Automatic update Jsitemap PRO

[komir2004]

Hello, I have a problem with Jsitemap automatic update. I use Panopticon to auto update my extensions on multiple sites, but I always get an error message when it tries to update JSitemap PRO. The message says:

Extension updates for site #15 (*****) failed installing update for component “ JSitemap PRO”. Joomla! reported an error: This extension does not provide a checksum for validation of the integrity of the downloaded file. • Component Install: The XML file did not have an administration element. • Error updating component.

However, when I go to the Joomla administration panel and update JSitemap PRO manually, it works fine.
Thanks in advance.

[nikosdion]

The message you get comes from Joomla! itself and has two parts.

Part I – Warning about the checksum

It has to do with the checksums in the update stream (see https://docs.joomla.org/Deploying_an_Update_Server and look for “sha256, sha384, sha512” in there).

In Joomla! 3.9 and 3.10 they were optional. If they were present, they were checked but nothing would happen if they did not match.

In Joomla! 4 they are optional. If they are not present a warning is presented saying that the extension does not provide a checksum for validation of the integrity of the downloaded file. This is what happened here. If they are present, they will be checked and the installation will be prevented if they do not match.

In Joomla! 5 they are mandatory and must match.

The developer of the extension MUST change their update XML file to provide the missing checksum information.

Part II – The manifest XML file is invalid

The component in the JSitemap PRO update package has an XML manifest which tells Joomla! how to install it. Joomla! cannot find the administration element which is mandatory for Joomla! components' XML manifests files.

Please remember that all of these messages come FROM JOOMLA! ITSELF. Panopticon DOES NOT perform the update of your extension. It merely tells Joomla! to please update the extension with ID 123, where 123 is the extension ID of the extension being updated. Joomla! uses its own code to download the update XML file, verify the checksums, extract the ZIP file and proceed with installing the updated code.

The fact that this only works from the backend of the site tells me that the developer of this extension probably uses a plugin to change the download information of the extension when performing the update. This plugin seems to not be loaded under the API application. You need to remind the developer of this extension that using installer plugins is a deprecated method since Joomla! 4.0. The correct method to provide downloads for paid extensions is using the Download Keys feature which had existed since Joomla! 3.2 and was exposed in Joomla's user interface since version 4.0. Considering that Joomla! 3.2 was released in 2014 (ten years ago) and Joomla! 4.0 was released in 2021 (2 ½ years ago) there is no reason to use an outdated update method.

[brianteeman]

In Joomla! 5 they are mandatory and must match.

Are you sure about that?

[nikosdion]

At least they were in the dev release. Maybe that changed, I don't know. I've had checksums in my software since ~2018. I have no reason to check again.

[brianteeman]

my understanding (could be wrong) is that if they exist then they must match but their existence is still optional

[komir2004]

Ok I see, Thank you for the clarification.
Do you have in plan to add feature to upload and install extension through Panopticon, similar mysites has https://mysites.guru/blog/install-a-joomla-extension-or-wordpress-plugin-to-1000-sites-with-ease-using-mysites-guru/

[nikosdion]

There is indeed such a feature planned: #346

However, if you could give me more information about whether the extension uses a plugin in the installer or system folder to effect its updates, and what is the URL to their update server there's a chance I might be bale to help in the meantime.

[komir2004]

Can I send you the installation to test it, so I don't give you any false information?

[nikosdion]

Sure thing! I need the following connection information to your (Joomla!) site.

Site connection information

• Login URL e.g. https://www.example.com/administrator/index.php?secret123
• Super User username
• Super User password

(S)FTP connection information – optional, but very helpful

• Hostname
• Port (if other than 21 or 22)
• Username
• Password

Do NOT paste this information unencrypted. GitHub issues and discussions are publicly visible. Instead, follow the instructions below to send me an encrypted copy of the information which can only be decrypted by me:

• Go to https://keybase.io/encrypt
• In the Recipient field type nikosdion.
• It will show you my face, my name, and the fact that I have linked my same-named GitHub account; verify this information and click on my face.
• In the Message to encrypt area enter the information I asked you above.
• Click the Encrypt button.
• After a short while the text area changes its title to The secret message.
• Click in the text area to copy the secret (encrypted) message.
• Paste it to your next reply to me.

This is perfectly safe to do! It uses public key encryption, just like HTTPS, with a much, MUCH stronger cipher (3744-bit Elliptic Curve Cryptography which is insanely secure). The message can only be decrypted with my secret key which is safely stored on a hardware token, protected by a PIN.

