better-staridc-MNBT

better-staridc-MNBT/ MPHX/github_updater.php 31.4 KB · 975 行原始文件
Z zfhsh first commit 2 天前
1<?php
2if (!defined('IN_CRONLITE')) exit();
3/**
* 系统更新：从 GitHub Release 拉包覆盖更新（V1.85 起替代自建更新服务器 check.php）
*
* 为什么这样写：更新包来自站外，配置文件 cf_up.php 里又能改仓库与镜像地址，
* 所以这里内置域名白名单 + 解析后 IP 校验，防止配置被人改成内网地址形成 SSRF。
* 只定义函数，不产生任何输出。
*/
10
11/** 站点根目录（带尾斜杠） */
12function mnbt_updater_root()
13{
return defined('ROOT') ? ROOT : rtrim(str_replace('\\', '/', dirname(__DIR__)), '/') . '/';
15}
16
17/** 默认配置：仓库与镜像 */
18function mnbt_updater_defaults()
19{
return ['repo' => '1181469655/MNBT', 'mirrors' => ['https://gh-proxy.com/'], 'github_token' => ''];
21}
22
23/** 读 cf_up.php 的 $mn_conf（页面已 include 时直接复用，避免重复读文件） */
24function mnbt_updater_read_conf()
25{
if (isset($GLOBALS['mn_conf']) && is_array($GLOBALS['mn_conf'])) {
return $GLOBALS['mn_conf'];
}
$mn_conf = [];
$cf = mnbt_updater_root() . 'cf_up.php';
if (is_file($cf)) {
include $cf;
}
return is_array($mn_conf) ? $mn_conf : [];
35}
36
37/** owner/repo 规范化，非法返回空串 */
38function mnbt_updater_norm_repo($repo)
39{
$repo = trim((string)$repo);
$repo = preg_replace('#^https?://github\.com/#i', '', $repo);
$repo = trim($repo, " \t\n\r/");
if (preg_match('#^([A-Za-z0-9._\-]{1,60})/([A-Za-z0-9._\-]{1,80})$#', $repo, $m)) {
// 仓库名带 .git 后缀时剥掉，GitHub API 不接受
return $m[1] . '/' . preg_replace('#\.git$#', '', $m[2]);
}
return '';
48}
49
50/** 镜像地址规范化：支持只填域名，统一补协议与尾斜杠；非法返回空串 */
51function mnbt_updater_norm_mirror($mirror)
52{
$mirror = trim((string)$mirror);
if ($mirror === '') return '';
if (!preg_match('#^https?://#i', $mirror)) {
if (!preg_match('#^[A-Za-z0-9.\-]{3,120}$#', $mirror)) return '';
$mirror = 'https://' . $mirror;
}
$mirror = rtrim($mirror, '/') . '/';
// 双引号写回 cf_up.php，出现引号/反斜杠/美元符会破坏配置文件
if (!preg_match('#^https?://[A-Za-z0-9.\-:/_]+$#', $mirror)) return '';
$host = strtolower((string)parse_url($mirror, PHP_URL_HOST));
if ($host === '' || strpos($host, '.') === false) return '';
return $mirror;
65}
66
67/** 更新配置：仓库、镜像列表、Token；缺省值兜底 */
68function mnbt_updater_config()
69{
$mn_conf = mnbt_updater_read_conf();
$def = mnbt_updater_defaults();
$up = isset($mn_conf['update']) && is_array($mn_conf['update']) ? $mn_conf['update'] : [];
73
$repo = isset($up['repo']) ? mnbt_updater_norm_repo($up['repo']) : '';
if ($repo === '') $repo = $def['repo'];
76
$mirrors = [];
$mirrors_set = false;
if (isset($up['mirrors'])) {
// 显式配置过就按配置走，包括被清空（只走 github 直连）
$mirrors_set = true;
$raw = is_array($up['mirrors']) ? $up['mirrors'] : preg_split('/\r\n|\r|\n/', (string)$up['mirrors']);
foreach ($raw as $m) {
	$n = mnbt_updater_norm_mirror($m);
	if ($n !== '' && !in_array($n, $mirrors, true)) $mirrors[] = $n;
}
}
if (!$mirrors_set && !$mirrors) $mirrors = $def['mirrors'];
89
$token = trim((string)($up['github_token'] ?? ''));
if ($token !== '' && !preg_match('#^[A-Za-z0-9._\-]{1,128}$#', $token)) $token = '';
92
return ['repo' => $repo, 'mirrors' => $mirrors, 'github_token' => $token];
94}
95
96/**
* 回写 cf_up.php 的 update 段，其余键原样保留（参照 admin/api/repair.php 的 ary_asd 写法）
* @param string|null $token null 表示保持原值不变
*/
100function mnbt_updater_save_config($repo, $mirrors, $token = null)
101{
$repo = mnbt_updater_norm_repo($repo);
if ($repo === '') return ['ok' => 0, 'error' => '仓库格式不正确，应为 owner/repo'];
104
$clean = [];
foreach ((array)$mirrors as $m) {
$n = mnbt_updater_norm_mirror($m);
if ($n !== '' && !in_array($n, $clean, true)) $clean[] = $n;
}
