Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Insecure Automatic Update #2146

Closed
anonymous-matomo-user opened this issue Mar 5, 2011 · 2 comments
Closed

Insecure Automatic Update #2146

anonymous-matomo-user opened this issue Mar 5, 2011 · 2 comments
Labels
duplicate For issues that already existed in our issue tracker and were reported previously. Enhancement For new feature suggestions that enhance Matomo's capabilities or add a new report, new API etc.
Milestone
1.2.1

Comments

@anonymous-matomo-user
Copy link

Right now, the automated update doesn't appear to check the authenticity of the zip. It would be straightforward in some networks to alias the piwik.org domain to some malicious machine containing a compromised zip. Some options are to download only via https, or verify a GnuPG detached signature with it.
@robocoder
Copy link
Contributor

GnuPG already has a ticket in #1757. It is a low priority feature because the required extensions/libraries aren't part of the core PHP distribution, so very few Piwik users would benefit from this feature.

It's already possible to use https. For example, in config/global.ini.php:

latest_version_url = https://piwik.org/latest.zip

However, there are technical drawbacks described in #1867.

@anonymous-matomo-user
Copy link
Author

Thanks. I'll take a look.

@anonymous-matomo-user anonymous-matomo-user added this to the Piwik 1.2.1 milestone Jul 8, 2014
This issue was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
duplicate For issues that already existed in our issue tracker and were reported previously. Enhancement For new feature suggestions that enhance Matomo's capabilities or add a new report, new API etc.
Projects
None yet
Milestone
1.2.1
Development

No branches or pull requests
2 participants
@robocoder @anonymous-matomo-user