Please make sure that you test the access credentials using a separate browser / (S)FTP software than what you normally use to ensure that they really work. Please make sure that there are no geographic or other restrictions which may prevent me from accessing your site. Kindly note that I am on the Asia/Nicosia timezone and I am handling support free of charge; some delays are to be expected.

[komir2004]

I have in mind sending you Jsitemap PRO installation so you can install it on your side and test

[nikosdion]

You can send me the information I need to download it, encrypted in the same way I described above.

[komir2004]

-----BEGIN PGP MESSAGE-----
Version: Keybase OpenPGP v2.1.13
Comment: https://keybase.io/crypto

wcBMA6+1LLjxrhABAQf/TydWtaNnDO+u+PonfWHYebmzYQNCp+qKKe0qEXOIOf4p
tI57ona5o6NywzjmTLjhaywPHDTLidu1Oa4yhUjeZDDuuO1o88ypbxaA5EEUYlDm
jzSibDhDcMjcxWmS1ZPBybvAZ5mDbhuw3Wdd9UFxJw1E7nokOQZt5Dwl+sE0v7MK
g5d/E70pvyv6bYJ01xDmEdPBdVr7bdIF2EH2Yi7BLFckaWrrcNm9HXnqfS5tMDEz
UR5rc3uXuOciPx/rVKjXTzOW8sIAh1iapuy1xy7o4eQfjI3mnXS8qV90nbYnyboS
myqaWBw7s4rtRu8OHBVU8hagYJVVoSs1mr/u0LLtSdKVARKPdjJObkzOvXEsmbZw
xiZK3r28ZSS9gGjQmk6W7/HLv9WRzTQlHjcUlx2w6WGMVZrsllcvX6DGrOUfzEv2
6R+xWQhDin9qG9UGUiuIDrqpnbcGJcxrptSsfrJz9srjjeLKz0l+Ak0K/zTCotmj
h4ymFYUtyHtSK5trUe5okaSTwrujtdXsXgCMAgHtzdKsuBmSjdc=
=6582
-----END PGP MESSAGE-----

[nikosdion]

Unfortunately, I was right. But wait, it's even worse. The way JSitemap Pro handles updates is not just fundamentally incompatible with anything other than performing updates manually from Joomla's interface, but betrays an utter lack of knowledge about how to distribute software, and zero critical thinking. It's a rolling Dumpster fire.

Their update server is http://storejextensions.org/updates/jsitemap_updater.xml. First of all, it lacks any checksums whatsoever. This sh!t won't fly with Joomla! 5, so they already have a big problem.

The second problem is that they say that the update file is http://storejextensions.org/updates/com_jsitemap.zip which is a fake update. If you download that ZIP file you will see that it has an invalid(!) XML manifest. Hence Joomla! complaining about it.

But why does it work manually?

Their system plugin handles the core Joomla! onInstallerBeforePackageDownload event in the jmapUpdateInstall event handler method. What they do there is… outright stupid.

They make an HTTP call to their server to verify that your email has a valid license to the software. If that returns true, they replace the download URL with a hardcoded one which is “encrypted” using ROT13 as "encryption". In short, anyone with half a brain can see what they are doing – it's in plain sight! – and download the new version for free, without having a license. I just did that.

But I digress.

The whole problem is that their system plugin is (correctly) not loaded under the API application, therefore it cannot work. At the very least they should move this code out into an installer plugin, which is the only plugin type which should be handling onInstallerBeforePackageDownload events. If they used the right plugin type, we could do something about it. We definitely can't load system plugins without breaking the API.

Beyond that, they should ideally get a grip on reality and understand that hardcoding a download URL is suicidal for business, especially when the entire protection is ROT-13, a slight variation of Caesar's Cipher which was broken at least 1200 years ago. Not that it matters, since it was dead obvious it's ROT-13 by the fact that their ‘encrypted’ URL starts with uggc://. This can't be anything other than http://, which makes it obvious with exactly the first two letters that it's ROT-13. And that's only if someone is to stupid to notice that 'str_' . 'ro' . 't' . '13' spells str_rot13.

[komir2004]

I see. I am not a programmer and didn't see those problems with extension
Unfortunately, this is a very useful extension with a lot of features in one extension. Maybe will be better to find some others with similar functionality but with better and more secure coding 🤔