Medowar
/
psa-orderform


			
				
					
						
						
							123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220
							<?php

declare(strict_types=1);

$baseDir = __DIR__;
$configFile = $baseDir . "/config.php";
$manifestFile = $baseDir . "/manifest.json";
$packagesDir = $baseDir . "/packages";

if (is_file($configFile)) {
    require_once $configFile;
}

require_once $baseDir . "/includes/update-server.php";

if (session_status() === PHP_SESSION_NONE) {
    ini_set("session.use_strict_mode", "1");
    ini_set("session.cookie_httponly", "1");
    ini_set("session.cookie_samesite", "Lax");
    session_start();
}

$messages = [];
$errors = [];

function updateManageEscape($value): string
{
    return htmlspecialchars((string) $value, ENT_QUOTES, "UTF-8");
}

function updateManagePasswordConfigured(): bool
{
    return defined("UPDATE_SERVER_PASSWORD_HASH") || defined("UPDATE_SERVER_PASSWORD");
}

function updateManagePasswordMatches(string $password): bool
{
    if (defined("UPDATE_SERVER_PASSWORD_HASH")) {
        return password_verify($password, (string) UPDATE_SERVER_PASSWORD_HASH);
    }

    if (defined("UPDATE_SERVER_PASSWORD")) {
        return hash_equals((string) UPDATE_SERVER_PASSWORD, $password);
    }

    return false;
}

function updateManageIsLoggedIn(): bool
{
    return !empty($_SESSION["update_server_logged_in"]);
}

function updateManageCsrfToken(): string
{
    if (empty($_SESSION["update_server_csrf_token"])) {
        $_SESSION["update_server_csrf_token"] = bin2hex(random_bytes(32));
    }

    return $_SESSION["update_server_csrf_token"];
}

function updateManageCsrfIsValid(string $token): bool
{
    return !empty($_SESSION["update_server_csrf_token"]) &&
        hash_equals($_SESSION["update_server_csrf_token"], $token);
}

if ($_SERVER["REQUEST_METHOD"] === "POST") {
    $action = (string) ($_POST["action"] ?? "");

    if ($action === "login") {
        if (!updateManagePasswordConfigured()) {
            $errors[] = "No password is configured.";
        } elseif (updateManagePasswordMatches((string) ($_POST["password"] ?? ""))) {
            session_regenerate_id(true);
            $_SESSION["update_server_logged_in"] = true;
            $messages[] = "Logged in.";
        } else {
            $errors[] = "Wrong password.";
        }
    } elseif ($action === "logout") {
        unset($_SESSION["update_server_logged_in"], $_SESSION["update_server_csrf_token"]);
        $messages[] = "Logged out.";
    } elseif (!updateManageIsLoggedIn()) {
        $errors[] = "Login required.";
    } elseif (!updateManageCsrfIsValid((string) ($_POST["csrf_token"] ?? ""))) {
        $errors[] = "Invalid token. Please reload the page and try again.";
    } else {
        try {
            if ($action === "upload") {
                updateServerPublishUpload(
                    trim((string) ($_POST["version"] ?? "")),
                    $_FILES["package"] ?? [],
                    $manifestFile,
                    $packagesDir,
                );
                $messages[] = "Release uploaded and published.";
            } elseif ($action === "set_latest") {
                updateServerSetLatest(trim((string) ($_POST["version"] ?? "")), $manifestFile);
                $messages[] = "Latest release updated.";
            } elseif ($action === "delete") {
                updateServerDeleteRelease(trim((string) ($_POST["version"] ?? "")), $manifestFile, $baseDir);
                $messages[] = "Release deleted.";
            }
        } catch (Throwable $exception) {
            $errors[] = $exception->getMessage();
        }
    }
}

try {
    $manifest = updateServerReadManifest($manifestFile, true);
} catch (Throwable $exception) {
    $manifest = ["latest" => "", "releases" => []];
    $errors[] = $exception->getMessage();
}

