primo commit

administrator/components/com_joomlaupdate/src/Controller/DisplayController.php

@@ -0,0 +1,119 @@
+<?php
+
+/**
+ * @package     Joomla.Administrator
+ * @subpackage  com_joomlaupdate
+ *
+ * @copyright   (C) 2012 Open Source Matters, Inc. <https://www.joomla.org>
+ * @license     GNU General Public License version 2 or later; see LICENSE.txt
+ */
+
+namespace Joomla\Component\Joomlaupdate\Administrator\Controller;
+
+use Joomla\CMS\Language\Text;
+use Joomla\CMS\MVC\Controller\BaseController;
+use Joomla\CMS\Response\JsonResponse;
+use Joomla\CMS\Router\Route;
+
+// phpcs:disable PSR1.Files.SideEffects
+\defined('_JEXEC') or die;
+// phpcs:enable PSR1.Files.SideEffects
+
+/**
+ * Joomla! Update Controller
+ *
+ * @since  2.5.4
+ */
+class DisplayController extends BaseController
+{
+    /**
+     * Method to display a view.
+     *
+     * @param   boolean  $cachable   If true, the view output will be cached.
+     * @param   array    $urlparams  An array of safe URL parameters and their variable types.
+     *                   @see        \Joomla\CMS\Filter\InputFilter::clean() for valid values.
+     *
+     * @return  static   This object to support chaining.
+     *
+     * @since   2.5.4
+     */
+    public function display($cachable = false, $urlparams = false)
+    {
+        // Get the document object.
+        $document = $this->app->getDocument();
+
+        // Set the default view name and format from the Request.
+        $vName   = $this->input->get('view', 'Joomlaupdate');
+        $vFormat = $document->getType();
+        $lName   = $this->input->get('layout', 'default', 'string');
+
+        // Get and render the view.
+        if ($view = $this->getView($vName, $vFormat)) {
+            // Only super user can access file upload
+            if ($view == 'upload' && !$this->app->getIdentity()->authorise('core.admin', 'com_joomlaupdate')) {
+                $this->app->redirect(Route::_('index.php?option=com_joomlaupdate', true));
+            }
+
+            // Get the model for the view.
+            /** @var \Joomla\Component\Joomlaupdate\Administrator\Model\UpdateModel $model */
+            $model = $this->getModel('Update');
+
+            /** @var ?\Joomla\Component\Installer\Administrator\Model\WarningsModel $warningsModel */
+            $warningsModel = $this->app->bootComponent('com_installer')
+                ->getMVCFactory()->createModel('Warnings', 'Administrator', ['ignore_request' => true]);
+
+            if ($warningsModel !== null) {
+                $view->setModel($warningsModel, false);
+            }
+
+            // Check for update result
+            if ($lName === 'complete') {
+                $state = $model->getState();
+                $state->set('update_finished_with_error', $this->app->getUserState('com_joomlaupdate.update_finished_with_error'));
+                $state->set('update_errors', (array) $this->app->getUserState('com_joomlaupdate.update_errors', []));
+                $state->set('update_channel_reset', $this->app->getUserState('com_joomlaupdate.update_channel_reset'));
+                $state->set('installer_message', $this->app->getUserState('com_joomlaupdate.installer_message'));
+                $state->set('log_file', $this->app->get('log_path') . '/joomla_update.php');
+            }
+
+            // Perform update source preference check and refresh update information.
+            $model->applyUpdateSite();
+            $model->refreshUpdates();
+
+            // Push the model into the view (as default).
+            $view->setModel($model, true);
+            $view->setLayout($lName);
+
+            // Push document object into the view.
+            $view->document = $document;
+            $view->display();
+        }
+
+        return $this;
+    }
+
+    /**
+     * Provide the data for a badge in a menu item via JSON
+     *
+     * @return  void
+     *
+     * @since   4.0.0
+     * @throws  \Exception
+     */
+    public function getMenuBadgeData()
+    {
+        if (!$this->app->getIdentity()->authorise('core.manage', 'com_joomlaupdate')) {
+            throw new \Exception(Text::_('JGLOBAL_AUTH_ACCESS_DENIED'));
+        }
+
+        $model = $this->getModel('Update');
+
+        $model->refreshUpdates();
+
+        $joomlaUpdate = $model->getUpdateInformation();
+
+        $hasUpdate = $joomlaUpdate['hasUpdate'] ? $joomlaUpdate['latest'] : '';
+
+        echo new JsonResponse($hasUpdate);
+    }
+}

administrator/components/com_joomlaupdate/src/Controller/UpdateController.php

@@ -0,0 +1,715 @@
+<?php
+
+/**
+ * @package     Joomla.Administrator
+ * @subpackage  com_joomlaupdate
+ *
+ * @copyright   (C) 2012 Open Source Matters, Inc. <https://www.joomla.org>
+ * @license     GNU General Public License version 2 or later; see LICENSE.txt
+ */
+
+namespace Joomla\Component\Joomlaupdate\Administrator\Controller;
+
+use Joomla\CMS\Factory;
+use Joomla\CMS\Installer\Installer;
+use Joomla\CMS\Language\Text;
+use Joomla\CMS\Log\Log;
+use Joomla\CMS\MVC\Controller\BaseController;
+use Joomla\CMS\Response\JsonResponse;
+use Joomla\CMS\Session\Session;
+use Joomla\Component\Joomlaupdate\Administrator\Model\UpdateModel;
+
+// phpcs:disable PSR1.Files.SideEffects
+\defined('_JEXEC') or die;
+// phpcs:enable PSR1.Files.SideEffects
+
+/**
+ * The Joomla! update controller for the Update view
+ *
+ * @since  2.5.4
+ */
+class UpdateController extends BaseController
+{
+    /**
+     * Performs the download of the update package
+     *
+     * @return  void
+     *
+     * @since   2.5.4
+     */
+    public function download()
+    {
+        $this->checkToken();
+
+        /** @var \Joomla\Component\Joomlaupdate\Administrator\Model\UpdateModel $model */
+        $model = $this->getModel('Update');
+        $user  = $this->app->getIdentity();
+
+        // Make sure logging is working before continue
+        try {
+            Log::add('Test logging', Log::INFO, 'Update');
+        } catch (\Throwable $e) {
+            $message = Text::sprintf('COM_JOOMLAUPDATE_UPDATE_LOGGING_TEST_FAIL', $e->getMessage());
+            $this->setRedirect('index.php?option=com_joomlaupdate', $message, 'error');
+            return;
+        }
+
+        Log::add(Text::sprintf('COM_JOOMLAUPDATE_UPDATE_LOG_START', $user->id, $user->name, \JVERSION), Log::INFO, 'Update');
+
+        $result = $model->download();
+        $file   = $result['basename'];
+
+        $message     = null;
+        $messageType = null;
+
+        // The versions mismatch (Use \JVERSION as target version when not set in case of reinstall core files)
+        if ($result['version'] !== $this->input->get('targetVersion', \JVERSION, 'string')) {
+            $message     = Text::_('COM_JOOMLAUPDATE_VIEW_UPDATE_VERSION_WRONG');
+            $messageType = 'error';
+            $url         = 'index.php?option=com_joomlaupdate';
+
+            $this->app->setUserState('com_joomlaupdate.file', null);
+            $this->setRedirect($url, $message, $messageType);
+
+            Log::add($message, Log::ERROR, 'Update');
+
+            return;
+        }
+
+        // The validation was not successful so stop.
