[4.0] Checksum extensions - GSoC Expand Extensions Manager by NunoLopesPT · Pull Request #17555 · joomla/joomla-cms

NunoLopesPT · 2017-08-16T00:21:56Z

Introduction

Currently there is no security when downloading files from update sites or uploading a package, with this feature the main goal is to make sure that only the original files are downloaded and installed by checking the integrity of the package(SHA256, SHA1 and MD5 Hashes), lowering the risk of getting infected files that can risk the user.

Summary of Changes

This verification will only be made for installing packages from URL or uploading a package file in the Install view, this is how the process of verification will happen:

(note: I forgot to place the SHA-256 hash here)

Testing Instructions

We will have 3 packages to test:

Package with the correct hashes in the update server manifest:
component_joomla.zip

Here is the update server manifest:
https://www.jah-tz.de/downloads/core/gsoc17/extension.xml

Package with the wrong hashes:
component_joomla_wrong_checksum.zip

I remember here that without the Force Install checked you won't install the extension

Update server manifest:
https://www.jah-tz.de/downloads/core/gsoc17/extension_wrong_hash.xml

Package without hashes:
component_joomla_no_checksum.zip

Update server manifest:
https://www.jah-tz.de/downloads/core/gsoc17/extension_no_chechsum.xml

Expected result

Case 1 - File Checksum OK:
A success message when the checksums are equal

Case 2 - File Checksum Failed:
A danger message when the checksums are not equal and the user does not want to force the installation, redirecting back to the view without installing the extension

Case 3 - File Checksum Failed but user wants to force install:
There will be a checkbox on the upload package and install from URL tab where the user can check if he really wants to install the extension even if the Checksum fails.
A warning if the checksum fails will appear.

Case 4 - No checksum found:
If the extension has no update site or no checksums (MD5, SHA1 or SHA256 tags) are showed in the update site manifest a warning should appear to make sure the users know that no security verification was provided in the extension package.
A info message will appear that no Hashes are available.

Actual result

Currently there is no security or information related to this

Documentation Changes Required

…cts/gsoc17_expand_extension_manager into checksum_extensions

…gsoc17_expand_extension_manager into checksum_extensions

brianteeman · 2017-08-16T07:52:26Z

administrator/language/en-GB/en-GB.com_installer.ini

 COM_INSTALLER_HEADING_UPDATESITE_NAME_DESC="Update Site descending"
 COM_INSTALLER_HEADING_UPDATESITEID="ID"
 COM_INSTALLER_INSTALL_BUTTON="Install"
+COM_INSTALLER_INSTALL_CHECKSUM_NOT_FOUND="There were no checksums provided in the package"


Please add a period at the end of the sentence

brianteeman · 2017-08-16T07:52:35Z

administrator/language/en-GB/en-GB.com_installer.ini

+COM_INSTALLER_INSTALL_CHECKSUM_NOT_FOUND="There were no checksums provided in the package"
+COM_INSTALLER_INSTALL_CHECKSUM_WRONG="File Checksum Failed"
+COM_INSTALLER_INSTALL_CHECKSUM_CORRECT="File Checksum OK"
+COM_INSTALLER_INSTALL_CHECKSUM_WRONG_NO_INSTALL="File Checksum Failed, Extension was not installed"


Please add a period at the end of the sentence

brianteeman · 2017-08-16T07:52:57Z

administrator/language/en-GB/en-GB.plg_installer_urlinstaller.ini


 PLG_INSTALLER_URLINSTALLER_BUTTON="Check and Install"
+PLG_INSTALLER_URLINSTALLER_FORCE_INSTALL="Force Install"
+PLG_INSTALLER_URLINSTALLER_FORCE_INSTALL_DETAILS="Forces the installation of the package even if it is not trusted"


Please add a period at the end of the sentence

alikon · 2017-08-19T09:34:07Z

a light port to 3.8 #17619

…hecksum_extensions

brianteeman · 2017-08-25T10:58:26Z

The provided hash lets you double-check that the file you downloaded was not corrupted accidentally in transit, or that the file you downloaded from another source (a faster mirror or github etc) is the same as the file available for download at the original website where the hash is published

Quy · 2017-08-25T21:00:51Z

administrator/language/en-GB/en-GB.com_installer.ini

 COM_INSTALLER_INSTALL_BUTTON="Install"
+COM_INSTALLER_INSTALL_CHECKSUM_NOT_FOUND="There were no checksums provided in the package."
+COM_INSTALLER_INSTALL_CHECKSUM_WRONG="File Checksum Failed"
+COM_INSTALLER_INSTALL_CHECKSUM_CORRECT="File Checksum OK"


Sort alpha order.

