Skip to content

Safer calling of install.php#7971

Merged
Alkarex merged 2 commits intoFreshRSS:edgefrom
Inverle:safer-install
Sep 15, 2025
Merged

Safer calling of install.php#7971
Alkarex merged 2 commits intoFreshRSS:edgefrom
Inverle:safer-install

Conversation

@Inverle
Copy link
Member

@Inverle Inverle commented Sep 15, 2025

To prevent install.php from being accessed in unintended places

@Alkarex Alkarex added this to the 1.27.1 milestone Sep 15, 2025
app/FreshRSS.php Outdated
* - Enable user extensions (need all the other initializations)
*/
public function init(): void {
define('FRESHRSS_INIT', true);
Copy link
Member

@Alkarex Alkarex Sep 15, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Instead of this additional constant, would it be sufficient to test whether the session has already been started?

Copy link
Member Author

@Inverle Inverle Sep 15, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hm I thought Minz_Session::init was being called twice in some place, but I missed the isset check, because of that I didn't do that.

So yes, but I would have to test what the behavior is when the session isn't setup correctly.
probably is fine though since there is no session_start() before

The ideal solution would be to wrap everything inside install.php into a function and call the function after including install.php somewhere.

Or refactor install.php into a controller

@Inverle
Copy link
Member Author

Inverle commented Sep 15, 2025

Done

@Alkarex Alkarex merged commit 25250f4 into FreshRSS:edge Sep 15, 2025
1 check passed
@Inverle Inverle deleted the safer-install branch September 15, 2025 22:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants