Fix a DoS or even PrivEsc vuln on POST /install

POST on /install must not respond when already installed. Denial of Service and possibly Privilege Escalation by changing the database/mail server
2018-09-30 16:46:33 +10:00 · 2018-09-30 16:46:33 +10:00 · 0b831955f2
parent 5cdfe7151b
commit 0b831955f2
1 changed files with 4 additions and 0 deletions
--- a/app/Http/Controllers/InstallerController.php
+++ b/app/Http/Controllers/InstallerController.php
@ -87,6 +87,10 @@ class InstallerController extends Controller
     */
    public function postInstaller(Request $request)
    {
+        if (file_exists(base_path('installed'))) {
+            abort(404);
+        }
+
        set_time_limit(300);

        $database['type'] = $request->get('database_type');