From ad62dcf15521c7295f3be32fa9017945ed376097 Mon Sep 17 00:00:00 2001
From: cjee21 <77721854+cjee21@users.noreply.github.com>
Date: Fri, 13 Dec 2024 23:05:24 +0800
Subject: [PATCH] Windows GUI: Update versioned online/stub installer for
 consistency

---
 Source/Install/MediaInfo_GUI_Windows_Stub.nsi | 87 +++++++++++++++----
 1 file changed, 71 insertions(+), 16 deletions(-)

diff --git a/Source/Install/MediaInfo_GUI_Windows_Stub.nsi b/Source/Install/MediaInfo_GUI_Windows_Stub.nsi
index 625d5b5e4..27b3721d6 100644
--- a/Source/Install/MediaInfo_GUI_Windows_Stub.nsi
+++ b/Source/Install/MediaInfo_GUI_Windows_Stub.nsi
@@ -16,7 +16,7 @@ RequestExecutionLevel admin
 SetCompressor /FINAL /SOLID lzma
 
 ; x64 stuff
-!include "x64.nsh"
+!include x64.nsh
 
 ; Logic stuff
 !include LogicLib.nsh
@@ -45,6 +45,10 @@ Name "${PRODUCT_NAME} ${PRODUCT_VERSION}"
 OutFile "..\..\Release\${PRODUCT_NAME}_GUI_${PRODUCT_VERSION}_Windows_Online.exe"
 ShowInstDetails nevershow
 
+; Variables
+Var ARCH_SELECTED
+Var DOWNLOAD_HANDLE
+
 Section
   HideWindow
   InitPluginsDir
@@ -53,29 +57,80 @@ Section
 
   ${If} ${IsNativeARM64}
     ${AndIf} ${AtLeastWin11}
-      inetc::get /CAPTION "MediaInfo Online Installer" /BANNER "Downloading MediaInfo ${PRODUCT_VERSION} ARM64..." \
-      "${BASEURL}/MediaInfo_GUI_${PRODUCT_VERSION}_Windows_ARM64.exe" "$PLUGINSDIR\MediaInfoInstaller.exe"
+      StrCpy $ARCH_SELECTED "ARM64"
+  ${ElseIf} ${IsNativeAMD64}
+    StrCpy $ARCH_SELECTED "x64"
   ${Else}
-    ${If} ${IsNativeAMD64}
-      inetc::get /CAPTION "MediaInfo Online Installer" /BANNER "Downloading MediaInfo ${PRODUCT_VERSION} x64..." \
-      "${BASEURL}/MediaInfo_GUI_${PRODUCT_VERSION}_Windows_x64.exe" "$PLUGINSDIR\MediaInfoInstaller.exe"
-    ${Else}
-      inetc::get /CAPTION "MediaInfo Online Installer" /BANNER "Downloading MediaInfo ${PRODUCT_VERSION} i386..." \
-      "${BASEURL}/MediaInfo_GUI_${PRODUCT_VERSION}_Windows_i386.exe" "$PLUGINSDIR\MediaInfoInstaller.exe"
-    ${EndIf}
+    StrCpy $ARCH_SELECTED "i386"
   ${EndIf}
 
+  inetc::get /CAPTION "MediaInfo GUI Online Installer" /BANNER "Downloading MediaInfo GUI ${PRODUCT_VERSION} $ARCH_SELECTED..." \
+    "${BASEURL}/MediaInfo_GUI_${PRODUCT_VERSION}_Windows_$ARCH_SELECTED.exe" "$PLUGINSDIR\MediaInfoInstaller.exe"
   Pop $0
-  ${If} $0 == "OK"
-    ${IfNot} ${Silent}
-      ExecWait '"$PLUGINSDIR\MediaInfoInstaller.exe"'
-    ${Else}
-      ExecWait '"$PLUGINSDIR\MediaInfoInstaller.exe" /S'
+  ${If} $0 != "OK"
+    MessageBox MB_OK "Download Status: $0"
+    goto Exit
+  ${EndIf}
+
+  ; Open a handle to prevent modification of the downloaded installer
+  !ifndef FILE_SHARE_READ
+    !define FILE_SHARE_READ 1
+  !endif
+  !ifndef GENERIC_READ
+    !define GENERIC_READ 0x80000000
+  !endif
+  !ifndef OPEN_EXISTING
+    !define OPEN_EXISTING 3
+  !endif
+  !ifndef INVALID_HANDLE_VALUE
+    !define INVALID_HANDLE_VALUE -1
+  !endif
+  StrCpy $R9 "${INVALID_HANDLE_VALUE}"
+  System::Call 'kernel32::CreateFileW(w "$PLUGINSDIR\MediaInfoInstaller.exe", \
+                                      i ${GENERIC_READ}, \
+                                      i ${FILE_SHARE_READ}, i 0, \
+                                      i ${OPEN_EXISTING}, i 0, i 0) i .R9'
+  StrCpy $DOWNLOAD_HANDLE "$R9"
+  ${If} $DOWNLOAD_HANDLE == ${INVALID_HANDLE_VALUE}
+    MessageBox mb_iconStop "Invalid file handle!"
+    goto Exit
+  ${EndIf}
+
+  ; Verify digital signature of the downloaded installer
+  CertCheck::CheckPETrustAndInfoAsync "$PLUGINSDIR\MediaInfoInstaller.exe" "MEDIAAREA.NET" "SSL.com Code Signing Intermediate CA RSA R1"
+  CertCheckGetStatus:
+    CertCheck::GetStatus
+    Pop $0
+    ${If} $0 == 0
+      sleep 10
+      goto CertCheckGetStatus
     ${EndIf}
+  Pop $0
+  Pop $1
+  ${If} $0 == 0
+    ${AndIf} $1 == 0
+      MessageBox mb_iconStop "Installer signed with an unexpected cert that is untrusted!"
+      goto CleanUp
+  ${ElseIf} $0 == 0
+    MessageBox mb_iconStop "Installer signed with an untrusted cert!"
+    goto CleanUp
+  ${ElseIf} $1 == 0
+    MessageBox mb_iconStop "Installer signed with an unexpected cert!"
+    goto CleanUp
+  ${EndIf}
+
+  ; Execute the downloaded installer
+  ${IfNot} ${Silent}
+    ExecWait '"$PLUGINSDIR\MediaInfoInstaller.exe"'
   ${Else}
-    MessageBox MB_OK "Download Status: $0"
+    ExecWait '"$PLUGINSDIR\MediaInfoInstaller.exe" /S'
   ${EndIf}
 
+  CleanUp:
+  ; Close the handle that prevents modification of the downloaded installer
+  System::Call 'kernel32::CloseHandle(i $DOWNLOAD_HANDLE)'
+
+  Exit:
   ; Make sure PLUGINSDIR is not locked and can be deleted
   SetOutPath "$TEMP"