+        if ($result['check'] === false) {
+            $message     = Text::_('COM_JOOMLAUPDATE_VIEW_UPDATE_CHECKSUM_WRONG');
+            $messageType = 'error';
+            $url         = 'index.php?option=com_joomlaupdate';
+
+            $this->app->setUserState('com_joomlaupdate.file', null);
+            $this->setRedirect($url, $message, $messageType);
+
+            Log::add($message, Log::ERROR, 'Update');
+
+            return;
+        }
+
+        if ($file) {
+            $this->app->setUserState('com_joomlaupdate.file', $file);
+            $url = 'index.php?option=com_joomlaupdate&task=update.install&' . $this->app->getSession()->getFormToken() . '=1';
+
+            Log::add(Text::sprintf('COM_JOOMLAUPDATE_UPDATE_LOG_FILE', $file), Log::INFO, 'Update');
+        } else {
+            $this->app->setUserState('com_joomlaupdate.file', null);
+            $url         = 'index.php?option=com_joomlaupdate';
+            $message     = Text::_('COM_JOOMLAUPDATE_VIEW_UPDATE_DOWNLOADFAILED');
+            $messageType = 'error';
+        }
+
+        $this->setRedirect($url, $message, $messageType);
+    }
+
+    /**
+     * Start the installation of the new Joomla! version
+     *
+     * @return  void
+     *
+     * @since   2.5.4
+     */
+    public function install()
+    {
+        $this->checkToken('get');
+        $this->app->setUserState('com_joomlaupdate.oldversion', JVERSION);
+
+        /** @var \Joomla\Component\Joomlaupdate\Administrator\Model\UpdateModel $model */
+        $model = $this->getModel('Update');
+
+        Log::add(Text::_('COM_JOOMLAUPDATE_UPDATE_LOG_INSTALL'), Log::INFO, 'Update');
+
+        $file = $this->app->getUserState('com_joomlaupdate.file', null);
+        $model->createRestorationFile($file);
+
+        $this->display();
+    }
+
+    /**
+     * Finalise the upgrade by running the necessary scripts
+     *
+     * @return  void
+     *
+     * @since   2.5.4
+     */
+    public function finalise()
+    {
+        /*
+         * Finalize with login page. Used for pre-token check versions
+         * to allow updates without problems but with a maximum of security.
+         */
+        if (!Session::checkToken('get')) {
+            $this->setRedirect('index.php?option=com_joomlaupdate&view=update&layout=finaliseconfirm');
+
+            return;
+        }
+
+        /** @var \Joomla\Component\Joomlaupdate\Administrator\Model\UpdateModel $model */
+        $model = $this->getModel('Update');
+
+        try {
+            $model->finaliseUpgrade();
+        } catch (\Throwable $e) {
+            $model->collectError('finaliseUpgrade', $e);
+        }
+
+        // Reset update source from "Joomla Next" to "Default"
+        $this->app->setUserState('com_joomlaupdate.update_channel_reset', $model->resetUpdateSource());
+
+        // Check for update errors
+        if ($model->getErrors()) {
+            // The errors already should be logged at this point
+            // Collect a messages to show them later in the complete page
+            $errors = [];
+            foreach ($model->getErrors() as $error) {
+                $errors[] = $error->getMessage();
+            }
+
+            $this->app->setUserState('com_joomlaupdate.update_finished_with_error', true);
+            $this->app->setUserState('com_joomlaupdate.update_errors', $errors);
+        }
+
+        // Check for captured output messages in the installer
+        $msg = Installer::getInstance()->get('extension_message');
+        if ($msg) {
+            $this->app->setUserState('com_joomlaupdate.installer_message', $msg);
+        }
+
+        $url = 'index.php?option=com_joomlaupdate&task=update.cleanup&' . Session::getFormToken() . '=1';
+        $this->setRedirect($url);
+    }
+
+    /**
+     * Clean up after ourselves
+     *
+     * @return  void
+     *
+     * @since   2.5.4
+     */
+    public function cleanup()
+    {
+        /*
+         * Cleanup with login page. Used for pre-token check versions to be able to update
+         * from =< 3.2.7 to allow updates without problems but with a maximum of security.
