replace-filemaker-jars-ubuntu.sh

#!/bin/bash
# FileMaker Apache Commons JAR Replacer for Ubuntu
# Automated JAR replacement tool for FileMaker Server on Ubuntu systems
# Addresses CVE-2025-46295 vulnerability by replacing vulnerable JAR files

set -euo pipefail

# Script metadata
# Read version from VERSION file
VERSION_FILE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/release/VERSION"
if [[ -f "$VERSION_FILE" ]]; then
    readonly SCRIPT_VERSION="$(cat "$VERSION_FILE" | tr -d '\n\r')"
else
    readonly SCRIPT_VERSION="1.0.12"  # Fallback version
fi
readonly SCRIPT_NAME="FileMaker Apache Commons JAR Replacer (Ubuntu)"
readonly CVE_ID="CVE-2025-46295"
readonly COMMONS_TEXT_VERSION="1.11.0"
readonly COMMONS_LANG_VERSION="3.18.0"

# Get script directory for module loading
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
readonly MODULES_DIR="$SCRIPT_DIR/scripts/ubuntu/modules"

# Global variables
VERBOSE_MODE=false
DRY_RUN_MODE=false
FORCE_MODE=false
SKIP_BACKUP=false
BACKUP_LOCATION=""
JAR_DOWNLOAD_URL=""
CREDENTIALS_SOURCE=""
LOG_LEVEL="INFO"
DISABLE_COLORS=false
COMMONS_TEXT_JAR=""
COMMONS_LANG_JAR=""

# Initialize arrays for modules
TARGET_JAR_CONFIG=()
SYSTEM_STATE_SNAPSHOTS=()

# Load required modules
source "$MODULES_DIR/utilities.sh"
source "$MODULES_DIR/user_interface.sh"
source "$MODULES_DIR/error_handling.sh"
source "$MODULES_DIR/filemaker_detection.sh"
source "$MODULES_DIR/backup_restore.sh"
source "$MODULES_DIR/update_download.sh"
source "$MODULES_DIR/installation.sh"
source "$MODULES_DIR/ubuntu_optimizations.sh"

#region Command Line Argument Processing

# Display usage information
show_usage() {
    cat << EOF
$SCRIPT_NAME v$SCRIPT_VERSION

DESCRIPTION:
    Automated JAR replacement tool for FileMaker Server on Ubuntu systems.
    Addresses $CVE_ID vulnerability by replacing vulnerable Apache Commons JAR files
    with secure versions ($COMMONS_TEXT_VERSION and $COMMONS_LANG_VERSION).

USAGE:
    $0 [OPTIONS]

OPTIONS:
    -h, --help                  Show this help message
    -v, --verbose              Enable verbose output
    -n, --dry-run              Show what would be done without making changes
    -f, --force                Force JAR replacement even if files appear secure
    --skip-backup              Skip backup creation (NOT RECOMMENDED)
    --backup-location PATH     Specify custom backup location
    --jar-download-url URL     Specify custom base URL for JAR downloads
    --credentials-source TYPE  Credential source: prompt|env|file
    --log-level LEVEL          Set logging level: DEBUG|INFO|WARN|ERROR

EXAMPLES:
    # Standard JAR replacement with interactive prompts
    sudo $0

    # Verbose mode with custom backup location
    sudo $0 --verbose --backup-location /opt/backups/filemaker

    # Dry run to see what would be done
    sudo $0 --dry-run --verbose

    # Use environment variables for credentials
    sudo FILEMAKER_USERNAME=admin FILEMAKER_PASSWORD=secret $0 --credentials-source env

SECURITY NOTES:
    - This script requires administrator privileges (run with sudo)
    - JAR files are replaced directly without stopping services
    - A backup is created before any changes (unless --skip-backup is used)
    - Credentials are handled securely and cleared from memory after use

WHAT THIS TOOL DOES:
    - Detects FileMaker Server installations and vulnerable JAR files
    - Downloads updated Apache Commons Text ($COMMONS_TEXT_VERSION) and Lang ($COMMONS_LANG_VERSION) JAR files
    - Creates backups of existing JAR files before replacement
    - Replaces vulnerable JAR files with secure versions
    - Provides comprehensive logging and error recovery
    - No service restart required - changes take effect when Web Publishing Engine is next used

DOCUMENTATION:
    CVE Details: https://nvd.nist.gov/vuln/detail/$CVE_ID
    Claris Advisory: https://support.claris.com/s/answerview?anum=000049055&language=en_US
    Manual JAR Replacement Guide: https://support.claris.com/s/answerview?anum=000049059&language=en_US

EOF
}

# Parse command line arguments
parse_arguments() {
    while [[ $# -gt 0 ]]; do
        case $1 in
            -h|--help)
                show_usage
                exit 0
                ;;
            -v|--verbose)
                VERBOSE_MODE=true
                LOG_LEVEL="DEBUG"
                shift
                ;;
            -n|--dry-run)
                DRY_RUN_MODE=true
                shift
                ;;
            -f|--force)
                FORCE_MODE=true
                shift
                ;;
            --skip-backup)
                SKIP_BACKUP=true
                shift
                ;;
            --backup-location)
                BACKUP_LOCATION="$2"
                shift 2
                ;;
            --jar-download-url)
                JAR_DOWNLOAD_URL="$2"
                shift 2
                ;;
            --credentials-source)
                CREDENTIALS_SOURCE="$2"
                case "$CREDENTIALS_SOURCE" in
                    prompt|env|file) ;;
                    *)
                        echo "Error: Invalid credentials source. Must be: prompt, env, or file" >&2
                        exit 1
                        ;;
                esac
                shift 2
                ;;
            --log-level)
                LOG_LEVEL="$2"
                case "$LOG_LEVEL" in
                    DEBUG|INFO|WARN|ERROR) ;;
                    *)
                        echo "Error: Invalid log level. Must be: DEBUG, INFO, WARN, or ERROR" >&2
                        exit 1
                        ;;
                esac
                shift 2
                ;;
            *)
                echo "Error: Unknown option $1" >&2
                echo "Use --help for usage information" >&2
                exit 1
                ;;
        esac
    done
}

#endregion

#region Main Execution Functions

# Initialize the script environment
initialize_script() {
    start_step "Initialize Script Environment" "Setting up logging, error handling, and system validation"
    local step_start_time="$STEP_START_TIME"
    
    # Check and request Administrator privileges if needed
    # TEMPORARY: Skip privilege check for container testing
    if [[ "${SKIP_PRIVILEGE_CHECK:-false}" == "true" ]]; then
        echo "Skipping privilege check for testing"
    elif ! assert_administrator_privileges "FileMaker Server security update requires administrator privileges to modify system files and manage services"; then
        exit 1
    fi
    
    # Set up logging
    local log_dir="$SCRIPT_DIR/logs"
    initialize_logging "$log_dir" "$LOG_LEVEL"
    
    # Initialize error handling
    initialize_error_handling "$VERBOSE_MODE"
    
    # Get Ubuntu system configuration
    local ubuntu_config=$(get_ubuntu_system_configuration)
    
    # Log script startup
    local system_info
    system_info=$(get_platform_info)
    write_log_entry "INFO" "Main" "ScriptStart" "FileMaker JAR Replacer started" "{\"version\":\"$SCRIPT_VERSION\",\"cve_id\":\"$CVE_ID\",\"commons_text_version\":\"$COMMONS_TEXT_VERSION\",\"commons_lang_version\":\"$COMMONS_LANG_VERSION\",\"system_info\":$system_info,\"ubuntu_config\":$ubuntu_config}"
    
    # Send startup notification
    send_update_notification "Detection" "Started"
    
    complete_step "$step_start_time" "true" "System validated and ready"
    return 0
}

# Detect FileMaker Server installations
detect_installations() {
    start_step "Detect FileMaker Installations" "Scanning system for FileMaker Server installations"
    local step_start_time="$STEP_START_TIME"
    
    if ! detect_filemaker_installations_with_jars; then
        complete_step "$step_start_time" "false" "Failed to scan for installations"
        send_update_notification "Detection" "Failed" "Failed to scan for installations"
        invoke_critical_error_handler \
            "Failed to detect FileMaker Server installations" \
            "Main" \
            "InstallationDetection" \
            "$(get_standard_recovery_instructions "FileMakerNotFound")"
        return 1
    fi
    
    local installation_count
    installation_count=$(get_installation_count)
    
    if [ "$installation_count" -eq 0 ]; then
        complete_step "$step_start_time" "false" "No FileMaker Server installations found"
        send_update_notification "Detection" "Failed" "No FileMaker Server installations found"
        invoke_critical_error_handler \
            "No FileMaker Server installations found on this system" \
            "Main" \
            "InstallationDetection" \
            "$(get_standard_recovery_instructions "FileMakerNotFound")"
        return 1
    fi
    
    complete_step "$step_start_time" "true" "Found $installation_count installation(s)"
    send_update_notification "Detection" "Completed" "Found $installation_count installation(s)"
    
    return 0
}

# Check vulnerability status
check_vulnerability_status() {
    start_step "Check Vulnerability Status" "Analyzing installations for CVE-2025-46295 vulnerability"
    local step_start_time="$STEP_START_TIME"
    
    local installation_count
    installation_count=$(get_installation_count)
    local vulnerable_count=0
    local vulnerable_jar_files=()
    
    # Report vulnerability status for each installation
    for ((i=0; i<installation_count; i++)); do
        local installation_info
        installation_info=$(get_installation_info "$i")
        local install_path version is_vulnerable vulnerable_jar_count war_check_info
        install_path=$(echo "$installation_info" | cut -d'|' -f1 | cut -d':' -f2-)
        version=$(echo "$installation_info" | cut -d'|' -f2 | cut -d':' -f2-)
        is_vulnerable=$(echo "$installation_info" | cut -d'|' -f3 | cut -d':' -f2-)
        vulnerable_jar_count=$(echo "$installation_info" | grep -o 'VULNERABLE_JARS:[0-9]*' | cut -d':' -f2 || echo "0")
        war_check_info=$(echo "$installation_info" | grep -o 'WAR_CHECK:.*' | cut -d':' -f2- || echo "")
        
