[PHP, GlazeDB] Hab-to-date: Self Updating CMS

[azaidi]

Any updates? :laugh:

I've been kinda busy with school this week, planning on doing a lot today. Anyways, I think I'm going to recreate the core so it allows for you to update your files without wiping all of your edits and settings. Also, I want to make it easier for the general user to push their updates if they want to, and I want to create a cron script that automatically pushes your updates for the public to download, and also downloads the newest edits. So I'm basically going to create a Developer or User switch for the cron. So getting any actual content updates might take some time, as I'll have to code all of that now tt1:



Okay, so I've got this now:

All pages and widgets have a column 'lastedit' with a timestamp
If $devmode is true, a cronjob will load all pages onto a serialized file every 12 hours instead of a simple .sql file
A cronjob will also download the new content every 24 hours from the $updates link, then insert settings you don't have yet into your db, replace all your defaults and ONLY update the pages that have a lower lastedit value.

Also I did a lot of cleanup and directory/file renaming + moving.

Now I'll have to get the management working with this again, seeing as the method I'm using now is quite different from what I did before.
Anyways, for now it can update itself, and only the things that were actually newly added, so if you translate everything you only have to translate the edited pages and widgets everytime a new update is available. Also for devs that would like to put their 'builds' online for users to use, all they have to do use the CMS on a hotel and visit it once a day (which they probably already do if they are make edits..). No need to export tables from phpmyadmin anymore!



Updating from management now works, but it applies the original build everytime you clear the cache (it doesn't overwrite any edits because of the lastedit column though) from there which I'm going to fix now.



Completed that aswell :fanny:



First-time use is now flawless, it's just copying a directory to /htdocs/, editing the config.php to connect to your db, and it will automatically update everything the first time you visit the page. My only problem now is that I'm going to need a place to store my builds for people that want to update my CMS when my PC is offline

 

[Joopie]

So, what you gonna do about exploits?

 

[alexandrosanto2]

All the gmaes are private servers ??:?::?:

 

[azaidi]

So, what you gonna do about exploits?

If you're talking about MySQL exploits, I have not used one query where I didn't pass the variables through a prepare/execute method (with a wrapper that handles it). I'm more worried about the way I'm caching my pages, it seems like the place where people could find a way to exploit it. Also, to enter the 'CMS Management' you'll have to login again under another session variable, and the 'Go Back' button in there deletes that session variable aswell. So I don't think XSS exploits are going to be that bad anyways. If anyone finds an exploit in my content I can just patch it in a day and the new build will get pushed to everyone that has auto-update enabled that day :laugh:

Oh yeah, my friend will let me borrow his domain and webhost so I'll push all my updates there, they will be on there 24/7 for atleast another year.



What I have right now: http://www.mediafire.com/download/5v5t2py97xsxymu/Hab-to-date_BETA_17-1.zip

If anyone wants critical snippets because they're too lazy to read through the entire thing just tell me.

All the gmaes are private servers ??:?::?:

What?

 

[Joopie]

Sorry, I was talking about.

Also, I want to make it easier for the general user to push their updates if they want to, and I want to create a cron script that automatically pushes your updates for the public to download, and also downloads the newest edits.

I like your idea,but IF you gonna do it. Remove the cronjob that auto-updates the cms and add a feature so users can verify the code before it will update the cms!

I wouldn't even use the cms, or atleast, i'll remove all auto update features just to make sure it's safe. It's not that I trust you.

 

[azaidi]

Updated Main Snippets.
Also, this is what I'm using for the updates, together with a simple cron class that runs the update code every 24 hours:

<?php
class content
{
	public static function uploadToDev($dir, $name)
	{
		file_put_contents($dir . '/' . $name, serialize(Array(
			'pages' => Query::Select('h2d_pages', '*')->All(),
			'widgets' => Query::Select('h2d_widgets', '*')->All(),
			'settings' => Query::Select('h2d_settings', '*')->All(),
			'defaults' => Query::Select('h2d_defaults', '*')->All())), LOCK_EX);
	}

	public static function updateFrom($path, $file)
	{
		$data = unserialize(file_get_contents($path . '/' . $file));
		if ($data === null || $data === false)
		{
			return;
		}

		foreach ($data['pages'] as $page)
		{
			if (Query::Select('h2d_pages', 'id', 'WHERE id = ? AND lastedit > ?', Array($page['id'], $page['lastedit']))->Object() === false)
			{
				Query::Delete('h2d_pages', 'WHERE id = ? LIMIT 1', $page['id'])->Execute();
				Query::Insert('h2d_pages', $page)->Execute();
			}
		}

		foreach ($data['widgets'] as $widget)
		{
			if (Query::Select('h2d_widgets', 'id', 'WHERE id = ? AND lastedit > ?', Array($widget['id'], $page['lastedit']))->Object() === false)
			{
				Query::Delete('h2d_widgets', 'WHERE id = ? LIMIT 1', $widget['id'])->Execute();
				Query::Insert('h2d_widgets', $widget)->Execute();
			}
		}
		
		foreach ($data['settings'] as $setting)
		{
			if (Query::Select('h2d_settings', 'id', 'WHERE id = ?', $setting['id'])->Object() === false)
			{
				Query::Delete('h2d_settings', 'WHERE id = ? LIMIT 1', $setting['id'])->Execute();
				Query::Insert('h2d_settings', $setting)->Execute();
			}
		}

		Query::Delete('h2d_defaults')->Execute();
		foreach ($data['defaults'] as $default)
		{
			Query::Insert('h2d_defaults', $default)->Execute();
		}
	}

	public static function pageExists($page)
	{
		return (Query::Select('h2d_pages', 'url', 'WHERE url = ? LIMIT 1', $page)->Column(0) !== null);
	}

	public static function getSettings($cache)
	{
		if (!$cache->hasFile('settings', 'all'))
		{
			$settings = new stdClass;
			$selectSettings = Query::Select('h2d_settings', 'name, value');

			while ($assoc = $selectSettings->Assoc())
			{
				$key = $assoc['name'];
				$settings->$key = $assoc['value'];
			}

			$cache->toFile('settings', 'all', serialize($settings));
		}

		return unserialize($cache->getFile('settings', 'all'));
	}
}
?>

Sorry, I was talking about.