+         */
+        if (!Session::checkToken('get')) {
+            $this->setRedirect('index.php?option=com_joomlaupdate&view=update&layout=finaliseconfirm');
+
+            return;
+        }
+
+        /** @var \Joomla\Component\Joomlaupdate\Administrator\Model\UpdateModel $model */
+        $model = $this->getModel('Update');
+
+        try {
+            $model->cleanUp();
+        } catch (\Throwable $e) {
+            $model->collectError('cleanUp', $e);
+        }
+
+        // Check for update errors
+        if ($model->getErrors()) {
+            // The errors already should be logged at this point
+            // Collect a messages to show them later in the complete page
+            $errors = $this->app->getUserState('com_joomlaupdate.update_errors', []);
+            foreach ($model->getErrors() as $error) {
+                $errors[] = $error->getMessage();
+            }
+
+            $this->app->setUserState('com_joomlaupdate.update_finished_with_error', true);
+            $this->app->setUserState('com_joomlaupdate.update_errors', $errors);
+        }
+
+        $url = 'index.php?option=com_joomlaupdate&view=joomlaupdate&layout=complete';
+
+        // In case for errored update, redirect to component view
+        if ($this->app->getUserState('com_joomlaupdate.update_finished_with_error')) {
+            $url .= '&tmpl=component';
+        }
+
+        $this->setRedirect($url);
+    }
+
+    /**
+     * Purges updates.
+     *
+     * @return  void
+     *
+     * @since   3.0
+     */
+    public function purge()
+    {
+        // Check for request forgeries
+        $this->checkToken('request');
+
+        // Purge updates
+        /** @var \Joomla\Component\Joomlaupdate\Administrator\Model\UpdateModel $model */
+        $model = $this->getModel('Update');
+        $model->purge();
+
+        $url = 'index.php?option=com_joomlaupdate';
+        $this->setRedirect($url, $model->_message);
+    }
+
+    /**
+     * Uploads an update package to the temporary directory, under a random name
+     *
+     * @return  void
+     *
+     * @since   3.6.0
+     */
+    public function upload()
+    {
+        // Check for request forgeries
+        $this->checkToken();
+
+        // Did a non Super User tried to upload something (a.k.a. pathetic hacking attempt)?
+        $this->app->getIdentity()->authorise('core.admin') or jexit(Text::_('JLIB_APPLICATION_ERROR_ACCESS_FORBIDDEN'));
+
+        /** @var \Joomla\Component\Joomlaupdate\Administrator\Model\UpdateModel $model */
+        $model = $this->getModel('Update');
+
+        // Make sure logging is working before continue
+        try {
+            Log::add('Test logging', Log::INFO, 'Update');
+        } catch (\Throwable $e) {
+            $message = Text::sprintf('COM_JOOMLAUPDATE_UPDATE_LOGGING_TEST_FAIL', $e->getMessage());
+            $this->setRedirect('index.php?option=com_joomlaupdate', $message, 'error');
+            return;
+        }
+
+        Log::add(Text::_('COM_JOOMLAUPDATE_UPDATE_LOG_UPLOAD'), Log::INFO, 'Update');
+
+        try {
+            $model->upload();
+        } catch (\RuntimeException $e) {
+            $url = 'index.php?option=com_joomlaupdate';
+            $this->setRedirect($url, $e->getMessage(), 'error');
+
+            return;
+        }
+
+        $token = Session::getFormToken();
+        $url   = 'index.php?option=com_joomlaupdate&task=update.captive&' . $token . '=1';
+        $this->setRedirect($url);
+    }
+
+    /**
+     * Checks there is a valid update package and redirects to the captive view for super admin authentication.
+     *
+     * @return  void
+     *
+     * @since   3.6.0
+     */
+    public function captive()
+    {
+        // Check for request forgeries
+        $this->checkToken('get');
+
+        // Did a non Super User tried to upload something (a.k.a. pathetic hacking attempt)?
+        if (!$this->app->getIdentity()->authorise('core.admin')) {
+            throw new \RuntimeException(Text::_('JLIB_APPLICATION_ERROR_ACCESS_FORBIDDEN'), 403);
+        }
+
+        // Do I really have an update package?
+        $tempFile = $this->app->getUserState('com_joomlaupdate.temp_file', null);
+
+        if (empty($tempFile) || !is_file($tempFile)) {
+            throw new \RuntimeException(Text::_('JLIB_APPLICATION_ERROR_ACCESS_FORBIDDEN'), 403);
+        }
+
+        $this->input->set('view', 'upload');
+        $this->input->set('layout', 'captive');
+
+        $this->display();
+    }
+
+    /**
+     * Checks the admin has super administrator privileges and then proceeds with the update.
+     *
+     * @return  void
+     *
+     * @since   3.6.0
+     */
+    public function confirm()
+    {
+        // Check for request forgeries
+        $this->checkToken();
+
+        // Did a non Super User tried to upload something (a.k.a. pathetic hacking attempt)?
+        if (!$this->app->getIdentity()->authorise('core.admin')) {
+            throw new \RuntimeException(Text::_('JLIB_APPLICATION_ERROR_ACCESS_FORBIDDEN'), 403);
+        }
+
+        /** @var \Joomla\Component\Joomlaupdate\Administrator\Model\UpdateModel $model */
+        $model = $this->getModel('Update');
+
+        // Get the captive file before the session resets
+        $tempFile = $this->app->getUserState('com_joomlaupdate.temp_file', null);
+
+        // Do I really have an update package?
+        if (!$model->captiveFileExists()) {
+            throw new \RuntimeException(Text::_('JLIB_APPLICATION_ERROR_ACCESS_FORBIDDEN'), 403);
+        }
+
+        // Try to log in
+        $credentials = [
+            'username'  => $this->input->post->get('username', '', 'username'),
+            'password'  => $this->input->post->get('passwd', '', 'raw'),
+            'secretkey' => $this->input->post->get('secretkey', '', 'raw'),
+        ];
+
+        $result = $model->captiveLogin($credentials);
+
+        if (!$result) {
+            $model->removePackageFiles();
+
+            throw new \RuntimeException(Text::_('JLIB_APPLICATION_ERROR_ACCESS_FORBIDDEN'), 403);
+        }
+
+        // Set the update source in the session
+        $this->app->setUserState('com_joomlaupdate.file', basename($tempFile));
+
+        try {
+            Log::add(Text::sprintf('COM_JOOMLAUPDATE_UPDATE_LOG_FILE', $tempFile), Log::INFO, 'Update');
+        } catch (\RuntimeException $exception) {
+            // Informational log only
+        }
+
+        // Redirect to the actual update page
+        $url = 'index.php?option=com_joomlaupdate&task=update.install&' . Session::getFormToken() . '=1';
+        $this->setRedirect($url);
+    }
+
+    /**
+     * Method to display a view.
