From f2a479695eb4e3b18c73fd2f535aace720b0f601 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rapha=C3=ABl=20Doursenaud?= Date: Mon, 22 Feb 2016 18:45:00 +0100 Subject: [PATCH] New: Improved forced install process Tamper proofed the process by not relying on POST values for forced fields. Disabled all fields set when $force_install_noedit is set. Added a full-featured forced install config file template. On the side: Improved Dolibarr root and url detection. Prevent install locking if install was not successful. Added missing translation on failed administrator creation. Better escaping of posted values. --- htdocs/install/check.php | 19 +- htdocs/install/fileconf.php | 342 +++++++++++++---------- htdocs/install/inc.php | 100 ++++++- htdocs/install/index.php | 7 +- htdocs/install/install.forced.sample.php | 73 +++++ htdocs/install/step1.php | 148 ++++++---- htdocs/install/step2.php | 15 +- htdocs/install/step4.php | 18 +- htdocs/install/step5.php | 75 +++-- htdocs/install/upgrade.php | 10 +- htdocs/install/upgrade2.php | 12 +- htdocs/langs/en_US/install.lang | 3 +- 12 files changed, 542 insertions(+), 280 deletions(-) create mode 100644 htdocs/install/install.forced.sample.php diff --git a/htdocs/install/check.php b/htdocs/install/check.php index 66a9f7f77bb..c2326d58486 100644 --- a/htdocs/install/check.php +++ b/htdocs/install/check.php @@ -1,11 +1,11 @@ - * Copyright (C) 2004-2015 Laurent Destailleur - * Copyright (C) 2005 Marc Barilley / Ocebo - * Copyright (C) 2005-2012 Regis Houssin - * Copyright (C) 2013-2014 Juanjo Menent +/* Copyright (C) 2004-2005 Rodolphe Quiedeville + * Copyright (C) 2004-2015 Laurent Destailleur + * Copyright (C) 2005 Marc Barilley / Ocebo + * Copyright (C) 2005-2012 Regis Houssin + * Copyright (C) 2013-2014 Juanjo Menent * Copyright (C) 2014 Marcos García - * Copyright (C) 2015 Raphaël Doursenaud + * Copyright (C) 2015-2016 Raphaël Doursenaud * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -28,6 +28,8 @@ */ include_once 'inc.php'; +global $langs; + $err = 0; $allowinstall = 0; $allowupgrade = false; @@ -42,7 +44,10 @@ $langs->load("install"); $useforcedwizard=false; $forcedfile="./install.forced.php"; if ($conffile == "/etc/dolibarr/conf.php") $forcedfile="/etc/dolibarr/install.forced.php"; -if (@file_exists($forcedfile)) { $useforcedwizard=true; include_once $forcedfile; } +if (@file_exists($forcedfile)) { + $useforcedwizard = true; + include_once $forcedfile; +} dolibarr_install_syslog("--- check: Dolibarr install/upgrade process started"); diff --git a/htdocs/install/fileconf.php b/htdocs/install/fileconf.php index d0cf9a4a385..1782be430bc 100644 --- a/htdocs/install/fileconf.php +++ b/htdocs/install/fileconf.php @@ -1,10 +1,11 @@ - * Copyright (C) 2004 Eric Seigne - * Copyright (C) 2004-2012 Laurent Destailleur - * Copyright (C) 2004 Benoit Mortier - * Copyright (C) 2004 Sebastien DiCintio - * Copyright (C) 2005-2011 Regis Houssin +/* Copyright (C) 2004 Rodolphe Quiedeville + * Copyright (C) 2004 Eric Seigne + * Copyright (C) 2004-2012 Laurent Destailleur + * Copyright (C) 2004 Benoit Mortier + * Copyright (C) 2004 Sebastien DiCintio + * Copyright (C) 2005-2011 Regis Houssin + * Copyright (C) 2016 Raphaël Doursenaud * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -28,6 +29,8 @@ include_once 'inc.php'; +global $langs; + $err=0; $setuplang=GETPOST("selectlang",'',3)?GETPOST("selectlang",'',3):(isset($_GET["lang"])?