        # Ensure vulnerable_jar_count is numeric
        if ! [[ "$vulnerable_jar_count" =~ ^[0-9]+$ ]]; then
            vulnerable_jar_count=0
        fi
        
        # Display installation details
        echo ""
        echo "FileMaker Server Installation:"
        echo "  Path: $install_path"
        echo "  Version: $version"
        echo "  Vulnerable JARs in lib: $([[ $vulnerable_jar_count -gt 0 ]] && echo "True" || echo "False")"
        
        # Check WAR file results if available
        if [[ -n "$war_check_info" ]]; then
            local war_has_vulnerable
            war_has_vulnerable=$(echo "$war_check_info" | grep -o '"has_vulnerable_jars":[^,]*' | cut -d':' -f2)
            echo "  Vulnerable JARs in WAR: $([[ "$war_has_vulnerable" == "true" ]] && echo "True" || echo "False")"
            
            if [[ "$war_has_vulnerable" == "true" ]]; then
                local war_file
                war_file=$(echo "$war_check_info" | grep -o '"war_file":"[^"]*"' | cut -d'"' -f4)
                echo "  WAR File: $war_file"
                
                # Extract vulnerable JAR names
                local vulnerable_jars
                vulnerable_jars=$(echo "$war_check_info" | grep -o '"vulnerable_jars":\[[^]]*\]' | sed 's/"vulnerable_jars":\[//; s/\]//; s/"//g')
                if [[ -n "$vulnerable_jars" ]]; then
                    echo "  Vulnerable JARs found in WAR:"
                    IFS=',' read -ra jar_array <<< "$vulnerable_jars"
                    for jar in "${jar_array[@]}"; do
                        echo "    - $jar"
                    done
                fi
            fi
        fi
        
        if [ "$is_vulnerable" = "true" ] || [ "$vulnerable_jar_count" -gt 0 ]; then
            ((vulnerable_count++))
            
            # Get specific vulnerable JAR files from lib directories
            local jar_files_section
            jar_files_section=$(echo "$installation_info" | sed 's/.*JAR_FILES:\(.*\)|VULNERABLE_JARS:.*/\1/' || echo "")
            
            if [[ -n "$jar_files_section" ]]; then
                # Parse JAR files and find vulnerable ones
                local jar_files
                IFS=';' read -ra jar_files <<< "$jar_files_section"
                for jar_file in "${jar_files[@]}"; do
                    if [[ "$jar_file" == *"VULNERABLE:true"* ]]; then
                        local jar_filename
                        jar_filename=$(echo "$jar_file" | grep -o 'FILENAME:[^|]*' | cut -d':' -f2)
                        if [[ -n "$jar_filename" ]]; then
                            vulnerable_jar_files+=("$jar_filename")
                        fi
                    fi
                done
            fi
        fi
    done
    
    # Analyze deployment scenarios for each installation
    local wpe_deployed_secure_count=0
    local wpe_never_enabled_count=0
    
    for ((i=0; i<installation_count; i++)); do
        local installation_info
        installation_info=$(get_installation_info "$i")
        local install_path vulnerable_jar_count war_check_info
        install_path=$(echo "$installation_info" | cut -d'|' -f1 | cut -d':' -f2-)
        vulnerable_jar_count=$(echo "$installation_info" | grep -o 'VULNERABLE_JARS:[0-9]*' | cut -d':' -f2 || echo "0")
        war_check_info=$(echo "$installation_info" | grep -o 'WAR_CHECK:.*' | cut -d':' -f2- || echo "")
        
        # Check if WPE lib directory exists and contains JAR files
        local lib_directory="$install_path/Web Publishing/publishing-engine/jwpc-tomcat/fmi/WEB-INF/lib"
        local has_commons_jars=false
        
        if [[ -d "$lib_directory" ]]; then
            # Check if commons JAR files exist in the lib directory
            if ls "$lib_directory"/commons-text-*.jar >/dev/null 2>&1 || ls "$lib_directory"/commons-lang3-*.jar >/dev/null 2>&1; then
                has_commons_jars=true
            fi
        fi
        
        if [[ $vulnerable_jar_count -eq 0 && -n "$war_check_info" ]]; then
            local war_has_vulnerable
            war_has_vulnerable=$(echo "$war_check_info" | grep -o '"has_vulnerable_jars":[^,]*' | cut -d':' -f2)
            
            if [[ "$war_has_vulnerable" == "true" ]]; then
                if [[ "$has_commons_jars" == "true" ]]; then
                    # WPE is deployed and JARs are secure (vulnerable_jar_count=0 + JARs exist = secure JARs)
                    ((wpe_deployed_secure_count++))
                else
                    # WPE has never been enabled (no JAR files deployed)
                    ((wpe_never_enabled_count++))
                    
