From 7fbb7f4dc4cd1918a5b3dfaa4c8dfb6a7e11d0c3 Mon Sep 17 00:00:00 2001
From: Lukas Reschke <lukas@owncloud.com>
Date: Thu, 8 Jan 2015 12:05:54 +0100
Subject: Add version to .htaccess

Currently if a user does not replace the .htaccess file with the new update this can lead to serious problems in case Apache is used as webserver.

This commit adds the version to the .htaccess file and the update routine fails in case not the newest version is specified in there. This obviously means that every release has to update the version specified in .htaccess as well. But I see no better solution for it.

Conflicts:
	lib/private/updater.php
---
 lib/private/setup.php   | 31 ++++++++++++++++++++++++++++++-
 lib/private/updater.php |  6 +++++-
 2 files changed, 35 insertions(+), 2 deletions(-)

(limited to 'lib')

diff --git a/lib/private/setup.php b/lib/private/setup.php
index e5eb2bac194..b9ba8d906c2 100644
--- a/lib/private/setup.php
+++ b/lib/private/setup.php
@@ -242,14 +242,43 @@ class OC_Setup {
 		return $error;
 	}
 
+	/**
+	 * @return string Absolute path to htaccess
+	 */
+	private function pathToHtaccess() {
+		return OC::$SERVERROOT.'/.htaccess';
+	}
+
+	/**
+	 * Checks if the .htaccess contains the current version parameter
+	 *
+	 * @return bool
+	 */
+	private function isCurrentHtaccess() {
+		$version = \OC_Util::getVersion();
+		unset($version[3]);
+
+		return !strpos(
+			file_get_contents($this->pathToHtaccess()),
+			'Version: '.implode('.', $version)
+		) === false;
+	}
+
 	/**
 	 * Append the correct ErrorDocument path for Apache hosts
+	 *
+	 * @throws \OC\HintException If .htaccess does not include the current version
 	 */
 	public static function updateHtaccess() {
+		$setupHelper = new OC_Setup(\OC::$server->getConfig());
+		if(!$setupHelper->isCurrentHtaccess()) {
+			throw new \OC\HintException('.htaccess file has the wrong version. Please upload the correct version.');
+		}
+
 		$content = "\n";
 		$content.= "ErrorDocument 403 ".OC::$WEBROOT."/core/templates/403.php\n";//custom 403 error page
 		$content.= "ErrorDocument 404 ".OC::$WEBROOT."/core/templates/404.php";//custom 404 error page
-		@file_put_contents(OC::$SERVERROOT.'/.htaccess', $content, FILE_APPEND); //suppress errors in case we don't have permissions for it
+		@file_put_contents($setupHelper->pathToHtaccess(), $content, FILE_APPEND); //suppress errors in case we don't have permissions for it
 	}
 
 	public static function protectDataDirectory() {
diff --git a/lib/private/updater.php b/lib/private/updater.php
index 6272f77cfc2..fb41e2d36f0 100644
--- a/lib/private/updater.php
+++ b/lib/private/updater.php
@@ -189,7 +189,11 @@ class Updater extends BasicEmitter {
 
 		// Update htaccess files for apache hosts
 		if (isset($_SERVER['SERVER_SOFTWARE']) && strstr($_SERVER['SERVER_SOFTWARE'], 'Apache')) {
-			\OC_Setup::updateHtaccess();
+			try {
+				\OC_Setup::updateHtaccess();
+			} catch (\Exception $e) {
+				throw new \Exception($e->getMessage());
+			}
 		}
 
 		// create empty file in data dir, so we can later find
-- 
cgit v1.2.3