$_GET["lang"]:'auto'); @@ -58,12 +61,10 @@ $useforcedwizard=false; $forcedfile="./install.forced.php"; if ($conffile == "/etc/dolibarr/conf.php") $forcedfile="/etc/dolibarr/install.forced.php"; // Must be after inc.php if (@file_exists($forcedfile)) { - $useforcedwizard=true; include_once $forcedfile; + $useforcedwizard = true; + include_once $forcedfile; } -//$force_install_message='This is the message'; -//$force_install_noedit=1; - /* * View @@ -120,37 +121,20 @@ if (! empty($force_install_message)) print $langs->trans("WebPagesDirectory"); print ""; - if(! isset($dolibarr_main_url_root) || dol_strlen($dolibarr_main_url_root) == 0) - { - //print "x".$_SERVER["SCRIPT_FILENAME"]." y".$_SERVER["DOCUMENT_ROOT"]; - - // Si le php fonctionne en CGI, alors SCRIPT_FILENAME vaut le path du php et - // ce n'est pas ce qu'on veut. Dans ce cas, on propose $_SERVER["DOCUMENT_ROOT"] - if (preg_match('/^php$/i',$_SERVER["SCRIPT_FILENAME"]) || preg_match('/[\\/]php$/i',$_SERVER["SCRIPT_FILENAME"]) || preg_match('/php\.exe$/i',$_SERVER["SCRIPT_FILENAME"])) - { - $dolibarr_main_document_root=$_SERVER["DOCUMENT_ROOT"]; - - if (! preg_match('/[\\/]dolibarr[\\/]htdocs$/i',$dolibarr_main_document_root)) - { - $dolibarr_main_document_root.="/dolibarr/htdocs"; - } - } - else - { - $dolibarr_main_document_root = substr($_SERVER["SCRIPT_FILENAME"],0,dol_strlen($_SERVER["SCRIPT_FILENAME"]) - 21); - // Nettoyage du path propose - // Gere les chemins windows avec double "\" - $dolibarr_main_document_root = str_replace('\\\\','/',$dolibarr_main_document_root); - - // Supprime les slash ou antislash de fins - $dolibarr_main_document_root = preg_replace('/[\\/]+$/','',$dolibarr_main_document_root); - } + if (empty($dolibarr_main_url_root)) { + $dolibarr_main_document_root = detect_dolibarr_main_document_root(); } ?> - '; - print ''; - ?> + + + > + trans("WithNoSlashAtTheEnd")."
"; print $langs->trans("Examples").":
"; @@ -167,24 +151,21 @@ if (! empty($force_install_message)) trans("DocumentsDirectory"); ?> - '; - print ''; - ?> + + + > + trans("WithNoSlashAtTheEnd")."
"; print $langs->trans("DirectoryRecommendation")."
"; @@ -199,39 +180,23 @@ if (! empty($force_install_message)) trans("URLRoot"); ?> - '; - print ''; - ?> + + + > + trans("Examples").":
"; ?>
  • http://localhost/
    • @@ -245,9 +210,17 @@ if (! empty($force_install_message)) ?> trans("ForceHttps"); ?> - > + + + + > + trans("CheckToForceHttps"); ?> @@ -265,13 +238,18 @@ if (! empty($force_install_message)) - trans("DatabaseName"); ?> - - - - trans("DatabaseName"); ?> + trans("DatabaseName"); ?> + + + + > + + trans("DatabaseName"); ?> @@ -286,7 +264,8 @@ if (! empty($force_install_message)) trans("DriverType"); ?> - + + - if ($force_install_noedit && $force_install_type) print ''; - print ''; - - ?> + trans("DatabaseType"); ?> @@ -356,11 +339,14 @@ if (! empty($force_install_message)) trans("Server"); ?> - - value=""> - '; ?> + + + > trans("ServerAddressDescription"); ?> @@ -369,11 +355,15 @@ if (! empty($force_install_message)) trans("Port"); ?> - - value=""> - '; ?> + + + > trans("ServerPortDescription"); ?> @@ -383,20 +373,33 @@ if (! empty($force_install_message)) trans("DatabasePrefix"); ?> - - + + + > + trans("DatabasePrefix"); ?> trans("CreateDatabase"); ?> - - > + + + + > + trans("CheckToCreateDatabase"); ?> @@ -404,33 +407,54 @@ if (! empty($force_install_message)) trans("Login"); ?> - + + + > + trans("AdminLogin"); ?> trans("Password"); ?> - + + + > + trans("AdminPassword"); ?> trans("CreateUser"); ?> - - > + + + + > + trans("CheckToCreateUser"); ?> @@ -438,8 +462,8 @@ if (! empty($force_install_message))
    @@ -449,9 +473,17 @@ if (! empty($force_install_message)) trans("Login"); ?> - + + + > + trans("DatabaseRootLoginDescription"); ?>