                    # Extract vulnerable JAR names from WAR
                    local vulnerable_jars
                    vulnerable_jars=$(echo "$war_check_info" | grep -o '"vulnerable_jars":\[[^]]*\]' | sed 's/"vulnerable_jars":\[//; s/\]//; s/"//g')
                    if [[ -n "$vulnerable_jars" ]]; then
                        IFS=',' read -ra jar_array <<< "$vulnerable_jars"
                        for jar in "${jar_array[@]}"; do
                            war_vulnerable_jars+=("$jar")
                        done
                    fi
                fi
            fi
        fi
    done
    
    if [ "$vulnerable_count" -eq 0 ] && [ "$wpe_deployed_secure_count" -gt 0 ] && [ "$wpe_never_enabled_count" -eq 0 ] && [ "$FORCE_MODE" != "true" ]; then
        complete_step "$step_start_time" "true" "All installations are secure (no update needed)"
        echo ""
        echo "✓ Security Status: SECURE"
        echo "  Web Publishing Engine is deployed and all JAR files are already patched against CVE-2025-46295"
        echo "  The deployed JAR files in the lib directory are secure versions"
        echo ""
        echo "📚 Relevant Documentation:"
        echo "  • CVE-2025-46295 Details: https://nvd.nist.gov/vuln/detail/CVE-2025-46295"
        echo "  • Claris Security Advisory: https://support.claris.com/s/answerview?anum=000049055&language=en_US"
        echo "  • FileMaker Server Update Guide: https://support.claris.com/s/answerview?anum=000049059&language=en_US"
        return 2  # Special return code for "already secure"
    fi
    
    if [ "$vulnerable_count" -eq 0 ] && [ "$wpe_never_enabled_count" -gt 0 ]; then
        complete_step "$step_start_time" "true" "Potential vulnerability detected in WAR files"
        echo ""
        echo "⚠ CVE-2025-46295 Status: POTENTIALLY VULNERABLE"
        echo ""
        echo "IMPORTANT:"
        echo "The Web Publishing Engine has never been enabled on this server."
        echo "However, if you enable the Web Publishing Engine in the future, vulnerable JAR files"
        echo "will be deployed and your server will become vulnerable to CVE-2025-46295."
        echo ""
        echo "RECOMMENDATION:"
        echo "Update FileMaker Server to a version that includes the security fixes before"
        echo "enabling the Web Publishing Engine, or contact Claris support for guidance."
        echo ""
        echo "Vulnerable JAR files found in WAR archives:"
        for jar_file in "${war_vulnerable_jars[@]}"; do
            echo "  • $jar_file"
        done
        echo ""
        echo "📚 Relevant Documentation:"
        echo "  • CVE-2025-46295 Details: https://nvd.nist.gov/vuln/detail/CVE-2025-46295"
        echo "  • Claris Security Advisory: https://support.claris.com/s/answerview?anum=000049055&language=en_US"
        echo "  • FileMaker Server Update Guide: https://support.claris.com/s/answerview?anum=000049059&language=en_US"
        return 2  # Exit for WAR-only vulnerability
    fi
    
    complete_step "$step_start_time" "true" "Found $vulnerable_count vulnerable installation(s)"
    echo ""
    
    if [ "$vulnerable_count" -gt 0 ]; then
        echo -e "${COLOR_RED}⚠ CVE-2025-46295 VULNERABILITY DETECTED${COLOR_RESET}"
        echo -e "${COLOR_RED}  Installation requires JAR file patching${COLOR_RESET}"
        echo ""
        
        # Show specific vulnerable JAR files found
        if [ ${#vulnerable_jar_files[@]} -gt 0 ]; then
            echo "📋 Vulnerable JAR Files Found:"
            for jar_file in "${vulnerable_jar_files[@]}"; do
                echo "  • $jar_file"
            done
            echo ""
        fi
        
        if [ "$DRY_RUN_MODE" = "true" ]; then
            echo "🔧 DRY RUN COMPLETE - NO CHANGES MADE"
            echo ""
            echo "Summary of what would be performed:"
            echo "  1. Create backup of FileMaker Server"
            echo "  2. Download secure JAR files (commons-text-1.11.0.jar, commons-lang3-3.18.0.jar)"
            echo "  3. Replace vulnerable JAR files with secure versions"
            echo "  4. Verify JAR replacement"
            echo ""
            echo "Vulnerable JAR files that would be replaced:"
            for jar_file in "${vulnerable_jar_files[@]}"; do
                echo "  • $jar_file"
            done
            echo ""
            echo "To apply these changes, run the script without --dry-run"
            return 2  # Exit for dry run
        fi
        
        echo "🔧 JAR Patching Process Initiated"
        echo "  Beginning security patching process for vulnerable JAR files"
    fi
    
    return 0
}

# Create backup of FileMaker Server
create_backup() {
    if [ "$SKIP_BACKUP" = "true" ]; then
        write_warning_message "Backup Skipped" "Proceeding without backup as requested (NOT RECOMMENDED)"
        return 0
    fi
    
    send_update_notification "Backup" "Started"
    start_step "Create System Backup" "Creating backup of FileMaker Server data and configuration"
    local step_start_time="$STEP_START_TIME"
    
    # Determine backup location
    local backup_path="$BACKUP_LOCATION"
    if [ -z "$backup_path" ]; then
        backup_path="$SCRIPT_DIR/backups/filemaker_backup_$(date +%Y%m%d_%H%M%S)"
    fi
    
    if [ "$DRY_RUN_MODE" = "true" ]; then
        complete_step "$step_start_time" "true" "DRY RUN: Would create backup at $backup_path"
        return 0
    fi
    
