CLI incorrectly shows "You’re all up-to-date!" when trying to update packages.

[janklan]

Description

I ran into issue similar to #3886, in my case Craft CLI is fully operational.

I tracked the root cause to this:

1. The misleading message shows up because \craft\services\Updates@109 defaults to an empty array if an exception is thrown
2. The API call fails because the remote side rejects the request due to absence of X-Craft-User-Email header, creating an exception
3. \craft\helpers\Api@57 fails to set X-Craft-User-Email header as there is no user logged in at that time.

The interesting bit follows: While working out the root cause, I changed the code to add a forged e-mail address in the right header, which fixed the problem and the right list of available updates showed up. When I then reverted my changes by removing vendor/ and reinstalling dependencies, the issue was gone!

Looks like it is caused by server-side behaviour requiring the e-mail header to be present in some specific case (first-time API call made via CLI?)

Steps to reproduce

1. Make sure the admin UI shows updates available
2. Run ./craft update

Note: as described above, after making a first successful API call with my code tweaks, I was no longer able to reproduce the problem.

Additional info

• Craft version: 3.4.10.1
• PHP version: 7.4.2
• Database driver & version: mysqlnd 7.4.2
• Plugins & versions: Irrelevant

[brandonkelly]

Thanks fro reporting that, and digging into it!

The API doesn’t generally require an email address, but it does when a new Craft license is being requested. I’ve just fixed this for the next release. Going forward if you try to run an update command without a license key, you will be prompted for your email address so a license key can be requested:

$ php craft update/info
No license key found.
Enter your email address to request a new license key: [email protected]
Requesting license... success!

Fetching available updates ... done
You’ve got 3 available updates:
...

[janklan]

Hey Brandon, that was quick!

Here's a thought: it's fixed for all future versions, but there are lots of old ones out there that have the bug and can't be updated because their software says there is nothing to update. Admittedly this is a narrow use case and you could go around it via the UI, but still... For all those people out there the bug isn't fixed in the version they have.

Any chance you can take care of this on the server side? I know without license you have no idea whether the person is eligible for any updates, but looking at P&T's general approach to licensing issues, I think allowing "unlawful" updates without a valid subscription would cause less customer grief than having people fighting the "You have no updates"?

I assume you'd be able to include this hacky behaviour only to affected versions of Craft?

Another thought: I didn't try to run the patched code, but it looks like if there was an API call exception, it would still show "There are no updates available"? If I'm correct, I'd say it's pretty misleading.

[brandonkelly]

I’d rather not; from the API’s perspective, the request is asking it to generate a new Craft license, but failing to provide it the basic info needed to create the license (the email that should be associated with it).

Another thought: I didn't try to run the patched code, but it looks like if there was an API call exception, it would still show "There are no updates available"? If I'm correct, I'd say it's pretty misleading.

No, it will output an error saying that it wasn’t able to obtain a license key and bail early.

[janklan]

Fair enough.

Just FYI, my license wasn't available to the CLI command because of my own mistake: I followed your suggestion in #4393 and added the code registering the license key from an environment variable into /web/index.php - but not into /craft, so the CLI runtime had no idea what the license key is, even though the web interface did.

Thanks for your help.

[brandonkelly]

Ah, sorry I should have mentioned to update that file as well.

[brandonkelly]

Craft 3.5.9 is out now with this change.