How to self-update PHP+MySQL CMS?

Question

I\'m writing a CMS on PHP+MySQL. I want it to be self-updatable (throw one click in admin panel). What are the best practices?
How to compare current version of cms and a ve

Answer 1

You have two scenarios to deal with:

1. The web server can write to files.
2. The web server can not write to files.

This just dictates if you will be decompressing a ZIP file or using FTP to update the files. In ether case, your first step is to take a dump of the database and a backup of the existing files, so that the user can roll back if something goes horribly wrong. As others have said, its important to keep anything that the user will likely customize out of the scope of the update. Wordpress does this nicely. If a user has made changes to core logic code, they are likely smart enough to resolve any merge conflicts on their own (and smart enough to know that a one click upgrade is probably going to lose their modifications).

Your second step is to make sure that your script doesn't die if the browser is closed. This is a process that really should not be interrupted. You could accomplish this via ignore_user_abort(true);, or some other means. Or, if you like, allow the user to check a box that says "Keep going even if I get disconnected". I'm assuming that you'll be handling errors internally.

Now, depending on permissions, you can either:

• Compress the files to be updated to the system /tmp directory
• Compress the files to be updated to a temporary file in the home directory

Then you are ready to:

• Download and decompress the update en situ , or in place.
• Download and decompress the update to the system's /tmp directory and use FTP to update the files in the web root

You can then:

• Apply any SQL changes as needed
• Ask the user if everything went OK
• Roll back if things went badly
• Clean up your temp directory in the system /tmp directory, or any staging files in the user's web root / home directory.

The most important aspect is making sure you can roll back changes if things went bad. The other thing to ensure is that if you use /tmp, be sure to check permissions of your staging area. 0600 should do nicely.

Take a look at how Wordpress and others do it. If your choice of licenses and their's agree, you might even be able to re-use some of that code.

Good luck with your project.