(original thread)Extension installer - new way to install extensions - Page 6

idioteque · 2007-07-26, 16:17

just curious, was or is it the installer or is / was it the MPI file that is not created ok ?

piranha · 2007-07-26, 17:27

Quote:

Originally Posted by dukus

Some news:
- MPInstaller now it is included in SVN
- support for a default skin files witch used in non supported skins
- saving file bug fixed
- in editor support for DEL key

Do you mean it has finally been included in MP SVN?

dukus · 2007-07-26, 19:35

Yes, it is included in MP SVN and we try to make a new site for supporting mpi files for updating and downloading.
But the program need to be tested....., and support from extension developers

Quote:

Originally Posted by idioteque

just curious, was or is it the installer or is / was it the MPI file that is not created ok ?

The problem was in installer the package it is mostly ok

Bram · 2007-07-26, 20:22

Quote:

Originally Posted by dukus

Yes, it is included in MP SVN and we try to make a new site for supporting mpi files for updating and downloading.
But the program need to be tested....., and support from extension developers

I've started scripting a bit (I'll have more time in some weeks) on the php interface.
What is making a bit more difficult is that the webserver of mediaportal is giving me no errors at all. Even with the error repoting flag set to ALL I can't get any error reports. Is there something I can do about that myself? It would speed up the development.

dukus · 2007-07-26, 20:27

try this
ini_set('display_errors',1);
work for me

Bram · 2007-07-27, 00:11

Thank you. It's not giving all errors now, but enough.

I've got the upload part (from a web interface of course) working with all possible checks. The most thorough one is the mime type check. But with the mpi extension that's a bit difficult. It makes php not recognize the file as a zip. The mime type it returns is "application/octet-stream". Which is the same as "*". In other words.... Allowing this mime type will create a security issue. If someone who would want to harm the server could break the login security, or in any other way could obtain access to the upload possibility, he could upload a file with any unknown extension (an executable script for example). This person would also have to hack the server again thrue another method to execute the file. If he would succeed in that he could do anything he wants with the server (everything the webserver allows). Read source files (database passwords .... etc.), delete and modify files....and so on.

It's not a very big risk, but it's there. This is all because of the for php unknown mpi extension. Even though it really is a zip file.
If I upload a zip file and restrict all other mime types the upload script is absolutely secure. But renaming the exact same file to *.mpi and uploading it results in having to allow all unknown file extensions.

I'm not sure how secure the script has to be.
One solution that I have already prepared is allowing only zip files to be uploaded. Then rename it to .mpi on the server. This would fix the security issue. Would that be a solution? Or should I ignore the security problem? It's highly unlikely anyone could ever gain (or want to gain) illegal access to the server to execute the illegally uploaded file (if one would even succeed uploading a harmfull file). But still, I like to be thorough.

dukus · 2007-07-27, 06:43

You should ignore this issue, when a file is uploaded is stored database only when published it exist physically on server, but then it is tested of it is a valid mpi file (zip,and contain right xml file)

lkuech · 2007-07-27, 06:51

Hi all.

I just discovered this great "plugin". Awesome idea... (and awesome result of course

)
I definitely plan to release next versions of my plugins as MPI. The group function helps me a lot with my new version of the ViewmodeSwitcher, because the version needs to know if the tv channel has been changed I need separated dll files installed beside the plugin. I was thinking about building a small installer my self to keep the "nastiness" from my users. Know I can just use the MPInstaller

I just did some brief test with the Installer: Could it be that the "Uninstall" function does not work right now? I get an "invalid package!" error. I use the SVN 15338.

And a potential suggestion: If two packages came this the same file (maybe a sql dll copied to the mp root) than it would be helpful to think about a file counter (like the windows installer did that for dll files). Every installation that comes with the file increased the counter and decreased it during uninstall. That avoids that the removal of one of those packages "destroys" the other one.

Bye
Lars

Bram · 2007-07-27, 10:03

Quote:

Originally Posted by dukus

You should ignore this issue, when a file is uploaded is stored database only when published it exist physically on server, but then it is tested of it is a valid mpi file (zip,and contain right xml file)

It seems that I still don't have enough information.
Could you make a document discribing the way you have in mind everything should work, step by step? I can help, but I need more info.

THDBASED · 2007-07-27, 10:32

Just a little off-topic question is this installer also going to be used to install skins? Because I was thinking about this the last couple of days. Because it is very hard to maintain a skin to be up to date with the latest version of MP there should be a way for Skin authors to upload there new files (updated ones for latest versions) to the SVN or some other place on the server and then hev a button in the settings part of the skin to update the skin to work with last version. I think this would really help out skin authors and because you are working on something similar it could be included in this project.

2007-07-26, 16:17	#51 (permalink)
idioteque Retired Team Member Join Date: Sep 2005 Posts: 618 Thanks: 5 Thanked 9 Times in 6 Posts Country: My System	just curious, was or is it the installer or is / was it the MPI file that is not created ok ? __________________ go to the new My Music Wiki, to expand the capabilities of your music collection: http://wiki.team-mediaportal.com/UsingMyMusic

2007-07-27, 00:11	#56 (permalink)
Bram Portal Member Join Date: Dec 2005 Location: 's-Hertogenbosch Age: 30 Posts: 834 Thanks: 19 Thanked 2 Times in 2 Posts Country: My System	Thank you. It's not giving all errors now, but enough. I've got the upload part (from a web interface of course) working with all possible checks. The most thorough one is the mime type check. But with the mpi extension that's a bit difficult. It makes php not recognize the file as a zip. The mime type it returns is "application/octet-stream". Which is the same as "". In other words.... Allowing this mime type will create a security issue. If someone who would want to harm the server could break the login security, or in any other way could obtain access to the upload possibility, he could upload a file with any unknown extension (an executable script for example). This person would also have to hack the server again thrue another method to execute the file. If he would succeed in that he could do anything he wants with the server (everything the webserver allows). Read source files (database passwords .... etc.), delete and modify files....and so on. It's not a very big risk, but it's there. This is all because of the for php unknown mpi extension. Even though it really is a zip file. If I upload a zip file and restrict all other mime types the upload script is absolutely secure. But renaming the exact same file to .mpi and uploading it results in having to allow all unknown file extensions. I'm not sure how secure the script has to be. One solution that I have already prepared is allowing only zip files to be uploaded. Then rename it to .mpi on the server. This would fix the security issue. Would that be a solution? Or should I ignore the security problem? It's highly unlikely anyone could ever gain (or want to gain) illegal access to the server to execute the illegally uploaded file (if one would even succeed uploading a harmfull file). But still, I like to be thorough. __________________ Last edited by Bram; 2007-07-27 at 00:13.

2007-07-27, 06:51	#58 (permalink)
lkuech Portal Developer Join Date: Feb 2007 Location: Hamburg Age: 34 Posts: 551 Thanks: 28 Thanked 44 Times in 18 Posts Country: My System	Hi all. I just discovered this great "plugin". Awesome idea... (and awesome result of course ) I definitely plan to release next versions of my plugins as MPI. The group function helps me a lot with my new version of the ViewmodeSwitcher, because the version needs to know if the tv channel has been changed I need separated dll files installed beside the plugin. I was thinking about building a small installer my self to keep the "nastiness" from my users. Know I can just use the MPInstaller I just did some brief test with the Installer: Could it be that the "Uninstall" function does not work right now? I get an "invalid package!" error. I use the SVN 15338. And a potential suggestion: If two packages came this the same file (maybe a sql dll copied to the mp root) than it would be helpful to think about a file counter (like the windows installer did that for dll files). Every installation that comes with the file increased the counter and decreased it during uninstall. That avoids that the removal of one of those packages "destroys" the other one. Bye Lars __________________ Using a wide screen and tired of changing the aspect ratio via remote all the time? Use the ViewModeSwitcher Plugin and everything is working automatically. Are you able to find your home in MediaPortal? Yes you are! With the WorldMap plugin!

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
(original thread) MCE Replacement Plugin v1.0.0	and-81	MCE Replacement Plugin	532	2007-02-23 23:24
(original thread) MP-TVSeries	Inker	My TVSeries	666	2007-02-21 21:15
(original thread) US/Canadian/Mexico EPG Zap2it Plugin Released	bradsjm	zap2it (discontinued)	513	2007-02-21 14:07
(original thread) MyFilms v3.1 - Use an ANT Movie Database (AMC) in MP	zebons	My Films	201	2007-02-12 08:27
(original thread) My Lyrics Plugin	mackey	My Lyrics Plugin	213	2007-01-27 11:39

2007-07-26, 20:27	#55 (permalink)
dukus Portal Developer Join Date: Jan 2006 Age: 28 Posts: 338 Thanks: 7 Thanked 50 Times in 21 Posts Country: My System	try this ini_set('display_errors',1); work for me

2007-07-27, 06:43	#57 (permalink)
dukus Portal Developer Join Date: Jan 2006 Age: 28 Posts: 338 Thanks: 7 Thanked 50 Times in 21 Posts Country: My System	You should ignore this issue, when a file is uploaded is stored database only when published it exist physically on server, but then it is tested of it is a valid mpi file (zip,and contain right xml file)

2007-07-27, 10:32	#60 (permalink)
THDBASED Portal Member Join Date: Jan 2006 Posts: 464 Thanks: 65 Thanked 2 Times in 2 Posts Country: My System	Just a little off-topic question is this installer also going to be used to install skins? Because I was thinking about this the last couple of days. Because it is very hard to maintain a skin to be up to date with the latest version of MP there should be a way for Skin authors to upload there new files (updated ones for latest versions) to the SVN or some other place on the server and then hev a button in the settings part of the skin to update the skin to work with last version. I think this would really help out skin authors and because you are working on something similar it could be included in this project.