#5629 Velopack allows uninstall while the viewer is running (#5662)

Velopack's uninstall can't be canceled, so instead it now checks for presense of a running window, makes sure window matches velopack's path, then sends a shutdown message. Window gets the message, verifies path, initiates shutdown.

1 files changed, 144 insertions, 0 deletions

diff --git a/indra/llwindow/llwindowwin32.cpp b/indra/llwindow/llwindowwin32.cpp
index c185fc6c4a..3cb2911f9a 100644
--- a/indra/llwindow/llwindowwin32.cpp
+++ b/indra/llwindow/llwindowwin32.cpp
@@ -2605,6 +2605,150 @@ LRESULT CALLBACK LLWindowWin32::mainWindowProc(HWND h_wnd, UINT u_msg, WPARAM w_
             // if session is ending OS is going to take care of it.
             return 0;
         }
+        case WM_POST_UNINSTALL_:
+        {
+            LL_PROFILE_ZONE_NAMED_CATEGORY_WIN32("mwp - WM_POST_UNINSTALL_");
+            // Other instance, likely velopack, requested we quit.
+            // Don't trust PID alone (can be spoofed), verify the
+            // path for security purposes before processing.
+            // Verifying path isn't a strong varranty, if this turns
+            // up to be a risk, we will want something more secure.
+            // See sendShutdownToOtherInstances for the sender.
+
+            // LPARAM contains message type.
+            DWORD message_type = static_cast<DWORD>(l_param);
+            if (message_type == WM_POST_UNINSTALL_MSG_SHUTDOWN || message_type == WM_POST_UNINSTALL_MSG_UPDATE)
+            {
+                DWORD sender_process_id = static_cast<DWORD>(w_param);
+
+                // Make sure something didn't just send us our own process
+                DWORD our_process_id = GetCurrentProcessId();
+                if (our_process_id == sender_process_id)
+                {
+                    LL_WARNS("Window") << "Received WM_POST_UNINSTALL_ from our own process, ignoring" << LL_ENDL;
+                    break;
+                }
+
+                if (sender_process_id == 0)
+                {
+                    LL_WARNS("Window") << "Received WM_POST_UNINSTALL_ but couldn't get sender process ID" << LL_ENDL;
+                    break;
+                }
+
+                // Open the existing sender process to verify its executable path
+                HANDLE hSenderProcess = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE, sender_process_id);
+                if (!hSenderProcess)
+                {
+                    LL_WARNS("Window") << "Received WM_POST_UNINSTALL_ but couldn't open sender process" << LL_ENDL;
+                    break;
+                }
+
+                // Get the actual executable path of the sender
+                wchar_t sender_exe_path[MAX_PATH];
+                DWORD size = MAX_PATH;
+                bool got_sender_path = QueryFullProcessImageNameW(hSenderProcess, 0, sender_exe_path, &size) != 0;
+                CloseHandle(hSenderProcess);
+
+                if (!got_sender_path)
+                {
+                    LL_WARNS("Window") << "Received WM_POST_UNINSTALL_ but couldn't query sender executable path" << LL_ENDL;
+                    break;
+                }
+
+                // Extract directory from sender's executable path
+                wchar_t sender_dir[MAX_PATH];
+                wchar_t* file_part = nullptr;
+                DWORD result = GetFullPathNameW(sender_exe_path, MAX_PATH, sender_dir, &file_part);
+
+                if (result == 0 || result >= MAX_PATH)
+                {
+                    LL_WARNS("Window") << "Failed to normalize sender executable path" << LL_ENDL;
+                    break;
+                }
+
+                // Remove the filename to get just directory
+                if (file_part)
+                {
+                    *file_part = L'\0';
+                }
+
+                // Remove trailing backslash
+                size_t sender_dir_len = wcslen(sender_dir);
+                if (sender_dir_len > 0 && sender_dir[sender_dir_len - 1] == L'\\')
+                {
+                    sender_dir[sender_dir_len - 1] = L'\0';
+                    sender_dir_len--;
+                }
+
+                // Remove "\current" suffix from sender's path if present
+                const std::wstring current_suffix = L"\\current";
+                std::wstring sender_normalized_str(sender_dir);
+                if (sender_normalized_str.length() >= current_suffix.length() &&
+                    _wcsicmp(sender_normalized_str.c_str() + sender_normalized_str.length() - current_suffix.length(),
+                        current_suffix.c_str()) == 0)
+                {
+                    sender_normalized_str.resize(sender_normalized_str.length() - current_suffix.length());
+                }
+
+                // Get our executable directory for comparison
+                std::wstring our_wide = ll_convert<std::wstring>(gDirUtilp->getExecutableDir());
+
+                // Normalize our path
+                wchar_t our_normalized[MAX_PATH];
+                file_part = nullptr;
+
+                DWORD result2 = GetFullPathNameW(our_wide.c_str(), MAX_PATH, our_normalized, &file_part);
+
+                if (result2 == 0 || result2 >= MAX_PATH)
+                {
+                    LL_WARNS("Window") << "Failed to normalize our executable path" << LL_ENDL;
+                    break;
+                }
+
+                // Remove trailing backslash
+                size_t our_len = wcslen(our_normalized);
+                if (our_len > 0 && our_normalized[our_len - 1] == L'\\')
+                {
+                    our_normalized[our_len - 1] = L'\0';
+                    our_len--;
+                }
+
+                // Remove "\current" suffix from our path if present
+                std::wstring our_normalized_str(our_normalized);
+                if (our_normalized_str.length() >= current_suffix.length() &&
+                    _wcsicmp(our_normalized_str.c_str() + our_normalized_str.length() - current_suffix.length(),
+                        current_suffix.c_str()) == 0)
+                {
+                    our_normalized_str.resize(our_normalized_str.length() - current_suffix.length());
+                }
+
+                // Compare the normalized base installation paths (case-insensitive)
+                if (_wcsicmp(sender_normalized_str.c_str(), our_normalized_str.c_str()) == 0)
+                {
+                    window_imp->post([=]()
+                    {
+                        LL_INFOS("Window") << "Received valid shutdown request from verified same installation directory" << LL_ENDL;
+                        // Check if app needs cleanup or can be closed immediately.
+                        if (window_imp->mCallbacks->handleCloseRequest(window_imp, false))
+                        {
+                            // Get the app to initiate cleanup.
+                            window_imp->mCallbacks->handleQuit(window_imp);
+                        }
+                    });
+                }
+                else
+                {
+                    LL_WARNS("Window") << "Rejected shutdown request - sender not from our installation directory. "
+                        << "Sender: " << ll_convert_wide_to_string(sender_normalized_str)
+                        << " Our: " << ll_convert_wide_to_string(our_normalized_str) << LL_ENDL;
+                }
+            }
+            else
+            {
+                LL_WARNS("Window") << "Received invalid WM_POST_UNINSTALL_ message" << LL_ENDL;
+            }
+            break;
+        }
         case WM_COMMAND:
         {
             LL_PROFILE_ZONE_NAMED_CATEGORY_WIN32("mwp - WM_COMMAND");