From 8c6b38c2c52eed65e107c59e28ee6d9cb81e8def Mon Sep 17 00:00:00 2001
From: Edwin Noorlander <edwin@noorlander.info>
Date: Wed, 29 Jul 2026 14:33:35 +0200
Subject: [PATCH] Add Git repository permission check to Admin Update page

---
 admin/templates/pages/update.php | 11 +++++++++++
 public/admin.php                 |  6 +++++-
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/admin/templates/pages/update.php b/admin/templates/pages/update.php
index e1438c0..a5eb847 100644
--- a/admin/templates/pages/update.php
+++ b/admin/templates/pages/update.php
@@ -1,5 +1,16 @@
 <h2 class="mb-4"><i class="bi bi-cloud-arrow-down"></i> Systeem Update</h2>
 
+<?php if (isset($isGitWritable) && $isGitWritable === false): ?>
+    <div class="alert alert-warning mb-4">
+        <i class="bi bi-exclamation-triangle-fill me-1"></i>
+        <strong>Schrijfrechten vereist voor Git:</strong> De PHP-webserver heeft geen schrijfrechten op de <code>.git/objects</code> map op de server. 
+        <br><br>
+        Voer op de live server eenmalig uit in de terminal (als <code>root</code>):
+        <pre class="bg-dark text-white p-2 rounded mt-2 mb-0 font-monospace">chown -R www-data:www-data /var/www/CodePress</pre>
+        <small class="text-muted mt-1 d-block">(Vervang <code>www-data</code> door jouw webserver gebruiker, bijvoorbeeld <code>www</code> of <code>nginx</code>, als dat anders is).</small>
+    </div>
+<?php endif; ?>
+
 <?php if (!empty($updateOutput)): ?>
     <div class="card shadow-sm mb-4">
         <div class="card-header bg-dark text-white">
diff --git a/public/admin.php b/public/admin.php
index 6e1c2a5..bebc459 100644
--- a/public/admin.php
+++ b/public/admin.php
@@ -1600,8 +1600,12 @@ function handleUpdate(AdminAuth $auth, array $config): void
         $cmsVersion = is_array($verData) ? ($verData['version'] ?? '1.7.1') : '1.7.1';
     }
 
-    // Get git branch
+    // Get git branch & check git permissions
     $gitBranch = 'main';
+    $root = $config['codepress_root'];
+    $gitDir = $root . '/.git';
+    $isGitWritable = is_dir($gitDir) && (is_writable($gitDir) && (!is_dir($gitDir . '/objects') || is_writable($gitDir . '/objects')));
+
     if (function_exists('exec')) {
         @exec('git rev-parse --abbrev-ref HEAD 2>&1', $branchOutput);
         if (!empty($branchOutput[0]) && strpos($branchOutput[0], 'fatal') === false) {