mirror of
https://github.com/Cockatrice/Cockatrice.git
synced 2026-11-05 01:23:24 -08:00
d42b9607c5
Some checks are pending
CodeQL / Analyze (cpp) (push) Waiting to run
CodeQL / Analyze (actions) (push) Waiting to run
Build Desktop / Configure (push) Waiting to run
Build Desktop / Debian 13 (push) Blocked by required conditions
Build Desktop / Debian 12 (push) Blocked by required conditions
Build Desktop / Fedora 44 (push) Blocked by required conditions
Build Desktop / Fedora 43 (push) Blocked by required conditions
Build Desktop / Servatrice_Debian 12 (push) Blocked by required conditions
Build Desktop / Ubuntu 24.04 (push) Blocked by required conditions
Build Desktop / Ubuntu 26.04 (push) Blocked by required conditions
Build Desktop / Arch (push) Blocked by required conditions
Build Desktop / Ubuntu 26.04 cover (push) Blocked by required conditions
Build Desktop / macOS 13 Intel (push) Blocked by required conditions
Build Desktop / macOS 14 (push) Blocked by required conditions
Build Desktop / macOS 15 (push) Blocked by required conditions
Build Desktop / macOS 26 Debug (push) Blocked by required conditions
Build Desktop / Windows 10 (push) Blocked by required conditions
Build Desktop / Prune caches (push) Waiting to run
Build Docker / Servatrice (arm) (push) Waiting to run
Build Docker / Servatrice (x86) (push) Waiting to run
Build Docker / Publish multi-platform Servatrice image (push) Blocked by required conditions
* [Installer] Check for running instances with the Restart Manager probe The running-instance guard was built on powershell.exe started from the 32-bit NSIS stub, which is the 32-bit Windows PowerShell: its Get-Process cannot read the path of a 64-bit process, so a running 64-bit Cockatrice was reported as not running, the update went ahead, and the purge then failed on the DLLs that instance still had mapped. Use tools/installer-holder-probe instead - the same Restart Manager lookup the abort path already had - before anything is replaced and in the uninstaller as well. It is bitness-agnostic, so the Sysnative and WMI fallbacks are gone. The guard looks only at the payload, asks Cockatrice to close once by itself (WM_CLOSE, the same request as the window's close button) and then offers close again / retry after closing by hand / cancel for whatever the close cannot reach - Oracle writes the card database in place, Servatrice has no window - without force-stopping anything. A failed purge offers the same close-and-retry, tries one last purge when nobody is named, and every dialog shows in every mode: a silent reinstall stays silent until something goes wrong. * [Installer] Name processes running from the install directory The running-instance guard answers from the Restart Manager, which reports who has a file open. A running instance does not have to have one open: its own image and the modules it loaded are mapped into it rather than opened by it, and a mapping is not reliably reported. That is the state the probe was added for - every DLL still on disk, an instance running from the directory, and "nothing is holding them any more" as the answer. A guard built on file handles alone is blind to exactly that instance, so it passes, the purge fails, the holder lookup after it names nobody either, and the install ends in a warning that no running program was found: no close is attempted and no retry is offered. A manual install with another instance open never asks it to close at all. Name every process whose image lives in the directory being replaced as well, with the same bitness-safe QueryFullProcessImageNameW the probe already uses to label its holders. The image lookup is listed first - it is the instance the user is asked to close - and the Restart Manager entries follow with the pids already named dropped, so the close still reaches everything that holds a file. A Restart Manager call that fails only makes the probe unable to answer when the image lookup named nobody either. Ask instead of dead-ending when the probe cannot answer at all: Retry checks again, Ignore carries on, Abort cancels, in the installer and the uninstaller alike, and the abort dialog says the check failed instead of claiming no running program was found. The Windows CI probe check covers the new lookup with a process started from the directory that holds no file open. * [Installer] Offer to wait again when the launcher has not exited A client that is still closing after 60 s is usually not hung: it is showing its own "quit anyway?" confirmation for an unsaved deck, an open game or a card database update, and the user is the one who has to answer it. The installer answered that with a plain warning and