    # Create backup
    local backup_result
    backup_result=$(create_filemaker_backup "$backup_path")
    local backup_success
    backup_success=$(echo "$backup_result" | jq -r '.success')
    
    if [ "$backup_success" != "true" ]; then
        local backup_errors
        backup_errors=$(echo "$backup_result" | jq -r '.results.errors[]' | tr '\n' '; ')
        complete_step "$step_start_time" "false" "Backup failed: $backup_errors"
        send_update_notification "Backup" "Failed" "Backup failed: $backup_errors"
        
        invoke_critical_error_handler \
            "Failed to create backup of FileMaker Server" \
            "Main" \
            "BackupCreation" \
            "$(get_standard_recovery_instructions "BackupFailed")" \
            "$backup_result"
        return 1
    fi
    
    complete_step "$step_start_time" "true" "Backup created successfully at $backup_path"
    send_update_notification "Backup" "Completed" "Backup location: $backup_path"
    
    # Store backup path for potential recovery
    BACKUP_LOCATION="$backup_path"
    
    return 0
}

# Download secure JAR files
download_secure_jars() {
    send_update_notification "Download" "Started"
    start_step "Download Secure JAR Files" "Downloading updated Apache Commons JAR files"
    local step_start_time="$STEP_START_TIME"
    
    if [ "$DRY_RUN_MODE" = "true" ]; then
        complete_step "$step_start_time" "true" "DRY RUN: Would download secure JAR files"
        return 0
    fi
    
    # Set default JAR download URLs if not provided
    local commons_text_url="https://repo1.maven.org/maven2/org/apache/commons/commons-text/$COMMONS_TEXT_VERSION/commons-text-$COMMONS_TEXT_VERSION.jar"
    local commons_lang_url="https://repo1.maven.org/maven2/org/apache/commons/commons-lang3/$COMMONS_LANG_VERSION/commons-lang3-$COMMONS_LANG_VERSION.jar"
    
    # Get download directory
    local download_dir="$SCRIPT_DIR/downloads"
    mkdir -p "$download_dir"
    
    local commons_text_file="$download_dir/commons-text-$COMMONS_TEXT_VERSION.jar"
    local commons_lang_file="$download_dir/commons-lang3-$COMMONS_LANG_VERSION.jar"
    
    # Check disk space (require 100MB free)
    if ! check_disk_space "$download_dir" $((100 * 1024 * 1024)); then
        complete_step "$step_start_time" "false" "Insufficient disk space for download"
        send_update_notification "Download" "Failed" "Insufficient disk space for download"
        invoke_recoverable_error_handler \
            "Insufficient disk space for JAR download" \
            "Main" \
            "JARDownload" \
            "" \
            1 \
            0
        return 1
    fi
    
    # Download commons-text JAR
    write_info_message "Downloading Commons Text JAR" "Downloading commons-text-$COMMONS_TEXT_VERSION.jar"
    if ! curl -L -o "$commons_text_file" "$commons_text_url"; then
        complete_step "$step_start_time" "false" "Failed to download commons-text JAR"
        send_update_notification "Download" "Failed" "Failed to download commons-text JAR"
        invoke_recoverable_error_handler \
            "Failed to download commons-text JAR" \
            "Main" \
            "JARDownload" \
            "curl -L -o \"$commons_text_file\" \"$commons_text_url\"" \
            3 \
            30
        return 1
    fi
    
    # Download commons-lang3 JAR
    write_info_message "Downloading Commons Lang JAR" "Downloading commons-lang3-$COMMONS_LANG_VERSION.jar"
    if ! curl -L -o "$commons_lang_file" "$commons_lang_url"; then
        complete_step "$step_start_time" "false" "Failed to download commons-lang3 JAR"
        send_update_notification "Download" "Failed" "Failed to download commons-lang3 JAR"
        invoke_recoverable_error_handler \
            "Failed to download commons-lang3 JAR" \
            "Main" \
            "JARDownload" \
            "curl -L -o \"$commons_lang_file\" \"$commons_lang_url\"" \
            3 \
            30
        return 1
    fi
    
    # Verify downloaded files
    if [[ ! -f "$commons_text_file" || ! -f "$commons_lang_file" ]]; then
        complete_step "$step_start_time" "false" "Downloaded JAR files not found"
        send_update_notification "Download" "Failed" "Downloaded JAR files not found"
        return 1
    fi
    
    complete_step "$step_start_time" "true" "Secure JAR files downloaded successfully"
    send_update_notification "Download" "Completed" "JAR files ready for replacement"
    
    # Store JAR file paths for replacement
    COMMONS_TEXT_JAR="$commons_text_file"
    COMMONS_LANG_JAR="$commons_lang_file"
    
    return 0
}

# Replace vulnerable JAR files
replace_vulnerable_jars() {
    send_update_notification "Installation" "Started"
    start_step "Replace Vulnerable JAR Files" "Replacing vulnerable JAR files with secure versions"
    local step_start_time="$STEP_START_TIME"
    
    if [ "$DRY_RUN_MODE" = "true" ]; then
        complete_step "$step_start_time" "true" "DRY RUN: Would replace vulnerable JAR files"
        return 0
    fi
    
    local replacement_count=0
    local errors=()
    