Quy · 2017-08-25T21:02:56Z

plugins/installer/packageinstaller/tmpl/default.php


 <div id="uploader-wrapper">
+	<div class="control-group">
+		<label for="force_install" class="control-label" title="<?php echo \JText::_('PLG_INSTALLER_URLINSTALLER_FORCE_INSTALL_DETAILS') ?>">


Add semicolon after echo \JText::_('PLG_INSTALLER_URLINSTALLER_FORCE_INSTALL_DETAILS')

Quy · 2017-08-25T21:03:27Z

plugins/installer/urlinstaller/tmpl/default.php

 	</div>
 </div>
+<div class="control-group">
+	<label for="force_install" class="control-label" title="<?php echo \JText::_('PLG_INSTALLER_URLINSTALLER_FORCE_INSTALL_DETAILS') ?>">


Add semicolon after echo \JText::_('PLG_INSTALLER_URLINSTALLER_FORCE_INSTALL_DETAILS')

wilsonge · 2017-11-19T10:58:00Z

administrator/components/com_installer/Helper/InstallerHelper.php

+		foreach ($hashes as $hash)
+		{
+			$hashPackage = hash_file($hash, $packagefile);
+			$hashRemote  = $updateServerManifest->$hash->_data;


If there is a hash missing you get PHP Errors. To solve this above this line add

// If there is no hashes set for an extension continue if (!property_exists($updateServerManifest, $hash)) { continue; }

wilsonge · 2017-11-19T11:00:15Z

Can we fix conflicts please :)
The bad checksum extension still installs (we talked about this after the panel - all the checksums in that file aren't the ones you check for)

schultz-it-solutions · 2019-04-15T07:10:33Z

The Update Server manifests seem to no longer exist
https://www.jah-tz.de/downloads/core/gsoc17/extension.xml

Could you please direct me to an example (or description) of the changes in the manifest.

sanderpotjer · 2019-05-05T13:37:05Z

@roland-d while working on the extension manager features, can you please update this PR as well (or create a new one).

Quy · 2019-05-06T02:27:36Z

administrator/language/en-GB/en-GB.com_installer.ini

 COM_INSTALLER_HEADING_UPDATESITE_NAME_DESC="Update Site descending"
 COM_INSTALLER_HEADING_UPDATESITEID="ID"
 COM_INSTALLER_INSTALL_BUTTON="Install"
+COM_INSTALLER_INSTALL_CHECKSUM_CORRECT="File Checksum OK"


String not used.

Quy · 2019-05-06T04:33:53Z

administrator/components/com_installer/Helper/InstallerHelper.php

+	{
+		$app = \JFactory::getApplication();
+
+		$hashes = array("sha256", "sha384", "sha512");


Suggested change

$hashes = array("sha256", "sha384", "sha512");

$hashes = ['sha256', 'sha384', 'sha512'];

uglyeoin · 2019-10-19T13:26:49Z

Have @wilsonge comments been taken account of? Is this ready to test yet?

wilsonge · 2019-10-19T13:36:02Z

No no use in testing this right now.

roland-d · 2020-08-01T15:23:10Z

This can be closed and picked up in another PR if someone is interested.

NunoLopesPT added 10 commits August 9, 2017 17:39

Signed Files Installation v1.0

348f1fd

Merge branch 'checksum_extensions' of https://github.com/joomla-proje…

73e6cd6

…cts/gsoc17_expand_extension_manager into checksum_extensions

Code style

b2e336a

Code style

94d9f39

Code style

4cca8ba

Code style

e8cfc9c

Code style

12f554a

bug fix

840f0f2

Merge branch 'checksum_extensions' of https://github.com/NunoLopes96/…

c7f8890

…gsoc17_expand_extension_manager into checksum_extensions

Added sha256 tag and rework on the code to make it less hardcoded

1bc0e7d

joomla-cms-bot added Language Change This is for Translators PR-4.0-dev labels Aug 16, 2017

NunoLopesPT changed the title ~~Checksum extensions~~ [4.0] Checksum extensions - GSoC Expand Extensions Manager Aug 16, 2017

brianteeman reviewed Aug 16, 2017

View reviewed changes

Bug Fix

34ccc41

alikon mentioned this pull request Aug 19, 2017

checksum extensions light #17619

Merged

NunoLopesPT added 2 commits August 23, 2017 21:44

Merge branch '4.0-dev' of https://github.com/joomla/joomla-cms into c…

70c00eb

…hecksum_extensions

Checksum added to updates

903e234

Quy reviewed Aug 25, 2017

View reviewed changes

Change Hash Algos to "sha256", "sha384" and "sha512" / Codestyle

04b1aba

wilsonge reviewed Nov 19, 2017

View reviewed changes

alikon mentioned this pull request Mar 22, 2019

[4.0] Warning and Notice when Installing language pack #24302

Closed

ghost added the J4 Issue label Apr 5, 2019

ghost removed the J4 Issue label Apr 13, 2019

roland-d self-assigned this May 5, 2019

Quy reviewed May 6, 2019

View reviewed changes

roland-d closed this Aug 1, 2020

roland-d deleted the checksum_extensions branch August 1, 2020 15:23

	$hashes = array("sha256", "sha384", "sha512");
	$hashes = ['sha256', 'sha384', 'sha512'];

Uh oh!

Conversation

NunoLopesPT commented Aug 16, 2017

Introduction

Summary of Changes

Testing Instructions

Expected result

Actual result

Documentation Changes Required

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

alikon commented Aug 19, 2017

Uh oh!

brianteeman commented Aug 25, 2017

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

wilsonge commented Nov 19, 2017

Uh oh!

schultz-it-solutions commented Apr 15, 2019

Uh oh!

sanderpotjer commented May 5, 2019

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

uglyeoin commented Oct 19, 2019

Uh oh!

wilsonge commented Oct 19, 2019

Uh oh!

roland-d commented Aug 1, 2020

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

10 participants