$token_new = null;
if ($token !== null) {
$token_new = trim((string)$token);
if ($token_new !== '' && !preg_match('#^[A-Za-z0-9._\-]{1,128}$#', $token_new)) {
	return ['ok' => 0, 'error' => 'Token 含非法字符，只允许字母、数字与 . _ -'];
}
}
117
$mn_conf = mnbt_updater_read_conf();
$old = isset($mn_conf['update']) && is_array($mn_conf['update']) ? $mn_conf['update'] : [];
$mn_conf['update'] = [
'repo' => $repo,
'mirrors' => array_values($clean),
'github_token' => $token_new === null ? (string)($old['github_token'] ?? '') : $token_new,
];
125
$kr_sxy = ary_asd($mn_conf);
if ($kr_sxy === '') return ['ok' => 0, 'error' => '配置数据为空，已取消写入'];
$cf = mnbt_updater_root() . 'cf_up.php';
if (is_file($cf) && !is_writable($cf)) return ['ok' => 0, 'error' => 'cf_up.php 不可写，请检查文件权限'];
$wr = @file_put_contents($cf, '<?php $mn_conf=array(' . $kr_sxy . ');?>');
if ($wr === false) return ['ok' => 0, 'error' => '配置文件写入失败'];
$GLOBALS['mn_conf'] = $mn_conf;
return ['ok' => 1, 'error' => ''];
134}
135
136/** 下载/接口地址的 host 是否授权：GitHub 官方域 + 配置里的镜像域 */
137function mnbt_updater_host_allowed($host, $cfg)
138{
$host = strtolower(trim((string)$host));
if ($host === '') return false;
// github.com / api.github.com / codeload.github.com / *.githubusercontent.com（附件与源码包的跳转目标）
if (preg_match('#^([a-z0-9\-]+\.)*github(usercontent)?\.com$#', $host)) return true;
foreach ((array)$cfg['mirrors'] as $m) {
$mh = strtolower((string)parse_url($m, PHP_URL_HOST));
if ($mh !== '' && $mh === $host) return true;
}
return false;
148}
149
150/** IP 是否为公网可路由地址 */
151function mnbt_updater_ip_public($ip)
152{
return (bool)filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE);
154}
155
156/** 域名解析结果必须全是公网地址，否则视为内网打洞 */
157function mnbt_updater_host_public($host, &$err)
158{
static $memo = [];
$host = strtolower((string)$host);
if (isset($memo[$host])) {
// 同一次请求里会反复校验同一批地址，避免重复解析
if ($memo[$host] === true) return true;
$err = $memo[$host];
return false;
}
$ips = @gethostbynamel($host);
if (!is_array($ips)) $ips = [];
if (function_exists('dns_get_record')) {
$v6 = @dns_get_record($host, DNS_AAAA);
if (is_array($v6)) {
	foreach ($v6 as $r) {
		if (!empty($r['ipv6'])) $ips[] = $r['ipv6'];
	}
}
}
if (!$ips) {
$err = '无法解析域名 ' . $host;
$memo[$host] = $err;
return false;
}
foreach ($ips as $ip) {
if (!mnbt_updater_ip_public($ip)) {
	$err = '域名 ' . $host . ' 解析到内网或保留地址，已拒绝';
	$memo[$host] = $err;
	return false;
}
}
$memo[$host] = true;
return true;
191}
192
193/** 完整地址安全检查：协议 + 白名单 + 解析 IP */
194function mnbt_updater_url_safe($url, $cfg, &$err)
195{
$url = trim((string)$url);
if (!preg_match('#^https?://#i', $url)) {
$err = '仅允许 http/https 地址';
return false;
}
$host = (string)parse_url($url, PHP_URL_HOST);
if ($host === '') {
$err = '地址无效';
return false;
}
if (!mnbt_updater_host_allowed($host, $cfg)) {
$err = '未授权的下载地址：' . $host;
return false;
}
return mnbt_updater_host_public($host, $err);
211}
212
213/** GitHub API 单次请求（返回体量很小，可以进内存） */
214function mnbt_updater_api_once($url, $cfg, $send_token)
215{
$out = ['ok' => 0, 'json' => null, 'http' => 0, 'error' => ''];
$err = '';
if (!mnbt_updater_url_safe($url, $cfg, $err)) {
$out['error'] = $err;
return $out;
}
$headers = [
'User-Agent: MNBT-Updater/1.85',
'Accept: application/vnd.github+json',
];
// Token 只用于提速率，发给镜像就等于把凭据交给第三方，所以只有直连才带
if ($send_token && $cfg['github_token'] !== '') {
$headers[] = 'Authorization: Bearer ' . $cfg['github_token'];
}