+     *
+     * @param   boolean  $cachable   If true, the view output will be cached
+     * @param   array    $urlparams  An array of safe URL parameters and their variable types.
+     *                   @see        \Joomla\CMS\Filter\InputFilter::clean() for valid values.
+     *
+     * @return  static  This object to support chaining.
+     *
+     * @since   2.5.4
+     */
+    public function display($cachable = false, $urlparams = [])
+    {
+        // Get the document object.
+        $document = $this->app->getDocument();
+
+        // Set the default view name and format from the Request.
+        $vName   = $this->input->get('view', 'update');
+        $vFormat = $document->getType();
+        $lName   = $this->input->get('layout', 'default', 'string');
+
+        // Get and render the view.
+        if ($view = $this->getView($vName, $vFormat)) {
+            // Get the model for the view.
+            /** @var \Joomla\Component\Joomlaupdate\Administrator\Model\UpdateModel $model */
+            $model = $this->getModel('Update');
+
+            // Push the model into the view (as default).
+            $view->setModel($model, true);
+            $view->setLayout($lName);
+
+            // Push document object into the view.
+            $view->document = $document;
+            $view->display();
+        }
+
+        return $this;
+    }
+
+    /**
+     * Checks the admin has super administrator privileges and then proceeds with the final & cleanup steps.
+     *
+     * @return  void
+     *
+     * @since   3.6.3
+     */
+    public function finaliseconfirm()
+    {
+        // Check for request forgeries
+        $this->checkToken();
+
+        // Did a non Super User try do this?
+        if (!$this->app->getIdentity()->authorise('core.admin')) {
+            throw new \RuntimeException(Text::_('JLIB_APPLICATION_ERROR_ACCESS_FORBIDDEN'), 403);
+        }
+
+        // Get the model
+        /** @var \Joomla\Component\Joomlaupdate\Administrator\Model\UpdateModel $model */
+        $model = $this->getModel('Update');
+
+        // Try to log in
+        $credentials = [
+            'username'  => $this->input->post->get('username', '', 'username'),
+            'password'  => $this->input->post->get('passwd', '', 'raw'),
+            'secretkey' => $this->input->post->get('secretkey', '', 'raw'),
+        ];
+
+        $result = $model->captiveLogin($credentials);
+
+        // The login fails?
+        if (!$result) {
+            $this->setMessage(Text::_('JGLOBAL_AUTH_INVALID_PASS'), 'warning');
+            $this->setRedirect('index.php?option=com_joomlaupdate&view=update&layout=finaliseconfirm');
+
+            return;
+        }
+
+        // Redirect back to the actual finalise page
+        $this->setRedirect('index.php?option=com_joomlaupdate&task=update.finalise&' . Session::getFormToken() . '=1');
+    }
+
+    /**
+     * Fetch Extension update XML proxy. Used to prevent Access-Control-Allow-Origin errors.
+     * Prints a JSON string.
+     * Called from JS.
+     *
+     * @since       3.10.0
+     *
+     * @deprecated  4.3 will be removed in 6.0
+     *              Use batchextensioncompatibility instead.
+     *              Example: $updateController->batchextensioncompatibility();
+     *
+     * @return void
+     */
+    public function fetchExtensionCompatibility()
+    {
+        $extensionID          = $this->input->get('extension-id', '', 'DEFAULT');
+        $joomlaTargetVersion  = $this->input->get('joomla-target-version', '', 'DEFAULT');
+        $joomlaCurrentVersion = $this->input->get('joomla-current-version', '', JVERSION);
+        $extensionVersion     = $this->input->get('extension-version', '', 'DEFAULT');
+
+        /** @var \Joomla\Component\Joomlaupdate\Administrator\Model\UpdateModel $model */
+        $model                      = $this->getModel('Update');
+        $upgradeCompatibilityStatus = $model->fetchCompatibility($extensionID, $joomlaTargetVersion);
+        $currentCompatibilityStatus = $model->fetchCompatibility($extensionID, $joomlaCurrentVersion);
+        $upgradeUpdateVersion       = false;
+        $currentUpdateVersion       = false;
+
+        $upgradeWarning = 0;
+
+        if ($upgradeCompatibilityStatus->state == 1 && !empty($upgradeCompatibilityStatus->compatibleVersions)) {
+            $upgradeUpdateVersion = end($upgradeCompatibilityStatus->compatibleVersions);
+        }
+
+        if ($currentCompatibilityStatus->state == 1 && !empty($currentCompatibilityStatus->compatibleVersions)) {
+            $currentUpdateVersion = end($currentCompatibilityStatus->compatibleVersions);
+        }
+
+        if ($upgradeUpdateVersion !== false) {
+            $upgradeOldestVersion = $upgradeCompatibilityStatus->compatibleVersions[0];
+
+            if ($currentUpdateVersion !== false) {
+                // If there are updates compatible with both CMS versions use these
+                $bothCompatibleVersions = array_values(
+                    array_intersect($upgradeCompatibilityStatus->compatibleVersions, $currentCompatibilityStatus->compatibleVersions)
+                );
+
+                if (!empty($bothCompatibleVersions)) {
+                    $upgradeOldestVersion = $bothCompatibleVersions[0];
+                    $upgradeUpdateVersion = end($bothCompatibleVersions);
+                }
+            }
+
+            if (version_compare($upgradeOldestVersion, $extensionVersion, '>')) {
+                // Installed version is empty or older than the oldest compatible update: Update required
+                $resultGroup = 2;
+            } else {
+                // Current version is compatible
+                $resultGroup = 3;
+            }
+
+            if ($currentUpdateVersion !== false && version_compare($upgradeUpdateVersion, $currentUpdateVersion, '<')) {
+                // Special case warning when version compatible with target is lower than current
+                $upgradeWarning = 2;
+            }
+        } elseif ($currentUpdateVersion !== false) {
+            // No compatible version for target version but there is a compatible version for current version
+            $resultGroup = 1;
+        } else {
+            // No update server available
+            $resultGroup = 1;
+        }
+
+        // Do we need to capture
+        $combinedCompatibilityStatus = [
+            'upgradeCompatibilityStatus' => (object) [
+                'state'             => $upgradeCompatibilityStatus->state,
+                'compatibleVersion' => $upgradeUpdateVersion,
+            ],
+            'currentCompatibilityStatus' => (object) [
+                'state'             => $currentCompatibilityStatus->state,
+                'compatibleVersion' => $currentUpdateVersion,
+            ],
+            'resultGroup'    => $resultGroup,
+            'upgradeWarning' => $upgradeWarning,
+        ];
+
+        $this->app           = Factory::getApplication();
+        $this->app->mimeType = 'application/json';
+        $this->app->charSet  = 'utf-8';
+        $this->app->setHeader('Content-Type', $this->app->mimeType . '; charset=' . $this->app->charSet);
+        $this->app->sendHeaders();
+
+        try {
+            echo new JsonResponse($combinedCompatibilityStatus);
+        } catch (\Exception $e) {
+            echo $e;
+        }
+
+        $this->app->close();
+    }
+
+    /**
+     * Determines the compatibility information for a number of extensions.
