16

When updating Joomla sites to the latest version I always have a minor panic in case the site I'm upgrading, built in the past by some rogue developer (i.e. me, 6 years ago), happens to feature changes ('hacks') to core Joomla files.

In an ideal world I could avoid this potential coronary by having an extension or tool that:

  • Knows all the core Joomla files included in each version of Joomla
  • Compares each file on my Joomla install to the master Joomla source files on Github or wherever (even something like an MD5 hash comparison)
  • If they differ, kick off a diff tool to find the differences and flag them for review
  • If they're the same, great stuff, no action required
  • Generate a report at the end detailing the results of the above process

I've found this extension which does most of the above, but it hasn't been updated since J2.5.7 or at all for J3.X - so that's out.

At my company we use MyJoomla to conduct full Joomla site 'audits' (a long checklist of best practice guidelines and fixes for Joomla sites) every once in a while, part of which is a 'Core Files Integrity Check'. However this service has a monthly subscription fee and all I really want to check is whether any files have been hacked before making an upgrade.

Does anyone know of any other solutions? Aside from 'don't hack core files' - until quite recently there was sometimes no other way to perform certain tasks without a boatload of additional, often unpaid, work.

Improve this question
2
11

I can't imagine a better tool than git. This is a great tool for tracking the changes that you make to code (if you are making any), is the system used by Joomla for contributing code (which is an awesome thing to do), and this is its purpose!

The workflow is pretty simple and should allow you to be pretty worry free:

  1. Back up your joomla website (which you were doing before anyway, right?)
  2. Set up the backup copy locally.
  3. Run git init on the root folder of the local copy. Then run git add --all and git commit. This takes a snapshot of the code as it is now.
  4. Grab the patch that matches your current Joomla version.
  5. Install that patch over your local copy.
  6. Run git diff and you will see a list of all differences in files between what you have running and the core files.

I recognize that this is a pretty "developery" answer and that not everyone wants to use git in the command line. If you use a Git GUI (such as Github's client), you can skip the last step, since the GUI will typically show you the diff automatically.

Ultimately I recommend this method since it both teaches you a skill that will help if you code and contribute to Joomla and it keeps all of the checking locally, so you don't have to worry about shipping your code to another website or service!

Improve this answer
4
  • I like this method, but typically maintenance is a thankless task which I'm trying to make time-negligible (hence we pay for MyJoomla). I may start doing this though, so thank you. – codinghands May 2 '14 at 11:53
  • 1
    Yeah. This becomes way faster if you are already using git for controlling and tracking site development, which i highly recommend! Though that doesn't help support old sites, using git will become easy, so you can use it in this way quickly. – David Fritsch May 2 '14 at 14:57
  • Although Git is popular, it's not always the best so I would like to generalize the answer: choose a revision control software which works for you. – miroxlav May 6 '14 at 3:31
  • I'm attempting to modify and/or clone an extension which comes as part of a 3rd party template and which overrides com_content. First, I need to reverse engineer it, so I'm hoping this solution will help me to find both modified and additional files (even though there may be lots - I need a good tool and methodology). I hope this solution will work for that :-) – NivF007 Dec 21 '17 at 0:10
5

This is an extension of FFrewin's answer. Akeeba also produce a free tool called SiteDiff. It allows you to compare 2 sites that have been backed up with Akeebabackup (there is a free version of that too).

To get this to work, you would have to have 2 backups. One backup would be of your site (let's say it was version 2.5.19). For the other backup, you would need to install a fresh copy of Joomla 2.5.19 and then make a backup of that installation. Next compare the two backups using the SiteDiff tool.

A problem with this method is that you will have more files in your site backup than your fresh installation. The extra files will appear as differences,possibly making it difficult to discern core changes from the rest of the 'noise'.

Improve this answer
3

http://audit-fs.co.za/ has a free tool called Audit_FS that shows you modified Joomla files and/or possibly corrupted Joomla files.

As a basic security tool Audit_FS is designed to perform audits of only your Joomla!® files, as well as, checking your file and directory permissions. It does not check for any changes or hacking in your database records nor does it check any files from extensions that you may have installed. The audit report will also ignore .htaccess, robots.xt, configuration.php, configuration.php-dist and copyright.php.

Improve this answer
2

I don't know any extension other than the one you mentioned, which is stopped somewhere in J2.5.

My way of handling this is by using desktop applications for file/folder comparison and I compare the site in question with its original joomla version. I personally use the DiffMerge on mac.

Another utility I know that could help you keep track of hacked/modified files on your sites is the Admin Tools pro. It provides the php scanner tool. But practically this one is for sites you have developed and scanned after launching, and to help you discover any infected files after hacking attempts.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.