    # Initialize backup system for individual JAR replacements
    local backup_dir="$SCRIPT_DIR/backups/jar_backups_$(date +%Y%m%d_%H%M%S)"
    initialize_backup_system "$backup_dir" >/dev/null
    
    # Process each FileMaker installation
    for ((i=0; i<$(get_installation_count); i++)); do
        local installation_info
        installation_info=$(get_installation_info "$i")
        local install_path
        install_path=$(echo "$installation_info" | cut -d'|' -f1 | cut -d':' -f2-)
        
        local jar_directory="$install_path/Web Publishing/publishing-engine/jwpc-tomcat/fmi/WEB-INF/lib"
        
        if [[ -d "$jar_directory" ]]; then
            write_info_message "Processing Installation" "Replacing JAR files in $install_path"
            
            # Replace commons-text JAR files
            for jar_file in "$jar_directory"/commons-text-*.jar; do
                if [[ -f "$jar_file" ]]; then
                    local new_jar_name="commons-text-$COMMONS_TEXT_VERSION.jar"
                    local new_jar_path="$jar_directory/$new_jar_name"
                    
                    write_info_message "Replacing JAR" "$(basename "$jar_file") -> $new_jar_name"
                    
                    # Create backup of old file first
                    if backup_jar_file "$jar_file" >/dev/null; then
                        # Remove old JAR file and install new one
                        if rm -f "$jar_file" && cp "$COMMONS_TEXT_JAR" "$new_jar_path"; then
                            # Set proper permissions and ownership
                            chmod 640 "$new_jar_path"
                            chown fmserver:fmsadmin "$new_jar_path"
                            ((replacement_count++))
                            write_log_entry "INFO" "JARReplace" "ReplaceVulnerable" "Replaced commons-text JAR" "original:$jar_file,new:$new_jar_path,new_version:$COMMONS_TEXT_VERSION"
                        else
                            errors+=("Failed to replace $(basename "$jar_file")")
                        fi
                    else
                        errors+=("Failed to backup $(basename "$jar_file")")
                    fi
                fi
            done
            
            # Replace commons-lang3 JAR files
            for jar_file in "$jar_directory"/commons-lang3-*.jar; do
                if [[ -f "$jar_file" ]]; then
                    local new_jar_name="commons-lang3-$COMMONS_LANG_VERSION.jar"
                    local new_jar_path="$jar_directory/$new_jar_name"
                    
                    write_info_message "Replacing JAR" "$(basename "$jar_file") -> $new_jar_name"
                    
                    # Create backup of old file first
                    if backup_jar_file "$jar_file" >/dev/null; then
                        # Remove old JAR file and install new one
                        if rm -f "$jar_file" && cp "$COMMONS_LANG_JAR" "$new_jar_path"; then
                            # Set proper permissions and ownership
                            chmod 640 "$new_jar_path"
                            chown fmserver:fmsadmin "$new_jar_path"
                            ((replacement_count++))
                            write_log_entry "INFO" "JARReplace" "ReplaceVulnerable" "Replaced commons-lang3 JAR" "original:$jar_file,new:$new_jar_path,new_version:$COMMONS_LANG_VERSION"
                        else
                            errors+=("Failed to replace $(basename "$jar_file")")
                        fi
                    else
                        errors+=("Failed to backup $(basename "$jar_file")")
                    fi
                fi
            done
        else
            errors+=("JAR directory not found: $jar_directory")
        fi
    done
    
    if [[ $replacement_count -gt 0 && ${#errors[@]} -eq 0 ]]; then
        complete_step "$step_start_time" "true" "Replaced $replacement_count JAR file(s) successfully"
        send_update_notification "Installation" "Completed" "JAR files replaced successfully"
        write_success_message "JAR Replacement Complete" "Successfully replaced $replacement_count vulnerable JAR file(s)"
        
        # Restart Web Publishing Engine to load new JAR files
        write_info_message "Restarting Web Publishing Engine" "Loading updated JAR files"
        if restart_web_publishing_engine 300; then
            write_success_message "Web Publishing Engine Restarted" "Updated JAR files are now active"
        else
            write_error_message "WPE Restart Failed" "Manual restart required"
            echo "Run this command manually: fmsadmin restart wpe -y"
        fi
        
        return 0
    else
        complete_step "$step_start_time" "false" "JAR replacement failed or incomplete"
        send_update_notification "Installation" "Failed" "JAR replacement failed"
        
        # Attempt recovery from backup if available
        if [ -n "$BACKUP_LOCATION" ] && [ -d "$BACKUP_LOCATION" ]; then
            write_warning_message "JAR Replacement Failed" "Attempting to restore from backup: $BACKUP_LOCATION"
            
            local restore_result
            restore_result=$(restore_filemaker_from_backup "$BACKUP_LOCATION")
            local restore_success
            restore_success=$(echo "$restore_result" | jq -r '.success')
            
            if [ "$restore_success" = "true" ]; then
                write_success_message "Recovery Successful" "JAR files restored from backup"
            else
                write_error_message "Recovery Failed" "Manual intervention required"
            fi
        fi
        
        local errors_msg=""
        if [ ${#errors[@]} -gt 0 ]; then
            errors_msg=" Errors: $(IFS=', '; echo "${errors[*]}")"
        fi
        
        invoke_critical_error_handler \
            "Failed to replace vulnerable JAR files$errors_msg" \
            "Main" \
            "JARReplacement" \
            "$(get_standard_recovery_instructions "InstallationFailed")"
        return 1
    fi
}