$ch = curl_init($url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, false);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);
curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 5);
curl_setopt($ch, CURLOPT_TIMEOUT, 20);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
$body = curl_exec($ch);
$cerr = curl_error($ch);
$out['http'] = (int)curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($body === false) {
$out['error'] = $cerr !== '' ? $cerr : '接口请求失败';
return $out;
}
if ($out['http'] < 200 || $out['http'] >= 300) {
$js = json_decode((string)$body, true);
$msg = is_array($js) && isset($js['message']) ? (string)$js['message'] : '';
$out['error'] = 'HTTP ' . $out['http'] . ($msg !== '' ? '（' . $msg . '）' : '');
return $out;
}
$js = json_decode((string)$body, true);
if (!is_array($js)) {
$out['error'] = '接口返回内容无法解析';
return $out;
}
$out['ok'] = 1;
$out['json'] = $js;
return $out;
261}
262
263/**
* 调用 GitHub API：先直连 api.github.com，失败再按镜像顺序尝试
* 国内环境直连 api.github.com 常常不通，但镜像可以代理它，所以这里也要有镜像兜底
*/
267function mnbt_updater_api_get($path, $cfg)
268{
$out = ['ok' => 0, 'json' => null, 'http' => 0, 'error' => ''];
if (!function_exists('curl_init')) {
$out['error'] = '服务器未启用 curl 扩展';
return $out;
}
$direct = 'https://api.github.com' . $path;
$urls = [['url' => $direct, 'token' => true]];
foreach ($cfg['mirrors'] as $m) {
$urls[] = ['url' => $m . $direct, 'token' => false];
}
$errs = [];
foreach ($urls as $u) {
$r = mnbt_updater_api_once($u['url'], $cfg, $u['token']);
if ($r['ok']) return $r;
$errs[] = ($u['token'] ? '直连' : $u['url']) . '：' . $r['error'];
$out['http'] = $r['http'];
}
$out['error'] = '接口请求失败（' . implode(' / ', $errs) . '）';
return $out;
288}
289
290/**
* tag 规范化成项目版本号：V1.84 => 1840
* 与 $WEBQB 的规则一致：主版本占千位、次版本占百十位、补丁占个位（补丁最多记 9）
*/
294function mnbt_updater_tag_to_version($tag)
295{
$tag = (string)$tag;
if (!preg_match('/(\d+)(?:[.\-](\d+))?(?:[.\-](\d+))?/', $tag, $m)) return 0;
$major = (int)$m[1];
$minor = isset($m[2]) && $m[2] !== '' ? (int)$m[2] : 0;
$patch = isset($m[3]) && $m[3] !== '' ? (int)$m[3] : 0;
return $major * 1000 + $minor * 10 + min(9, $patch);
302}
303
304/** tag 显示名（GitHub 上的 tag 已带 V 前缀，这里只做兜底） */
305function mnbt_updater_tag_display($tag)
306{
$tag = trim((string)$tag);
if ($tag === '') return '';
return (preg_match('/^v/i', $tag) ? '' : 'V') . $tag;
310}
311
312/** 从 release 的 assets 里挑自定义 zip 附件 */
313function mnbt_updater_pick_asset($assets)
314{
if (!is_array($assets)) return ['url' => '', 'name' => '', 'size' => 0];
foreach ($assets as $a) {
if (!is_array($a)) continue;
$url = isset($a['browser_download_url']) ? (string)$a['browser_download_url'] : '';
$name = isset($a['name']) ? (string)$a['name'] : '';
if ($url === '') continue;
if (!preg_match('#\.zip$#i', $name !== '' ? $name : $url)) continue;
return ['url' => $url, 'name' => $name, 'size' => (int)($a['size'] ?? 0)];
}
return ['url' => '', 'name' => '', 'size' => 0];
325}
326
327/**
* 下载候选地址：包来源优先级为 release 自定义 zip 附件 > GitHub 自动源码包；
* 每个来源再按 github.com 直连、配置镜像顺序依次尝试
*/
331function mnbt_updater_candidates($cfg, $tag, $asset_url)
332{
$srcs = [];
if ($asset_url !== '') {
$srcs[] = ['type' => 'asset', 'label' => 'Release 附件', 'url' => $asset_url];
}
// archive/refs/tags 会由 GitHub 跳到 codeload，legacy.zip 是 codeload 的直链形式，两种都留作兜底
$srcs[] = [
'type' => 'source',
'label' => 'GitHub 源码包',
'url' => 'https://github.com/' . $cfg['repo'] . '/archive/refs/tags/' . rawurlencode($tag) . '.zip',
];
$srcs[] = [
