diagnostic
  56 RedirectMatch 403 {$ignoreCase}/+files\.md5$
  57 # END SUGARCRM RESTRICTIONS
  58 EOQ;
  59
  60 if(file_exists($htaccess_file)){
  61     $fp = fopen($htaccess_file, 'r');
  62     $skip = false;
  63     while($line = fgets($fp)){
  64
  65         if(preg_match("/\s*#\s*BEGIN\s*SUGARCRM\s*RESTRICTIONS/i", $line))$skip = true;
  66         if(!$skip)$contents .= $line;
  67         if(preg_match("/\s*#\s*END\s*SUGARCRM\s*RESTRICTIONS/i", $line))$skip = false;
  68     }
  69 }
  70 $status =  file_put_contents($htaccess_file, $contents . $restrict_str);
  71 if( !$status ){
  72     echo '<p>' . $mod_strings['LBL_HT_NO_WRITE'] . '<span class=stop>$htaccess_file</span></p>\n';
  73     echo '<p>' . $mod_strings['LBL_HT_NO_WRITE_2'] . '</p>\n';
  74     echo "$redirect_str";
  75 }
  76
  77
  78 // cn: bug 9365 - security for filesystem
  79 $uploadDir='';
  80 $uploadHta='';
  81
  82 if (empty($GLOBALS['sugar_config']['upload_dir'])) {
  83     $GLOBALS['sugar_config']['upload_dir']='cache/upload/';
  84 }
  85 $uploadDir = getcwd()."/".$sugar_config['upload_dir'];
  86 if(file_exists($uploadDir)){
  87         $uploadHta = $uploadDir.".htaccess";
  88 }
  89 else{
  90         mkdir_recursive($uploadDir);
  91         if(is_dir($uploadDir)){
  92                 $uploadHta = $uploadDir.".htaccess";
  93         }
  94 }
  95
  96 $denyAll =<<<eoq
  97 <Directory>
  98         Order Deny,Allow
  99         Deny from all
 100 </Directory>
 101 eoq;
 102
 103 if(file_exists($uploadHta) && filesize($uploadHta)) {
 104         // file exists, parse to make sure it is current
 105         if(is_writable($uploadHta) && ($fpUploadHta = @sugar_fopen($uploadHta, "r+"))) {
 106                 $oldHtaccess = fread($fpUploadHta, filesize($uploadHta));
 107                 // use a different regex boundary b/c .htaccess uses the typicals
 108                 if(!preg_match("=".$denyAll."=", $oldHtaccess)) {
 109                         $oldHtaccess .= $denyAll;
 110                 }
 111
 112                 rewind($fpUploadHta);
 113                 fwrite($fpUploadHta, $oldHtaccess);
 114                 ftruncate($fpUploadHta, ftell($fpUploadHta));
 115                 fclose($fpUploadHta);
 116         } else {
 117                 $htaccess_failed = true;
 118         }
 119 } else {
 120         // no .htaccess yet, create a fill
 121         if($fpUploadHta = @sugar_fopen($uploadHta, "w")) {
 122                 fputs($fpUploadHta, $denyAll);
 123                 fclose($fpUploadHta);
 124         } else {
 125                 $htaccess_failed = true;
 126         }
 127 }
 128
 129
 130
 131
 132 include('modules/Versions/ExpectedVersions.php');
 133
 134
 135 global $expect_versions;
 136
 137 if (isset($expect_versions['htaccess'])) {
 138         $version = new Version();
 139         $version->retrieve_by_string_fields(array('name'=>'htaccess'));
 140
 141         $version->name = $expect_versions['htaccess']['name'];
 142         $version->file_version = $expect_versions['htaccess']['file_version'];
 143         $version->db_version = $expect_versions['htaccess']['db_version'];
 144         $version->save();
 145 }
 146
 147 /* Commenting out as this shows on upgrade screen
 148  * echo "\n" . $mod_strings['LBL_HT_DONE']. "<br />\n";
 149 */
 150
 151 ?>