Author: Gunnar Wolf <gwolf@debian.org>
Forwarded: yes (private mail)
Last-Update: 2013-10-26
Description: Fix install.php so it does not require to be disabled
 The upstream-supplied install.php can be a huge security risk. We had
 disabled it, but it does importantly reduce ease of
 installation. This patch re-enables it, but does some sanity checks
 to avoid a rogue user disrupting the site.
Index: collabtive/install.php
===================================================================
--- collabtive.orig/install.php
+++ collabtive/install.php
@@ -15,6 +15,14 @@ session_unset();
 setcookie("PHPSESSID", "");
 date_default_timezone_set("Europe/Berlin");
 require("./init.php");
+
+$safeguard_flag = CL_ROOT . "/config/flags/configured";
+// Safeguard file checking is done before any actions are carried out
+// to be sure it prevents all of this script's functionality.
+if (file_exists($safeguard_flag)) {
+    die("Collabtive is marked as already configured. <br/>If you want to enable `install.php' functionality again, remove the `$safeguard_flag' file from your system.");
+}
+
 error_reporting(0);
 $action = getArrayVal($_GET, "action");
 $locale = getArrayVal($_GET, "locale");
@@ -82,7 +90,7 @@ if (!$action) {
 ?>";
     $put = fwrite($file, "$str");
     if ($put) {
-        @chmod(CL_ROOT . "/config/" . CL_CONFIG . "/config.php", 0755);
+        @chmod(CL_ROOT . "/config/" . CL_CONFIG . "/config.php", 0440);
     }
     $installer_include = "yes";
     // connect database.
@@ -159,6 +167,13 @@ if (!$action) {
         die();
     }
     $rolesobj->assign($adminrid, $usrid);
+    if (is_writable(dirname($safeguard_flag))) {
+      fopen($safeguard_flag, 'w');
+    } else {
+      $template->assign("errortext", "Error: Could not create safeguard `$safeguard_flag' file. This means that `install.php' can be called by an unauthenticated user. It is strongly suggested you create that file!");
+      $template->display('error.tpl');
+      die();
+    }
 
     $template->display("install3.tpl");
 }