'type' => 'source',
'label' => 'GitHub 源码包（直连 codeload）',
'url' => 'https://codeload.github.com/' . $cfg['repo'] . '/legacy.zip/refs/tags/' . rawurlencode($tag),
];
348
$out = [];
foreach ($srcs as $s) {
$out[] = ['type' => $s['type'], 'label' => $s['label'], 'url' => $s['url'], 'via' => 'github', 'mirror' => ''];
foreach ($cfg['mirrors'] as $m) {
	$out[] = ['type' => $s['type'], 'label' => $s['label'], 'url' => $m . $s['url'], 'via' => 'mirror', 'mirror' => $m];
}
}
return $out;
357}
358
359/** 检查结果缓存文件（后台首页每次加载都要问一遍，不限流会很快打满匿名请求配额） */
360function mnbt_updater_cache_file()
361{
$dir = mnbt_updater_root() . 'runtime/cache';
if (!is_dir($dir)) mnbt_updater_mkdir($dir);
return $dir . '/github_updater_check.json';
365}
366
367/** 检查最新版本；返回展示与下载所需的全部信息 */
368function mnbt_updater_check($force = false, $ttl = 1800)
369{
$cfg = mnbt_updater_config();
$cur = (int)($GLOBALS['WEBQB'] ?? 0);
$out = [
'ok' => 0, 'error' => '', 'repo' => $cfg['repo'], 'mirrors' => $cfg['mirrors'],
'has_token' => ($cfg['github_token'] !== ''), 'current' => 'V' . sprintf('%.2f', $cur / 1000),
'current_version' => $cur, 'tag' => '', 'latest' => '', 'version' => 0, 'name' => '', 'body' => '',
'asset_url' => '', 'asset_name' => '', 'asset_size' => 0, 'source' => '', 'source_label' => '',
'published_at' => '', 'fallback' => 0, 'can_update' => 0, 'candidates' => [],
];
if ($cfg['repo'] === '') {
$out['error'] = '未配置更新仓库';
return $out;
}
383
// 仓库或本地版本变了要重新问；失败结果最多缓存 5 分钟
$cf = mnbt_updater_cache_file();
if (!$force && is_file($cf)) {
$c = json_decode((string)@file_get_contents($cf), true);
if (is_array($c) && isset($c['ts'], $c['repo'], $c['ver'], $c['data'])
	&& $c['repo'] === $cfg['repo'] && (int)$c['ver'] === $cur) {
	$life = !empty($c['data']['ok']) ? min((int)($c['ttl'] ?? 1800), (int)$ttl) : min(300, (int)$ttl);
	if (time() - (int)$c['ts'] < $life) {
		return $c['data'];
	}
}
}
396
$rel = null;
$err1 = '';
$api = mnbt_updater_api_get('/repos/' . $cfg['repo'] . '/releases/latest', $cfg);
if ($api['ok']) {
$js = $api['json'];
// latest 接口对非数组返回也会给 200，这里靠 tag_name 判定
if (isset($js['tag_name']) && mnbt_updater_tag_to_version($js['tag_name']) > 0) {
	$rel = $js;
}
} else {
$err1 = $api['error'];
}
if (!is_array($rel)) {
// latest 不可用（未来 tag 可能不再以 V 开头，或接口限流），退化成列表取版本号最高的一个
$list = mnbt_updater_api_get('/repos/' . $cfg['repo'] . '/releases?per_page=20', $cfg);
if (!$list['ok']) {
	$out['error'] = $list['error'] !== '' ? $list['error'] : $err1;
	mnbt_updater_cache_put($cfg, $cur, $out, $ttl);
	return $out;
}
$best = null;
$bestv = 0;
foreach ($list['json'] as $js) {
	if (!is_array($js) || empty($js['tag_name'])) continue;
	if (!empty($js['draft']) || !empty($js['prerelease'])) continue;
	$v = mnbt_updater_tag_to_version($js['tag_name']);
	if ($v > $bestv) { $bestv = $v; $best = $js; }
}
if (!is_array($best)) {
	$out['error'] = $err1 !== '' ? $err1 : 'GitHub 未找到可用的版本发布';
	mnbt_updater_cache_put($cfg, $cur, $out, $ttl);
	return $out;
}
$rel = $best;
$out['fallback'] = 1;
}
433
$tag = (string)$rel['tag_name'];
$asset = mnbt_updater_pick_asset($rel['assets'] ?? []);
$ver = mnbt_updater_tag_to_version($tag);
437
$out['ok'] = 1;
$out['tag'] = $tag;
$out['latest'] = mnbt_updater_tag_display($tag);
$out['version'] = $ver;
$out['name'] = (string)($rel['name'] ?? '');
$out['body'] = (string)($rel['body'] ?? '');
$out['published_at'] = (string)($rel['published_at'] ?? '');
$out['asset_url'] = $asset['url'];
