XOOPS 
Forum
Forum Index General Forums Community Support Modules Support Themes Support Development International Support Module Hack Reviews Theme Designer Talk
  1. Board index / 
  2. Xoops Development / 
  3. Xoops Development 
  4.  / Md5 or md5_file ?
Register
1
culex
Md5 or md5_file ?

  • 2009/12/6 0:18

  • culex

  • Module Developer

  • Posts: 711

  • Since: 2004/9/23


as I have been looking in to a md5 checksum of files being left out of indexscans search I notiched I have difficulties getting the checksum.php to work as I expected.

I "Stole" the md5check.php from the xoopsCore to reuse and created a indexscan.md5 file to compare against.

However as it worked fine on my server, it failed on my local test server..

First it failed on my wamp server with the $sum & and the md5($txt) having same value.

I then modified a little to use the md5_file function and then worked. But only worked on my testing server if I ran a create md5 files "on_server" and didnt work on uploading the ready made one.

My Create md5 function
<?php IndexScanCreateMd5('.'); function IndexScanCreateMd5($dir) { // Open .md5 file for appending $fh = fopen('indexscan.md5', 'a') or die("can't open file"); // We open the file if ($url = opendir($dir)) { // It searches all folders and files it contains while ($folder = readdir($url)) { // The path of current folder $path = $dir . '/' . $folder; // If we find a folder, then relaunch it function to search // Once all the files and folders it contains if ($folder != '.' && $folder != '..' && is_dir($path)) IndexScanCreateMd5($path); // If we are dealing with a file elseif ($folder != '.' && $folder != '..' && !is_dir($path)) { $stringData = $path . ':' . md5_file($path); echo $path . ':' . md5_file($path).'<br />'; // We insert the path of the file and its MD5 hash fwrite($fh, $stringData."n"); } } closedir($url); } } ?>


My modified XOOPS checksum

<?php if (file_exists('indexscan.md5')) { /** * XOOPS installation md5 checksumminig script * * This script allows you to check that the XOOPS system files have been correctly uploaded. * It reads all the XOOPS files and reports missing or invalid ones. * * Instructions: * - Upload this script and xoops.md5 to your XOOPS documents root * - Access it using a browser * - Re-upload missing/invalid files * * @copyright The XOOPS project https://xoops.org/ * @license http://www.fsf.org/copyleft/gpl.html GNU public license * @author Skalpa Keo <skalpa@xoops.org> * @since 2.0.14 * @version $Id: md5check.php 808 2006-11-15 16:22:22Z skalpa $ * @package xoops */ error_reporting( 0 ); header( "Content-type: text/plain" ); if ( !is_file( "indexscan.md5" ) || !is_readable( "indexscan.md5" ) ) { echo "xoops.md5 file not found.n"; exit(); } $sums = explode( "n", rtrim( file_get_contents( "indexscan.md5" ) ) ); foreach ( $sums as $line ) { list( $file, $sum ) = explode( ":", $line, 2 ); if ( !file_exists( $file ) ) { echo "$file missing !n"; } else { $txt = $file; if ( md5_file($txt) != $sum ) { echo "$file content invalidn"; } } } echo "Files are verified"; } else { Echo "indexscan.md5 is missingnPlease upload"; } ?>


website server using
XOOPS Version XOOPS 2.4.2
PHP Version 5.2.10
mySQL Version 5.0.32-Debian_7etch11-log

Local server
XOOPS Version XOOPS 2.4.2
PHP Version 5.3.0
mySQL Version 5.1.33-community-log
Server API apache2handler
OS WINNT


Any pointers on how to include the indexscan.md5 file with the values so the can be used allround?

I create them on installing the module ? or is there a work-around method ?
2
trabis
Re: Md5 or md5_file ?

  • 2009/12/6 0:57

  • trabis

  • Core Developer

  • Posts: 2269

  • Since: 2006/9/1 1


The file with the checksum cannot be in the same folder of the package you are comparing it with. If it is, then you need to exclude it from being hashed by that recursive function (if file is the checksum then skip).
3
wishcraft
Re: Md5 or md5_file ?

md5 is good for textual hashing, that is a hash which is based in a string, not good for file processing as you have to load the file into memory. md5_file is for getting md5 of files withouy file buffering.

If you are having trouble you can always store the md5 in the filename and scan for .md5 file with a prefix therefore you don't have to open the file, or what trabis suggested is probably just a little less in code lines.
4
iHackCode
Re: Md5 or md5_file ?

Dont include the absolute path in the indexscan.md5 file

try these, i only modified it a little bit.
these two files are placed in the same level as the 'Frameworks' folder (i'm using that folder as an example). to get the code with the backslashes you will have to hit reply and use the quote button to get the code.

checksum
<?php if (file_exists('indexscan.md5')) { /** * XOOPS installation md5 checksumminig script * * This script allows you to check that the XOOPS system files have been correctly uploaded. * It reads all the XOOPS files and reports missing or invalid ones. * * Instructions: * - Upload this script and xoops.md5 to your XOOPS documents root * - Access it using a browser * - Re-upload missing/invalid files * * @copyright The XOOPS project https://xoops.org/ * @license http://www.fsf.org/copyleft/gpl.html GNU public license * @author Skalpa Keo <skalpa@xoops.org> * @since 2.0.14 * @version $Id: md5check.php 808 2006-11-15 16:22:22Z skalpa $ * @package xoops */ error_reporting( 0 ); $dir = "Frameworks"; header( "Content-type: text/plain" ); if ( !is_file( "indexscan.md5" ) || !is_readable( "indexscan.md5" ) ) { echo "indexscan.md5 file not found.n"; exit(); } $sums = explode( "n", rtrim( file_get_contents( "indexscan.md5" ) ) ); foreach ( $sums as $line ) { list( $file, $sum ) = explode( ":", $line, 2 ); if ( !file_exists( $dir.$file ) ) { echo "$file missing !n"; } else { $txt = $dir.$file; if ( md5_file($txt) != $sum ) { echo "$file content invalidn"; } } } echo "Files are verified"; } else { Echo "indexscan.md5 is missingnPlease upload"; } ?>


create
<?php IndexScanCreateMd5('Frameworks',''); function IndexScanCreateMd5($dir,$location) { // Open .md5 file for appending $fh = fopen('indexscan.md5', 'a') or die("can't open file"); // We open the file if ($url = opendir("$dir/$location")) { // It searches all folders and files it contains while ($folder = readdir($url)) { // The path of current folder $path = $dir . '/'.$location. '/' . $folder; // If we find a folder, then relaunch it function to search // Once all the files and folders it contains if ($folder != '.' && $folder != '..' && is_dir($path)) IndexScanCreateMd5($dir,"$location/$folder"); // If we are dealing with a file elseif ($folder != '.' && $folder != '..' && !is_dir($path)) { $stringData = "$location/$folder" . ':' . md5_file($path); echo "$location/$folder" . ':' . md5_file($path).'<br />'; // We insert the path of the file and its MD5 hash fwrite($fh, $stringData."n"); } } closedir($url); } } ?>


um.. yea. i think i misunderstood the question.
5
culex
Re: Md5 or md5_file ?

  • 2009/12/6 21:27

  • culex

  • Module Developer

  • Posts: 711

  • Since: 2004/9/23


Cool thanks. I think I got it working now..

The idea is this. When i use indexscan I leave some files out from the scan as they contain for instance the word Iframe som many times in descriptions etc. and therefore they give a false scan result. I leave these out but as Ghia mentioned this is a blind spot.

I now need to run a check on these files using checksum, but I do not want to leave this indexscan.md5 on the server, as it's browsable

. Any ideas how to do this ?
6
ghia
Re: Md5 or md5_file ?

  • 2009/12/7 0:07

  • ghia

  • Community Support Member

  • Posts: 4953

  • Since: 2008/7/3 1


I'm thinking about some auto check for the file itself. I know we did in early days something like that on some programs (not PHP), but I don't remember the exact details. Must plow some archives for that. I still know the workflow.
You define a checksum definition as 0x00000000.
You let the program calculate and display its checksum.
You modified the checksum definition with this value (or was it a kind of complement?). Result was that the next checksum calculation was zero.
So this result could be used to check if the file was not corrupted. I believe the calculation method was CRC32.

Other possibility could be to make the MD5 calculations on all lines of the file exept the one with the define of the MD5 result.
The definition line can be secured by a pattern match.
7
culex
Re: Md5 or md5_file ?

  • 2009/12/7 19:50

  • culex

  • Module Developer

  • Posts: 711

  • Since: 2004/9/23


I made it work.

All files are now scanned. Only admin/index.php have the word iframe features so this is left out and insted checked by md5parse.php by checksum.

<?php $dir = ""; $file="index.php"; $verifyMessage=""; // $checksum ="aff9e481b01ba61606b59a32b87aaaea"; // php checksum Linux $checksumNT = "f5e765568ec1fd209cceee4932c3a82f"; // php checksum Winnt $indexscanfile = $dir.$file; echo "<br><br>".$dir.$file." : ".md5_file("$indexscanfile")." = ".$checksum; if ( md5_file($indexscanfile) != $checksum && md5_file($indexscanfile) != $checksumNT) { //echo "$file content invalidn"; $verifyMessage .= _AM_INDEXSCAN_NOTVERIFY."<img src='alert.png'></img>"."<br>"; } elseif ( md5_file($indexscanfile) == $checksum ) { //$verifyMessage .= _AM_INDEXSCAN_VERIFIED."<img src='verified.png'></img>"."<br>"; } ?>


Md5parse.php is instead checked by the index.php.

However my problem is now, that I get 2 different sums for admin/index.php even though the files are identical in content, size etc.

On my local test server (wamp) i get
index.php : f5e765568ec1fd209cceee4932c3a82f

An online on my website I get
index.php : aff9e481b01ba61606b59a32b87aaaea

I realize that my website is using linux and the local is using apache inside windows but shouldn't the 2 sums be identical ??

- I have cleared the problem by validating both sums.
8
culex
Re: Md5 or md5_file ?

  • 2009/12/7 19:51

  • culex

  • Module Developer

  • Posts: 711

  • Since: 2004/9/23


I made it work.

All files are now scanned. Only admin/index.php have the word iframe features so this is left out and insted checked by md5parse.php by checksum.

<?php $dir = ""; $file="index.php"; $verifyMessage=""; // $checksum ="aff9e481b01ba61606b59a32b87aaaea"; // php checksum Linux $checksumNT = "f5e765568ec1fd209cceee4932c3a82f"; // php checksum Winnt $indexscanfile = $dir.$file; echo "<br><br>".$dir.$file." : ".md5_file("$indexscanfile")." = ".$checksum; if ( md5_file($indexscanfile) != $checksum && md5_file($indexscanfile) != $checksumNT) { //echo "$file content invalidn"; $verifyMessage .= _AM_INDEXSCAN_NOTVERIFY."<img src='alert.png'></img>"."<br>"; } elseif ( md5_file($indexscanfile) == $checksum ) { //$verifyMessage .= _AM_INDEXSCAN_VERIFIED."<img src='verified.png'></img>"."<br>"; } ?>


Md5parse.php is instead checked by the index.php.

However my problem is now, that I get 2 different sums for admin/index.php even though the files are identical in content, size etc.

On my local test server (wamp) i get
index.php : f5e765568ec1fd209cceee4932c3a82f

An online on my website I get
index.php : aff9e481b01ba61606b59a32b87aaaea

I realize that my website is using linux and the local is using apache inside windows but shouldn't the 2 sums be identical ??

- I have cleared the problem by validating both sums.
9
ghia
Re: Md5 or md5_file ?

  • 2009/12/7 23:03

  • ghia

  • Community Support Member

  • Posts: 4953

  • Since: 2008/7/3 1


I think the difference is how you upload the files in ascii or binary.
When uploaded as binary the checksums should be the same.
If in ascii, the line ends are different: line feed on Linux and carriage return, line feed on Windows.
10
culex
Re: Md5 or md5_file ?

  • 2009/12/7 23:28

  • culex

  • Module Developer

  • Posts: 711

  • Since: 2004/9/23


Yeah I actually just checked this ...

I suddently readlized that I do not really upload files to my test server, just copy-paste to the www folder and therefore the process is not the same.

I'll leave both sums in the script though, maybe someone else like me is too lazy to ftp files from desktop to test servers folder :) :)

Thanks for the help

Login

Register now!  |  Lost Password?

Search

Advanced Search

Recent Posts

Donat-O-Meter

Stats
Goal: $15.00
Due Date: Jul 31
Gross Amount: $0.00
Net Balance: $0.00
Left to go: $15.00
Make donations with PayPal!

Latest GitHub Commits