[TYPO3-core] RFC #15265: InstallTool-login not possible after Update to 4.4.1 due to session_start() in extensions

[Jeff Segars]

On 8/2/10 6:43 AM, Ernesto Baschny [cron IT] wrote:
> Hi,
>
> This is a SVN patch request.
>
> Type: Bugfix
>
> BT reference: http://bugs.typo3.org/view.php?id=15265
>
> Branches: trunk, TYPO3_4-4, TYPO3_4-3, TYPO3_4-2, TYPO3_4-1
>
> Problem:
> After updating to one of the latest security releases (e.g. 4.4.1) and
> going to the Install Tool, entering the correct password, the user is
> redirected to login-form again. It seems that the user is not logged in.
>
>
> Background Info:
> The trouble was introduced in the session fixation fix that changed the
> session ID on correct login. This made an unterlying problem to emerge
> that the session might already been started, thus bypassing all security
> precautions that we implemented in the install tool session handling.
>
> The "already started" session might come from:
>
> 1) an extension which might do a session_start() in its
> ext_localconf.php, which is loaded before the install tool. One known
> extension that does this is ameos_formidable. The author Jerome
> Schneider kindly provided a patch in our bug tracker entry which should
> solve this issue. It should be included in a later release of that
> extension.
>
> 2) PHP / Apache settings session.auto_start, which will start a PHP
> session even if no session_start() is done in the PHP code. There is no
> way to avoid this inside the PHP code. This can be configured either in
> the php.ini or adding a line to the apaches .htaccess:
>
> php_value session.auto_start On
>
>
> Solution:
> There is no solution possible, except to give the user an error message
> if such a situation is encountered, so that the user can fix it in their
> setup. Having such a setup is *insecure* anyway.
>
> The attached patches adds a nice message giving the user a hint on where
> to look for. In 4.4 and later it is nicely formatted using the same
> template as the "The Install Tool is locked" message, in previous
> versions it doesn't use any template.
>
>
> How to test:
>
> 1) Add this line to your .htaccess
>
> php_value session.auto_start On
>
> and try to login to install tool. Try again after patching.
>
> 2) Install ameos_formidable (v1.1.3) and try to login to install tool.
> Try again after patching.
>
>
> Cheers,
> Ernesto

+1 on reading and testing with trunk.

The styling for the code inside the <pre> tag is really, really small 
but that should be unrelated to this patch.

It seems like the error messages could be a little more user friendly as 
well...maybe just some more detail about why there's an error. That 
certainly shouldn't hold up the commit as its far better than the 
current situation. I'll post back here if I have a chance to come up 
with some extra text.

Thanks,
jeff