$out['asset_name'] = $asset['name'];
$out['asset_size'] = $asset['size'];
$out['can_update'] = ($ver > $cur) ? 1 : 0;
$out['source'] = $asset['url'] !== '' ? 'asset' : 'source';
$out['source_label'] = $asset['url'] !== '' ? 'Release 附件 ' . $asset['name'] : 'GitHub 自动源码包（需剥顶层目录）';
$out['candidates'] = mnbt_updater_candidates($cfg, $tag, $asset['url']);
mnbt_updater_cache_put($cfg, $cur, $out, $ttl);
return $out;
454}
455
456/** 写检查结果缓存；缓存里不含 Token，只存展示与下载所需数据 */
457function mnbt_updater_cache_put($cfg, $cur, $out, $ttl = 1800)
458{
$cf = mnbt_updater_cache_file();
@file_put_contents($cf, json_encode([
'ts' => time(),
'ttl' => (int)$ttl,
'repo' => $cfg['repo'],
'ver' => (int)$cur,
'data' => $out,
], JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES));
467}
468
469/**
* 流式下载压缩包到临时文件：逐跳校验地址、校验 zip 魔数与字节数，失败即删除
* @return bool
*/
473function mnbt_updater_download($url, $dest, $cfg, &$err)
474{
$err = '';
if (!function_exists('curl_init')) {
$err = '服务器未启用 curl 扩展';
return false;
}
if (!mnbt_updater_url_safe($url, $cfg, $err)) return false;
$fp = @fopen($dest, 'wb');
if (!$fp) {
$err = '无法创建临时文件 ' . $dest;
return false;
}
$cur = (string)$url;
$ok = false;
$heads = [];
for ($hop = 0; $hop < 6; $hop++) {
if (!mnbt_updater_url_safe($cur, $cfg, $err)) break;
$heads = [];
$ch = curl_init($cur);
curl_setopt($ch, CURLOPT_FILE, $fp);
curl_setopt($ch, CURLOPT_HEADER, false);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);
curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 10);
curl_setopt($ch, CURLOPT_TIMEOUT, 300);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
	// 下载请求不带 Token，避免跳转或镜像把它带出去
	'User-Agent: MNBT-Updater/1.85',
	'Accept: application/octet-stream',
]);
curl_setopt($ch, CURLOPT_HEADERFUNCTION, function ($ch, $line) use (&$heads) {
	$len = strlen($line);
	$p = strpos($line, ':');
	if ($p !== false) {
		$heads[strtolower(trim(substr($line, 0, $p)))] = trim(substr($line, $p + 1));
	}
	return $len;
});
$res = curl_exec($ch);
$cerr = curl_error($ch);
$code = (int)curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($res === false) {
	$err = $cerr !== '' ? $cerr : '下载中断';
	break;
}
if ($code >= 300 && $code < 400) {
	$loc = $heads['location'] ?? '';
	if ($loc === '') {
		$err = 'HTTP ' . $code . ' 但未返回跳转地址';
		break;
	}
	$next = mnbt_updater_abs_url($cur, $loc);
	if ($next === '') {
		$err = '跳转地址无效';
		break;
	}
	$cur = $next;
	// 跳转响应可能自带一小段 HTML，会把压缩包开头弄脏，跳一次就把文件截回空
	rewind($fp);
	ftruncate($fp, 0);
	continue;
}
if ($code !== 200) {
	$err = 'HTTP ' . $code;
	break;
}
$ok = true;
break;
}
fflush($fp);
$bytes = ftell($fp);
fclose($fp);
548
if ($ok) {
$expect = (int)($heads['content-length'] ?? 0);
if ($expect > 0 && $expect !== $bytes) {
	$err = '文件不完整，应为 ' . $expect . ' 字节，实际 ' . $bytes . ' 字节';
	$ok = false;
} elseif ($bytes < 1024) {
	$err = '下载内容过小（' . $bytes . ' 字节），不像有效的压缩包';
	$ok = false;
} elseif (!mnbt_updater_is_zip($dest)) {
	$err = '下载内容不是有效的 zip 压缩包（可能是镜像返回的错误页）';
	$ok = false;
}
}
if (!$ok) {
@unlink($dest);
}
return $ok;
566}
567
568/** 相对跳转地址转绝对 */
569function mnbt_updater_abs_url($base, $loc)
570{
$loc = trim((string)$loc);
if ($loc === '') return '';
if (preg_match('#^https?://#i', $loc)) return $loc;
$p = parse_url($base);
if (!$p || empty($p['host'])) return '';
$scheme = isset($p['scheme']) ? $p['scheme'] : 'https';
if (strpos($loc, '/') === 0) return $scheme . '://' . $p['host'] . $loc;
$dir = isset($p['path']) ? substr($p['path'], 0, strrpos($p['path'], '/') + 1) : '/';
