Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[5.2] FIX xml sha verification for update server #44336

Open
wants to merge 2 commits into
base: 5.2-dev
Choose a base branch
from

Conversation

tkuschel
Copy link
Contributor

@tkuschel tkuschel commented Oct 21, 2024

I added an optional sha512 hash to my update extension xml file, which is autogenerated for the extension update zip-file. Deploying my extension on an Update Server which is also described here: https://manual.joomla.org/docs/building-extensions/install-update/update-server/.
When there is a space and/or newline, which I unfortunately added in my xml file, the upload breaks.

Summary of Changes

Trimming of the sha512 string value (and other hashes) in the validation of the hash from the xml update file.

Testing Instructions

  1. Create Update Server
  2. Create a xml file with optional sha512 value of an extension install ZIP-FIle, store the value with spaces (or newline) after the tag . Just like in the description from the joomla manual.
  3. E.g.
<updates>
	<update>
		<name>Depot</name>
		<description>Depot component</description>
		<element>com_depot</element>
		<type>component</type>
		<version>0.9.25</version>
		<infourl title="Gitea Versioning">
			https://git.kuschel.at/tom/depot
		</infourl>
		<downloads>
			<downloadurl type="full" format="zip">https://kuschel.at/update/depot_0.9.24.zip</downloadurl>
		</downloads>
		<tags>
			<tag>dev</tag>	<!-- Development versions, very unstable and pre-alpha (e.g. nightly builds) -->
		<!--	<tag>alpha</tag>  --> <!-- Alpha quality software (features not implemented, show-stopper bugs) -->
		<!--	<tag>beta</tag>   --> <!-- Beta quality software (all features implemented, show-stopper bugs possible,minor bugs almost certain) -->
		<!--	<tag>rc</tag>     --> <!-- Release Candidate quality software (no show stopper bugs, minor bugs may still be present) -->
		<!--	<tag>stable</tag> --> <!-- Production quality software. All other tags are currently ignored. -->
		</tags>
		<targetplatform name="joomla" version="5.[0123]" />
		<php_minimum>8.1</php_minimum>
		<sha512>
e63c8b4203b6fdc69f51f3d963fa44231a5df2b5e1f2a2a230856a97d62a7e11f852c274c3b9ac7145cb45cf57e4c59b8906c016bcb339c75137c830df5eba35
		</sha512>
		<maintainer>KW4NZ</maintainer>
		<maintainerurl>https://kuschel.at</maintainerurl>
	</update>
</updates>

Alternative test (from @obuisard):

1 - Download the test extension https://updates.simplifyyourweb.com/free/backgroundstretch/v200/mod_backgroundstretch.zip
2 - Install on a test site.
3 - The version of the module is 2.0.0. A 2.0.1 update is available. Go to Extensions -> Update.
4 - Check for updates (the update server's xml file contains spaces like above).
5 - Try and update 'Background Stretch'.
6 - Before using this patch, the update should fail with a message like this one:
The checksum verification failed. Please make sure you are using the correct update server!
7 - Apply the PR.
8 - When trying to update, the update should go through.

Actual result BEFORE applying this Pull Request

The update is canceled because the two hashes are different.

Expected result AFTER applying this Pull Request

The update is done because the two hashes are identical.

Link to documentations

Please select:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants