8

Joomla provide the ability to add an update server allowing users to install an extension update when release at the click of a button.

This is of course great for free extensions, however for commercial extensions, one would run into a problem where someone could simply get the download URL from the update XML file and publish it, so this is a no go.

What I did have in mind, was doing something along the same lines, but it would simply notify the user that there is an update and they would have to go to the developer website and manually download it, however I didn't use any subscription extensions, thus there are no special permissions to get access to these commercial extensions. Instead I used a component that simply allows the user to purchase the extension and that's it.

So my question is, is there a built-in method that I'm unaware of that allows an update server for commercial extensions? I believe I remember this being discussed a long time ago, but not sure if anything was implemented into Joomla for it.

Or maybe instead, would it be an idea to prevent direct access to the XML if one types in the URL in their browser using a htaccess file?

Note: I'm referring to a module, else I might have looked into something like Akeeba Live Update

Improve this question
2
  • 1
    I would contact one of the extension makers who do this already. The Rocket Theme guys created their own plugin that validates off their server and still uses the built in update mechanism. Akeeba does it without an extra plugin, but will update if your code is entered in the component settings. You could also ask the watchful.li guys as their system can tap into all of these and run the upgrade for you. Someone may be willing to let you in on how they do it.
    – Brian Peat
    Commented Oct 10, 2014 at 4:34
  • @BrianPeat - thank you for your input. I found a commit on Github by Nick from Akeeba which allows exactly what I want, however (and maybe it's just me having a blonde moment), but I don't feel the "developer guide" suffices. It doesn't mention where to put the code. The person I work with will be asking him for more detail on the matter so hopefully this will get me somewhere.
    – Lodder
    Commented Oct 10, 2014 at 7:18

1 Answer 1

Reset to default
5

My version of Implementation would be...

The Client:- Just give each subscribed user a unique(secret) key and simply pass that as GET variable when checking for new updates.

The Server:- Likewise, just check the incoming requests for that variable, and match it with a database, cool? allow : deny;.

The Misuse:- Keep a record of each key being used, and set a no of feasible requests allowed, beyond which just flag that key and its user as suspecious, then do whatever what you think of doing like, warning that user, blocking is for sometime, or just plain subscription termination...etc the possibilities are endless.

Improve this answer
3
  • what happens after the server responded as 'allow'? In other words how this validation works along with the update server?
    – Malaiselvan
    Commented Oct 29, 2015 at 9:14
  • allow means the server has decided to send the update file as response.
    – Mohd Abdul Mujib
    Commented Oct 29, 2015 at 13:09
  • Thanks @9ksoft. Your solution will allow the user to download the updated extension. I believe it cannot do any automatic installation using update server right? Or do you have a solution to do auto update after the validation? Sorry for asking many questions.... :-)
    – Malaiselvan
    Commented Oct 29, 2015 at 16:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.