[TYPO3-core] RFC #15265: InstallTool-login not possible after Update to 4.4.1 due to session_start() in extensions

[Ernesto Baschny [cron IT]]

Jeff Segars schrieb am 02.08.2010 18:15:
> On 8/2/10 6:43 AM, Ernesto Baschny [cron IT] wrote:
>> Hi,
>>
>> This is a SVN patch request.
>>
>> Type: Bugfix
>>
>> BT reference: http://bugs.typo3.org/view.php?id=15265
>>
>> Branches: trunk, TYPO3_4-4, TYPO3_4-3, TYPO3_4-2, TYPO3_4-1
>>
>> Problem:
>> After updating to one of the latest security releases (e.g. 4.4.1) and
>> going to the Install Tool, entering the correct password, the user is
>> redirected to login-form again. It seems that the user is not logged in.
>>
>>
>> Background Info:
>> The trouble was introduced in the session fixation fix that changed the
>> session ID on correct login. This made an unterlying problem to emerge
>> that the session might already been started, thus bypassing all security
>> precautions that we implemented in the install tool session handling.
>>
>> The "already started" session might come from:
>>
>> 1) an extension which might do a session_start() in its
>> ext_localconf.php, which is loaded before the install tool. One known
>> extension that does this is ameos_formidable. The author Jerome
>> Schneider kindly provided a patch in our bug tracker entry which should
>> solve this issue. It should be included in a later release of that
>> extension.
>>
>> 2) PHP / Apache settings session.auto_start, which will start a PHP
>> session even if no session_start() is done in the PHP code. There is no
>> way to avoid this inside the PHP code. This can be configured either in
>> the php.ini or adding a line to the apaches .htaccess:
>>
>> php_value session.auto_start On
>>
>>
>> Solution:
>> There is no solution possible, except to give the user an error message
>> if such a situation is encountered, so that the user can fix it in their
>> setup. Having such a setup is *insecure* anyway.
>>
>> The attached patches adds a nice message giving the user a hint on where
>> to look for. In 4.4 and later it is nicely formatted using the same
>> template as the "The Install Tool is locked" message, in previous
>> versions it doesn't use any template.
>>
>>
>> How to test:
>>
>> 1) Add this line to your .htaccess
>>
>> php_value session.auto_start On
>>
>> and try to login to install tool. Try again after patching.
>>
>> 2) Install ameos_formidable (v1.1.3) and try to login to install tool.
>> Try again after patching.
>>
>>
>> Cheers,
>> Ernesto
> 
> +1 on reading and testing with trunk.
> 
> The styling for the code inside the <pre> tag is really, really small
> but that should be unrelated to this patch.
> 
> It seems like the error messages could be a little more user friendly as
> well...maybe just some more detail about why there's an error. That
> certainly shouldn't hold up the commit as its far better than the
> current situation. I'll post back here if I have a chance to come up
> with some extra text.

Nice, a native speakers text would be most appreciated. As the release
is planned for tomorrow, it would be great if you could come up with
something today. ;)

Thanks for your help, Jeff.

Cheers,
Ernesto