PHP Application Updates

Question

I am writing a web app in PHP, and it has come time to build an update system, one of the requirements is automatic updates, how should I do this?

I want to do it without a cron, so I'm going to have to check for updates when requests are made to the system, should I do this only when an admin, with significant privs, logs-in, I think this is going to be the best but at least 1 client has said they don't want this because they only intend to login every few month, and they still want to get the security updates.

Answer 1

Perhaps you can have a page on your site that returns a small XML file with the most current version number and a URL for download:

<xml> <version>1.x.y</version> <url>http://example.com/current.tgz </url> </xml>

Then if the admin chooses to perform and upgrade, your application won't need to know anything other than the URL to the XML file and the current version number.

Of course this is a very limited example upon which you can expand to your hearts content.

Answer 2

Who's going to be creating the updates? If it's you, why not just have the updates pushed to the server when they're made? Once an update is written, just rsync it over and the server will be immediately up to date. It beats cron, and it definitely beats checking while your users are waiting for their page to load.

Answer 3

Use versioning ofcourse!

I include this 'plugin' in most of my production sites: Ofcourse, you need to create a limited-rights robot svn account for this first and svn must be installed on the server.

    <?php

    echo(' updating from svn<br>' );
    $username = Settings::Load()->Get('svn','username');
    $password = Settings::Load()->Get('svn','password');
    echo(" <pre>" );
    $repos = Settings::Load()->Get('svn' , 'repository');
    echo system ("svn export --username={$username} --password {$password} {$repos}includes/ ".dirname(__FILE__)."/../includes --force");
    echo system("svn export --username={$username} --password {$password} {$repos}plugins/ ".dirname(__FILE__)."/../plugins --force");

    die();

Make sure you put this behind a .htpasswded site ofcourse, and make sure you do not update the 'production settings' from SVN. Et voila, You update your complete code base with one HTTP query to your site :) SVN overwrites the files automatically, there's no hidden files or folders left behind and its easily adapted to update or revert to a specific version. Now all your team needs to do is commit to their SVN repository, run this piece of code on the testing environment, make sure everything works and then run it on production :)