+     *
+     * Called by the Joomla Update JavaScript (PreUpdateChecker.checkNextChunk).
+     *
+     * @return  void
+     * @since   4.2.0
+     *
+     */
+    public function batchextensioncompatibility()
+    {
+        $joomlaTargetVersion  = $this->input->post->get('joomla-target-version', '', 'DEFAULT');
+        $joomlaCurrentVersion = $this->input->post->get('joomla-current-version', JVERSION);
+        $extensionInformation = $this->input->post->get('extensions', []);
+
+        /** @var \Joomla\Component\Joomlaupdate\Administrator\Model\UpdateModel $model */
+        $model = $this->getModel('Update');
+
+        $extensionResults = [];
+        $leftover         = [];
+        $startTime        = microtime(true);
+
+        foreach ($extensionInformation as $information) {
+            // Only process an extension if we have spent less than 5 seconds already
+            $currentTime = microtime(true);
+
+            if ($currentTime - $startTime > 5.0) {
+                $leftover[] = $information;
+
+                continue;
+            }
+
+            // Get the extension information and fetch its compatibility information
+            $extensionID                = $information['eid'] ?: '';
+            $extensionVersion           = $information['version'] ?: '';
+            $upgradeCompatibilityStatus = $model->fetchCompatibility($extensionID, $joomlaTargetVersion);
+            $currentCompatibilityStatus = $model->fetchCompatibility($extensionID, $joomlaCurrentVersion);
+            $upgradeUpdateVersion       = false;
+            $currentUpdateVersion       = false;
+            $upgradeWarning             = 0;
+
+            if ($upgradeCompatibilityStatus->state == 1 && !empty($upgradeCompatibilityStatus->compatibleVersions)) {
+                $upgradeUpdateVersion = end($upgradeCompatibilityStatus->compatibleVersions);
+            }
+
+            if ($currentCompatibilityStatus->state == 1 && !empty($currentCompatibilityStatus->compatibleVersions)) {
+                $currentUpdateVersion = end($currentCompatibilityStatus->compatibleVersions);
+            }
+
+            if ($upgradeUpdateVersion !== false) {
+                $upgradeOldestVersion = $upgradeCompatibilityStatus->compatibleVersions[0];
+
+                if ($currentUpdateVersion !== false) {
+                    // If there are updates compatible with both CMS versions use these
+                    $bothCompatibleVersions = array_values(
+                        array_intersect($upgradeCompatibilityStatus->compatibleVersions, $currentCompatibilityStatus->compatibleVersions)
+                    );
+
+                    if (!empty($bothCompatibleVersions)) {
+                        $upgradeOldestVersion = $bothCompatibleVersions[0];
+                        $upgradeUpdateVersion = end($bothCompatibleVersions);
+                    }
+                }
+
+                if (version_compare($upgradeOldestVersion, $extensionVersion, '>')) {
+                    // Installed version is empty or older than the oldest compatible update: Update required
+                    $resultGroup = 2;
+                } else {
+                    // Current version is compatible
+                    $resultGroup = 3;
+                }
+
+                if ($currentUpdateVersion !== false && version_compare($upgradeUpdateVersion, $currentUpdateVersion, '<')) {
+                    // Special case warning when version compatible with target is lower than current
+                    $upgradeWarning = 2;
+                }
+            } elseif ($currentUpdateVersion !== false) {
+                // No compatible version for target version but there is a compatible version for current version
+                $resultGroup = 1;
+            } else {
+                // No update server available
+                $resultGroup = 1;
+            }
+
+            // Do we need to capture
+            $extensionResults[] = [
+                'id'                         => $extensionID,
+                'upgradeCompatibilityStatus' => (object) [
+                    'state'             => $upgradeCompatibilityStatus->state,
+                    'compatibleVersion' => $upgradeUpdateVersion,
+                ],
+                'currentCompatibilityStatus' => (object) [
+                    'state'             => $currentCompatibilityStatus->state,
+                    'compatibleVersion' => $currentUpdateVersion,
+                ],
+                'resultGroup'    => $resultGroup,
+                'upgradeWarning' => $upgradeWarning,
+            ];
+        }
+
+        $this->app->mimeType = 'application/json';
+        $this->app->charSet  = 'utf-8';
+        $this->app->setHeader('Content-Type', $this->app->mimeType . '; charset=' . $this->app->charSet);
+        $this->app->sendHeaders();
+
+        try {
+            $return = [
+                'compatibility' => $extensionResults,
+                'extensions'    => $leftover,
+            ];
+
+            echo new JsonResponse($return);
+        } catch (\Exception $e) {
+            echo $e;
+        }
+
+        $this->app->close();
+    }
+
+    /**
+     * Fetch and report updates in \JSON format, for AJAX requests
+     *
+     * @return  void
+     *
+     * @since   3.10.10
+     */
+    public function ajax()
+    {
