Project

General

Profile

Actions

Bug #65014

closed

Install tool should show warning if session file can not be created

Added by Christian Kuhn about 9 years ago. Updated over 5 years ago.

Status:
Closed
Priority:
Should have
Assignee:
-
Category:
-
Target version:
-
Start date:
2015-02-11
Due date:
% Done:

100%

Estimated time:
TYPO3 Version:
6.2
PHP Version:
5.5
Tags:
Complexity:
easy
Is Regression:
No
Sprint Focus:
Stabilization Sprint

Description

There is a nasty bug in the install tool login that prevents a login and does not show any error message:

If a session file can not be created within typo3temp/InstallToolSessions due to file permission problems, the login will just fail without further notice.

There should be a check if the file was properly created - and if not, the install tool login must show an according warning.

Actions #1

Updated by Christian Kuhn about 9 years ago

Reproduce:

prepare: enter install tool and select "Production preset"
prepare: log out from install tool
clean up: Remove typo3temp/InstallTollSessions directory
create one session file: touch ENABLE_INSTALL_TOOL and call typo3/install/index.php so install tool login is shown
kill session file permissions: go to typo3temp/InstallTollSessions/*the-created-session-hash-folder*, chmod 550 on session-hash-folder, chmod 440 on hash_* file. This removes write permission on both session-hash-folder and the session file
try to log in with correct password: Login is not successful and no error is shown

Actions #2

Updated by Christian Kuhn about 9 years ago

TYPO3\CMS\Core\Error\Exception: PHP Warning: fopen(/var/www/t3master/cms/typo3temp/InstallToolSessions/c14704f9419f9ff2a0f07c233acc51bb7fa070fa/hash_ded5e1d44e38cc2576953c0ac29cbced): failed to open stream: Permission denied in /var/www/t3master/cms/typo3/sysext/core/Classes/Utility/GeneralUtility.php line 2560 in /var/www/t3master/cms/typo3/sysext/core/Classes/Error/ErrorHandler.php on line 102
Call Stack
  1. Time Memory Function Location
    1 0.0001 231312 {main}( ) ../Install.php:0
    2 0.0001 231888 require( '/var/www/t3master/cms/typo3/sysext/install/Resources/Private/PHP/Boot.php' ) ../Install.php:112
    3 0.0407 2019272 TYPO3\CMS\Install\Controller\StepController->execute( ) ../Boot.php:39
    4 0.0497 2201832 TYPO3\CMS\Install\Controller\AbstractController->outputLoginFormIfNotAuthorized( ) ../StepController.php:59
    5 0.0952 3079080 TYPO3\CMS\Install\Controller\AbstractController->output( ) ../AbstractController.php:265
    6 0.0953 3078904 TYPO3\CMS\Install\Service\SessionService->__destruct( ) ../SessionService.php:0
    7 0.0953 3078952 session_write_close ( ) ../SessionService.php:416
    8 0.0953 3079600 TYPO3\CMS\Install\Service\SessionService->write( ) ../SessionService.php:416
    9 0.0953 3079896 TYPO3\CMS\Core\Utility\GeneralUtility::writeFile( ) ../SessionService.php:368
    10 0.0953 3080080 fopen ( ) ../GeneralUtility.php:2560
    11 0.0954 3082336 TYPO3\CMS\Core\Error\ErrorHandler->handleError( ) ../GeneralUtility.php:2560
Actions #3

Updated by Christian Kuhn about 9 years ago

Another one if permissions to the session-hash-folder are set to 440 instead of 550

#1: PHP Warning: filemtime(): stat failed for /var/www/t3master/cms/typo3temp/InstallToolSessions/c14704f9419f9ff2a0f07c233acc51bb7fa070fa/hash_ded5e1d44e38cc2576953c0ac29cbced in /var/www/t3master/cms/typo3/sysext/install/Classes/Service/SessionService.php line 395 (More information)

TYPO3\CMS\Core\Error\Exception thrown in file
/var/www/t3master/cms/typo3/sysext/core/Classes/Error/ErrorHandler.php in line 102.

Actions #4

Updated by Gerrit Code Review about 9 years ago

  • Status changed from New to Under Review

Patch set 1 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at http://review.typo3.org/37025

Actions #5

Updated by Christian Kuhn about 9 years ago

Use case on how to fall into this issue:

Have an instance on a test server and call install tool ... all good. Session will be created within typo3temp/InstallToolSessions. After that, copy the whole instance over to a different server / folder, but fail to fix permission properly. The session directory will then still exist, but can not be written -> no login to install tool possible and no error message.

Actions #6

Updated by Gerrit Code Review about 9 years ago

Patch set 2 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at http://review.typo3.org/37025

Actions #7

Updated by Christian Kuhn about 9 years ago

  • Sprint Focus set to Stabilization Sprint

I took the freedom to add this to Stabilization Sprint focus - would be cool if the patch could make it into 6.2.10.

Actions #8

Updated by Gerrit Code Review about 9 years ago

Patch set 1 for branch TYPO3_6-2 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at http://review.typo3.org/37028

Actions #9

Updated by Christian Kuhn about 9 years ago

  • Status changed from Under Review to Resolved
  • % Done changed from 0 to 100
Actions #10

Updated by Benni Mack over 5 years ago

  • Status changed from Resolved to Closed
Actions

Also available in: Atom PDF