return $scheme . '://' . $p['host'] . $dir . $loc;
580}
581
582/** zip 魔数校验 */
583function mnbt_updater_is_zip($file)
584{
if (!is_file($file)) return false;
$fp = @fopen($file, 'rb');
if (!$fp) return false;
$magic = fread($fp, 4);
fclose($fp);
return $magic === "PK\x03\x04" || $magic === "PK\x05\x06";
591}
592
593/** zip 条目名安全校验：禁止绝对路径、盘符、反斜杠与 .. 段 */
594function mnbt_updater_entry_safe($name)
595{
$name = (string)$name;
if ($name === '' || strpos($name, "\0") !== false) return false;
if (strpos($name, '/') === 0) return false;
if (strpos($name, '\\') !== false) return false;
if (preg_match('#^[A-Za-z]:#', $name)) return false;
foreach (explode('/', $name) as $seg) {
if ($seg === '..') return false;
}
return true;
605}
606
607/**
* 解压前扫描：拒绝危险条目、识别需要剥掉的顶层目录、确认剥完之后确实是站点根
* @return array|null 成功返回 ['strip'=>..,'entries'=>..,'files'=>..]，失败返回 null 并写 $err
*/
611function mnbt_updater_zip_analyze($file, &$err)
612{
$err = '';
if (!class_exists('ZipArchive')) {
$err = '服务器未启用 Zip 扩展，无法在线更新';
return null;
}
$zip = new ZipArchive();
$op = $zip->open($file);
if ($op !== true) {
$err = '压缩包无法打开（错误码 ' . $op . '），可能下载不完整';
return null;
}
$n = (int)$zip->numFiles;
if ($n <= 0) {
$zip->close();
$err = '压缩包是空的';
return null;
}
$names = [];
$files = 0;
for ($i = 0; $i < $n; $i++) {
$e = $zip->statIndex($i);
$name = isset($e['name']) ? (string)$e['name'] : '';
if (!mnbt_updater_entry_safe($name)) {
	$zip->close();
	$err = '压缩包含非法路径，已中止：' . $name;
	return null;
}
$names[] = $name;
if (substr($name, -1) !== '/') $files++;
}
$strip = mnbt_updater_zip_strip($names);
// 附件包（无顶层目录）与源码包（剥掉顶层目录后）都必须落在站点根上，否则视为包内容不对
if (!mnbt_updater_zip_looks_like_site($names, $strip)) {
$zip->close();
$err = '压缩包结构不符合站点根目录，已中止';
return null;
}
$zip->close();
return ['strip' => $strip, 'entries' => $n, 'files' => $files];
652}
653
654/**
* 顶层目录识别：GitHub 自动源码包的顶层名有两种（MNBT-1.84/ 与 1181469655-MNBT-<sha>/），
* 所以只按「所有条目共享同一个顶层目录」来判断，不硬编码名字
*/
658function mnbt_updater_zip_strip($names)
659{
$top = null;
foreach ($names as $name) {
$pos = strpos($name, '/');
if ($pos === false || $pos === 0) return '';
$seg = substr($name, 0, $pos);
if ($top === null) {
	$top = $seg;
} elseif ($top !== $seg) {
	return '';
}
}
return $top === null ? '' : $top . '/';
672}
673
674/** 剥掉顶层目录后是否还是一个站点根 */
675function mnbt_updater_zip_looks_like_site($names, $strip)
676{
$need = ['MPHX/function.php', 'admin/ajax.php', 'index.php', 'cf_up.php'];
$len = strlen($strip);
foreach ($names as $name) {
if ($strip !== '' && strncmp($name, $strip, $len) !== 0) continue;
$rel = rtrim($strip === '' ? $name : substr($name, $len), '/');
if ($rel !== '' && in_array($rel, $need, true)) return true;
}
return false;
685}
686
687/** 逐级建目录 */
688function mnbt_updater_mkdir($dir)
689{
if (is_dir($dir)) return true;
return @mkdir($dir, 0755, true);
692}
693
694/**
* 逐条目解压（需要剥顶层目录时 extractTo 做不到，所以统一走这里）
* @return bool
*/
698function mnbt_updater_extract($file, $root, $strip, &$err)
699{
$err = '';
$zip = new ZipArchive();
if ($zip->open($file) !== true) {
$err = '压缩包打开失败';
return false;
}
$n = (int)$zip->numFiles;
for ($i = 0; $i < $n; $i++) {
$e = $zip->statIndex($i);
$name = isset($e['name']) ? (string)$e['name'] : '';
if (!mnbt_updater_entry_safe($name)) {
	$zip->close();
	$err = '压缩包含非法路径，已中止：' . $name;
	return false;
}
$rel = $name;
if ($strip !== '') {
	if (strpos($name, $strip) !== 0) continue;
	$rel = substr($name, strlen($strip));