+        if (!Session::checkToken('get')) {
+            $this->app->setHeader('status', 403, true);
+            $this->app->sendHeaders();
+            echo Text::_('JINVALID_TOKEN_NOTICE');
+            $this->app->close();
+        }
+
+        /** @var UpdateModel $model */
+        $model      = $this->getModel('Update');
+        $updateInfo = $model->getUpdateInformation();
+
+        $update   = [];
+        $update[] = ['version' => $updateInfo['latest']];
+
+        echo json_encode($update);
+
+        $this->app->close();
+    }
+}

administrator/components/com_joomlaupdate/src/Dispatcher/Dispatcher.php

@@ -0,0 +1,39 @@
+<?php
+
+/**
+ * @package     Joomla.Administrator
+ * @subpackage  com_joomlaupdate
+ *
+ * @copyright   (C) 2005 Open Source Matters, Inc. <https://www.joomla.org>
+ * @license     GNU General Public License version 2 or later; see LICENSE.txt
+ */
+
+namespace Joomla\Component\Joomlaupdate\Administrator\Dispatcher;
+
+use Joomla\CMS\Access\Exception\NotAllowed;
+use Joomla\CMS\Dispatcher\ComponentDispatcher;
+
+// phpcs:disable PSR1.Files.SideEffects
+\defined('_JEXEC') or die;
+// phpcs:enable PSR1.Files.SideEffects
+
+/**
+ * ComponentDispatcher class for com_joomlaupdate
+ *
+ * @since  4.0.0
+ */
+class Dispatcher extends ComponentDispatcher
+{
+    /**
+     * Joomla Update is checked for global core.admin rights - not the usual core.manage for the component
+     *
+     * @return  void
+     */
+    protected function checkAccess()
+    {
+        // Check the user has permission to access this component if in the backend
+        if ($this->app->isClient('administrator') && !$this->app->getIdentity()->authorise('core.admin')) {
+            throw new NotAllowed($this->app->getLanguage()->_('JERROR_ALERTNOAUTHOR'), 403);
+        }
+    }
+}

administrator/components/com_joomlaupdate/src/View/Joomlaupdate/HtmlView.php

@@ -0,0 +1,325 @@
+<?php
+
+/**
+ * @package     Joomla.Administrator
+ * @subpackage  com_joomlaupdate
+ *
+ * @copyright   (C) 2012 Open Source Matters, Inc. <https://www.joomla.org>
+ * @license     GNU General Public License version 2 or later; see LICENSE.txt
+ */
+
+namespace Joomla\Component\Joomlaupdate\Administrator\View\Joomlaupdate;
+
+use Joomla\CMS\Component\ComponentHelper;
+use Joomla\CMS\Factory;
+use Joomla\CMS\Language\Text;
+use Joomla\CMS\MVC\View\HtmlView as BaseHtmlView;
+use Joomla\CMS\Toolbar\ToolbarHelper;
+use Joomla\CMS\Version;
+
+// phpcs:disable PSR1.Files.SideEffects
+\defined('_JEXEC') or die;
+// phpcs:enable PSR1.Files.SideEffects
+
+/**
+ * Joomla! Update's Default View
+ *
+ * @since  2.5.4
+ */
+class HtmlView extends BaseHtmlView
+{
+    /**
+     * An array with the Joomla! update information.
+     *
+     * @var    array
+     *
+     * @since  3.6.0
+     */
+    protected $updateInfo = null;
+
+    /**
+     * PHP options.
+     *
+     * @var   array  Array of PHP config options
+     *
+     * @since 3.10.0
+     */
+    protected $phpOptions = null;
+
+    /**
+     * PHP settings.
+     *
+     * @var   array  Array of PHP settings
+     *
+     * @since 3.10.0
+     */
+    protected $phpSettings = null;
+
+    /**
+     * Non Core Extensions.
+     *
+     * @var   array  Array of Non-Core-Extensions
+     *
+     * @since 3.10.0
+     */
+    protected $nonCoreExtensions = null;
+
+    /**
+     * The model state
+     *
+     * @var   \Joomla\Registry\Registry
+     *
+     * @since  4.0.0
+     */
+    protected $state;
+
+    /**
+     * Flag if the update component itself has to be updated
+     *
+     * @var boolean  True when update is available otherwise false
+     *
+     * @since 4.0.0
+     */
+    protected $selfUpdateAvailable = false;
+
+    /**
+     * The default admin template for the major version of Joomla that should be used when
+     * upgrading to the next major version of Joomla
+     *
+     * @var string
+     *
+     * @since 4.0.0
+     */
+    protected $defaultBackendTemplate = 'atum';
+
+    /**
+     * Flag if default backend template is being used
+     *
+     * @var boolean  True when default backend template is being used
+     *
+     * @since 4.0.0
+     */
+    protected $isDefaultBackendTemplate = false;
+
+    /**
+     * A special prefix used for the emptystate layout variable
+     *
+     * @var string  The prefix
+     *
+     * @since 4.0.0
+     */
+    protected $messagePrefix = '';
+
+    /**
+     * A special text used for the emptystate layout to explain why there is no download
+     *
+     * @var string  The message
+     *
+     * @since 4.4.0
+     */
+    protected $reasonNoDownload = '';
+
+    /**
+     * Details on failed PHP or DB version requirements to be shown in the emptystate layout when there is no download
+     *
+     * @var \stdClass  PHP and database requirements from the update manifest
+     *
+     * @since 4.4.2
+     */
+    protected $detailsNoDownload;
+
+    /**
+     * List of non core critical plugins
+     *
+     * @var    \stdClass[]
+     * @since  4.0.0
+     */
+    protected $nonCoreCriticalPlugins = [];
+
+    /**
+     * Should I disable the confirmation checkbox for pre-update extension version checks?
+     *
+     * @var   boolean
+     * @since 4.2.0
+     */
+    protected $noVersionCheck = false;
+
+    /**
+     * Should I disable the confirmation checkbox for taking a backup before updating?
