[TYPO3-core] RFC #15265: InstallTool-login not possible after Update to 4.4.1 due to session_start() in extensions

[Ernesto Baschny [cron IT]]

Hi,

This is a SVN patch request.

Type: Bugfix

BT reference: http://bugs.typo3.org/view.php?id=15265

Branches: trunk, TYPO3_4-4, TYPO3_4-3, TYPO3_4-2, TYPO3_4-1

Problem:
After updating to one of the latest security releases (e.g. 4.4.1) and
going to the Install Tool, entering the correct password, the user is
redirected to login-form again. It seems that the user is not logged in.


Background Info:
The trouble was introduced in the session fixation fix that changed the
session ID on correct login. This made an unterlying problem to emerge
that the session might already been started, thus bypassing all security
precautions that we implemented in the install tool session handling.

The "already started" session might come from:

1) an extension which might do a session_start() in its
ext_localconf.php, which is loaded before the install tool. One known
extension that does this is ameos_formidable. The author Jerome
Schneider kindly provided a patch in our bug tracker entry which should
solve this issue. It should be included in a later release of that
extension.

2) PHP / Apache settings session.auto_start, which will start a PHP
session even if no session_start() is done in the PHP code. There is no
way to avoid this inside the PHP code. This can be configured either in
the php.ini or adding a line to the apaches .htaccess:

php_value session.auto_start On


Solution:
There is no solution possible, except to give the user an error message
if such a situation is encountered, so that the user can fix it in their
setup. Having such a setup is *insecure* anyway.

The attached patches adds a nice message giving the user a hint on where
to look for. In 4.4 and later it is nicely formatted using the same
template as the "The Install Tool is locked" message, in previous
versions it doesn't use any template.


How to test:

1) Add this line to your .htaccess

php_value session.auto_start On

and try to login to install tool. Try again after patching.

2) Install ameos_formidable (v1.1.3) and try to login to install tool.
Try again after patching.


Cheers,
Ernesto
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: 15265-4_1-v2.diff
URL: <http://lists.typo3.org/pipermail/typo3-team-core/attachments/20100802/dc672013/attachment.txt>
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: 15265-4_2-v2.diff
URL: <http://lists.typo3.org/pipermail/typo3-team-core/attachments/20100802/dc672013/attachment.asc>
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: 15265-4_3-v2.diff
URL: <http://lists.typo3.org/pipermail/typo3-team-core/attachments/20100802/dc672013/attachment-0001.txt>
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: 15265-4_4-v2.diff
URL: <http://lists.typo3.org/pipermail/typo3-team-core/attachments/20100802/dc672013/attachment-0001.asc>
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: 15265-trunk-v2.diff
URL: <http://lists.typo3.org/pipermail/typo3-team-core/attachments/20100802/dc672013/attachment-0002.txt>