stopped, so the only way forward was to close Cockatrice by hand and run the update again - which on an in-app update means finding the downloaded installer. Ask instead: Retry brings the client to the front, asks it to close again (WM_CLOSE, nothing forced) and keeps waiting on its handle, Cancel stops as before. There is no "install anyway" answer because a live process has its image and Qt DLLs mapped, so writing the payload over them is the broken install this wait exists to prevent - and the guard that runs right after names the same process by its image path and stops there, so ignoring would only move the same question a moment later. * [Installer] Ask about a launcher that has not exited after ten seconds A minute of silence is a long time to sit in front of an installer that has no window yet, and the case it is waiting for is not a slow flush: a client that started an update exits in well under a second, so a minute means it is almost always showing its own "quit anyway?" confirmation with nobody looking at it. Wait ten seconds for the first question instead, and the full grace for the ones after it. The normal path is untouched - WaitForSingleObject returns as soon as the handle signals, so a client that exits in 200 ms still costs 200 ms - and answering the first question once does not turn into a stream of prompts while the user is in Cockatrice's window. --------- Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>
60 lines
3 KiB
C++
60 lines
3 KiB
C++
#ifndef RESTART_MANAGER_HOLDERS_H
|
|
#define RESTART_MANAGER_HOLDERS_H
|
|
|
|
#include "holder_line.h"
|
|
|
|
#include <string>
|
|
#include <vector>
|
|
|
|
/**
|
|
* @brief Lists the payload files, as full paths.
|
|
*
|
|
* The set is what the installer replaces and the purge removes: the three executables,
|
|
* qt.conf, every top-level DLL and everything below Plugins. A document, a log or a
|
|
* screenshot the user happens to have open in the install directory is not part of it,
|
|
* so it cannot be mistaken for a running instance and block an upgrade.
|
|
*
|
|
* Restart Manager refuses a directory with ERROR_ACCESS_DENIED, which is why the probe
|
|
* registers files and this has to name them first. Missing files and unreadable
|
|
* directories are skipped rather than reported, and the list is capped: this runs before
|
|
* the first page and on the abort path, and must not walk a tree of downloaded pictures.
|
|
*/
|
|
std::vector<std::wstring> collectPayloadFiles(const std::wstring &installDir);
|
|
|
|
/**
|
|
* @brief Names the applications and services that have one of @p files open or mapped.
|
|
*
|
|
* Restart Manager reports both a process that loaded one of the files as a module and
|
|
* one that merely holds a handle to it, and it reports services, which is the whole
|
|
* reason it is used instead of walking every process's module list.
|
|
*
|
|
* @param holders replaced with one entry per holder, in the order Windows reported them.
|
|
* @return 0 when the lookup ran, even if nothing is holding the files; otherwise the
|
|
* Win32 code of the Restart Manager call that failed.
|
|
*/
|
|
unsigned long findProcessesUsingFiles(const std::vector<std::wstring> &files, std::vector<Holder> &holders);
|
|
|
|
/**
|
|
* @brief Lists every process whose image lives in @p installDir, whether or not it has a
|
|
* payload file open.
|
|
*
|
|
* Restart Manager answers the question "who has this file open", and a running instance
|
|
* does not necessarily have one open: its own image and the modules it loaded are mapped
|
|
* into it, not opened by it, and RmGetList does not reliably report a mapping. That is
|
|
* the state the failed updates this probe exists for were in - every DLL still on disk,
|
|
* an instance running from the directory, and "nothing is holding them any more" as the
|
|
* answer - so an answer built on file handles alone cannot be the guard's authority.
|
|
*
|
|
* Reading the image path needs PROCESS_QUERY_LIMITED_INFORMATION and
|
|
* QueryFullProcessImageNameW, neither of which depends on the bitness of either process,
|
|
* so a 64-bit instance is named from this 32-bit stub. The comparison is on the
|
|
* directory, not on an image name, so a process that merely shares a name (an Oracle
|
|
* database server next to a Cockatrice install) is never named.
|
|
*
|
|
* @param installDir the directory being replaced, as a full path.
|
|
* @return one entry per process running from it, in snapshot order, without the probe
|
|
* itself; empty when the directory is empty or no process runs from it.
|
|
*/
|
|
std::vector<Holder> findProcessesRunningFrom(const std::wstring &installDir);
|
|
|
|
#endif
|