summaryrefslogtreecommitdiff
path: root/installer
diff options
context:
space:
mode:
authorthomascube <thomas@roundcube.net>2008-10-14 12:55:45 +0000
committerthomascube <thomas@roundcube.net>2008-10-14 12:55:45 +0000
commit32eb29fb994404a74b39e707995918f718948cfd (patch)
treefe2a8d8078e426a073ef61d4836196e5c9c5d5eb /installer
parente905db13057c84403d33b7007b4a13e9ffbf2ed0 (diff)
Secure new config merging feature + remove full path disclosure
Diffstat (limited to 'installer')
-rw-r--r--installer/index.php5
1 files changed, 3 insertions, 2 deletions
diff --git a/installer/index.php b/installer/index.php
index 6ece82385..c7f69e3f5 100644
--- a/installer/index.php
+++ b/installer/index.php
@@ -45,7 +45,8 @@ if (isset($_GET['_getfile']) && in_array($_GET['_getfile'], array('main', 'db'))
}
}
-if (isset($_GET['_mergeconfig']) && in_array($_GET['_mergeconfig'], array('main', 'db'))) {
+if ($RCI->configured && ($RCI->getprop('enable_installer') || $_SESSION['allowinstaller']) &&
+ isset($_GET['_mergeconfig']) && in_array($_GET['_mergeconfig'], array('main', 'db'))) {
$filename = $_GET['_mergeconfig'] . '.inc.php';
header('Content-type: text/plain');
@@ -93,7 +94,7 @@ if ($RCI->configured && empty($_REQUEST['_step'])) {
if ($RCI->configured && !$RCI->getprop('enable_installer') && !$_SESSION['allowinstaller']) {
// header("HTTP/1.0 404 Not Found");
echo '<h2 class="error">The installer is disabled!</h2>';
- echo '<p>To enable it again, set <tt>$rcmail_config[\'enable_installer\'] = true;</tt> in '.RCMAIL_CONFIG_DIR.'/main.inc.php</p>';
+ echo '<p>To enable it again, set <tt>$rcmail_config[\'enable_installer\'] = true;</tt> in RCMAIL_CONFIG_DIR/main.inc.php</p>';
echo '</div></body></html>';
exit;
}