# Verify JAR replacement
verify_jar_replacement() {
    send_update_notification "Validation" "Started"
    start_step "Verify JAR Replacement" "Confirming vulnerable JAR files were replaced successfully"
    local step_start_time="$STEP_START_TIME"
    
    if [ "$DRY_RUN_MODE" = "true" ]; then
        complete_step "$step_start_time" "true" "DRY RUN: Would verify JAR replacement"
        return 0
    fi
    
    # Re-detect installations to get updated JAR information
    if ! detect_filemaker_installations_with_jars; then
        complete_step "$step_start_time" "false" "Failed to re-detect installations"
        send_update_notification "Validation" "Failed" "Failed to re-detect installations"
        return 1
    fi
    
    local installation_count
    installation_count=$(get_installation_count)
    
    if [ "$installation_count" -eq 0 ]; then
        complete_step "$step_start_time" "false" "No installations found after JAR replacement"
        send_update_notification "Validation" "Failed" "No installations found after JAR replacement"
        invoke_critical_error_handler \
            "FileMaker Server installations not found after JAR replacement" \
            "Main" \
            "JARVerification" \
            "$(get_standard_recovery_instructions "InstallationFailed")"
        return 1
    fi
    
    # Check if installations are now secure
    local secure_count=0
    local total_vulnerable_jars=0
    
    for ((i=0; i<installation_count; i++)); do
        local installation_info
        installation_info=$(get_installation_info "$i")
        local vulnerable_jar_count
        vulnerable_jar_count=$(echo "$installation_info" | cut -d'|' -f6 | cut -d':' -f2- 2>/dev/null || echo "0")
        # Ensure vulnerable_jar_count is numeric
        if ! [[ "$vulnerable_jar_count" =~ ^[0-9]+$ ]]; then
            vulnerable_jar_count=0
        fi
        
        total_vulnerable_jars=$((total_vulnerable_jars + vulnerable_jar_count))
        
        if [ "$vulnerable_jar_count" -eq 0 ]; then
            ((secure_count++))
        fi
    done
    
    if [ "$secure_count" -eq "$installation_count" ] && [ "$total_vulnerable_jars" -eq 0 ]; then
        complete_step "$step_start_time" "true" "All installations are now secure"
        send_update_notification "Validation" "Completed" "CVE-2025-46295 resolved, all JAR files secure"
        write_success_message "JAR Replacement Verification: SUCCESS" "All FileMaker Server installations are now protected against $CVE_ID"
        return 0
    else
        complete_step "$step_start_time" "false" "Some JAR files may still be vulnerable"
        send_update_notification "Validation" "Failed" "Some JAR files may still be vulnerable"
        write_warning_message "JAR Replacement Verification: PARTIAL" "Some JAR files may still require attention ($total_vulnerable_jars vulnerable JAR files remaining)"
        return 1
    fi
}

# Cleanup temporary files
cleanup_files() {
    start_step "Cleanup Temporary Files" "Removing temporary files and clearing sensitive data"
    local step_start_time="$STEP_START_TIME"
    
    # Clean up downloaded JAR files
    if [ -n "${COMMONS_TEXT_JAR:-}" ] && [ -f "$COMMONS_TEXT_JAR" ]; then
        rm -f "$COMMONS_TEXT_JAR" 2>/dev/null
    fi
    
    if [ -n "${COMMONS_LANG_JAR:-}" ] && [ -f "$COMMONS_LANG_JAR" ]; then
        rm -f "$COMMONS_LANG_JAR" 2>/dev/null
    fi
    
    # Clean up download directory if empty
    local download_dir="$SCRIPT_DIR/downloads"
    if [ -d "$download_dir" ]; then
        rmdir "$download_dir" 2>/dev/null || true
    fi
    
    # Clear any credential variables
    if [ -n "${FILEMAKER_CREDENTIALS:-}" ]; then
        unset FILEMAKER_CREDENTIALS
    fi
    
    complete_step "$step_start_time" "true" "Cleanup completed"
    
    return 0
}

#endregion

#region Main Execution Flow

# Main function that orchestrates the entire update process
main() {
    # Parse command line arguments
    parse_arguments "$@"
    
    # Initialize step progress tracking first
    local total_steps=8
    if [ "$SKIP_BACKUP" = "true" ]; then
        total_steps=7
    fi
    
    initialize_step_progress "$total_steps" "FileMaker Server JAR Replacement Process"
    
    # Display script header
    echo ""
    echo "═══════════════════════════════════════════════════════════════"
    echo " $SCRIPT_NAME v$SCRIPT_VERSION"
    echo " JAR File Replacement for $CVE_ID"
    echo "═══════════════════════════════════════════════════════════════"
    echo ""
    
    if [ "$DRY_RUN_MODE" = "true" ]; then
        write_info_message "DRY RUN MODE" "No changes will be made to the system"
    fi
    
    if [ "$VERBOSE_MODE" = "true" ]; then
        write_info_message "VERBOSE MODE" "Detailed logging enabled"
    fi
    