+     *
+     * @var   boolean
+     * @since 4.2.0
+     */
+    protected $noBackupCheck = false;
+
+    /**
+     * Renders the view
+     *
+     * @param   string  $tpl  Template name
+     *
+     * @return void
+     *
+     * @since  2.5.4
+     */
+    public function display($tpl = null)
+    {
+        $this->updateInfo          = $this->get('UpdateInformation');
+        $this->selfUpdateAvailable = $this->get('CheckForSelfUpdate');
+
+        // Get results of pre update check evaluations
+        $model                          = $this->getModel();
+        $this->phpOptions               = $this->get('PhpOptions');
+        $this->phpSettings              = $this->get('PhpSettings');
+        $this->nonCoreExtensions        = $this->get('NonCoreExtensions');
+        $this->isDefaultBackendTemplate = (bool) $model->isTemplateActive($this->defaultBackendTemplate);
+        $nextMajorVersion               = Version::MAJOR_VERSION + 1;
+
+        // The critical plugins check is only available for major updates.
+        if (version_compare($this->updateInfo['latest'], (string) $nextMajorVersion, '>=')) {
+            $this->nonCoreCriticalPlugins = $this->get('NonCorePlugins');
+        }
+
+        // Set to true if a required PHP option is not ok
+        $isCritical = false;
+
+        foreach ($this->phpOptions as $option) {
+            if (!$option->state) {
+                $isCritical = true;
+                break;
+            }
+        }
+
+        $this->state = $this->get('State');
+
+        $hasUpdate   = !empty($this->updateInfo['hasUpdate']);
+        $hasDownload = isset($this->updateInfo['object']->downloadurl->_data);
+
+        // Fresh update, show it
+        if ($this->getLayout() == 'complete') {
+            // Complete message, nothing to do here
+        } elseif ($this->selfUpdateAvailable) {
+            // There is an update for the updater itself. So we have to update it first
+            $this->setLayout('selfupdate');
+        } elseif (!$hasDownload || !$hasUpdate) {
+            // Could be that we have a download file but no update, so we offer a re-install
+            if ($hasDownload) {
+                // We can reinstall if we have a URL but no update
+                $this->setLayout('reinstall');
+            } else {
+                // No download available
+                if ($hasUpdate) {
+                    $this->messagePrefix     = '_NODOWNLOAD';
+                    $this->reasonNoDownload  = 'COM_JOOMLAUPDATE_NODOWNLOAD_EMPTYSTATE_REASON';
+                    $this->detailsNoDownload = $this->updateInfo['object']->get('otherUpdateInfo');
+                }
+
+                $this->setLayout('noupdate');
+            }
+        } elseif ($this->getLayout() != 'update' && ($isCritical || $this->shouldDisplayPreUpdateCheck())) {
+            // Here we have now two options: preupdatecheck or update
+            $this->setLayout('preupdatecheck');
+        } else {
+            $this->setLayout('update');
+        }
+
+        if (\in_array($this->getLayout(), ['preupdatecheck', 'update', 'upload'])) {
+            $language = $this->getLanguage();
+            $language->load('com_installer', JPATH_ADMINISTRATOR, 'en-GB', false, true);
+            $language->load('com_installer', JPATH_ADMINISTRATOR, null, true);
+
+            Factory::getApplication()->enqueueMessage(Text::_('COM_JOOMLAUPDATE_VIEW_DEFAULT_UPDATE_NOTICE'), 'warning');
+        }
+
+        $params = ComponentHelper::getParams('com_joomlaupdate');
+
+        switch ($params->get('updatesource', 'default')) {
+            case 'next':
+                // "Minor & Patch Release for Current version AND Next Major Release".
+                $this->langKey         = 'COM_JOOMLAUPDATE_VIEW_DEFAULT_UPDATES_INFO_NEXT';
+                $this->updateSourceKey = Text::_('COM_JOOMLAUPDATE_CONFIG_UPDATESOURCE_NEXT');
+                break;
+
+            case 'custom':
+                // "Custom"
+                $this->langKey         = 'COM_JOOMLAUPDATE_VIEW_DEFAULT_UPDATES_INFO_CUSTOM';
+                $this->updateSourceKey = Text::_('COM_JOOMLAUPDATE_CONFIG_UPDATESOURCE_CUSTOM');
+                break;
+
+            default:
+                /**
+                 * "Minor & Patch Release for Current version (recommended and default)".
+                 * The commented "case" below are for documenting where 'default' and legacy options falls
+                 * case 'default':
+                 * case 'sts':
+                 * case 'lts':
+                 * case 'nochange':
+                 * case 'testing':
+                 */
+                $this->langKey         = 'COM_JOOMLAUPDATE_VIEW_DEFAULT_UPDATES_INFO_DEFAULT';
+                $this->updateSourceKey = Text::_('COM_JOOMLAUPDATE_CONFIG_UPDATESOURCE_DEFAULT');
+        }
+
+        $this->noVersionCheck = $params->get('versioncheck', 1) == 0;
+        $this->noBackupCheck  = $params->get('backupcheck', 1) == 0;
+
+        // Remove temporary files
+        $this->getModel()->removePackageFiles();
+
+        $this->addToolbar();
+
+        // Render the view.
+        parent::display($tpl);
+    }
+
+    /**
+     * Add the page title and toolbar.
+     *
+     * @return  void
+     *
+     * @since   4.0.0
+     */
+    protected function addToolbar()
+    {
+        // Set the toolbar information.
+        ToolbarHelper::title(Text::_('COM_JOOMLAUPDATE_OVERVIEW'), 'joomla install');
+
+        if (\in_array($this->getLayout(), ['update', 'complete'])) {
+            $arrow = $this->getLanguage()->isRtl() ? 'arrow-right' : 'arrow-left';
+
+            ToolbarHelper::link('index.php?option=com_joomlaupdate', 'JTOOLBAR_BACK', $arrow);
+
+            ToolbarHelper::title(Text::_('COM_JOOMLAUPDATE_VIEW_DEFAULT_TAB_UPLOAD'), 'joomla install');
+        } elseif (!$this->selfUpdateAvailable) {
+            ToolbarHelper::custom('update.purge', 'loop', '', 'COM_JOOMLAUPDATE_TOOLBAR_CHECK', false);
+        }
+
+        // Add toolbar buttons.
