Prompt for temporary access when file system is not writable

Created on 16 July 2020, over 4 years ago
Updated 5 December 2024, 14 days ago

Motivation

Automatic Updates currently asks admins to configure core files to be writable by the PHP user. While the update process itself is trustworthy, this enables vulnerabilities in Drupal, contributed projects, or dependencies to be exploited to modify core files. This is a serious problem in the real world that could negate the advantage of automatic updates.

Proposed resolution

This problem has already been solved by the Update module. When updating contrib projects, if PHP does not have permission to change a contributed module, the Update module checks for file transfer backends. If one exists, authorize.php prompts for the user name and password of the user who has permission to write to the file system. No credentials are stored in Drupal, so an authorized must be present to modify files.

File transfer base class

Automatic updates on cron can be run using a command line script by a user who has permission to modify core files.

Remaining tasks

  1. Add prompt for file system user credentials if file system is not writable and file transfer backend is available.
  2. Add script to run automatic updates from the command line as a user with permission to modify core files.
  3. Update messages and documentation to explain how to configure automatic updates without giving PHP write access to core files.

User interface changes

Changes notices and adds a prompt to the admin UI when user initiates automatic update.

Feature request
Status

Needs work

Version

1.0

Component

User interface

Created by

🇺🇸United States darren oh Lakeland, Florida

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

  • 🇺🇸United States darren oh Lakeland, Florida
  • 🇺🇸United States darren oh Lakeland, Florida
  • 🇺🇸United States darren oh Lakeland, Florida
  • 🇺🇸United States darren oh Lakeland, Florida
  • 🇺🇸United States darren oh Lakeland, Florida
  • 🇺🇸United States darren oh Lakeland, Florida
  • 🇺🇸United States darren oh Lakeland, Florida
  • 🇺🇸United States dww

    If you intend to rely on the FileTranfser classes to do this, and you actually think that could still work, you need to speak up (quickly?) in 📌 Deprecate/remove the ability to update a module from a URL and authorize.php Active . The current MR there completely removes that entire API (along with authorize.php and related methods from system.module). Everyone (so far) thinks it’s legacy cruft that no one could possibly care about anymore and doesn’t even deserve to be deprecated before removal. 😅

    I’m extremely familiar with the goal of UI-based updates for sites configured in depth. I have championed that approach since D6, and wrote the bulk of this code in the first place. You don’t have to explain to me how it works or why in principle it’s a good idea.

    However, I’m no longer convinced that any site with httpd running as another user than the one who owns the files will be maintained by someone who is CLI averse. It’s only wild speculation, but my sense is the intersection of those two sets is vanishingly small, and not worth bogging down core with technical debt to support.

    It’s absolutely worth making the UI play nicely with a cron-driven “sudo” step. That’s already been done. But actually requiring manually logging in via FileTransfer directly as part of the UI seems unnecessary.

  • 🇺🇸United States dww

    Point 2 in remaining tasks is already done. Adding links.

  • 🇺🇸United States dww

    For clarity, the “cron-driven sudo” step that’s already supported is not via Drupal’s hook cron, which “might be triggered by any user”. I/we are talking about good ole *nix crontab, and specifically setting up the script completely outside of Drupal.

Production build 0.71.5 2024