[TYPO3-core] RFC #14719: Automatically create ENABLE_INSTALL_TOOL file when 1-2-3 Install Tool is used

[bernd wilke]

Am Wed, 16 Jun 2010 15:20:05 -0500 schrieb Jeff Segars:

> On 6/14/10 12:06 PM, Jeff Segars wrote:
>> Hey guys,
>> This is a SVN patch request.
>>
>> Type: (mini) Feature, Usability
>>
>> Bugtracker Reference: http://bugs.typo3.org/view.php?id=14719
>>
>> Branches: Trunk
>>
>> Problem:
>> When a new user first installs TYPO3, they must create the
>> ENABLE_INSTALL_TOOL file before installation can continue. For a
>> friendlier first install, it would be nice to automatically create the
>> file and go directly to the 1-2-3 Install Tool
>>
>> Solution:
>> Just before tslib_fe redirects to the 1-2-3 Install Tool, we can create
>> the missing ENABLE_INSTALL_TOOL file.
>>
>> Additional Notes:
>> * This file will be created anytime there's a redirect to the 1-2-3
>> Install Tool and not just on initial install. In practice, this should
>> only happen for the initial install but there's no check to prevent it
>> at other times if the db connection info is missing (if anyone thinks
>> this a problem).
>>
>> * typo3/install/index.php handles the check for the ENABLE_INSTALL_TOOL
>> file and the rest of TYPO3 is not yet initialized at this point so that
>> forces us to create the file as part of the tslib_fe redirect or do a
>> more complex rework of typo3/install/index.php.
>>
>> Thanks,
>> Jeff
> 
> After talking it over with Ben, here's v2 of the patch that takes
> Philipp's idea and Steffen's original idea into account and also
> addresses the security issues.
> 
> If typo3conf/FIRST_INSTALL is present, we immediately delete it and
> create typo3conf/ENABLE_INSTALL_TOOL. If the file is not present or
> could not be deleted, then we do not create ENABLE_INSTALL_TOOL and the
> normal lock message is shown.
> 
> Any thoughts?
>
what security is there if somebody 'installed'(copied/extracted) just the 
core and the dummy and does not enter the real installation?
the install tool will be open like only questioning the DB-values, which 
are not set till now.

I came up with this idea:
if the directory /typo3conf (or other?) is less than 30(or less?) minutes 
old, the ENABLE_INSTALL_TOOL file will be generated automaticly. So any 
installer can access the install-tool immediate after copy, but later 
access to an unconfigured TYPO3 is disabled by default.

bernd
-- 
http://www.pi-phi.de/cheatsheet.html