groupoffice/install available to world

[synlos]

Dear GO Team,
I recognized, that the URL groupoffice/install is always available to anyone accessing it.
The options: [Install license] and [Upgrade database] can be triggered by anyone without authentication.
I always chmod the install dir, so no one can access it after an update. Is this a bug or a feature?

Best regards,
Markus aka Syn

[mschering]

Yes it's available but you can't access the license once installed.

[michalcharvat]

But in theory, any robot could access the /install/upgrade.php URL, and clearing caches during server load isn’t a good idea — you could easily bring the server down. 😛 I would recommend to put there .htaccess but you have to also allow access from the localhost because of multiinstance option

[synlos]

Hi, thanks for the responses, I now have solved it for me with htaccess.

.htaccess:

RewriteEngine` On

RewriteCond %{HTTP:Authorization} !^$
RewriteRule .* - [E=HAS_AUTH:1]

RewriteCond %{HTTP:Cookie} accessToken=([^;]+) [NC]
RewriteRule .* - [E=HAS_COOKIE:1]

RewriteCond %{ENV:HAS_AUTH} !=1
RewriteCond %{ENV:HAS_COOKIE} !=1
RewriteRule ^(.*)$ / [R=302,L]

RewriteCond %{ENV:HAS_AUTH} =1 [OR]
RewriteCond %{ENV:HAS_COOKIE} =1
RewriteCond %{QUERY_STRING} (^|&)post_login=install(&|$) [NC]
RewriteRule ^/?$ /install [R=302,L]<