}
if ($rel === '') continue;
$target = $root . $rel;
if (substr($name, -1) === '/') {
	if (!is_dir($target) && !mnbt_updater_mkdir($target)) {
		$zip->close();
		$err = '目录创建失败：' . $rel;
		return false;
	}
	continue;
}
$dir = dirname($target);
if (!is_dir($dir) && !mnbt_updater_mkdir($dir)) {
	$zip->close();
	$err = '目录创建失败：' . $dir;
	return false;
}
$src = $zip->getStream($name);
if ($src === false) {
	$zip->close();
	$err = '条目读取失败：' . $rel;
	return false;
}
$dst = @fopen($target, 'wb');
if (!$dst) {
	fclose($src);
	$zip->close();
	$err = '文件写入失败：' . $rel;
	return false;
}
stream_copy_to_stream($src, $dst);
fclose($dst);
fclose($src);
}
$zip->close();
return true;
755}
756
757/** 需要备份还原的本地文件：装完就有、包里有但不能被覆盖 */
758function mnbt_updater_local_files()
759{
return ['config.php', 'cf_up.php', 'MPHX/SQ.php', 'install/install.lock'];
761}
762
763/** 需要备份还原的本地目录：包里可能带着作者的数据，整目录换回来 */
764function mnbt_updater_local_dirs()
765{
return ['api/cookie'];
767}
768
769/** 递归删除目录（只用于更新流程自己产生的临时目录） */
770function mnbt_updater_rrmdir($dir)
771{
if (!is_dir($dir)) return;
$items = @scandir($dir);
if (!is_array($items)) return;
foreach ($items as $it) {
if ($it === '.' || $it === '..') continue;
$p = $dir . '/' . $it;
if (is_dir($p)) {
	mnbt_updater_rrmdir($p);
} else {
	@unlink($p);
}
}
@rmdir($dir);
785}
786
787/** 递归复制目录 */
788function mnbt_updater_copy_dir($src, $dst)
789{
if (!is_dir($src)) return;
if (!is_dir($dst) && !mnbt_updater_mkdir($dst)) return;
$items = @scandir($src);
if (!is_array($items)) return;
foreach ($items as $it) {
if ($it === '.' || $it === '..') continue;
$s = $src . '/' . $it;
$d = $dst . '/' . $it;
if (is_dir($s)) {
	mnbt_updater_copy_dir($s, $d);
} else {
	@copy($s, $d);
}
}
804}
805
806/**
* 备份本地文件（记录哪些原本存在，install.lock 之类要按原样决定留还是删）
* @return array ['dir'=>备份目录,'files'=>[相对路径=>是否已备份],'dirs'=>[...],'present'=>[...]]
*/
810function mnbt_updater_backup_local($root, $bak_dir, &$err)
811{
$err = '';
$st = ['dir' => $bak_dir, 'files' => [], 'dirs' => [], 'present' => []];
if (!mnbt_updater_mkdir($bak_dir)) {
$err = '备份目录创建失败：' . $bak_dir;
return $st;
}
foreach (mnbt_updater_local_files() as $rel) {
$src = $root . $rel;
$st['present'][$rel] = is_file($src);
if (!is_file($src)) continue;
$dst = $bak_dir . '/' . $rel;
if (!is_dir(dirname($dst)) && !mnbt_updater_mkdir(dirname($dst))) {
	$err = '备份目录创建失败：' . dirname($dst);
	continue;
}
if (@copy($src, $dst)) {
	$st['files'][$rel] = 1;
} else {
	$err = '本地文件备份失败：' . $rel;
}
}
foreach (mnbt_updater_local_dirs() as $rel) {
$src = rtrim($root, '/') . '/' . $rel;
$st['present'][$rel] = is_dir($src);
if (!is_dir($src)) continue;
mnbt_updater_copy_dir($src, $bak_dir . '/' . $rel);
$st['dirs'][$rel] = 1;
}
return $st;
841}
842
843/**
* 还原本地文件；backup 为空数组时按「跳过备份」处理，只保证不会误判成未安装
* @return bool
*/
847function mnbt_updater_restore_local($root, $backup, &$err)
848{
$err = '';
$dir = isset($backup['dir']) ? $backup['dir'] : '';
if ($dir === '' || !is_dir($dir)) return true;
foreach ($backup['files'] as $rel => $ok) {
if (empty($ok)) continue;
$bak = $dir . '/' . $rel;
if (is_file($bak)) {
	$dst = $root . $rel;
	if (!is_dir(dirname($dst)) && !mnbt_updater_mkdir(dirname($dst))) {
		$err .= '无法还原目录：' . dirname($dst) . '；';
		continue;
	}
	if (!@copy($bak, $dst)) $err .= '本地文件还原失败：' . $rel . '；';
}
}
// 新包带的安装锁不能让站点被判定为未安装，原本没有就必须删掉
$lock = $root . 'install/install.lock';
if (empty($backup['files']['install/install.lock']) && is_file($lock)) {