    # Execute main workflow
    local overall_success=true
    local exit_code=0
    
    # Step 1: Initialize script environment
    if ! initialize_script; then
        overall_success=false
        exit_code=1
    fi
    
    # Step 2: Detect FileMaker installations
    if [ "$overall_success" = "true" ]; then
        if ! detect_installations; then
            overall_success=false
            exit_code=1
        fi
    fi
    
    # Step 3: Check vulnerability status
    if [ "$overall_success" = "true" ]; then
        local vuln_check_result
        vuln_check_result=0
        check_vulnerability_status || vuln_check_result=$?
        
        if [ "$vuln_check_result" -eq 2 ]; then
            # Already secure, WAR-only vulnerability, or dry run complete
            local installation_count
            installation_count=$(get_installation_count)
            
            # Count actual vulnerabilities for proper reporting
            local actual_vulnerable_count=0
            local actual_war_vulnerable_count=0
            
            for ((i=0; i<installation_count; i++)); do
                local installation_info
                installation_info=$(get_installation_info "$i")
                local vulnerable_jar_count war_check_info
                vulnerable_jar_count=$(echo "$installation_info" | grep -o 'VULNERABLE_JARS:[0-9]*' | cut -d':' -f2 || echo "0")
                war_check_info=$(echo "$installation_info" | grep -o 'WAR_CHECK:.*' | cut -d':' -f2- || echo "")
                
                if ! [[ "$vulnerable_jar_count" =~ ^[0-9]+$ ]]; then
                    vulnerable_jar_count=0
                fi
                
                if [ "$vulnerable_jar_count" -gt 0 ]; then
                    ((actual_vulnerable_count++))
                elif [[ -n "$war_check_info" ]]; then
                    local war_has_vulnerable
                    war_has_vulnerable=$(echo "$war_check_info" | grep -o '"has_vulnerable_jars":[^,]*' | cut -d':' -f2)
                    if [[ "$war_has_vulnerable" == "true" ]]; then
                        ((actual_war_vulnerable_count++))
                    fi
                fi
            done
            
            if [ "$DRY_RUN_MODE" = "true" ]; then
                show_operation_summary "true" "Dry run completed - no changes were made" "installations_checked:$installation_count,vulnerable_count:$actual_vulnerable_count,war_vulnerable_count:$actual_war_vulnerable_count,mode:dry_run"
                show_final_vulnerability_status "$actual_vulnerable_count" "$actual_war_vulnerable_count" "dry_run"
            else
                show_operation_summary "true" "No security update required - all installations are already secure" "installations_checked:$installation_count,vulnerable_count:$actual_vulnerable_count,war_vulnerable_count:$actual_war_vulnerable_count"
                show_final_vulnerability_status "$actual_vulnerable_count" "$actual_war_vulnerable_count" "live"
            fi
            show_documentation_links "general"
            exit 0
        elif [ "$vuln_check_result" -ne 0 ]; then
            overall_success=false
            exit_code=1
        fi
    fi
    
    # Step 4: Create backup (unless skipped)
    if [ "$overall_success" = "true" ] && [ "$SKIP_BACKUP" != "true" ]; then
        if ! create_backup; then
            overall_success=false
            exit_code=1
        fi
    fi
    
    # Step 5: Download secure JAR files
    if [ "$overall_success" = "true" ]; then
        if ! download_secure_jars; then
            overall_success=false
            exit_code=1
        fi
    fi
    
    # Step 6: Replace vulnerable JAR files
    if [ "$overall_success" = "true" ]; then
        if ! replace_vulnerable_jars; then
            overall_success=false
            exit_code=1
        fi
    fi
    
    # Step 7: Verify JAR replacement
    if [ "$overall_success" = "true" ]; then
        if ! verify_jar_replacement; then
            overall_success=false
            exit_code=1
        fi
    fi
    
    # Step 8: Cleanup temporary files
    cleanup_files  # Always run cleanup, even if previous steps failed
    
    # Show final summary
    local summary_details="{\"installations_processed\":$(get_installation_count)}"
    if [ -n "$BACKUP_LOCATION" ]; then
        summary_details=$(echo "$summary_details" | jq --arg backup "$BACKUP_LOCATION" '. + {backup_location: $backup}')
    fi
    summary_details=$(echo "$summary_details" | jq '. + {system_config_updated: "Yes"}')
    
    if [ "$overall_success" = "true" ]; then
        show_operation_summary "true" "FileMaker Server JAR replacement completed successfully" "$summary_details"
        send_update_notification "Completion" "Completed"
        write_success_message "JAR Replacement Complete" "Your FileMaker Server installation is now protected against $CVE_ID"
    else
        show_operation_summary "false" "FileMaker Server JAR replacement failed" "$summary_details"
        send_update_notification "Completion" "Failed" "JAR replacement failed"
        write_error_message "JAR Replacement Failed" "Please review the errors above and take corrective action"
    fi
    
    # Show documentation links
    show_documentation_links "general"
    
    exit "$exit_code"
}

#endregion

# Execute main function with all arguments
main "$@"