Merge pull request #7327 from piwik/https-update

Update Piwik over HTTPS

4 files changed, 37 insertions, 2 deletions

diff --git a/plugins/CoreUpdater/Controller.php b/plugins/CoreUpdater/Controller.php
index 90b0d13aa5..c8f3e927b5 100644
--- a/plugins/CoreUpdater/Controller.php
+++ b/plugins/CoreUpdater/Controller.php
@@ -37,6 +37,8 @@ use Piwik\View;
 class Controller extends \Piwik\Plugin\Controller
 {
     const PATH_TO_EXTRACT_LATEST_VERSION = '/latest/';
+    const LATEST_VERSION_URL = '://builds.piwik.org/piwik.zip';
+    const LATEST_BETA_VERSION_URL = '://builds.piwik.org/piwik-%s.zip';
 
     private $coreError = false;
     private $warningMessages = array();
@@ -48,9 +50,18 @@ class Controller extends \Piwik\Plugin\Controller
     protected static function getLatestZipUrl($newVersion)
     {
         if (@Config::getInstance()->Debug['allow_upgrades_to_beta']) {
-            return 'http://builds.piwik.org/piwik-' . $newVersion . '.zip';
+            $url = sprintf(self::LATEST_BETA_VERSION_URL, $newVersion);
+        } else {
+            $url = self::LATEST_VERSION_URL;
+        }
+
+        if (self::isUpdatingOverHttps()) {
+            $url = 'https' . $url;
+        } else {
+            $url = 'http' . $url;
         }
-        return Config::getInstance()->General['latest_version_url'];
+
+        return $url;
     }
 
     public function newVersionAvailable()
@@ -426,4 +437,11 @@ class Controller extends \Piwik\Plugin\Controller
         return PluginManager::getInstance()->getIncompatiblePlugins($piwikVersion);
     }
 
+    public static function isUpdatingOverHttps()
+    {
+        $openSslEnabled = extension_loaded('openssl');
+        $usingMethodSupportingHttps = (Http::getTransportMethod() !== 'socket');
+
+        return $openSslEnabled && $usingMethodSupportingHttps;
+    }
 }
diff --git a/plugins/Installation/SystemCheck.php b/plugins/Installation/SystemCheck.php
index de55506884..93ed1ac75f 100644
--- a/plugins/Installation/SystemCheck.php
+++ b/plugins/Installation/SystemCheck.php
@@ -19,6 +19,7 @@ use Piwik\Filechecks;
 use Piwik\Filesystem;
 use Piwik\Http;
 use Piwik\Piwik;
+use Piwik\Plugins\CoreUpdater;
 use Piwik\Plugins\UserCountry\LocationProvider;
 use Piwik\SettingsServer;
 use Piwik\Url;
@@ -102,6 +103,9 @@ class SystemCheck
         $infos['tracker_status'] = Common::getRequestVar('trackerStatus', 0, 'int');
 
         $infos['is_nfs'] = Filesystem::checkIfFileSystemIsNFS();
+
+        $infos['https_update'] = CoreUpdater\Controller::isUpdatingOverHttps();
+
         $infos = self::enrichSystemChecks($infos);
 
         return $infos;
diff --git a/plugins/Installation/lang/en.json b/plugins/Installation/lang/en.json
index 9711d997c3..2d3afbf8c9 100644
--- a/plugins/Installation/lang/en.json
+++ b/plugins/Installation/lang/en.json
@@ -115,6 +115,8 @@
         "SystemCheckCronArchiveProcess": "Archive Cron",
         "SystemCheckCronArchiveProcessCLI": "Managing processes via CLI",
         "SystemCheckPhpSetting": "To prevent some critical issue, you must set the following in your php.ini file: %s",
+        "SystemCheckUpdateHttps": "Update over HTTPS",
+        "SystemCheckUpdateHttpsNotSupported": "Piwik cannot use HTTPS to update, it will fall back to the insecure HTTP update. Check that CURL or allow_url_fopen is supported and that the openssl PHP extension is installed: http://piwik.org/faq/troubleshooting/faq_177/.",
         "NotSupported": "not supported",
         "Tables": "Creating the Tables",
         "TablesCreatedSuccess": "Tables created with success!",
diff --git a/plugins/Installation/templates/_systemCheckSection.twig b/plugins/Installation/templates/_systemCheckSection.twig
index f797d18969..b56db9b672 100755
--- a/plugins/Installation/templates/_systemCheckSection.twig
+++ b/plugins/Installation/templates/_systemCheckSection.twig
@@ -356,6 +356,17 @@
         </tr>
     {% endif %}
 
+    <tr>
+        <td class="label">{{ 'Installation_SystemCheckUpdateHttps'|translate }}</td>
+        <td>
+            {% if infos.https_update %}
+                {{ ok }}
+            {% else %}
+                {{ warning }} {{ 'Installation_SystemCheckUpdateHttpsNotSupported'|translate }}
+            {% endif %}
+        </td>
+    </tr>
+
 </table>
 
 {% include "@Installation/_integrityDetails.twig" %}