I'm working on my CMS (in PHP platform) for a long time now. The main program is done and I'm currently developing the Installer part. Installation itself will be fairly simple:Upload all filesVerify that the content/ dir has correct permissionsCheck if ALL files are intact and not modified [This is the subject of this question]Insert the config data and first settingsRun install (Generate all DB tables and insert sample data etc.)Now the question-mark is at step 3. How do I verify ALL files? Verification itself should compare all CMS root-directories files against a list from remote location. List should contain filename, filesize and filetype. This way the user can check, that there are no unnecessary or corrupted files, that could indicated a breach in the software.I have seen some software installers do that, but I cannot find any right now and there for I'm clueless on the most optimal method for this. Of course there always is a simple array trick, but there surely must be a better and faster method?!
How to verify that all files are intact prior to install?
php;installer;content management;verification
First of all, I'd say checking for 'unnecessary' files is not really a good idea. The user might have installed your CMS in a common folder with another piece of software.On the other hand, if you confirm your own files are not corrupt, it should be OK, since a user has to edit your files in order to introduce something else in your CMS (otherwise your design is suboptimal, but it can happen if you import all files that fit a pattern; you shouldn't depend on this).Another thing: in PHP (to my knowledge) you can't really make sure your files don't get edited to include a 'crack' to your security mechanism. This in turn means everything you do in the installer is theoretically useless, since it can be defeated by a smart enough adversary.So, on the topic.If possible, use Public-key cryptography instead of hashing.You can easily include a list of files and check them with sha1_file (hash) or a better equivalent (PKC).Then compare the computed values with the proper values and generate error messages if there are discrepancies.If you really want to make sure only your files are on the server, use readdir to generate the list of files and check it against your bundle. This is all pretty straight-forward IMO.