@unlink($lock);
}
foreach ($backup['dirs'] as $rel => $ok) {
if (empty($ok)) continue;
$target = rtrim($root, '/') . '/' . $rel;
mnbt_updater_rrmdir($target);
mnbt_updater_copy_dir($dir . '/' . $rel, $target);
}
// 站点原本没有这些目录时，包里带进来的同名内容一律清掉（例如作者打包残留的 cookie）
foreach ($backup['present'] as $rel => $existed) {
if (!empty($existed)) continue;
$p = rtrim($root, '/') . '/' . $rel;
if (is_dir($p)) {
	mnbt_updater_rrmdir($p);
}
}
return $err === '';
884}
885
886/** 更新流程的兜底状态：任何中断路径（超时、致命错误、用户关页面）都要收拾残局 */
887function mnbt_updater_guard_start()
888{
$GLOBALS['mnbt_updater_guard'] = [
'running' => 1, 'root' => mnbt_updater_root(), 'zip' => '', 'bak' => '',
'admin_now' => '', 'admin_orig' => '', 'moved' => 0, 'backup' => null, 'restored' => 0,
];
register_shutdown_function('mnbt_updater_guard_shutdown');
894}
895
896/** 更新兜底状态的某个键 */
897function mnbt_updater_guard($key, $val)
898{
if (!isset($GLOBALS['mnbt_updater_guard']) || !is_array($GLOBALS['mnbt_updater_guard'])) {
$GLOBALS['mnbt_updater_guard'] = [];
}
$GLOBALS['mnbt_updater_guard'][$key] = $val;
903}
904
905/** 流程正常收尾：关掉兜底，避免残局处理再动一次文件 */
906function mnbt_updater_guard_done()
907{
$GLOBALS['mnbt_updater_guard']['running'] = 0;
909}
910
911/**
* 回滚/收尾：还原本地配置 → 把改名后的后台目录还原 → 清临时包与备份
* 成功与失败都走这里，所以逻辑必须可重复执行
*/
915function mnbt_updater_guard_rollback()
916{
$g = $GLOBALS['mnbt_updater_guard'] ?? null;
if (!is_array($g)) return;
$root = !empty($g['root']) ? $g['root'] : mnbt_updater_root();
if (!empty($g['backup']) && empty($g['restored'])) {
$re = '';
mnbt_updater_restore_local($root, $g['backup'], $re);
$GLOBALS['mnbt_updater_guard']['restored'] = 1;
}
if (!empty($g['moved']) && !empty($g['admin_orig']) && !empty($g['admin_now']) && $g['admin_now'] !== $g['admin_orig']) {
if (!file_exists($g['admin_orig'])) {
	@rename($g['admin_now'], $g['admin_orig']);
} elseif (is_dir($g['admin_orig']) && !is_dir($g['admin_now'] . '/api')) {
	// 新包里恰好带了同名目录：先删掉空的占位目录再改回来
	@rmdir($g['admin_orig']);
	if (!file_exists($g['admin_orig'])) @rename($g['admin_now'], $g['admin_orig']);
}
}
if (!empty($g['zip']) && is_file($g['zip'])) @unlink($g['zip']);
if (!empty($g['bak']) && is_dir($g['bak'])) mnbt_updater_rrmdir($g['bak']);
936}
937
938/** 关机兜底：流程没正常跑完时至少把站点恢复成可访问状态 */
939function mnbt_updater_guard_shutdown()
940{
$g = $GLOBALS['mnbt_updater_guard'] ?? null;
if (!is_array($g) || empty($g['running'])) return;
mnbt_updater_guard_rollback();
944}
945
946/**
* V1.85 迁移链（MPHX/migrations.php / MN_dbver 游标表）的旧式兼容路径：
* 仅用于执行发布包里遗留的单文件 update/update.sql，按分号逐句跑，不做 DELIMITER 切分。
* 新版本请改放 update/update_v<3位或4位>_<slug>.sql，走 mnbt_migrations_run。
* 注意参数顺序是 mysqli(host, user, pwd, dbname[, port])，旧代码把 dbname 和 pwd 传反了，
* 导致连接总是失败，这里按正确顺序传
* @return string 空串表示成功，否则为错误说明
*/
954function mnbt_updater_run_sql($file, $dbconfig)
955{
if (!is_file($file)) return '';
$_sql = @file_get_contents($file);
if ($_sql === false || trim($_sql) === '') return '';
$port = !empty($dbconfig['port']) ? (int)$dbconfig['port'] : 3306;
try {
$_mysqli = new mysqli($dbconfig['host'], $dbconfig['user'], $dbconfig['pwd'], $dbconfig['dbname'], $port);
} catch (Throwable $e) {
return '连接数据库出错：' . $e->getMessage();
}
if (mysqli_connect_errno()) {
return '连接数据库出错：' . mysqli_connect_error();
}
$_mysqli->query('set names utf8;');
foreach (explode(';', $_sql) as $_value) {
if (trim((string)$_value) === '') continue;
$_mysqli->query($_value);
}
$_mysqli->close();
return '';
975}