search

akeeba / panopticon

Self-hosted site monitoring and management
GNU Affero General Public License v3.0
39 stars 20 forks source link

Check integrity of Joomla core files #20

Open nikosdion opened 1 year ago

nikosdion commented 1 year ago

We would need to check if the Joomla version is listed in the download.joomla.org site.

Download the ZIP file and create SHA-1 checksums of the files as-is and with all their newlines converted to LF (i.e. convert CRLF to LF, and CR to LF).

The same needs to happen server-side, e.g. make an API call which allows us to retrieve a list of the checksums of a bunch of files we send in a POST request.

If any checksums differ, notify the user.

This is auxiliary to the PHP File Change Scanner. It cannot detect added files in core folders; that's something the PHP File Change Scanner can do, though.

nikosdion commented 10 months ago

We are automatically generating the checksum and make them available in an API: https://getpanopticon.com/checksums/ This is much better than having each installation download Joomla's ZIP files by itself.

We need to write a connector feature to walk through the filesystem and return the checksums.

nikosdion commented 5 months ago

The service endpoint is fully operational.

nikosdion commented 3 months ago

This feature needs a full site scan, which is duplicating a lot of the work done in the PHP File Change Scanner. This feature should really be added to Admin Tools' PHP File Change Scanner and its results reported to Panopticon.

This is an important enough feature that may warrant a backport to Admin Tools 6 for Joomla! 3 — a CMS release which refuses to die just by virtue of sheer deployment size.