{"action":"created","issue":{"url":"https://api.github.com/repos/andrepereiradasilva/joomla-cms/issues/64","repository_url":"https://api.github.com/repos/andrepereiradasilva/joomla-cms","labels_url":"https://api.github.com/repos/andrepereiradasilva/joomla-cms/issues/64/labels{/name}","comments_url":"https://api.github.com/repos/andrepereiradasilva/joomla-cms/issues/64/comments","events_url":"https://api.github.com/repos/andrepereiradasilva/joomla-cms/issues/64/events","html_url":"https://github.com/andrepereiradasilva/joomla-cms/pull/64","id":171860875,"number":64,"title":"[Poc?] Let's try to put the update sequence like it was (no intermediate steps)","user":{"login":"andrepereiradasilva","id":9630530,"avatar_url":"https://avatars.githubusercontent.com/u/9630530?v=3","gravatar_id":"","url":"https://api.github.com/users/andrepereiradasilva","html_url":"https://github.com/andrepereiradasilva","followers_url":"https://api.github.com/users/andrepereiradasilva/followers","following_url":"https://api.github.com/users/andrepereiradasilva/following{/other_user}","gists_url":"https://api.github.com/users/andrepereiradasilva/gists{/gist_id}","starred_url":"https://api.github.com/users/andrepereiradasilva/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andrepereiradasilva/subscriptions","organizations_url":"https://api.github.com/users/andrepereiradasilva/orgs","repos_url":"https://api.github.com/users/andrepereiradasilva/repos","events_url":"https://api.github.com/users/andrepereiradasilva/events{/privacy}","received_events_url":"https://api.github.com/users/andrepereiradasilva/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":22,"created_at":"2016-08-18T09:46:54Z","updated_at":"2016-08-18T13:24:51Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/andrepereiradasilva/joomla-cms/pulls/64","html_url":"https://github.com/andrepereiradasilva/joomla-cms/pull/64","diff_url":"https://github.com/andrepereiradasilva/joomla-cms/pull/64.diff","patch_url":"https://github.com/andrepereiradasilva/joomla-cms/pull/64.patch"},"body":"### Summary of Changes\r\n\r\nPoC to try to solve the update sequence issues.\r\nThe goal of this code is to be able to upgrade from 3.x to 3.6.3 without need for any intermediate step.\r\n\r\n### Testing Instructions\r\n\r\n1. Code review\r\n2. Download \r\n[fake-update-to-370.zip](https://github.com/andrepereiradasilva/joomla-cms/files/424523/fake-update-to-370.zip)\r\n\r\n3. Try all possible update combinations:\r\n- From 3.x to this\r\n- From staging to this.\r\n- Using \"Upload & Install\" or direct download from update server (you need a test update server)\r\n- From 2.5.28 to this (using a complete update package and just changing the files in the zip)\r\n- Upgrade two times to make sure upgrade also works after this change.\r\n - etc\r\n\r\nNote: Even after merged this should be tested further to make sure there are no issues.\r\n\r\n### Documentation Changes Required\r\n\r\nThe upgrade path wiki must be changed to reflect this.\r\n\r\n### Notes\r\n\r\n- This uses a one time template (will only appear in the first upgrade to this version) or when you direct access `/administrator/index.php?option=com_joomlaupdate&view=update&layout=finalise`\r\n\r\n- This template allows the user to cancel the action before finalising the update (if somehow the user is a target of a CSRF attack he can cancel here by pressing the red button).\r\n\r\n- Instead of auto javascript submit i added after 5 seconds + cancel button if user wants to cancel, it's possible, in alternative, to add a button for the user to confirm the update process finish in the template added in this (not sure is needed, but even them, asking the user to press a button one time in his life is, IMO, MUCH better than the current update sequence).\r\n\r\n- Of course, other improvements cna be made, this is just, what i hope to be a PoC\r\n\r\n@mbabker @wilsonge please check that from a security point there is no issue with this.\r\n\r\n@zero-24 since you are more familiar to the update process that i am, and i don't have a lot of time to pursue this at the moment (my goal was just making a PoC), if michael and george think this is ok can you take over this code and make a PR to the cms?"},"comment":{"url":"https://api.github.com/repos/andrepereiradasilva/joomla-cms/issues/comments/240721579","html_url":"https://github.com/andrepereiradasilva/joomla-cms/pull/64#issuecomment-240721579","issue_url":"https://api.github.com/repos/andrepereiradasilva/joomla-cms/issues/64","id":240721579,"user":{"login":"andrepereiradasilva","id":9630530,"avatar_url":"https://avatars.githubusercontent.com/u/9630530?v=3","gravatar_id":"","url":"https://api.github.com/users/andrepereiradasilva","html_url":"https://github.com/andrepereiradasilva","followers_url":"https://api.github.com/users/andrepereiradasilva/followers","following_url":"https://api.github.com/users/andrepereiradasilva/following{/other_user}","gists_url":"https://api.github.com/users/andrepereiradasilva/gists{/gist_id}","starred_url":"https://api.github.com/users/andrepereiradasilva/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andrepereiradasilva/subscriptions","organizations_url":"https://api.github.com/users/andrepereiradasilva/orgs","repos_url":"https://api.github.com/users/andrepereiradasilva/repos","events_url":"https://api.github.com/users/andrepereiradasilva/events{/privacy}","received_events_url":"https://api.github.com/users/andrepereiradasilva/received_events","type":"User","site_admin":false},"created_at":"2016-08-18T13:24:51Z","updated_at":"2016-08-18T13:24:51Z","body":">  So it really needs to be thought through and it really needs to be done in a way that makes it difficult to exploit outside the update system or it needs to raise question to the security practices in place and whether they're adequate for this workflow.\r\n\r\nSure of course. I tottly understand that.\r\nI would never would put joomla with that risk, that's why i asked you guys the opinion for this PoC."}}
{"actor":{"display_login":"andrepereiradasilva"}}