I like your idea,but IF you gonna do it. Remove the cronjob that auto-updates the cms and add a feature so users can verify the code before it will update the cms!

I wouldn't even use the cms, or atleast, i'll remove all auto update features just to make sure it's safe. It's not that I trust you.[/COLOR]

You have to specify the url from which you want to retrieve the updates. You shouldn't use the builds from an untrustable dev. I'm completely inspired by the way android updates work. When I'm using cyanogenmod I have no idea if I can trust them, but I just do it because they dev for thousands of phones and nobody has problems with them. It's not like a public github (is that possible? never used in-depth github) where everyone can just push their updates to the main code. It works as follows now:

Users download the CMS with the update-script pointed at my PC (I'll change it to a webhost soon).
Every day their CMS applies the newest build, well only the things I edited in the newest build.

They can change the pointer of the update-script to another hotel/webhost/wherever somebody is creating content.
Those devs can build their dev on my updates, and add their own features. It's just like my version is cyanogenmod, and then their builds are like cyanogenmod-based custom roms in android. Maybe somebody will set it up in a way that everyone can supply their updates.

Also, you can turn off auto-updates and apply them from the updates tab in the CMS Management daily yourself if you are afraid the code is malicious. But why would you use my CMS if you were afraid of my code? Same for other people their builds, why would you even use them if you don't trust them?



- Made it so cron only checks if there are scripts to run every hour.

 

[Hoshiko]

Sigh. Where are the interesting Golang based CMS developments?

 

[azaidi]

Sigh. Where are the interesting Golang based CMS developments?

Not here. What's wrong with PHP?

I'm partly creating this for the community. I bet most of the people here don't even know how to set that up or what it is.



Made the style of the management more consistent and better looking. It still has an overal blue theme, I can make it black if you prefer that.
I think I'm going to start working on more content now, probably the housekeeping first.



Ported the news page from the Boost Housekeeping, I'll do the /profile or other housekeeping pages next.



Added setting for one web_promo directory or loosely-typed links.



What do you guys prefer when this situation happens:

- I, the updates-creator, make an edit to a page at 3pm.
- An hotel using my CMS makes an edit to that same page at 4pm.
- Cron script updates their CMS at 8pm every evening.

Should their page stay or my page? At the moment it would keep their page, and they could apply my page by manually deleting their own page and updating their cms from the updates tab again.



New pictures, I posted them on Retronet aswell: http://imgur.com/a/WOg60



Added show-dump to browser for older versions in the /development/ dir when devmode is on.
That is so when the main version creator (me) makes an update and somebody elses (who uses my versions as a base) edits get wiped they can open read their own old versions without having to reinstall their own old version.

 

[The General]

Do you mean some other hotel can edit a certain page (for example the /me page) and then it gets pushed to all other hotels?

 

[azaidi]

Do you mean some other hotel can edit a certain page (for example the /me page) and then it gets pushed to all other hotels?

No, that's what I've been trying to clarify. If you CHOOSE to use that Hotel as your main-build then yes, it will get pushed to you. By default it only takes updates from ME. You can change it in the config file to link to another hotel to download it from them (if they allow you to).

 

[seanrom]

I don't think you should force an update on anyone, let them choose trough a control panel.

 

[azaidi]

I don't think you should force an update on anyone, let them choose trough a control panel.

I'm not forcing anything. You can disable it in the config and do it manually through the control panel.
But that's almost just as much trouble as just downloading an update .zip and copying the files..

 

[Hoshiko]

Not here. What's wrong with PHP?

More like; what isn't wrong with the whole CGI model?

 

[azaidi]

- Fixed some stupid coding mistakes
- Made the config.php a lot easier to use
- Let 2 people test the CMS, auto-updating is working fine

Updates might be slow the next 7 days, my testweek is starting tomorrow :*:

 

[The General]

Nice updates.

Write some use cases and make some deployment diagrams. Do a few sequence or activity diagrams and write a class diagram. Will help your development even though people may claim it is shenanigans and a waste of time.

Or am I the only one who develops things this way?

 

[azaidi]

Nice updates.

Write some use cases and make some deployment diagrams. Do a few sequence or activity diagrams and write a class diagram. Will help your development even though people may claim it is shenanigans and a waste of time.

Or am I the only one who develops things this way?

I wasn't even planning on making this a Habbo Dev in the first place, I was just toying around with making an auto-update system. And when it worked without a struggle, I just decided I could make a great habbo cms and service out of it. I'm probably going to redo the entire management because it's kinda ugly and badly coded, so I will try it for that. I will also integrate the housekeeping inside of the management instead of recreating a standalone boost-rip, which is what the housekeeping is now.

 

[Twan]

Nice! Good luck with this, i hope you finish this. Is this gonna be compitable with Azure?

 

[azaidi]

Nice! Good luck with this, i hope you finish this. Is this gonna be compitable with Azure?

It is so far only tested and confirmed working 100% with Azure. Haven't tested anything else yet tt1:

Also I restarted the management itself (not the framework/classes, only the front-end) because it looked horrible and was really messy.

 

[azaidi]

Old look:

What do you guys think of this:

 

[Twan]

Nice, looks much better!