Support

Admin Tools

#30720 Scan Differences

Posted in ‘Admin Tools for Joomla! 4 & 5’
This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version
n/a
PHP version
n/a
Admin Tools version
n/a

Latest post by on Saturday, 26 January 2019 17:17 CST

b8fish
It has been my habit when installing component or core updates to always run file scan so as to create a new checksum baseline.

i.e. there are updates to install
so, run filescan to verify no unexpected changes since last updates applied
(if changes, investigate)
if no changes, apply component updates
apply core updates
run filescan
--many differences are of course now reported

Since the new code installed is core or vendor updates, I then just mark everything "Safe" to establish a new baseline. However, this is a more tedious process than perhaps it could be.

1. marking only applies to the displayed differences in the screen report; So many next/mark all's must be done
2. Selecting "all" for pages size and marking all usually ends up with the interface exiting back to the Joomla Control panel and have to start again
3. after everything is marked (takes several iterations and run reports) need to rerun a final report to create the new 0 diffs baseline.

I suggest a button to "Create new checksum baseline" that will do just that. And purge older checksum baselines.

nicholas
Akeeba Staff
Manager
Step 3 is actually unnecessary. The condition to mark a file as suspicious is that its threat score is non-zero AND the identical file was not marked safe. "Identical" in this context means that the file size, file modification date and both checksums are a complete match. You can spoof up to three items, but not all four. Moreover, if you have the calculate diffs option enabled, every time you run a scan the contents of the file end up in the database irrespective of whether the file had a non-zero threat score or not. If the next run deems the file suspicious the current contents (on disk) and those already cached in the database are compared and diff'ed.

As for the "Mark all as Safe" I can see the use case and we will implement it in the next version of Admin Tools.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

System Task
system
This ticket has been automatically closed. All tickets which have been inactive for a long time are automatically closed. If you believe that this ticket was closed in error, please contact us.

Support Information

Working hours: We are open Monday to Friday, 9am to 7pm Cyprus timezone (EET / EEST). Support is provided by the same developers writing the software, all of which live in Europe. You can still file tickets outside of our working hours, but we cannot respond to them until we're back at the office.

Support policy: We would like to kindly inform you that when using our support you have already agreed to the Support Policy which is part of our Terms of Service. Thank you for your understanding and for helping us help you!