Merge pull request from GHSA-h8wc-r4jh-mg7m

* Don't login after install * Fail the install if database is not created --------- Co-authored-by: Zeegaan <[email protected]> Co-authored-by: Nikolaj <[email protected]>
umbraco · Jul 13, 2023 · 82eae48 · 82eae48
1 parent dc5c7a1
commit 82eae48
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 13 deletions.
diff --git a/src/Umbraco.Infrastructure/Runtime/RuntimeState.cs b/src/Umbraco.Infrastructure/Runtime/RuntimeState.cs
@@ -213,7 +213,7 @@ public void DetermineRuntimeLevel()
                     if (_globalSettings.Value.InstallMissingDatabase || _databaseProviderMetadata.CanForceCreateDatabase(_databaseFactory))
                     {
                         // ok to install on a configured but missing database
-                        Level = RuntimeLevel.Install;
+                        Level = RuntimeLevel.BootFailed;
                         Reason = RuntimeLevelReason.InstallMissingDatabase;
                         return;
                     }

diff --git a/src/Umbraco.Web.BackOffice/Install/InstallApiController.cs b/src/Umbraco.Web.BackOffice/Install/InstallApiController.cs
@@ -1,5 +1,6 @@
 using System.Reflection;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Logging;
 using Newtonsoft.Json.Linq;
 using Umbraco.Cms.Core;
@@ -25,15 +26,14 @@ namespace Umbraco.Cms.Web.BackOffice.Install;
 [Area(Constants.Web.Mvc.InstallArea)]
 public class InstallApiController : ControllerBase
 {
-    private readonly IBackOfficeSignInManager _backOfficeSignInManager;
-    private readonly IBackOfficeUserManager _backOfficeUserManager;
     private readonly DatabaseBuilder _databaseBuilder;
     private readonly InstallStatusTracker _installStatusTracker;
     private readonly InstallStepCollection _installSteps;
     private readonly ILogger<InstallApiController> _logger;
     private readonly IProfilingLogger _proflog;
     private readonly IRuntime _runtime;
 
+    [Obsolete("Use the constructor without IBackOfficeUserManager & IBackOfficeSignInManager instead, scheduled for removal in v14")]
     public InstallApiController(
         DatabaseBuilder databaseBuilder,
         IProfilingLogger proflog,
@@ -44,14 +44,25 @@ public InstallApiController(
         IRuntime runtime,
         IBackOfficeUserManager backOfficeUserManager,
         IBackOfficeSignInManager backOfficeSignInManager)
+        : this(databaseBuilder, proflog, logger, installHelper, installSteps, installStatusTracker, runtime)
+    {
+    }
+
+    [ActivatorUtilitiesConstructor]
+    public InstallApiController(
+        DatabaseBuilder databaseBuilder,
+        IProfilingLogger proflog,
+        ILogger<InstallApiController> logger,
+        InstallHelper installHelper,
+        InstallStepCollection installSteps,
+        InstallStatusTracker installStatusTracker,
+        IRuntime runtime)
     {
         _databaseBuilder = databaseBuilder ?? throw new ArgumentNullException(nameof(databaseBuilder));
         _proflog = proflog ?? throw new ArgumentNullException(nameof(proflog));
         _installSteps = installSteps;
         _installStatusTracker = installStatusTracker;
         _runtime = runtime;
-        _backOfficeUserManager = backOfficeUserManager;
-        _backOfficeSignInManager = backOfficeSignInManager;
         InstallHelper = installHelper;
         _logger = logger;
     }
@@ -88,16 +99,8 @@ public InstallSetup GetSetup()
     [HttpPost]
     public async Task<ActionResult> CompleteInstall()
     {
-        RuntimeLevel levelBeforeRestart = _runtime.State.Level;
-
         await _runtime.RestartAsync();
 
-        if (levelBeforeRestart == RuntimeLevel.Install)
-        {
-            BackOfficeIdentityUser identityUser = await _backOfficeUserManager.FindByIdAsync(Core.Constants.Security.SuperUserIdAsString);
-            _backOfficeSignInManager.SignInAsync(identityUser, false);
-        }
-
         return NoContent();
     }