mirror of
https://github.com/itflow-org/itflow
synced 2026-08-05 15:17:17 +00:00
ae468d6cee
Backups are now AES-256 encrypted zips in three types (full, database only, master key), catalogued in a new backups table, built by cron rather than the web request, and kept under uploads/backups with retention in the nightly job. The encryption key is one value per install held in config.php, never in the database and never in the file name. Restore is shared by the setup wizard and the new scripts/restore_cli.php, which is the only path without an upload size limit. It verifies the key and unpacks the archive before dropping anything, and dumps the current database first so a failed import is rolled back. A backup dumps, zips and encrypts for minutes without issuing a query, so on a server with a short wait_timeout the connection is closed underneath it and the UPDATE marking the backup complete is what fails - long after the archive was written correctly. The connection is now held open for the job and re-established before any write that follows long file work, including the database phase of a restore. Retention recovers rows a dropped connection left behind: still Running after six hours becomes Complete if the archive is on disk, Failed if it is not. cron.php's own failure path is hardened to match. It recorded job failures through the same connection the failing job had just killed, so an uncaught exception ended the dispatch and no trace of the original error survived. Failures now also echo to stdout, so cron mails something useful when the database is unreachable. Security: the setup wizard's restore step is now closed on any install that has users, whatever config.php says. $config_enable_setup defaulted to enabled when the flag was absent, and the flag is only written at the end of a successful install, so an install abandoned partway left an unauthenticated endpoint that would drop every table, import an attacker-supplied archive, and overwrite uploads/ including the .htaccess that stops PHP running there. Affects 26.07 and earlier. Restoring over a live install is now CLI only.
39 lines
2.1 KiB
PHP
39 lines
2.1 KiB
PHP
<?php
|
|
|
|
/*
|
|
* ITFlow - Database update to version 2.6.4 (from 2.6.3)
|
|
* Included by admin/database_updates.php - do not access directly
|
|
*/
|
|
|
|
defined('FROM_DB_UPDATER') || die("Direct file access is not allowed");
|
|
|
|
// Backup catalogue - one row per archive produced, so the app knows what exists
|
|
// without trusting a directory listing
|
|
|
|
mysqli_query($mysqli, "CREATE TABLE IF NOT EXISTS `backups` (
|
|
`backup_id` int(11) NOT NULL AUTO_INCREMENT,
|
|
`backup_type` varchar(20) NOT NULL DEFAULT 'full',
|
|
`backup_file_name` varchar(255) NOT NULL,
|
|
`backup_size` bigint(20) NOT NULL DEFAULT 0,
|
|
`backup_sha256` varchar(64) DEFAULT NULL,
|
|
`backup_status` varchar(20) NOT NULL DEFAULT 'Pending',
|
|
`backup_error` text DEFAULT NULL,
|
|
`backup_source` varchar(20) NOT NULL DEFAULT 'Manual',
|
|
`backup_created_by` varchar(200) DEFAULT NULL,
|
|
`backup_created_at` datetime NOT NULL DEFAULT current_timestamp(),
|
|
`backup_completed_at` datetime DEFAULT NULL,
|
|
`backup_downloaded_at` datetime DEFAULT NULL,
|
|
PRIMARY KEY (`backup_id`),
|
|
KEY `backup_status_created` (`backup_status`, `backup_created_at`)
|
|
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci");
|
|
|
|
// Retention and what the scheduled backup produces
|
|
mysqli_query($mysqli, "ALTER TABLE settings ADD COLUMN IF NOT EXISTS `config_backup_retention_days` int(11) NOT NULL DEFAULT 30");
|
|
mysqli_query($mysqli, "ALTER TABLE settings ADD COLUMN IF NOT EXISTS `config_backup_retention_count` int(11) NOT NULL DEFAULT 5");
|
|
mysqli_query($mysqli, "ALTER TABLE settings ADD COLUMN IF NOT EXISTS `config_backup_cron_type` varchar(20) NOT NULL DEFAULT 'full'");
|
|
|
|
// Seed the scheduled backup job. The dispatcher would create this row itself the first
|
|
// time it sees the job, but seeding it here means the schedule is right on an install
|
|
// that already has cron_jobs rows - the every-minute default bit us once already.
|
|
mysqli_query($mysqli, "INSERT IGNORE INTO cron_jobs SET cron_job_name = 'backup', cron_job_enabled = 0, cron_job_schedule = 'Daily', cron_job_daily_at = '02:00'");
|