+        if ($this->getCurrentUser()->authorise('core.admin')) {
+            ToolbarHelper::preferences('com_joomlaupdate');
+        }
+
+        ToolbarHelper::divider();
+        ToolbarHelper::help('Joomla_Update');
+    }
+
+    /**
+     * Returns true, if the pre update check should be displayed.
+     *
+     * @return boolean
+     *
+     * @since 3.10.0
+     */
+    public function shouldDisplayPreUpdateCheck()
+    {
+        // When the download URL is not found there is no core upgrade path
+        if (!isset($this->updateInfo['object']->downloadurl->_data)) {
+            return false;
+        }
+
+        $nextMinor = Version::MAJOR_VERSION . '.' . (Version::MINOR_VERSION + 1);
+
+        // Show only when we found a download URL, we have an update and when we update to the next minor or greater.
+        return $this->updateInfo['hasUpdate']
+            && version_compare($this->updateInfo['latest'], $nextMinor, '>=');
+    }
+}

administrator/components/com_joomlaupdate/src/View/Update/HtmlView.php

@@ -0,0 +1,46 @@
+<?php
+
+/**
+ * @package     Joomla.Administrator
+ * @subpackage  com_joomlaupdate
+ *
+ * @copyright   (C) 2012 Open Source Matters, Inc. <https://www.joomla.org>
+ * @license     GNU General Public License version 2 or later; see LICENSE.txt
+ */
+
+namespace Joomla\Component\Joomlaupdate\Administrator\View\Update;
+
+use Joomla\CMS\Factory;
+use Joomla\CMS\Language\Text;
+use Joomla\CMS\MVC\View\HtmlView as BaseHtmlView;
+use Joomla\CMS\Toolbar\ToolbarHelper;
+
+// phpcs:disable PSR1.Files.SideEffects
+\defined('_JEXEC') or die;
+// phpcs:enable PSR1.Files.SideEffects
+
+/**
+ * Joomla! Update's Update View
+ *
+ * @since  2.5.4
+ */
+class HtmlView extends BaseHtmlView
+{
+    /**
+     * Renders the view.
+     *
+     * @param   string  $tpl  Template name.
+     *
+     * @return  void
+     */
+    public function display($tpl = null)
+    {
+        Factory::getApplication()->getInput()->set('hidemainmenu', true);
+
+        // Set the toolbar information.
+        ToolbarHelper::title(Text::_('COM_JOOMLAUPDATE_OVERVIEW'), 'sync install');
+
+        // Render the view.
+        parent::display($tpl);
+    }
+}

administrator/components/com_joomlaupdate/src/View/Upload/HtmlView.php

@@ -0,0 +1,113 @@
+<?php
+
+/**
+ * @package     Joomla.Administrator
+ * @subpackage  com_joomlaupdate
+ *
+ * @copyright   (C) 2016 Open Source Matters, Inc. <https://www.joomla.org>
+ * @license     GNU General Public License version 2 or later; see LICENSE.txt
+ */
+
+namespace Joomla\Component\Joomlaupdate\Administrator\View\Upload;
+
+use Joomla\CMS\Component\ComponentHelper;
+use Joomla\CMS\Language\Text;
+use Joomla\CMS\MVC\View\HtmlView as BaseHtmlView;
+use Joomla\CMS\Toolbar\ToolbarHelper;
+
+// phpcs:disable PSR1.Files.SideEffects
+\defined('_JEXEC') or die;
+// phpcs:enable PSR1.Files.SideEffects
+
+/**
+ * Joomla! Update's Update View
+ *
+ * @since  3.6.0
+ */
+class HtmlView extends BaseHtmlView
+{
+    /**
+     * An array with the Joomla! update information.
+     *
+     * @var    array
+     *
+     * @since  4.0.0
+     */
+    protected $updateInfo = null;
+
+    /**
+     * Flag if the update component itself has to be updated
+     *
+     * @var boolean  True when update is available otherwise false
+     *
+     * @since 4.0.0
+     */
+    protected $selfUpdateAvailable = false;
+
+    /**
+     * Warnings for the upload update
+     *
+     * @var array  An array of warnings which could prevent the upload update
+     *
+     * @since 4.0.0
+     */
+    protected $warnings = [];
+
+    /**
+     * Should I disable the confirmation checkbox for taking a backup before updating?
+     *
+     * @var   boolean
+     * @since 4.2.0
+     */
+    protected $noBackupCheck = false;
+
+    /**
+     * Renders the view.
+     *
+     * @param   string  $tpl  Template name.
+     *
+     * @return  void
+     *
+     * @since   3.6.0
+     */
+    public function display($tpl = null)
+    {
+        // Load com_installer's language
+        $language = $this->getLanguage();
+        $language->load('com_installer', JPATH_ADMINISTRATOR, 'en-GB', false, true);
+        $language->load('com_installer', JPATH_ADMINISTRATOR, null, true);
+
+        $this->updateInfo          = $this->get('UpdateInformation');
+        $this->selfUpdateAvailable = $this->get('CheckForSelfUpdate');
+
+        if ($this->getLayout() !== 'captive') {
+            $this->warnings = $this->get('Items', 'warnings');
+        }
+
+        $params               = ComponentHelper::getParams('com_joomlaupdate');
+        $this->noBackupCheck  = $params->get('backupcheck', 1) == 0;
+
+        $this->addToolbar();
+
+        // Render the view.
+        parent::display($tpl);
+    }
+
+    /**
+     * Add the page title and toolbar.
+     *
+     * @return  void
+     *
+     * @since   4.0.0
+     */
+    protected function addToolbar()
+    {
+        // Set the toolbar information.
+        ToolbarHelper::title(Text::_('COM_JOOMLAUPDATE_OVERVIEW'), 'sync install');
+
+        $arrow = $this->getLanguage()->isRtl() ? 'arrow-right' : 'arrow-left';
+        ToolbarHelper::link('index.php?option=com_joomlaupdate&' . ($this->getLayout() == 'captive' ? 'view=upload' : ''), 'JTOOLBAR_BACK', $arrow);
+        ToolbarHelper::divider();
+        ToolbarHelper::help('Joomla_Update');
+    }
+}