如何让我的 CMS 自行升级？
我构建了一个供所有客户使用的 CMS（使用 Codeigniter PHP 框架）。我不断地对其进行调整，并且很难跟踪哪些客户端拥有哪个版本。我们真的希望每个人都能始终拥有最新版本。
我以一种方式编写它，以便更新和升级通常只涉及通过 FTP 上传新版本，并删除旧版本 - 我只是不碰 /uploads 或 / theme 目录（特定于该站点的所有内容都在那里或在数据库中）。一切都是一个模块，每个模块都有自己的版本号（以及核心 CMS），以及每个版本的安装和卸载脚本，但我必须先手动 FTP 文件，然后运行模块的安装脚本从控制面板。我亲自编写并将继续编写所有内容，因此我对代码有完全的控制权。
我希望能够从 CMS 本身的控制面板升级核心 CMS 和各个模块。这是一个“傻瓜式 CMS”，因此要求人们使用 FTP 或执行任何远程技术操作是不可能的。我设想在登录时或在已安装模块列表中弹出一条消息，例如“新版本可用”。
我相信一旦开始，我就能理清大部分技术细节，但我不确定该朝哪个方向发展。我可以想出一些方法来尝试使用 cURL（从我们服务器上的某个位置验证并提取源文件）和 PHP 的本机文件系统函数，例如 unlink()、file_put_contents()等来执行对文件的实际更新或将“旧”CMS 放入备份目录中并设置新的 CMS，但即使在我写这篇文章时 - 这听起来像是一场灾难。
我不使用 git/github 或任何东西，但我感觉类似的东西可以帮助？我应该（或不应该）如何处理这个问题？
I've built a CMS (using the Codeigniter PHP framework) that we use for all our clients. I'm constantly tweaking it, and it gets hard to keep track of which clients have which version. We really want everyone to always have the latest version.
I've written it in a way so that updates and upgrades generally only involve uploading the new version via FTP, and deleting the old one - I just don't touch the /uploads or /themes directories (everything specific to the site is either there or in the database). Everything is a module, and each module has it's own version number (as well as the core CMS), as well as an install and uninstall script for each version, but I have to manually FTP the files first, then run the module's install script from the control panel. I wrote and will continue to write everything personally, so I have complete control over the code.
What I'd like is to be able to upgrade the core CMS and individual modules from the control panel of the CMS itself. This is a "CMS for Dummies", so asking people to FTP or do anything remotely technical is out of the question. I'm envisioning something like a message popping up on login, or in the list of installed modules, like "New version available".
I'm confident that I can sort out most of the technical details once I get this going, but I'm not sure which direction to take. I can think of ways to attempt this with cURL (to authenticate and pull source files from somewhere on our server) and PHP's native filesystem functions like unlink(), file_put_contents(), etc. to preform the actual updates to files or stuff the "old" CMS in a backup directory and set up the new one, but even as I'm writing this post - it sounds like a recipe for disaster.
I don't use git/github or anything, but I have the feeling something like that could help? How should (or shouldn't) I approach this?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
有很多方法可以做到这一点，但最简单的就是将 Git 安装在客户端服务器上，并设置一个 cron 作业来时不时地运行 git pull origin master。如果您的应用程序使用迁移，那应该很容易做到。
您可以这样做，因为听起来您可以完全控制您的客户。对于像 PyroCMS 或 PancakeApp 这样的东西是行不通的，因为任何人都可以在任何服务器上拥有它，我们必须变得更聪明一点。我们只需下载一个 ZIP，其中包含所有已更改的文件和已删除文件的列表，这意味着文件系统已很好地更新。
我们有一个安装列表，我们可以使用 HTTP 请求对其进行 ping 操作，以便系统知道要运行下载，或者在登录时单击可以点击“升级”。
Theres a bunch of ways to do this but the least complicated is just to have Git installedo n your client servers and set up a cron job that runs a git pull origin master every now and then. If your application uses Migrations it should be easy as hell to do.
You can do this as it sounds like you are in full control of your clients. For something like PyroCMS or PancakeApp that doesn't work because anyone can have it on any server and we have to be a little smarter. We just download a ZIP which contains all changed files and a list of deleted files, which means the file system is updated nicely.
We have a list of installations which we can ping with a HTTP request so the system knows to run the download, or the click can hit "Upgrade" when they log in.
您可以在 CMS 中使用 Git：Glip。 cron 将是您自己系统上的一个 url，无需安装 Git。
You can use Git from your CMS: Glip. The cron would be a url on your own system, without installing Git.
@Obsidian DNS 中毒攻击不会也会损害该线程中提到的大多数方法吗？
此外，SSH 也可能受到中间人攻击的影响。
虽然在处理安全问题时，完全偏执是一件好事，但 WordPress 作为 GPL 代码库，如果确实发生此类攻击，可以很容易地检测到代码中未经授权的代码更改，因此解决方案很容易。
SSH 和 Git 听起来确实是一个不错的解决方案，但目标受众是什么？
@Obsidian Wouldn't a DNS poisoning attack also compromise most methods being mentioned in this thread?
Additionally SSH could be compromised by a man in the middle attack as well.
While total paranoia is a good thing when dealing with security, Wordpress being a GPL codebase would make it easy to detect an unauthorized code change in your code if such an attack did occur, so resolution would be easy.
SSH and Git does sound like a good solution, but what is the intended audience?
你看过 WordPress 是如何做到的吗？
这似乎会做你想做的事。
检查此页面以获取其工作原理的描述。
http://tech.ipstenu.org/2011/how-the- wordpress-upgrade-works/
Have you taken a look at how WordPress does it?
That would seem to do what you want.
Check this page for a description of how it works.
http://tech.ipstenu.org/2011/how-the-wordpress-upgrade-works/