$releases = $manifest["releases"];
krsort($releases);

?>
<!DOCTYPE html>
<html lang="de">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Update Management</title>
</head>
<body>
    <h1>Update Management</h1>

    <?php foreach ($messages as $message): ?>
        <p><strong><?php echo updateManageEscape($message); ?></strong></p>
    <?php endforeach; ?>

    <?php foreach ($errors as $error): ?>
        <p><strong>Error:</strong> <?php echo updateManageEscape($error); ?></p>
    <?php endforeach; ?>

    <?php if (!updateManageIsLoggedIn()): ?>
        <form method="POST">
            <input type="hidden" name="action" value="login">
            <p>
                <label for="password">Password</label><br>
                <input type="password" id="password" name="password" required>
            </p>
            <button type="submit">Login</button>
        </form>
    <?php else: ?>
        <form method="POST">
            <input type="hidden" name="action" value="logout">
            <button type="submit">Logout</button>
        </form>

        <h2>Upload release</h2>
        <form method="POST" enctype="multipart/form-data">
            <input type="hidden" name="action" value="upload">
            <input type="hidden" name="csrf_token" value="<?php echo updateManageEscape(updateManageCsrfToken()); ?>">
            <p>
                <label for="version">Version</label><br>
                <input type="text" id="version" name="version" required placeholder="v1.3.3" pattern="v[0-9]+\.[0-9]+\.[0-9]+">
            </p>
            <p>
                <label for="package">ZIP package</label><br>
                <input type="file" id="package" name="package" accept=".zip,application/zip" required>
            </p>
            <button type="submit">Upload and publish</button>
        </form>

        <h2>Current manifest</h2>
        <p>Latest: <?php echo updateManageEscape($manifest["latest"] !== "" ? $manifest["latest"] : "none"); ?></p>
        <p>Manifest endpoint: <a href="manifest.php">manifest.php</a></p>

        <?php if (empty($releases)): ?>
            <p>No releases configured.</p>
        <?php else: ?>
            <table border="1" cellpadding="6" cellspacing="0">
                <thead>
                    <tr>
                        <th>Version</th>
                        <th>Package</th>
                        <th>SHA-256</th>
                        <th>Size</th>
                        <th>Published</th>
                        <th>Actions</th>
                    </tr>
                </thead>
                <tbody>
                    <?php foreach ($releases as $version => $release): ?>
                        <tr>
                            <td><?php echo updateManageEscape($version); ?></td>
                            <td><?php echo updateManageEscape($release["package"] ?? ""); ?></td>
                            <td><?php echo updateManageEscape($release["sha256"] ?? ""); ?></td>
                            <td><?php echo updateManageEscape($release["size"] ?? ""); ?></td>
                            <td><?php echo updateManageEscape($release["published_at"] ?? ""); ?></td>
                            <td>
                                <?php if ($manifest["latest"] !== $version): ?>
                                    <form method="POST" style="display:inline">
                                        <input type="hidden" name="action" value="set_latest">
                                        <input type="hidden" name="csrf_token" value="<?php echo updateManageEscape(updateManageCsrfToken()); ?>">
                                        <input type="hidden" name="version" value="<?php echo updateManageEscape($version); ?>">
                                        <button type="submit">Set latest</button>
                                    </form>
                                <?php endif; ?>
                                <form method="POST" style="display:inline" onsubmit="return confirm('Delete this release?');">
                                    <input type="hidden" name="action" value="delete">
                                    <input type="hidden" name="csrf_token" value="<?php echo updateManageEscape(updateManageCsrfToken()); ?>">
                                    <input type="hidden" name="version" value="<?php echo updateManageEscape($version); ?>">
                                    <button type="submit">Delete</button>
                                </form>
                            </td>
                        </tr>
                    <?php endforeach; ?>
                </tbody>
            </table>
        <?php endif; ?>
    <?php endif; ?>
</body>
</html>